fix(deps): bump Wasmtime to 46.0.2 for RUSTSEC-2026-0222

CHANGELOG.md

@@ -8,6 +8,19 @@ versions still track specification maturity rather than a released product.
 
 ## [Unreleased]
 
+### Security
+
+- Raised the pinned Wasmtime engine from `46.0.1` to `46.0.2` to clear
+  [RUSTSEC-2026-0222](https://rustsec.org/advisories/RUSTSEC-2026-0222)
+  ("Stores can mix up type indices between engines"). The pin is exact, so the
+  bump moves `crates/edict-provider-host-wasmtime/Cargo.toml`, the
+  `provider-runtime-dependencies` boundary check in `xtask`, and the providers
+  architecture shelf together. Patch-level within `46.x`; no host API, provider
+  ABI, or golden artifact changes. The provider component fixture inventory
+  records a new `sourceDigest` because the workspace `Cargo.lock` is one of its
+  hashed provenance inputs; all five component digests are unchanged, since the
+  guest components do not depend on the host engine version.
+
 ### Changed
 
 - Replaced sentinel external-request schema and reconciliation identities

crates/edict-provider-host-wasmtime/Cargo.toml

@@ -16,7 +16,7 @@ edict-provider-schema = { path = "../edict-provider-schema" }
 edict-syntax = { path = "../edict-syntax" }
 sha2 = "0.10.9"
 wasmparser = { version = "=0.251.0", default-features = false, features = ["component-model", "std", "validate"] }
-wasmtime = { version = "=46.0.1", default-features = false, features = ["component-model", "cranelift", "runtime", "std"] }
+wasmtime = { version = "=46.0.2", default-features = false, features = ["component-model", "cranelift", "runtime", "std"] }
 
 [dev-dependencies]
 wasm-encoder = "=0.251.0"

docs/topics/providers/architecture.md

@@ -36,7 +36,7 @@ present.
 
 ## Engine And Store
 
-`ProviderComponentHost` owns one Wasmtime 46.0.1 engine. The configuration
+`ProviderComponentHost` owns one Wasmtime 46.0.2 engine. The configuration
 enables the component model and fuel, disables epochs, SIMD, relaxed SIMD, tail
 calls, memory64, multi-memory, and copy-on-write initialization, canonicalizes
 NaNs, and fixes the maximum Wasm stack. Epoch interruption is absent, so this

fixtures/providers/components/inventory.json

@@ -7,5 +7,5 @@
     "malformed-lowerer": "sha256:dfcd171918373d18b9dff16778e98b7618eeb4ac85976dd7134b9e201562f41b",
     "verifier": "sha256:9fa8e16ed7735075d559e3094685ce846d06425b4bb479be31f7498417bf87e4"
   },
-  "sourceDigest": "sha256:0f4d719b50a0ec4073693905bf254ef7bf59d43b2ca2f2b4d2bfd8bea08b1992"
+  "sourceDigest": "sha256:ddd74b104927c021fdd753582697b3a16da065697faebabc14e6d90ea84740f7"
 }

xtask/src/provider_dependencies.rs

@@ -5,7 +5,7 @@ use std::process::Command;
 
 use serde_json::Value;
 
-const WASMTIME_VERSION: &str = "46.0.1";
+const WASMTIME_VERSION: &str = "46.0.2";
 
 pub(crate) fn provider_runtime_dependencies(root: &Path) -> Result<(), String> {
     let cargo = env::var_os("CARGO").unwrap_or_else(|| "cargo".into());
@@ -87,14 +87,14 @@ fn check_metadata(metadata: &Value) -> Result<(), String> {
                     "workspace package `{package_name}` must not declare Wasmtime"
                 ));
             }
-            if dependency.get("req").and_then(Value::as_str) != Some("=46.0.1")
+            if dependency.get("req").and_then(Value::as_str) != Some("=46.0.2")
                 || dependency
                     .get("uses_default_features")
                     .and_then(Value::as_bool)
                     != Some(false)
             {
                 return Err(
-                    "provider host must pin Wasmtime 46.0.1 with default features disabled"
+                    "provider host must pin Wasmtime 46.0.2 with default features disabled"
                         .to_owned(),
                 );
             }