Barbacane v0.12.3

Wasmtime moves to 48.0.5 for five advisories. Two reach the gateway: a plugin could run past its fuel budget, or corrupt the GC heap using GC references and exceptions. A response to a request carrying Authorization is no longer cached unless the upstream allows a shared cache to reuse it, and responses rate-limit lets through now carry the documented X-RateLimit-* headers. A plugin configuration with an unknown key inside a nested object, such as request-transformer's headers, now fails compilation with E1023 instead of being ignored, so a spec that compiled under 0.12.2 can be refused: compile yours before upgrading a running gateway. The MSRV is 1.95. No artifact change: 0.12.x artifacts load as they are.

Security

• wasm runtime: Wasmtime is upgraded from 47.0.4 to 48.0.5 for RUSTSEC-2026-0315 (GHSA-m63x-6p34-q65x). With fuel metering and Cranelift, both of which the gateway uses, a plugin containing call_ref or try_table could drop the fuel its callees consumed and run for exponential time on linear fuel. RUSTSEC-2026-0316, in the component-model Val API, is fixed by the same release; the gateway loads core modules and does not use that API.
• wasm runtime: the same upgrade fixes RUSTSEC-2026-0326 (GHSA-hw8m-q44c-ggrf). A GC reference live across a try_call could be left unrooted, so a plugin using GC references and exceptions, both enabled by default since Wasmtime 47, could corrupt the GC heap and execute incorrectly. RUSTSEC-2026-0325 and RUSTSEC-2026-0327, fixed by the same release, are in component validation and the component-model async ABI; the gateway loads core modules.

Added

• request-transformer: skip_if_empty: true skips an add or set (headers, query parameters, body) whose value references a variable that resolves to an empty string, absent values included. Authorization: "Bearer $cookie.sso_token" under set then sends no header for a request without the cookie, instead of Bearer . Values without variables are always written, and the option is off by default.

Changed

• plugin config: the nested objects of request-transformer (headers, querystring, path, path.replace, body), response-transformer (headers, body) and the kafka and nats ack_response reject unknown keys, so a key in the wrong place (such as skip_if_empty under headers) fails compilation with E1023 instead of being ignored. A test requires every object schema in a plugin's config-schema.json to state additionalProperties; jwt-auth's public_key_jwk stays open, as a JWK may carry other members.
• MSRV: the minimum supported Rust version is 1.95, required by Wasmtime 48. The Docker images build with rust:1.95.

Fixed

• wasm runtime: initialising a plugin gives the config write a fresh fuel and time budget. The plugin's alloc ran on what instantiation had left, so a slow instantiation (a loaded host, an instrumented build) could fail it and the route answered 500. A failing alloc now names its cause (out of fuel, timeout, or the trap) instead of only alloc failed.
• docs: the transformation guide gives the order request-transformer applies header operations in (remove, rename, set, add; query and body: remove, rename, add). It listed add first.
• cache: a response to a request carrying Authorization is no longer stored unless it allows a shared cache to reuse it (public, s-maxage or must-revalidate, per RFC 9111 §3.5), or the middleware varies on authorization. An upstream returning a user-specific response without Cache-Control could have it served to other users. Cache-Control directives are now matched by name, so an extension such as x-private-hint no longer prevents caching. The caching guide now describes what the middleware does: max-age and no-cache are not interpreted, and the query string is part of the key.
• rate-limit: allowed responses carry the X-RateLimit-Policy, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers, as documented. They were set only on the request forwarded to the upstream, so clients never received them. With stacked instances, the response reports the policy with the fewest requests remaining, and a 429 from one of them carries only the rejecting policy's RateLimit headers. The plugin now declares the context_set capability.
• oidc-auth: an empty issuer_override means unset, so the issuer from the discovery document is expected. It was taken as the expected issuer itself, so every token was refused with invalid_token. An env:// reference to a variable set but empty resolves to exactly that.
• vacuum ruleset: barbacane-auth-opt-out-explicit is removed. It reported every operation that set its own x-barbacane-middlewares without an auth plugin as dropping auth, but operation middlewares are merged with the global ones, so those operations keep the global auth; only x-barbacane-middlewares: [] removes it. barbacane-auth-opt-out.js is still published and reports nothing, so download scripts that list it keep working. The vacuum guide's download loops now list the functions the ruleset uses; the CI example named barbacane-no-duplicate-middlewares, which does not exist.