v0.8.1

Wassette v0.8.1

This patch release hardens the boundary between component acquisition and host
permissions, makes policy-free execution deny environment access by default,
and updates audited runtime dependencies.

Security and permissions

• OCI artifacts containing publisher-supplied policies are rejected by default.
  After reviewing a policy, a direct operator can activate it explicitly with
  wassette component load <OCI-URI> --trust-bundled-policy; automated and
  agent-facing load paths remain fail closed.
• Components without an attached policy no longer receive configured environment
  values or stored secrets. Deployments that relied on ambient inheritance must
  grant each required environment variable explicitly.
• Rejected OCI policy loads preserve the previously installed component, policy,
  metadata, and precompiled cache.

Maintenance

• Updated Wasmtime, quinn-proto, and rustls to patched releases.
• Updated example policies and workflows to document the explicit permissions
  required by each component.

What's Changed

• Fix CI with the Wasmtime 48.0.3 upgrade by Yosh (@yoshuawuyts) with @Copilot in #836
• Make MCP Inspector tests use the in-memory secret store by Aaron Wislang (@asw101) in #887
• Require explicit approval for OCI-bundled component policies by Aaron Wislang (@asw101) in #888
• Deny component environment access when no policy is attached by Aaron Wislang (@asw101) in #889
• chore(release): bump version to 0.8.1 by Aaron Wislang (@asw101) in #890

Full Changelog: v0.8.0...v0.8.1

Downloads

Linux

• AMD64 (tar.gz)
• ARM64 (tar.gz)

macOS (Darwin)

• AMD64/Intel (tar.gz)
• ARM64/Apple Silicon (tar.gz)

Windows

• AMD64 (zip)
• ARM64 (zip)

Install

All Platforms (Shell Script)

curl -fsSL https://raw.githubusercontent.com/microsoft/wassette/main/scripts/install.sh | WASSETTE_GITHUB_REPO=microsoft/wassette bash

This will detect your platform and install the latest wassette binary to your $PATH.

Usage

# Local MCP client integration (stdio)
wassette run

# Remote MCP server (Streamable HTTP)
wassette serve