# Otōto 2026.21.2 > Source: > Published: 2026-11-04 10:41:48+00:00 - **Security: the plugin runtime and the certificate checks are updated.** Wasmtime, which runs Otōto's plugins, moves to 48.0.8 for six advisories dated 19 and 29 October. One is rated critical: on Apple silicon and arm64 Linux, a plugin's code could be compiled to jump to the wrong place (RUSTSEC-2026-0379). A plugin runs only when signed by a key you trust; update anyway, on a Mac above all. rustls-webpki and webpki-roots, which check the certificates of Otōto's HTTPS connections, no longer accept the intermediates distrusted in October (RUSTSEC-2026-0381, 0382), and tokio is updated for RUSTSEC-2026-0386. A scanner will still list RUSTSEC-2026-0387 (crypto-bigint): Otōto reaches it only to check a plugin signed with an ECDSA key, using its public key, so there is nothing secret for it to leak. - **`ototo update` no longer stops when a settings file was only reformatted.** If an editor or another tool had laid out Claude Code's`settings.json` (or OpenCode's config) differently, the update counted that as a change, asked about it, and with no terminal to ask at stopped with an error, although nothing differed. It now compares the settings themselves. - Upgrading from 2026.21.1: `ototo update` .