fix(deps): upgrade wasmtime 41->43 and rumqttc 0.24->0.25 to resolve CVEs (RUSTSEC-2026-0049, 0085-0096)

Cargo.toml

@@ -83,7 +83,7 @@ tokio-tungstenite = { version = "0.24", default-features = false, features = ["c
 url = "2"
 
 # WASM sandbox
-wasmtime = "41"
+wasmtime = "43"
 
 # HTTP server (for API daemon)
 axum = { version = "0.8", features = ["ws", "multipart"] }
@@ -147,7 +147,7 @@ native-tls = { version = "0.2", features = ["vendored"] }
 mailparse = "0.16"
 
 # MQTT client
-rumqttc = "0.24"
+rumqttc = { version = "0.25", default-features = false, features = ["use-native-tls"] }
 
 # OpenSSL (vendored = statically compiled, no runtime libssl dependency on Linux)
 openssl = { version = "0.10", features = ["vendored"] }

crates/openfang-runtime/src/sandbox.rs

@@ -286,18 +286,18 @@ impl WasmSandbox {
                 |mut caller: Caller<'_, GuestState>,
                  request_ptr: i32,
                  request_len: i32|
-                 -> Result<i64, anyhow::Error> {
+                 -> Result<i64, Error> {
                     // Read request from guest memory
                     let memory = caller
                         .get_export("memory")
                         .and_then(|e| e.into_memory())
-                        .ok_or_else(|| anyhow::anyhow!("no memory export"))?;
+                        .ok_or_else(|| format_err!("no memory export"))?;
 
                     let data = memory.data(&caller);
                     let start = request_ptr as usize;
                     let end = start + request_len as usize;
                     if end > data.len() {
-                        anyhow::bail!("host_call: request out of bounds");
+                        bail!("host_call: request out of bounds");
                     }
                     let request_bytes = data[start..end].to_vec();
 
@@ -324,7 +324,7 @@ impl WasmSandbox {
                     let alloc_fn = caller
                         .get_export("alloc")
                         .and_then(|e| e.into_func())
-                        .ok_or_else(|| anyhow::anyhow!("no alloc export"))?;
+                        .ok_or_else(|| format_err!("no alloc export"))?;
                     let alloc_typed = alloc_fn.typed::<i32, i32>(&caller)?;
                     let ptr = alloc_typed.call(&mut caller, len)?;
 
@@ -332,12 +332,12 @@ impl WasmSandbox {
                     let memory = caller
                         .get_export("memory")
                         .and_then(|e| e.into_memory())
-                        .ok_or_else(|| anyhow::anyhow!("no memory export"))?;
+                        .ok_or_else(|| format_err!("no memory export"))?;
                     let mem_data = memory.data_mut(&mut caller);
                     let dest_start = ptr as usize;
                     let dest_end = dest_start + response_bytes.len();
                     if dest_end > mem_data.len() {
-                        anyhow::bail!("host_call: response exceeds memory bounds");
+                        bail!("host_call: response exceeds memory bounds");
                     }
                     mem_data[dest_start..dest_end].copy_from_slice(&response_bytes);
 
@@ -356,17 +356,17 @@ impl WasmSandbox {
                  level: i32,
                  msg_ptr: i32,
                  msg_len: i32|
-                 -> Result<(), anyhow::Error> {
+                 -> Result<(), Error> {
                     let memory = caller
                         .get_export("memory")
                         .and_then(|e| e.into_memory())
-                        .ok_or_else(|| anyhow::anyhow!("no memory export"))?;
+                        .ok_or_else(|| format_err!("no memory export"))?;
 
                     let data = memory.data(&caller);
                     let start = msg_ptr as usize;
                     let end = start + msg_len as usize;
                     if end > data.len() {
-                        anyhow::bail!("host_log: pointer out of bounds");
+                        bail!("host_log: pointer out of bounds");
                     }
                     let msg = std::str::from_utf8(&data[start..end]).unwrap_or("<invalid utf8>");
                     let agent_id = &caller.data().agent_id;