{"slug": "ototo-2026-21-2", "title": "Otōto 2026.21.2", "summary": "Otōto released version 2026.21.2, updating its plugin runtime to Wasmtime 48.0.8 to address six advisories dated 19 and 29 October, including the critical RUSTSEC-2026-0379, in which a plugin's code on Apple silicon and arm64 Linux could be compiled to jump to the wrong place. The release also updates rustls-webpki and webpki-roots to reject certificate intermediates distrusted in October (RUSTSEC-2026-0381 and RUSTSEC-2026-0382) and updates tokio for RUSTSEC-2026-0386, while noting RUSTSEC-2026-0387 (crypto-bigint) remains listed by scanners but exposes nothing secret because Otōto only uses a plugin's ECDSA public key. The `ototo update` command now compares settings themselves rather than their formatting, so a reformatted Claude Code `settings.json` or OpenCode config no longer halts the update with an error when no terminal is available.", "body_md": "- **Security: the plugin runtime and the certificate checks are updated.** Wasmtime, which runs Otōto's plugins, moves to 48.0.8 for six advisories dated 19 and 29 October. One is rated critical: on Apple silicon and arm64 Linux, a plugin's code could be compiled to jump to the wrong place (RUSTSEC-2026-0379). A plugin runs only when signed by a key you trust; update anyway, on a Mac above all. rustls-webpki and webpki-roots, which check the certificates of Otōto's HTTPS connections, no longer accept the intermediates distrusted in October (RUSTSEC-2026-0381, 0382), and tokio is updated for RUSTSEC-2026-0386. A scanner will still list RUSTSEC-2026-0387 (crypto-bigint): Otōto reaches it only to check a plugin signed with an ECDSA key, using its public key, so there is nothing secret for it to leak.\n- **`ototo update` no longer stops when a settings file was only reformatted.** If an editor or another tool had laid out Claude Code's`settings.json` (or OpenCode's config) differently, the update counted that as a change, asked about it, and with no terminal to ask at stopped with an error, although nothing differed. It now compares the settings themselves.\n- Upgrading from 2026.21.1: `ototo update` .", "url": "https://wpnews.pro/news/ototo-2026-21-2", "canonical_source": "https://ototo.dev/changelog#v2026.21.2", "published_at": "2026-11-04 10:41:48+00:00", "updated_at": "2026-11-04 11:50:57.267288+00:00", "lang": "en", "topics": ["ai-tools", "ai-agents", "developer-tools"], "entities": ["Otōto", "Wasmtime", "rustls-webpki", "webpki-roots", "tokio", "crypto-bigint", "Claude Code", "OpenCode"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ototo-2026-21-2", "markdown": "https://wpnews.pro/news/ototo-2026-21-2.md", "text": "https://wpnews.pro/news/ototo-2026-21-2.txt", "jsonld": "https://wpnews.pro/news/ototo-2026-21-2.jsonld"}}