diff --git a/Cargo.lock b/Cargo.lock
index d35fed10..cab66579 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -124,9 +124,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cap-fs-ext"
-version = "4.0.2"
+version = "4.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d78e5a3368ae89b7cb68186411452b4b9fac8b41be9c19bf3f47c2d2c8e36e6b"
+checksum = "56ff379b70af8e08307a8f65e7040c7301cb4a572538ade16b4984f0da77847f"
 dependencies = [
  "cap-primitives 4.0.3",
  "cap-std",
@@ -269,27 +269,27 @@ dependencies = [
 
 [[package]]
 name = "cranelift-assembler-x64"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d552bd33b7a56dc70aeb1e1c960e51a218fa0db50f23873b500a310379450b2d"
+checksum = "9903e767cc0a95a59950de099a6b1d61e1476f774be1cdfa06d7ccdc9bfae56f"
 dependencies = [
  "cranelift-assembler-x64-meta",
 ]
 
 [[package]]
 name = "cranelift-assembler-x64-meta"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "078e80e4c222279e3330f6aa1a256ca77ddf156d4453166a9f09defedc4594dd"
+checksum = "e777252ea3ec9daffa71408fbfe0793ab0a7b7bc3b2cf0f417dd0fa33964b8ef"
 dependencies = [
  "cranelift-srcgen",
 ]
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "820ce15d4ad3562d613c31a67b6d0434d403e7091a68d1349903842f7d31737e"
+checksum = "7828208a36e6627481cea61bd24c6234e31411d5c58b48e80ca094a1d593b944"
 dependencies = [
  "cranelift-entity",
  "wasmtime-internal-core",
@@ -297,9 +297,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-bitset"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61bca563d4b86d285928d9e27f97f27039bb33a0fc524fa130d7d0c106bf8ab3"
+checksum = "a58c8447cc59ef98c49096679f81392ad0acec2224cea2bef52011f5169f9d02"
 dependencies = [
  "serde",
  "serde_derive",
@@ -308,9 +308,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709f4b7c0fb57d952658d5b5c07fbdc4149acd7b7f0de9678ae754b9c981949a"
+checksum = "ce520e899df1de583e7b564eafd66760fbc147d72894d2278ddac57a1489fcc0"
 dependencies = [
  "bumpalo",
  "cranelift-assembler-x64",
@@ -339,9 +339,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "903dc8915af62aad1d9d0f39a5968d33fa80b9aa899ed6f56e47f40ca4512e1e"
+checksum = "8d8ab23e63d78ea6bbda18ae1ed9c958bc1cb88d90fb5e95f5ba62e9c019474b"
 dependencies = [
  "cranelift-assembler-x64-meta",
  "cranelift-codegen-shared",
@@ -352,24 +352,24 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-shared"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0522d74c227e49f3fd49ab055311486ae4f09083262b66705bed676952491469"
+checksum = "24319a996b1ef40ebf8af69b39c868c790b35a42cfe38edacfd8c9deb75ea712"
 
 [[package]]
 name = "cranelift-control"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66560ea1c5cef72e170b18e46d263dba2d3169c9d39e8cafdab2173c6362cc1a"
+checksum = "cf9856d68cc2cefb83229cb2c55b620dd38427555c2fe87d73f8a4421616f628"
 dependencies = [
  "arbitrary",
 ]
 
 [[package]]
 name = "cranelift-entity"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b62ef5b17cc814d27e96b66a5b46da0e4ce2b8ac55a6d478048bb99d04b05526"
+checksum = "e0ec225d6b79c5d61358cb5ea081a1384ec541dbf8c1a8c618d187875af326ad"
 dependencies = [
  "cranelift-bitset",
  "serde",
@@ -379,9 +379,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a87e0aaa39dbf70693b348a221e45904111704ee8f9fef140498471005f9842d"
+checksum = "7d3a96a09bd9bd3cf6df2de2ea15d7418f493e946a8eaa1acfe39297a67ed3f3"
 dependencies = [
  "cranelift-codegen",
  "hashbrown 0.17.0",
@@ -392,15 +392,15 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf79003ebfa1eed5e87f3b84446ad5236f540268289960e14f387dc9b28e40b7"
+checksum = "bd28f593c36afbdc9aa17305c0bb66c39ce0530e1caffcf389fbec053950083e"
 
 [[package]]
 name = "cranelift-native"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05bf4f235743c81e67ee4db617c5a4a0b65d58d3f0cfc575ee0f1a4e0cd58273"
+checksum = "2987ca47affc261aa31ac643fb80dd7f8274cebf878003ba9f50cd6ff2c1055f"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -409,9 +409,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-srcgen"
-version = "0.134.3"
+version = "0.135.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6977c2a71ab1e0d1e62f966b411a498aa04c4dce47d93d52f8a360a06058922"
+checksum = "b7431dd8c9def94aca43b27915dee0d42103d9b13922cfb044febcd975547d68"
 
