dev

Fix debug assert in `ref.test` of `any.convert_extern`-internalized `…

v48.0.2: Release Wasmtime 48.0.2 (#14310)

48.0.2

Released 2026-09-10.

Changed

• Wasmtime's dependency on cap-primitives is now vendored within Wasmtime
  itself.
  #14225

Fixed

• Code generated by bindgen! is now compatible with the latest Rust nightly by
  default.
  #14307

v36.0.15: Release Wasmtime 36.0.15 (#14309)

36.0.15

Released 2026-09-10

Changed

• Wasmtime's internal implementation of wasmtime-wasi no longer depends on
  cap-std crates for the underlying implementation. Instead the cap-std
  implementation was vendored into wasmtime-wasi. This is intended to have no
  visible side effects or result in any behavior changes.
  #14219

v49.0.0-rc.1: Release Wasmtime 49.0.0-rc.1 (#14283)

49.0.0

Unreleased.

Added

Changed

• Config::operator_cost now applies to operators inside constant expressions
  (global initializers, element and data segment offsets, element segment
  expressions) and to the synthesized call to a module's start function.
  Previously each of those was charged 1 fuel unit regardless of the configured
  cost.
  #14215

v48.0.1: Release Wasmtime 48.0.1 (#14197)

48.0.1

Released 2026-08-24.

Fixed

• Context slots in component compositions are now correctly managed.
  #14139

• The Host header is now set by default for HTTP requests sent with WASIp2.
  #14167

v48.0.0: Release Wasmtime 48.0.0 (#14169)

48.0.0

Released 2026-08-20.

Added

• Wasmtime has an initial implementation of the component model
  fixed-length-lists feature.
  #12315

• Wasmtime's reflection of component imports/exports now exposes external-id
  information.
  #13874

• Cranelift's alias analysis pass now eliminates dead stores.
  #13806
  #13947

• Winch now supports the wasm SIMD proposal on AArch64.
  #13911
  #13921
  #13928
  #13937
  #13945
  #13938
  #13946
  ...

• Cranelift now supports an AVX512-VNNI lowering for the dot-product wasm
  instruction and usdot on AArch64.
  #14006
  #14054

• Wasmtime's bindgen! macro now has an include_component_type option to
  generate a COMPONENT_TYPE constant with the encoded type of the world being
  bound.
  #14013

• Wasmtime now supports configurable fuel costs for variable-length wasm
  opcodes.
  #13931

Changed

• Host-implemented traits in wasmtime-wasi-http are now the same across
  wasip2/wasip3 and no longer require separate implementations/structures.
  #13810
  #13812
  #13835

• Wasmtime will now use the process_madvise syscall on Linux where available
  which can improve the performance of the pooling allocator when the
  deallocation batch size is configured to larger than 1.
  #13830

• Synchronous cancellation of streams/futures/subtasks now traps if the waitable
  was already in a waitable set.
  #13708

• Winch is now flagged to be compatible with component-model-async.
  #13845

• Wasmtime's pooling allocator now uses more sharding to reduce lock contention.
  #13840

• Wasmtime now requires Rust 1.95.0 to build.
  #13853

• Cranelift now has a uniform maximum size across all backends on the bounds of
  a function's stack frame.
  #13783

• Wasmtime's LinkerInstance for components now supports being reopened to
  gradually add more items.
  #13908

• The wasmtime-wasi crate's default configuration now denies creation of
  TCP/UDP sockets by default.
  #13936

• Wasmtime now configures async task context fields on realloc calls to zero.
  #13949

• Work has continued on continuous verification of Cranelift's lowering rules
  on AArch64.
  #13935
  #13929
  #13998

• Codegen for loads on AArch64 has been optimized slightly to improve sharing
  common sub-expressions.
  #13766

• Work continues on implementing the stack-switching proposal.
  #11717
  #13996
  #14052

• Permissions for wasi-filesystem in the implementation of the wasmtime-wasi
  crate have been simplified to either read-write or read-only for a directory.
  #14010

Fixed

• A late-drop of host-defined stream producers/consumers has been fixed.
  #13891

• Call hooks are now invoked around async yields when dealing with concurrent
  execution.
  #13871

• Extreme filesystem timestamps no longer cause panics.
  #13894

• An erroneous trap was fixed where an async-delivered write-closed event was
  sent to a future.
  #13914

• An erroneous trap where Wasmtime internally used the wrong thread id has been
  fixed.
  #13926

• Cross-component instance streams are no longer erroneously flagged as being
  intra-instance.
  #14018

• A panic in the wasmtime CLI with non-utf8 environment variables has been
  fixed.
  #14017

• Atomic waits on big-endian hosts have been fixed.
  #14027

• Enabling MPK with CoW images has been fixed.
  #14076

v47.0.4: Add release notes (#14183)

47.0.4

Released 2026-08-20

Fixed

• Guest controlled-size host heap allocation through WASIp3 streams.
  GHSA-x84v-gj2h-g759

• Filesystem sandbox escape when paths or symlinks contain trailing slashes.
  GHSA-vqjp-4c8c-hfgg

v46.0.3: Release Wasmtime 46.0.3 (#14170)

46.0.3

Released 2026-08-20

Fixed

• Guest controlled-size host heap allocation through WASIp3 streams.
  GHSA-x84v-gj2h-g759

• Filesystem sandbox escape when paths or symlinks contain trailing slashes.
  GHSA-vqjp-4c8c-hfgg

v36.0.14: Release Wasmtime 36.0.14 (#14172)

36.0.14

Released 2026-08-20

Fixed

• Filesystem sandbox escape when paths or symlinks contain trailing slashes.
  GHSA-vqjp-4c8c-hfgg

v24.0.13: Release Wasmtime 24.0.13 (#14173)

24.0.13

Released 2026-08-20

Fixed

• Filesystem sandbox escape when paths or symlinks contain trailing slashes.
  GHSA-vqjp-4c8c-hfgg