v3.42.0

3.42.0 (2026-05-11)

This is another release tackling a number of bugs exposed by either GC settings or automated security scanners. We've also hardened reusable sandboxes so they don't continue if we're not confident in their current state.

Features

• Bail out of reusable sandbox if request fails (#1453) (b6f41b0)

Bug Fixes

• Allocation failure checks (#1457) (c882105)
• Avoid dereferencing one-past-the-end iterator in host_api (#1461) (acf2b25)
• Be more defensive in ip_octets_to_js_string (#1468) (60bbec1)
• Cache body range check (#1463) (f38ce55)
• Cache override getters for beforeSend and afterSend (#1466) (5261936)
• Correct GC guard type in KVStore::put to prevent wasm unreachable crashes and fix some CI issues (#1475) (15f850d)
• Ensure nul-termination of string for inet_pton (#1462) (0e3afbe)
• Find invalid characters after nul bytes in KV store keys (#1464) (5f0f0f2)
• Incorrect catch handler failure check (#1458) (fb3c01a)
• Memory leak in get_found_response (#1456) (17559d3)
• Memory leak on failed inspect hostcall (#1455) (9b77977)
• Protect against GC from validate_bytes (#1447) (be0867b)
• Shrinking realloc in KVStorePendingLookup (#1467) (5a72d13)
• Throw error on negative ttl and swr (#1465) (7d29650)