 [[package]]
 name = "crc32fast"
@@ -468,9 +468,9 @@ dependencies = [
 
 [[package]]
 name = "deterministic-wasi-ctx"
-version = "4.0.6"
+version = "4.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73c95101e20f499777c4d00aa9b3b204edb0dfd5eaae44297ddfbd900130ce16"
+checksum = "6432053c1f8b6e7a37b962e0cab9c07bde4e2eb148e92905d6141c13c7f684c8"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1273,9 +1273,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-interpreter"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc5c8c21ea032e4efbdf2d067dc45171779dbe0c8ecf20ef4a57efa7474f2b0a"
+checksum = "f755d75e0809a4738a3e4880eeeb852fadbe1de5a437505b84f09c381657012a"
 dependencies = [
  "cranelift-bitset",
  "log",
@@ -1285,9 +1285,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-macros"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f10925455d5dde962e3604eade797ba5488644c8ee14a44191e2f2b58980574"
+checksum = "c7e69fa1c4a555946f82e7894a7df88b0e9ee03b4266829b4811467c616ce51d"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1404,9 +1404,9 @@ dependencies = [
 
 [[package]]
 name = "regalloc2"
-version = "0.15.1"
+version = "0.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de2c52737737f8609e94f975dee22854a2d5c125772d4b1cf292120f4d45c186"
+checksum = "757712e8e61590d6d4f5d563483755538b5aa13467837a3b41cd9832509a7f85"
 dependencies = [
  "allocator-api2",
  "bumpalo",
@@ -1959,9 +1959,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-compose"
-version = "0.252.0"
+version = "0.254.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d59b710751a35d54732a63851cdfacbfb2266b7160ce174faf269d3f4e84e31b"
+checksum = "8fd717357bff09b5f1ea49aea8ed1cd149b0c521823a1cc70bc2ac16b90b651a"
 dependencies = [
  "anyhow",
  "heck",
@@ -1969,8 +1969,8 @@ dependencies = [
  "log",
  "petgraph",
  "smallvec",
- "wasm-encoder 0.252.0",
- "wasmparser 0.252.0",
+ "wasm-encoder 0.254.0",
+ "wasmparser 0.254.0",
  "wat",
 ]
 
@@ -1986,12 +1986,12 @@ dependencies = [
 
 [[package]]
 name = "wasm-encoder"
-version = "0.252.0"
+version = "0.254.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8185ae345fa5687c054626ff9a50e7089797a343d9904d1dc9820eb4c4d3196f"
+checksum = "09480d646178e5fdd12bb06e812d0af9a3a191dbc9cd697fdc86687beade7393"
 dependencies = [
  "leb128fmt",
- "wasmparser 0.252.0",
+ "wasmparser 0.254.0",
 ]
 
 [[package]]
@@ -2016,6 +2016,18 @@ dependencies = [
  "wasmparser 0.244.0",
 ]
 
+[[package]]
+name = "wasm-metadata"
+version = "0.254.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b01df5f3b4ca7881e843f3bc0fb8a3905d79c68692250dcb8e33e698705ccdb6"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder 0.254.0",
+ "wasmparser 0.254.0",
+]
+
 [[package]]
 name = "wasmparser"
 version = "0.244.0"
@@ -2030,9 +2042,9 @@ dependencies = [
 
 [[package]]
 name = "wasmparser"
-version = "0.252.0"
+version = "0.254.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3eb099dcadcde5be9eef55e3a337128efd4e44b4c93122487e4d2e4e1c6627c"
+checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27"
 dependencies = [
  "bitflags",
  "hashbrown 0.17.0",
@@ -2054,27 +2066,26 @@ dependencies = [
 
 [[package]]
 name = "wasmprinter"
-version = "0.252.0"
+version = "0.254.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7142797de29b35ab8dbf15c00f55fda75d409da4c423a8ab8bd6b667a785824b"
+checksum = "64e3ba11e024f504698f87b629b2b66c22a1231758de7607754963f7d198be39"
 dependencies = [
  "anyhow",
  "termcolor",
- "wasmparser 0.252.0",
+ "wasmparser 0.254.0",
 ]
 
 [[package]]
 name = "wasmtime"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c80ca6098e0d4d06886d91d7f2cc3cb6623eb583c4c0ab3c89cbfb6098c8586c"
+checksum = "1bd39f78fe9bc82cee4025ec9d52118269e9a1498016cc60119b14f2e1d86a8d"
 dependencies = [
  "addr2line",
  "async-trait",
  "bitflags",
  "bumpalo",
  "cc",
- "cfg-if",
  "encoding_rs",
  "futures",
  "fxprof-processed-profile",
@@ -2098,8 +2109,8 @@ dependencies = [
  "target-lexicon",
  "tempfile",
  "wasm-compose",
- "wasm-encoder 0.252.0",
- "wasmparser 0.252.0",
+ "wasm-encoder 0.254.0",
+ "wasmparser 0.254.0",
  "wasmtime-environ",
  "wasmtime-internal-cache",
  "wasmtime-internal-component-macro",
@@ -2114,14 +2125,14 @@ dependencies = [
  "wasmtime-internal-winch",
  "wat",
  "windows-sys 0.61.2",
- "wit-parser 0.252.0",
+ "wit-parser 0.254.0",
 ]
 
