v49.0.3: Release Wasmtime 49.0.3 (#14725)

49.0.3

Released 2026-10-14.

Fixed

• Out-of-bounds zero-length stream writes can panic.
  GHSA-93g3-36p8-x2gc

• Host panic when component call_async is cancelled under some conditions.
  GHSA-3r89-v5mq-j5xf

• Panic on erroneous call-to-host from guest realloc call.
  GHSA-7v24-42x9-pxf7

• Yielding in a component start function can lead to a host panic.
  GHSA-5hhx-4wrr-3j9g

• Panic when invoking an async-lifted function via call.
  GHSA-m6w2-jwq2-cv2c

• Panic when pending calls are run after a trap.
  GHSA-hmwq-g22x-qjw5

• Stack overflow dropping a long chain of recursive types.
  GHSA-wjc8-633q-pwxr

• Wasmtime may not properly enforce async-entrypoint requirement.
  GHSA-vcg5-q8m5-8379

• Panic viewing component model stream or future as the wrong type.
  GHSA-63h4-6cx9-pjfj

• Component-model handle tables are capped only per instance and charged to no
  limit.
  GHSA-q554-3cjc-rx7p

• Exception tags can cause host data structures to be unaligned.
  GHSA-p79w-pv2r-29qp

• Filesystem sandbox escape when renaming symlinks with trailing slashes.
  GHSA-m9f7-9w4p-gv38

• Overlapping string transcode in a fused adapter can panic.
  GHSA-54p9-vhhq-8f7q

• Guests can send absolute-form HTTP requests to different hosts.
  GHSA-5qpp-g3j2-8frx

• wasi-http: Request with long url before query parameter crashes host.
  GHSA-w36r-2hch-9xp9