- Security: the plugin runtime and the certificate checks are updated. Wasmtime, which runs Otōto's plugins, moves to 48.0.8 for six advisories dated 19 and 29 October. One is rated critical: on Apple silicon and arm64 Linux, a plugin's code could be compiled to jump to the wrong place (RUSTSEC-2026-0379). A plugin runs only when signed by a key you trust; update anyway, on a Mac above all. rustls-webpki and webpki-roots, which check the certificates of Otōto's HTTPS connections, no longer accept the intermediates distrusted in October (RUSTSEC-2026-0381, 0382), and tokio is updated for RUSTSEC-2026-0386. A scanner will still list RUSTSEC-2026-0387 (crypto-bigint): Otōto reaches it only to check a plugin signed with an ECDSA key, using its public key, so there is nothing secret for it to leak.
ototo updateno longer stops when a settings file was only reformatted. If an editor or another tool had laid out Claude Code'ssettings.json(or OpenCode's config) differently, the update counted that as a change, asked about it, and with no terminal to ask at stopped with an error, although nothing differed. It now compares the settings themselves.- Upgrading from 2026.21.1:
ototo update.
source & further reading
ototo.dev — original article
Otōto 2026.21.1
Otōto 2026.21
Otōto 2026.20