 [[package]]
 name = "wasmtime-environ"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "134f9d136d29c76f6c1b4c9b468e97a2efc38c7d49fd188e39b64870b2fea701"
+checksum = "00c1070d95484d048994ec109cd42c4932ac07e6ee3cc1886fb90c7a18ec29da"
 dependencies = [
  "anyhow",
  "cpp_demangle",
@@ -2141,8 +2152,8 @@ dependencies = [
  "sha2",
  "smallvec",
  "target-lexicon",
- "wasm-encoder 0.252.0",
- "wasmparser 0.252.0",
+ "wasm-encoder 0.254.0",
+ "wasmparser 0.254.0",
  "wasmprinter",
  "wasmtime-internal-component-util",
  "wasmtime-internal-core",
@@ -2150,9 +2161,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-cache"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65db2eb1bfc5371a3b4107dbf539d0b93d05016fc29625b1648146b47db02071"
+checksum = "9d447fd40f3e149cda8c0cd808660a1d1de438f3ff28627abb9bcda90dfb4895"
 dependencies = [
  "base64",
  "directories-next",
@@ -2170,9 +2181,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-component-macro"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bf7b91fed3fc34781d57f9c6654ea2513bf0a99f7b0b0523c00de1e6efebe1c"
+checksum = "f3d2b2f9f89a65bb2277d82fbdd49263d27d8233bc717d750c4b13a23d57721c"
 dependencies = [
  "anyhow",
  "proc-macro2",
@@ -2180,20 +2191,20 @@ dependencies = [
  "syn 2.0.106",
  "wasmtime-internal-component-util",
  "wasmtime-internal-wit-bindgen",
- "wit-parser 0.252.0",
+ "wit-parser 0.254.0",
 ]
 
 [[package]]
 name = "wasmtime-internal-component-util"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc8a678149885cae00289f806fbe74c7863084cf74cace0b8dc73602279400e1"
+checksum = "2c0fe8292115fda08875f29064ae9f7f0b2c1ffbb323146eae538ae34b8a613f"
 
 [[package]]
 name = "wasmtime-internal-core"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0092c4b9d070ac5e278b6d0db10f5e71214190f0347ca57502b4692f796321"
+checksum = "821385794cf44baf2967fd2515368429ed2bff9b9b256f62d09a0f1301474fd8"
 dependencies = [
  "anyhow",
  "hashbrown 0.17.0",
@@ -2203,11 +2214,10 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-cranelift"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6851ebc9e03cab23d9821d2b2505d380bdfe38f35ccec945247b05274d85c98b"
+checksum = "0238b4a52773457ad1b8a1a26be90486e0ca0108cf46b9be16cc1d8d8cabdfa1"
 dependencies = [
- "cfg-if",
  "cranelift-codegen",
  "cranelift-control",
  "cranelift-entity",
@@ -2221,7 +2231,7 @@ dependencies = [
  "smallvec",
  "target-lexicon",
  "thiserror 2.0.17",
- "wasmparser 0.252.0",
+ "wasmparser 0.254.0",
  "wasmtime-environ",
  "wasmtime-internal-core",
  "wasmtime-internal-unwinder",
@@ -2230,12 +2240,11 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-fiber"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b26da6d5f60d4c438da70bba3553fe810a840533a64156be287dca2081c6991"
+checksum = "596f1d85e06cbf9c9add9c78ea135171c5753264ffe94a83dcc082a1ff49fc9b"
 dependencies = [
  "cc",
- "cfg-if",
  "libc",
  "rustix",
  "wasmtime-environ",
@@ -2245,9 +2254,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-debug"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed621ba25d7bf78b7edd7b4749abbb27c2e5cdba836c9504a424ee74b6c23149"
+checksum = "365faed74827bb0116785bab5872372df1baaec9ec0003c83bc99ccdc595f689"
 dependencies = [
  "cc",
  "object",
@@ -2257,11 +2266,10 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-icache-coherence"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5684ba160951baad06a725696f3c590e2fb0e8067c2aebee27bf7f9259058e85"
+checksum = "3cce25afd9e7ac4957292a5c6a219951dd0f140b8417e7378a97f50b67c3b96f"
 dependencies = [
- "cfg-if",
  "libc",
  "wasmtime-internal-core",
  "windows-sys 0.61.2",
@@ -2269,11 +2277,10 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-unwinder"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112eead527bffa8ff0646a11fb4339a9d52ddd1da2b9a6fce4aff84c815dd94f"
+checksum = "a1fdea09d51e39c774984ca68a7d7486767e5b2935f5e686fa654aabcfc3c42d"
 dependencies = [
- "cfg-if",
  "cranelift-codegen",
  "log",
  "object",
@@ -2282,9 +2289,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-versioned-export-macros"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "153592e0bed824fc13c6696203fa1bd7bd20eb355316475e39a55f081ef80eca"
+checksum = "97e48a5f514c38c2f74249724cb3501e45548d3311ca9e3881694859fd6ba116"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2293,16 +2300,16 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-winch"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "749c6e19c12a2a9ee29fac3085f8921401b89a953047e5bd02bf5fca08985913"
+checksum = "5273668f321005b9c75532ed073c0f6c3fd1147f3736a544c9e3070c47876489"
 dependencies = [
  "cranelift-codegen",
  "gimli",
  "log",
  "object",
  "target-lexicon",
- "wasmparser 0.252.0",
+ "wasmparser 0.254.0",
  "wasmtime-environ",
  "wasmtime-internal-cranelift",
  "winch-codegen",
@@ -2310,20 +2317,21 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-wit-bindgen"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c456ad6e81e0f46abfeca43687d18ea15e289c395b262ea6e0023e2682e088be"
+checksum = "07429ab53576255be2d298e04b2e1f381e39645465adbaebd69314b5430165c0"
 dependencies = [
  "anyhow",
  "bitflags",
  "heck",
  "indexmap",
- "wit-parser 0.252.0",
+ "wit-component 0.254.0",
+ "wit-parser 0.254.0",
 ]
 
