v2.5.0

Spin v2.5

The v2.5 release of Spin brings a number of features, improvements and bug fixes.

Some highlights in v2.5.0 at a glance:

• Support for application-internal private endpoints, which allows you to avoid exposing internal components on public routes while still splitting them out to their own microservices. #2418
• Spin now allows you to specify routes with more granularity #2464
• Improved support for OpenTelemetry #2463
• Azure Key Vault Application Variable Provider #2472

As always, thanks to contributors old and new for helping improve Spin on a daily basis! 🎉

Verifying the Release Signature

After downloading the 2.5.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.5.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

• chore(release): update versions for v2.5.0-pre0 by @kate-goldenring in #2400
• ci: Run macos builds on M1 by @lann in #2404
• Improved rumqttc event loop check. by @suneetnangia in #2362
• Add recent SIPs to the index document by @tschneidereit in #2403
• chore(trigger-http): bump tls-listener by @vdice in #2409
• feat(oci): deduplicate layers prior to push; archive if needed by @vdice in #2395
• feat(oci): set token expiration for oci client by @vdice in #2417
• feat: add support for setting the pushed oci image manifest annotations by @rgl in #2254
• feat(*): Add tracing to some more host components by @calebschoepp in #2398
• use template from v2.0 branch of spin-python-sdk in test by @dicej in #2421
• Fix outbound-mqtt bug with QoS 2 by @fibonacci1729 in #2420
• Rationalise plugin install prompts by @itowlson in #2412
• Warn when sending bare 404 response by @itowlson in #2410
• Private endpoints by @itowlson in #2418
• Accept runtime config in either JSON or TOML by @lann in #2427
• build(deps): bump h2 from 0.3.24 to 0.3.26 by @dependabot in #2430
• ci(dispatch.yml): dispatch to fermyon/homebrew-tap by @vdice in #2428
• ci(release): fix dispatch conditional by @vdice in #2434
• chore(spin-timer): bump whoami per GHSA-w5w5-8vfh-xcjq by @vdice in #2431
• chore(*): bump h2 per GHSA-q6cp-qfwq-4gcv by @vdice in #2432
• ci(build/release): restore mac amd64 builds by @vdice in #2435
• Trace some more host components by @calebschoepp in #2437
• Trace db host components by @calebschoepp in #2439
• style(linting): Fix some linting rules by @calebschoepp in #2442
• Update Rust templates and bump Spin SDK version from 2.2.0 to 3.0.1 by @ThorstenHans in #2445
• Option to suppress plugin on-run compatibility warnings by @itowlson in #2426
• Review new dependencies for known vulnerabilities by @itowlson in #2440
• Add that Python SDK does support Redis Trigger by @tpmccallum in #2429
• ci(build.yml): gate dependency review on PRs only by @vdice in #2450
• ref(*): Refactor host components to avoid returning Result<Result> if they don't trap by @calebschoepp in #2433
• Don't print plugin prerelease warning in middle of help by @itowlson in #2452
• Trigger tracing by @calebschoepp in #2441
• Allow template to have tmpl extension by @rylev in #2456
• Summarise runtime config by @itowlson in #2453
• Bikeshed private endpoint UI by @itowlson in #2451
• Add Redis components to existing app by @itowlson in #2446
• ref(outbound-http): Add a small hack to improve the tracing of outbound http requests through spin core by @calebschoepp in #2459
• Check for illegal file name when copying single file by @itowlson in #2460
• feat(telemetry): Make telemetry support http/protobuf protocol in addition to grpc protocol by @calebschoepp in #2463
• Refactor expressions Resolver to provide sync API by @rylev in #2458
• fixed logic in spin doctor to display 'No problems found' properly by @garikAsplund in #2466
• Setup a docker compose file that creates an o11y stack for Spin to use by @calebschoepp in #2465
• chore(crates): address lint errs when rust is at 1.77+ by @vdice in #2474
• added local_addr() to listeners to display random port numbers by @garikAsplund in #2473
• Don't attempt to cancel workflow if lints fail by @itowlson in #2476
• Taking a first crack at implementing metrics by @calebschoepp in #2475
• Add SIP for configuring and emitting observability by @calebschoepp in #2303
• Granular route matching by @itowlson in #2464
• Fix watch not picking up manifest changes by @itowlson in #2481
• feat: Add Azure Key Vault Variable Provider by @ThorstenHans in #2472
• core: Add note to find_host_component_handle docs by @lann in #2484
• telemetry: Nicen layer return types by @lann in #2488
• Fix incorrect base passed in service chaining by @itowlson in #2489
• Fix 1.78 lints by @itowlson in #2491
• Update version for v2.5.0 release by @kate-goldenring in #2497

New Contributors

• @rgl made their first contribution in #2254
• @garikAsplund made their first contribution in #2466

Full Changelog: v2.4.3...v2.5.0