[nol4lej]

Summary

cargo deny check advisories has failed on main since the 2026-10-15 scheduled run: RustSec published advisories against rustls 0.23.45 and wasmtime 36.0.16. The code didn't change; the same commit a509c153 passed on 2026-10-14. This PR bumps both crates to their patched releases. Only Cargo.lock changes.

Versions

Crate	From	To	Advisories
rustls	0.23.45	0.23.46	RUSTSEC-2026-0346, 0347, 0348, 0349
wasmtime	36.0.16	36.0.18	RUSTSEC-2026-0363

The wasmtime bump also moves cranelift-* (0.123.16 → 0.123.18), pulley-*, wasmtime-internal-* and winch-codegen (36.0.16 → 36.0.18): 30 packages, all patch releases inside the current semver range. No Cargo.toml changes.

Advisories

• RUSTSEC-2026-0346: Debug impls of TLS client session values print the master secret / resumption PSK.
• RUSTSEC-2026-0347: after an ECH rejection, buffered application data is sent to the outer server.
• RUSTSEC-2026-0348: Brotli certificate decompression (non-default brotli feature) can allocate up to 1 GiB before authentication.
• RUSTSEC-2026-0349: an unauthenticated ServerHello can downgrade later connections to classical key exchange.
• RUSTSEC-2026-0363: Wasmtime component-model handle tables are capped only per instance and charged to no limit (GHSA-q554-3cjc-rx7p).

Verification

• cargo deny --all-features check advisories → advisories ok
• Build and tests: CI

Rollout

Running nodes keep the vulnerable versions until the next release. No runtime or spec change, so no setCode needed.