 [[package]]
 name = "wasmtime-rb"
-version = "47.0.3"
+version = "48.0.1"
 dependencies = [
  "async-timer",
  "async-trait",
@@ -2344,18 +2352,16 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c1cf60cd6a565213af7074b4aad7bb5e110e3c6c6aae54425aa0500a0e15e86"
+checksum = "85dd81ee95792682ea5b279c9ed352f6b8a2cba084c2f8abdb225e6933323fed"
 dependencies = [
  "async-trait",
  "bitflags",
  "bytes",
  "cap-fs-ext",
- "cap-std",
- "cfg-if",
+ "cap-primitives 4.0.3",
  "futures",
- "io-lifetimes 3.0.1",
  "rand",
  "rustix",
  "thiserror 2.0.17",
@@ -2370,9 +2376,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi-io"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fb08e1d7755aaa467ce14080b7b01e33c914a920f6000696f1e42e40ea6387e"
+checksum = "6a557bc8a7232cd079f6b423a9bb385f3ff9148824f3c26c07a028b499fab2bf"
 dependencies = [
  "async-trait",
  "bytes",
@@ -2424,9 +2430,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89091642df051b84a7e00bdff75e985e507f2298384e477cc9310b0ddd79f004"
+checksum = "b871ea219ad85c1e59ee7d013563814e86d2e6aa094d3bc66b7675ec4ca58bb7"
 dependencies = [
  "bitflags",
  "thiserror 2.0.17",
@@ -2438,9 +2444,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle-generate"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12247f46f31bb5e7593947f9bba07317d0c1978e0d02250b979dd08f56f46e9f"
+checksum = "ed981675756e748a4725286a4059c9be006749a8db4120d54e2021d0f167bac3"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -2452,9 +2458,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle-macro"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e556a0880c9506fdcc662b1e226c7ced692f4977fed5b1ed40a3f3f0a48356f2"
+checksum = "7f3927729af874585c58b85710128e40d459a7064bb9aea9b0b420fb5eafd555"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2495,9 +2501,9 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "winch-codegen"
-version = "47.0.3"
+version = "48.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea2e389413b4fcf6488bf3bccb0804b8f80f156cf6a14c49688ed2970fa2544"
+checksum = "5b223d6350e387101a19062dd25b1c1763b0c28b26b8eeedde2e7568cab1b07c"
 dependencies = [
  "cranelift-assembler-x64",
  "cranelift-codegen",
@@ -2506,7 +2512,7 @@ dependencies = [
  "smallvec",
  "target-lexicon",
  "thiserror 2.0.17",
- "wasmparser 0.252.0",
+ "wasmparser 0.254.0",
  "wasmtime-environ",
  "wasmtime-internal-core",
  "wasmtime-internal-cranelift",
@@ -2727,9 +2733,9 @@ dependencies = [
  "indexmap",
  "prettyplease",
  "syn 2.0.106",
- "wasm-metadata",
+ "wasm-metadata 0.244.0",
  "wit-bindgen-core",
- "wit-component",
+ "wit-component 0.244.0",
 ]
 
 [[package]]
@@ -2761,11 +2767,30 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "wasm-encoder 0.244.0",
- "wasm-metadata",
+ "wasm-metadata 0.244.0",
  "wasmparser 0.244.0",
  "wit-parser 0.244.0",
 ]
 
+[[package]]
+name = "wit-component"
+version = "0.254.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0e65bb94c369b3c4741ce3d1d2704b1fec93db7c540df0e521a097e7ceeb5be"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder 0.254.0",
+ "wasm-metadata 0.254.0",
+ "wasmparser 0.254.0",
+ "wit-parser 0.254.0",
+]
+
 [[package]]
 name = "wit-parser"
 version = "0.244.0"
@@ -2786,9 +2811,9 @@ dependencies = [
 
 [[package]]
 name = "wit-parser"
-version = "0.252.0"
+version = "0.254.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4266bea110371c620ccf3201c5023676046bc4556e5c7cfb5d500bda5ebc162d"
+checksum = "1655131e4f7d3f0cb141f6eca71315ca40eff0f3d4de7cff0a82bacedd8c89b4"
 dependencies = [
  "anyhow",
  "hashbrown 0.17.0",
@@ -2800,7 +2825,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "unicode-ident",
- "wasmparser 0.252.0",
+ "wasmparser 0.254.0",
 ]
 
 [[package]]
diff --git a/Gemfile.lock b/Gemfile.lock
index 10995c71..1e84d995 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    wasmtime (47.0.3)
+    wasmtime (48.0.1)
       rb_sys (~> 0.9.130)
 
 GEM
diff --git a/ext/Cargo.toml b/ext/Cargo.toml
index e937db87..1692e178 100644
--- a/ext/Cargo.toml
+++ b/ext/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-rb"
-version = "47.0.3"
+version = "48.0.1"
 edition = "2021"
 authors = ["The Wasmtime Project Developers"]
 license = "Apache-2.0"
@@ -24,8 +24,8 @@ magnus = { version = "0.8", features = ["rb-sys"] }
 rb-sys = { version = "*", default-features = false, features = [
   "stable-api-compiled-fallback",
 ] }
-wasmtime = { version = "=47.0.3", features = ["memory-protection-keys"] }
-wasmtime-wasi = "=47.0.3"
+wasmtime = { version = "=48.0.1", features = ["memory-protection-keys"] }
+wasmtime-wasi = "=48.0.1"
 cap-std = "4.0.2"
 wat = "1.251.0"
 tokio = { version = "1.52.3", features = [
@@ -38,8 +38,8 @@ async-timer = { version = "1.0.0-beta.15", features = [
   "tokio1",
 ], optional = true }
 static_assertions = "1.1.0"
-wasmtime-environ = "=47.0.3"
-deterministic-wasi-ctx = { version = "=4.0.6" }
+wasmtime-environ = "=48.0.1"
+deterministic-wasi-ctx = { version = "=4.0.7" }
 
