build(deps): update wasmtime to v40 (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
wasi-common	workspace.dependencies	major	39.0 → 40.0
wasmtime	workspace.dependencies	major	39.0 → 40.0
wasmtime-wasi	workspace.dependencies	major	39.0 → 40.0

---

Release Notes

bytecodealliance/wasmtime (wasi-common)

v40.0.0

Compare Source

40.0.0

Released 2025-12-20.

Added

• WASIp3 support for wasi:http now implements Response::from_http to convert
  from standard Rust types to WASI types.
  #​12063

• Cranelift now supports a "patchable" ABI which has a maximum number of
  arguments and clobbers no registers. This is paired as well with a new
  patchable_call instruction which supports being turned into NOPs at runtime.
  #​12061
  #​12101

Changed

• Support for the WebAssembly threads proposal is now classified as tier 2 by
  default. Additionally creation of SharedMemory is disabled by deafult behind
  a new config knob/CLI flag.
  #​12036

• A variety of peephole-style optimizations have been added to Cranelift's
  optimization passes.
  #​11994
  #​11995
  #​11996
  #​11997
  #​11998
  #​11999
  #​12000
  #​12006
  #​12008

• Component host functions have been slightly optimized to remove an Arc clone
  and reduce contention.
  #​11987

• Support for component-model-async has been updated to account for the
  changes specified in WebAssembly/component-model#578.
  This means that historical binaries using WASIp3, for example, are no longer
  valid. Recompilation of historical components will be required and
  source-level changes may also be required in some circumstances.
  #​12031
  #​12043

• The UnsyncBoxBody type is now used everywhere in wasmtime-wasi-http instead
  of just in the wasip3 support.
  #​12060

• Initial groundwork for gracefully handling OOM (e.g. returning an error
  instead of aborting) has been added.
  #​12070
  #​12089

• Wasmtime will create a private copy of code memory when guest debugging is
  enabled to assist with modifying code when adding/removing breakpoints.
  #​12051

• The ResourceTable type will no longer use Tombstone when compiled in debug
  mode.
  #​12114

• Intra-component future/stream reads/writes will now trap instead of
  accidentally being allowed.
  #​12117

• Cranelift optimization rules have been tweaked after it was discovered that
  they could pessimize code containing long chains of computations.
  #​12116

Fixed

• Compilation of i8x16.popcnt has been fixed in Winch for some potential
  inputs.
  #​12010

• A panic in Instance::prepare_call for some component-model-async situations
  has been fixed.
  #​12054

• An off-by-one error for lifting/lowering enums/variants with 255 cases has
  been fixed.
  #​12066

• Restarting the read of a host future after cancellation has been fixed.
  #​12093

• Compilation for OpenBSD on x86_64 has been fixed.
  #​12097

• Components containing a module type which exoprts a tag are now supported.
  #​12125

---

Configuration

📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[viccuad]

Deferring until we move to monorepo.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 40.x releases. But if you manually upgrade to 40.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.