chore(deps): bump wasmtime from 39.0.1 to 40.0.1

[dependabot]

Bumps wasmtime from 39.0.1 to 40.0.1.

Release notes

Sourced from wasmtime's releases.

v40.0.1

40.0.1

Released 2026-01-07.

Changed

• This release is a test of Wasmtime's CI-based crate publishing infrastructure. Wasmtime is switching to crates.io-based trusted publishing for this release and is testing that everything works. #12257

v40.0.0

40.0.0

Released 2025-12-20.

Added

• WASIp3 support for wasi:http now implements Response::from_http to convert from standard Rust types to WASI types. #12063

• Cranelift now supports a "patchable" ABI which has a maximum number of arguments and clobbers no registers. This is paired as well with a new patchable_call instruction which supports being turned into NOPs at runtime. #12061 #12101

Changed

• Support for the WebAssembly threads proposal is now classified as tier 2 by default. Additionally creation of SharedMemory is disabled by deafult behind a new config knob/CLI flag. #12036

• A variety of peephole-style optimizations have been added to Cranelift's optimization passes. #11994 #11995 #11996 #11997 #11998 #11999 #12000 #12006 #12008

• Component host functions have been slightly optimized to remove an Arc clone and reduce contention.

... (truncated)

Changelog

Sourced from wasmtime's changelog.

40.0.1

Released 2026-01-07.

Changed

• This release is a test of Wasmtime's CI-based crate publishing infrastructure. Wasmtime is switching to crates.io-based trusted publishing for this release and is testing that everything works. #12257

---

40.0.0

Released 2025-12-20.

Added

• WASIp3 support for wasi:http now implements Response::from_http to convert from standard Rust types to WASI types. #12063

• Cranelift now supports a "patchable" ABI which has a maximum number of arguments and clobbers no registers. This is paired as well with a new patchable_call instruction which supports being turned into NOPs at runtime. #12061 #12101

Changed

• Support for the WebAssembly threads proposal is now classified as tier 2 by default. Additionally creation of SharedMemory is disabled by deafult behind a new config knob/CLI flag. #12036

• A variety of peephole-style optimizations have been added to Cranelift's optimization passes. #11994 #11995 #11996 #11997 #11998 #11999 #12000 #12006 #12008

• Component host functions have been slightly optimized to remove an Arc clone and reduce contention.

... (truncated)

Commits

• 918e5dc Release Wasmtime 40.0.1 (#12271)
• 01cc1c0 Migrate this workspace to using trusted publishing (#12257) (#12265)
• 0807b00 Release Wasmtime 40.0.0 (#12192)
• fadd22a [40.0.0] trap on blocking call in sync task before return (#12144)
• c242041 Add release notes (#12132)
• ac3358b Fix various broken links in docs. (#12125)
• 058a9bc Components: implement exception-tag translation in core module types. (#12122)
• 54826c0 Update wasm-tools/wit-bindgen dependencies (#12121)
• 245580e Cranelift: support fuzzing patchable_call. (#12118)
• 1d73897 Use core::convert::Infallible instead of our own Uninhabited type (#12115)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9e9f3be6c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Align wasmtime-wasi version with wasmtime

Updating wasmtime to 40.0.1 while keeping wasmtime-wasi at 39.0.1 pulls two incompatible wasmtime versions into the build. The runtime calls p1::add_to_linker_sync with a Linker from the direct wasmtime dependency (e.g., runtime.rs around the _start setup), but wasmtime-wasi 39 expects types from wasmtime 39, so this version skew should fail to compile due to mismatched wasmtime::Linker/Store types. Consider bumping wasmtime-wasi to the matching 40.x series (or keep wasmtime at 39.x) to keep the type graph consistent.

Useful? React with 👍 / 👎.