 [build-dependencies]
 rb-sys-env = "0.2.3"
diff --git a/ext/src/ruby_api/component/convert.rs b/ext/src/ruby_api/component/convert.rs
index 7f8b928e..e82622f7 100644
--- a/ext/src/ruby_api/component/convert.rs
+++ b/ext/src/ruby_api/component/convert.rs
@@ -41,7 +41,7 @@ pub(crate) fn component_val_to_rb(
         Val::Float64(n) => Ok(n.into_value_with(ruby)),
         Val::Char(c) => Ok(c.into_value_with(ruby)),
         Val::String(s) => Ok(s.as_str().into_value_with(ruby)),
-        Val::List(vec) => {
+        Val::List(vec) | Val::FixedLengthList(vec) => {
             let array = ruby.ary_new_capa(vec.len());
             for val in vec {
                 array.push(component_val_to_rb(ruby, val, _store)?)?;
@@ -101,6 +101,46 @@ pub(crate) fn component_val_to_rb(
     }
 }
 
+fn rb_to_component_list(
+    value: Value,
+    store: Option<&StoreContextValue>,
+    element_ty: &Type,
+    expected_len: Option<usize>,
+) -> Result<Vec<Val>, Error> {
+    let ruby = Ruby::get_with(value);
+    let array = RArray::try_convert(value)?;
+
+    if let Some(expected_len) = expected_len {
+        if array.len() != expected_len {
+            return Err(Error::new(
+                ruby.exception_type_error(),
+                format!(
+                    "invalid array length for fixed-length list (given {}, expected {})",
+                    array.len(),
+                    expected_len
+                ),
+            ));
+        }
+    }
+
+    let mut values = Vec::with_capacity(array.len());
+    let list_kind = if expected_len.is_some() {
+        "fixed-length list"
+    } else {
+        "list"
+    };
+
+    // SAFETY: we don't mutate the RArray and we don't call into
+    // user code so user code can't mutate it either.
+    for (index, value) in unsafe { array.as_slice() }.iter().enumerate() {
+        let value = rb_to_component_val(*value, store, element_ty)
+            .map_err(|e| e.append(format!(" ({list_kind} item at index {index})")))?;
+        values.push(value);
+    }
+
+    Ok(values)
+}
+
 pub(crate) fn rb_to_component_val(
     value: Value,
     _store: Option<&StoreContextValue>,
@@ -135,19 +175,10 @@ pub(crate) fn rb_to_component_val(
         Type::Float64 => Ok(Val::Float64(f64::try_convert(value)?)),
         Type::Char => Ok(Val::Char(value.to_r_string()?.to_char()?)),
         Type::String => Ok(Val::String(RString::try_convert(value)?.to_string()?)),
-        Type::List(list) => {
-            let ty = list.ty();
-            let rarray = RArray::try_convert(value)?;
-            let mut vals: Vec<Val> = Vec::with_capacity(rarray.len());
-            // SAFETY: we don't mutate the RArray and we don't call into
-            // user code so user code can't mutate it either.
-            for (i, value) in unsafe { rarray.as_slice() }.iter().enumerate() {
-                let component_val = rb_to_component_val(*value, _store, &ty)
-                    .map_err(|e| e.append(format!(" (list item at index {i})")))?;
-
-                vals.push(component_val);
-            }
-            Ok(Val::List(vals))
+        Type::List(list) => rb_to_component_list(value, _store, &list.ty(), None).map(Val::List),
+        Type::FixedLengthList(list) => {
+            rb_to_component_list(value, _store, &list.ty(), Some(list.len() as usize))
+                .map(Val::FixedLengthList)
         }
         Type::Record(record) => {
             let hash = RHash::try_convert(value)?;
diff --git a/ext/src/ruby_api/wasi_config.rs b/ext/src/ruby_api/wasi_config.rs
index 3e031de1..7c54337a 100644
--- a/ext/src/ruby_api/wasi_config.rs
+++ b/ext/src/ruby_api/wasi_config.rs
@@ -26,7 +26,7 @@ use wasmtime_wasi::cli::{InputFile, OutputFile};
 use wasmtime_wasi::p1::WasiP1Ctx;
 use wasmtime_wasi::p2::pipe::MemoryInputPipe;
 use wasmtime_wasi::sockets::SocketAddrUse;
-use wasmtime_wasi::{DirPerms, FilePerms, WasiCtx, WasiCtxBuilder};
+use wasmtime_wasi::{FsPerms, WasiCtx, WasiCtxBuilder};
 
