RATATOSKRATATOSK
ログイン

wasmCloud

v2.12.0Orchestration & Management
2026年11月4日

ACTION 2CHECK 2OTHER 52

NATS、メモリ管理、ストレージ、ランタイムの改善を含む、機能面の拡張が多いリリースです。依存関係の更新と、詳細が公開されていないセキュリティ修正も含まれています。

要対応 (2)

  • securityzstd-sysのセキュリティ勧告対応

    zstd-sysをRUSTSEC-2026-0410より新しい版へ更新し、到達不能なzstdの勧告を無視するようにしました。

    wasmCloud#5753

  • security依存関係のセキュリティ勧告対応

    オープンなセキュリティ勧告がある依存関係を更新しました。

    wasmCloud#5767

影響確認 (2)

  • securityNATS TLS、postgres arrays、S3 readsのセキュリティ修正

    NATS TLS、postgres arrays、またはS3 readsを使用している場合に適用されます。

    wash-runtimeに、NATS TLS、postgres arrays、S3 reads向けのリリース前セキュリティ修正を追加しました。

    wasmCloud#5871

  • breakingdev egressのデフォルト変更

    dev egressを使用している場合に適用されます。

    washでは、dev egressのデフォルトをallow-allに変更しました。

    wasmCloud#5835

その他の記録済み変更 52 件すべてfixes 24 · additions 15 · value changes 12 · constraints 1

fixes (24)

  • * fix(wash-runtime): cap a cgroup memory limit at RAM plus swap by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5710
  • * fix(otel): align HTTP span names by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5579
  • * fix(runtime): reject plugin-served WASI overrides by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5721
  • * fix: reject limits above semaphore capactity by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5718
  • * fix(deps): update ctutils to resolve cargo audit failure by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5736
  • * fix(wash-runtime): allow shutdown during stalled NATS secret reads by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5741
  • * fix(wash-runtime): refuse a postgres parameter whose type does not match by @cvas22 in https://github.com/wasmCloud/wasmCloud/pull/5732
  • * fix(wash-runtime): treat deleted objects as absent in the NATS blobstore by @ThomasDravigney in https://github.com/wasmCloud/wasmCloud/pull/5726
  • * fix(sockets): cover UDP contracts and correct datagram handling by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5794
  • * fix(wash-runtime): free stopped workloads with linked async exports, and surface P3 service pre-instantiation errors by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5802
  • * fix(wash-runtime): honor service failures and reclaim linked tasks by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5808
  • * fix(sockets): compile udp_disconnect on Windows by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5809
  • * fix(sockets): handle UDP reconnects and shared receive budgets by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5805
  • * fix(wash): honour WIT source overrides and the default cache by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5811
  • * fix(wasi-otel): count cumulative guest metrics once by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5810
  • * fix(deps): update pulldown-cmark to resolve cargo audit failure by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5830
  • * fix(operator): match owned objects by owner UID and tidy DaemonSet deletes by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5817
  • * fix(wash-runtime): reconnect redis keyvalue backends after a server restart by @ericgregory in https://github.com/wasmCloud/wasmCloud/pull/5827
  • * fix(wash-runtime): preserve KV updates across bucket recreation by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5840
  • * fix(runtime-operator): environment isolation and refused child writes by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5717
  • * fix(runtime): preserve command exits during initialization by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5684
  • * fix(wash-runtime): honor blobstore TLS client identities by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5847
  • * fix(wash-runtime): export the component handler span as invoke_component_handler by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5757
  • * fix(sockets): preserve nonblocking UDP progress by @mackaby in https://github.com/wasmCloud/wasmCloud/pull/5772

additions (15)

  • * feat(wash-runtime): support NATS client authentication and connection names by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5733
  • * feat(wash-runtime): allow assigning a host ID before connecting by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5734
  • * feat(operator): configure NATS client authentication and inbox prefixes by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5735
  • * feat(wash): configure host NATS authentication per connection by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5742
  • * feat(wash-runtime): expand NATS JetStream and KV APIs by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5751
  • * feat: NATS credential rotation for wasmcloud:nats, JWT-as-token, embedder API and operator liveness by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5755
  • * perf: add growth memory budget by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5799
  • * Add WorkloadDaemonset and update status subresource by @jfleitz in https://github.com/wasmCloud/wasmCloud/pull/5784
  • * feat(wash-runtime): add an S3 wasi:blobstore backend on object_store by @jtakakura in https://github.com/wasmCloud/wasmCloud/pull/5643
  • * feat: expose wasmtime's hostcall_fuel by @MendyBerger in https://github.com/wasmCloud/wasmCloud/pull/5824
  • * feat(wash-runtime): guard and explain hostcall fuel by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5834
  • * feat(wash-runtime): resolve secret: config references at bind by @jfleitz in https://github.com/wasmCloud/wasmCloud/pull/5716
  • * feat(wash-runtime): connect a NATS blobstore binding with its own credentials by @ThomasDravigney in https://github.com/wasmCloud/wasmCloud/pull/5828
  • * feat(wash-runtime): let hosts ignore NATS servers a cluster advertises by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5841
  • * feat(wash-runtime): keep a plugin secret typed until its plugin reads it by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5833

value changes (12)

  • * build(deps): Bump the all-go group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/wasmCloud/wasmCloud/pull/5728
  • * build(deps): Bump the all-docker group across 2 directories with 1 update by @dependabot[bot] in https://github.com/wasmCloud/wasmCloud/pull/5727
  • * fix(deps): take wasi-gfx 0.3.1 from crates.io, drop the git patch by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5754
  • * perf(wash-runtime): hand p3 response bodies to hyper directly by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5737
  • * perf(wash-runtime): size pool counters past the linear memories by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5745
  • * chore(deps): bump pulldown-cmark to 0.13.5 by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5764
  • * chore(deps): bump opentelemetry to 0.32 by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5768
  • * perf: finer grained controls for memory pools and sizing by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5763
  • * fix(deps): upgrade Wasmtime to 48.0.8 by @ricochet in https://github.com/wasmCloud/wasmCloud/pull/5818
  • * perf(wash-runtime): drop component and service linkers once linked by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5800
  • * chore(deps): bump github.com/nats-io/nats.go from 1.54.0 to 1.55.0 in /runtime-operator in the all-go group across 1 directory by @dependabot[bot] in https://github.com/wasmCloud/wasmCloud/pull/5820
  • * perf: enable reducing memory reservation by @vados-cosmonic in https://github.com/wasmCloud/wasmCloud/pull/5801

constraints (1)

  • * fix(runtime-operator): make 7 host status fields optional by @steverogersX in https://github.com/wasmCloud/wasmCloud/pull/5554
wasmCloudをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗wasmCloudのリリース一覧 →