ClojureWasm is no longer maintained — v1.10.1 is the final release

[chaploud]

ClojureWasm is no longer maintained. A from-scratch Clojure runtime turned out to be more than one person can sustain, so I am stopping here while it still works, rather than letting it erode.

v1.10.1 is the final release.

The substance is in v1.10.0 just before it: everything there is a fix, and three of the four came from @BuddhiLW, who reported them with diagnoses and working branches over two days. Each one's class was then swept, which is where the rest came from — a set literal of 9+ elements crashing macroexpansion turned into four fixes and a gate, and one entry point ignoring the classpath turned into a differential oracle across all six of them. v1.10.1 changes no runtime behaviour; it exists so the final tag does not document a world that has already moved on (see below).

What stays true

• The code stays up under EPL-2.0. Fork it, rename it, build on it — no permission needed from me, and no credit expected.
• The released binaries stay on the releases page, and brew install clojurewasm/tap/cljw keeps working.
• Discussions remain open. I may not answer.

What is going away

• The two hosted demos are being shut down and their repositories archived: the Playground (cw-playground) and the Bookshelf (cw-serverless-demo). Their source stays public and still builds — each builds cljw from source in its Dockerfile, so they remain a working end-to-end deployment recipe — but the URLs will stop answering.
• There will be no security fixes, including for critical vulnerabilities. SECURITY.md now says so plainly rather than listing supported versions it cannot support. If you have cljw anywhere it meets untrusted input, treat migrating off it as the fix.

What is not affected

zwasm, the WebAssembly engine ClojureWasm embeds, has moved to its own organisation and continues under separate maintainership. It is a standalone runtime, useful well beyond this project, and a vulnerability or bug there is still worth reporting — that project can act on it.

I believe ClojureWasm demonstrated what a from-scratch Clojure can be: a single small static binary, with a WebAssembly FFI. The hardest parts — and why this needs more than a solo maintainer — were keeping up JVM-Clojure compatibility (Java interop above all) and performance.

Thanks to everyone who used it, reported differences, and contributed fixes.

[BuddhiLW]

Thank you very much to create this project. I will be trying to maintain it on my fork.

But, I'm not sure if adoption will continue as great. And that speaks to the caliber of the creator!

Regards,
Pedro

[chaploud]

Update — the final release is now v1.10.1, not v1.10.0. I have edited the post above rather than leaving a stale headline.

No runtime behaviour changed — cljw is the same program. It exists because two things around the project moved within days of v1.10.0, and a final tag that documents a world which no longer exists is worse than one more patch:

• zwasm moved out of this organisation to github.com/zwasm/zwasm, where it continues under separate maintainership. The dependency now names that location directly instead of relying on GitHub's transfer redirect — a redirect is only an alias until something else claims the vacated name, which is a shape worth not depending on. Same tag, same commit, same content hash.
• The two hosted demos are being retired, so the README no longer points at URLs that will stop answering.

Two things also got fixed on the way in, both found by making the test suite report failures instead of dying on them: every nREPL end-to-end test had been leaking a server process (( cd DIR && cmd ) & makes $! the subshell, so kill $! orphans the runtime), and the accumulated memory was enough for macOS to kill an unrelated freshly-built binary — a leak that presented as a crash. Details in the changelog.