 /// Storage for errors that occur in socket_addr_check callbacks.
 /// We store (class_name, message) tuples since magnus::Error is not Send+Sync.
@@ -59,31 +59,18 @@ impl WasiRetainedData {
 }
 
 define_rb_intern!(
-    READ => "read",
-    WRITE => "write",
-    MUTATE => "mutate",
-    ALL => "all",
+    READ_ONLY => "read_only",
+    READ_WRITE => "read_write",
 );
 
 lazy_static! {
-    static ref FILE_PERMS_MAPPING: SymbolEnum<'static, FilePerms> = {
-        let mapping = vec![
-            (*READ, FilePerms::READ),
-            (*WRITE, FilePerms::WRITE),
-            (*ALL, FilePerms::all()),
-        ];
-
-        SymbolEnum::new(":file_perms", mapping)
-    };
-    static ref DIR_PERMS_MAPPING: SymbolEnum<'static, DirPerms> = {
-        let mapping = vec![
-            (*READ, DirPerms::READ),
-            (*MUTATE, DirPerms::MUTATE),
-            (*ALL, DirPerms::all()),
-        ];
-
-        SymbolEnum::new(":dir_perms", mapping)
-    };
+    static ref FS_PERMS_MAPPING: SymbolEnum<'static, FsPerms> = SymbolEnum::new(
+        ":fs_perms",
+        vec![
+            (*READ_ONLY, FsPerms::ReadOnly),
+            (*READ_WRITE, FsPerms::ReadWrite),
+        ],
+    );
 }
 
 enum ReadStream {
@@ -117,21 +104,19 @@ impl WriteStream {
     }
 }
 
-struct PermsSymbolEnum(Symbol);
+struct FsPermsSymbol(Symbol);
 
 #[derive(Clone)]
 struct MappedDirectory {
     host_path: Opaque<RString>,
     guest_path: Opaque<RString>,
-    dir_perms: Opaque<Symbol>,
-    file_perms: Opaque<Symbol>,
+    fs_perms: Opaque<Symbol>,
 }
 impl MappedDirectory {
     pub fn mark(&self, marker: &Marker) {
         marker.mark(self.host_path);
         marker.mark(self.guest_path);
-        marker.mark(self.dir_perms);
-        marker.mark(self.file_perms);
+        marker.mark(self.fs_perms);
     }
 }
 
@@ -176,10 +161,12 @@ unsafe impl Sync for SocketAddrProc {}
 fn socket_addr_use_to_symbol(ruby: &Ruby, use_: SocketAddrUse) -> Symbol {
     match use_ {
         SocketAddrUse::TcpBind => ruby.to_symbol("tcp_bind"),
+        SocketAddrUse::TcpListen => ruby.to_symbol("tcp_listen"),
+        SocketAddrUse::TcpAccept => ruby.to_symbol("tcp_accept"),
         SocketAddrUse::TcpConnect => ruby.to_symbol("tcp_connect"),
         SocketAddrUse::UdpBind => ruby.to_symbol("udp_bind"),
-        SocketAddrUse::UdpConnect => ruby.to_symbol("udp_connect"),
-        SocketAddrUse::UdpOutgoingDatagram => ruby.to_symbol("udp_outgoing_datagram"),
+        SocketAddrUse::UdpSend => ruby.to_symbol("udp_send"),
+        SocketAddrUse::UdpReceive => ruby.to_symbol("udp_receive"),
     }
 }
 
@@ -225,19 +212,12 @@ impl WasiConfigInner {
     }
 }
 
-impl TryFrom<PermsSymbolEnum> for DirPerms {
+impl TryFrom<FsPermsSymbol> for FsPerms {
     type Error = magnus::Error;
-    fn try_from(value: PermsSymbolEnum) -> Result<Self, Error> {
-        let ruby = Ruby::get_with(value.0);
-        DIR_PERMS_MAPPING.get(value.0.into_value_with(&ruby))
-    }
-}
 
-impl TryFrom<PermsSymbolEnum> for FilePerms {
-    type Error = magnus::Error;
-    fn try_from(value: PermsSymbolEnum) -> Result<Self, Error> {
+    fn try_from(value: FsPermsSymbol) -> Result<Self, Self::Error> {
         let ruby = Ruby::get_with(value.0);
-        FILE_PERMS_MAPPING.get(value.0.into_value_with(&ruby))
+        FS_PERMS_MAPPING.get(value.0.into_value_with(&ruby))
     }
 }
 
@@ -406,22 +386,19 @@ impl WasiConfig {
     /// Set mapped directory for host path and guest path.
     /// @param host_path [String]
     /// @param guest_path [String]
-    /// @param dir_perms [Symbol] Directory permissions, one of :read, :mutate, or :all
-    /// @param file_perms [Symbol] File permissions, one of :read, :write, or :all
-    /// @def set_mapped_directory(host_path, guest_path, dir_perms, file_perms)
+    /// @param fs_perms [Symbol] Filesystem permissions, either :read_only or :read_write
+    /// @def set_mapped_directory(host_path, guest_path, fs_perms)
     /// @return [WasiConfig] +self+
     pub fn set_mapped_directory(
         rb_self: RbSelf,
         host_path: RString,
         guest_path: RString,
-        dir_perms: Symbol,
-        file_perms: Symbol,
+        fs_perms: Symbol,
     ) -> RbSelf {
         let mapped_dir = MappedDirectory {
             host_path: host_path.into(),
             guest_path: guest_path.into(),
-            dir_perms: dir_perms.into(),
-            file_perms: file_perms.into(),
+            fs_perms: fs_perms.into(),
         };
 
         let mut inner = rb_self.inner.borrow_mut();
@@ -431,8 +408,9 @@ impl WasiConfig {
     }
 
     /// @yard
-    /// Enable all network access by inheriting the host's network.
-    /// This allows the WASI module to use TCP, UDP, and DNS resolution.
+    /// Allow all network addresses accessible to the host.
+    /// TCP, UDP, and IP name lookup must be enabled separately with +allow_tcp+,
+    /// +allow_udp+, and +allow_ip_name_lookup+.
     ///
     /// Note: any network access happens while the Global VM Lock (GVL) is held, so other
     /// threads will be blocked in the meantime.
@@ -444,7 +422,7 @@ impl WasiConfig {
     }
 
     /// @yard
-    /// Allow or deny TCP socket access. Allowed by default, can be used to blanket disable TCP.
+    /// Allow or deny TCP socket access. Disabled by default.
     /// @param enabled [Boolean] Whether to allow TCP socket access
     /// @def allow_tcp(enabled)
     /// @return [WasiConfig] +self+
@@ -455,7 +433,7 @@ impl WasiConfig {
     }
 
     /// @yard
-    /// Allow or deny UDP socket access. Allowed by default, can be used to blanket disable UDP.
+    /// Allow or deny UDP socket access. Disabled by default.
     /// @param enabled [Boolean] Whether to allow UDP socket access
     /// @def allow_udp(enabled)
     /// @return [WasiConfig] +self+
@@ -479,8 +457,8 @@ impl WasiConfig {
     /// @yard
     /// Set a custom check function for socket address access control.
     /// The block will be called for each socket operation with the socket address (as a String)
-    /// and the operation type (as a Symbol: :tcp_bind, :tcp_connect, :udp_bind, :udp_connect,
-    /// :udp_outgoing_datagram).
+    /// and the operation type (as a Symbol: :tcp_bind, :tcp_listen, :tcp_accept,
+    /// :tcp_connect, :udp_bind, :udp_send, or :udp_receive).
     /// The block should return true to allow the operation or false to deny it.
     /// If the block raises an exception, the operation will be denied.
     ///
@@ -614,16 +592,10 @@ impl WasiConfig {
         for mapped_dir in &inner.mapped_directories {
             let host_path = ruby.get_inner(mapped_dir.host_path).to_string()?;
             let guest_path = ruby.get_inner(mapped_dir.guest_path).to_string()?;
-            let dir_perms = ruby.get_inner(mapped_dir.dir_perms);
-            let file_perms = ruby.get_inner(mapped_dir.file_perms);
+            let fs_perms = FsPermsSymbol(ruby.get_inner(mapped_dir.fs_perms)).try_into()?;
 
             builder
-                .preopened_dir(
-                    Path::new(&host_path),
-                    &guest_path,
-                    PermsSymbolEnum(dir_perms).try_into()?,
-                    PermsSymbolEnum(file_perms).try_into()?,
-                )
+                .preopened_dir(Path::new(&host_path), &guest_path, fs_perms)
                 .map_err(|e| error!("{}", e))?;
         }
 
@@ -698,7 +670,7 @@ pub fn init(ruby: &Ruby) -> Result<(), Error> {
 
     class.define_method(
         "set_mapped_directory",
-        method!(WasiConfig::set_mapped_directory, 4),
+        method!(WasiConfig::set_mapped_directory, 3),
     )?;
 
     class.define_method("inherit_network", method!(WasiConfig::inherit_network, 0))?;
diff --git a/lib/wasmtime/version.rb b/lib/wasmtime/version.rb
index c8763957..9c2fc0ec 100644
--- a/lib/wasmtime/version.rb
+++ b/lib/wasmtime/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Wasmtime
-  VERSION = "47.0.3"
+  VERSION = "48.0.1"
 end
diff --git a/spec/unit/wasi_spec.rb b/spec/unit/wasi_spec.rb
index bdcd6f40..6a211b1f 100644
--- a/spec/unit/wasi_spec.rb
+++ b/spec/unit/wasi_spec.rb
@@ -244,7 +244,7 @@ module Wasmtime
 
         wasi_config = WasiConfig.new
           .set_argv(["wasi-fs", "/tmp/counter"])
-          .set_mapped_directory(tempfile_path("tmp"), "/tmp", :all, :all)
+          .set_mapped_directory(tempfile_path("tmp"), "/tmp", :read_write)
 
         expect { run_fs.call(wasi_config) }.not_to raise_error
 
@@ -259,7 +259,7 @@ module Wasmtime
         wasi_config = WasiConfig.new
           .set_argv(["wasi-fs", "/tmp/counter"])
           .set_stderr_buffer(stderr_str, 40000)
-          .set_mapped_directory(tempfile_path("tmp"), "/tmp", :read, :read)
+          .set_mapped_directory(tempfile_path("tmp"), "/tmp", :read_only)
 
         expect { run_fs.call(wasi_config) }.to raise_error do |error|
           expect(error).to be_a(Wasmtime::Error)
@@ -270,21 +270,16 @@ module Wasmtime
         expect(File.read(tempfile_path(File.join("tmp", "counter")))).to eq("0")
       end
 
-      it "fails to read from mapped directory if not permitted" do
+      it "does not accept legacy permissions" do
         Dir.mkdir(tempfile_path("tmp"))
         File.write(tempfile_path(File.join("tmp", "counter")), "0")
 
-        stderr_str = ""
         wasi_config = WasiConfig.new
           .set_argv(["wasi-fs", "/tmp/counter"])
-          .set_stderr_buffer(stderr_str, 40000)
-          .set_mapped_directory(tempfile_path("tmp"), "/tmp", :mutate, :write)
-
-        expect { run_fs.call(wasi_config) }.to raise_error do |error|
-          expect(error).to be_a(Wasmtime::Error)
-        end
+          .set_mapped_directory(tempfile_path("tmp"), "/tmp", :all)
 
-        expect(stderr_str).to match(/failed to open counter file/)
+        expect { run_fs.call(wasi_config) }
+          .to raise_error(ArgumentError, /invalid :fs_perms, expected one of \[:read_only, :read_write\], got :all/)
 
         expect(File.read(tempfile_path(File.join("tmp", "counter")))).to eq("0")
       end
@@ -309,7 +304,7 @@ module Wasmtime
 
       it "does not accept an invalid host path" do
         wasi_config = WasiConfig.new
-          .set_mapped_directory(tempfile_path("tmp"), "/tmp", :all, :all)
+          .set_mapped_directory(tempfile_path("tmp"), "/tmp", :read_write)
 
         expect { run_fs.call(wasi_config) }.to raise_error do |error|
           expect(error).to be_a(Wasmtime::Error)
@@ -319,11 +314,11 @@ module Wasmtime
 
       it "does not accept invalid permissions" do
         wasi_config = WasiConfig.new
-          .set_mapped_directory(tempfile_path("tmp"), "/tmp", :mutate, :invalid_permission)
+          .set_mapped_directory(tempfile_path("tmp"), "/tmp", :invalid_permission)
 
         expect { run_fs.call(wasi_config) }.to raise_error do |error|
           expect(error).to be_a(ArgumentError)
-          expect(error.message).to match(/invalid :file_perms, expected one of \[:read, :write, :all\], got :invalid_permission/)
+          expect(error.message).to match(/invalid :fs_perms, expected one of \[:read_only, :read_write\], got :invalid_permission/)
         end
       end
     end
@@ -449,7 +444,7 @@ module Wasmtime
         cleanup_server(server_pid)
       end
 
-      it "allows tcp when inheriting network access" do
+      it "allows tcp when network addresses and TCP are enabled" do
         port_file = tempfile_path("tcp_port")
         server_pid = spawn_tcp_server(port_file)
         port = wait_for_port(port_file)
@@ -459,6 +454,7 @@ module Wasmtime
           .set_argv(["wasi-network", "tcp", "127.0.0.1", port.to_s])
           .set_stdout_buffer(stdout_str, 40000)
           .inherit_network
+          .allow_tcp(true)
 
         run_wasi_component_network(wasi_config)
 
@@ -470,7 +466,7 @@ module Wasmtime
         cleanup_server(server_pid)
       end
 
-      it "disallows tcp when tcp is disabled" do
+      it "does not enable tcp when only inheriting network addresses" do
         port_file = tempfile_path("tcp_port_deny")
         server_pid = spawn_tcp_server(port_file)
         port = wait_for_port(port_file)
@@ -480,7 +476,6 @@ module Wasmtime
           .set_argv(["wasi-network", "tcp", "127.0.0.1", port.to_s])
           .set_stdout_buffer(stdout_str, 40000)
           .inherit_network
-          .allow_tcp(false)
 
         run_wasi_component_network(wasi_config)
 
@@ -491,7 +486,7 @@ module Wasmtime
         cleanup_server(server_pid)
       end
 
-      it "allows udp when inheriting network access" do
+      it "allows udp when network addresses and UDP are enabled" do
         port_file = tempfile_path("udp_port")
         server_pid = spawn_udp_server(port_file)
         port = wait_for_port(port_file)
@@ -501,6 +496,7 @@ module Wasmtime
           .set_argv(["wasi-network", "udp", "127.0.0.1", port.to_s])
           .set_stdout_buffer(stdout_str, 40000)
           .inherit_network
+          .allow_udp(true)
 
         run_wasi_component_network(wasi_config)
 
@@ -570,9 +566,10 @@ module Wasmtime
         wasi_config = WasiConfig.new
           .set_argv(["wasi-network", "tcp", "127.0.0.1", port.to_s])
           .set_stdout_buffer(stdout_str, 40000)
+          .allow_tcp(true)
           .socket_addr_check do |addr, use|
             # Only allow connections to localhost on the specific port
-            addr.start_with?("127.0.0.1:") && use == :tcp_connect
+            use == :tcp_bind || (addr.start_with?("127.0.0.1:") && use == :tcp_connect)
           end
 
         run_wasi_component_network(wasi_config)
@@ -594,6 +591,7 @@ module Wasmtime
         wasi_config = WasiConfig.new
           .set_argv(["wasi-network", "tcp", "127.0.0.1", port.to_s])
           .set_stdout_buffer(stdout_str, 40000)
+          .allow_tcp(true)
           .socket_addr_check do |_addr, _use|
             false # Block all access
           end
@@ -616,6 +614,7 @@ module Wasmtime
         wasi_config = WasiConfig.new
           .set_argv(["wasi-network", "tcp", "127.0.0.1", port.to_s])
           .set_stdout_buffer(stdout_str, 40000)
+          .allow_tcp(true)
           .socket_addr_check do |_addr, _use|
             raise ArgumentError, "Intentional error for testing"
           end