v4.1.0

Verifying the Release Signature

After downloading the v4.1.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then, from the directory containing the extracted release archive (spin, spin.sig and crt.pem), run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/spinframework/spin/.github/workflows/release.yml@refs/tags/v4.1.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha c0b3726aa4857961e20cf8616a0df5f0741af73d \
    --certificate-github-workflow-repository spinframework/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

• Bump version for next anticipated release by @fibonacci1729 in #3470
• Bump rust version in CI by @fibonacci1729 in #3473
• Update CI rust version (again) by @fibonacci1729 in #3475
• Bump opentelemetry-wasi off missing version by @itowlson in #3474
• spin: update from wasm32-wasip1 to wasm32-wasip2 by @gdamjan in #3471
• chore(rust-sdk-release): bump Spin Rust SDK to v6.0.0 by @spinframeworkbot in #3472
• Update to Wasmtime 44.0.0 by @alexcrichton in #3476
• Update schemars by @itowlson in #3477
• Update to Rust 2024 by @itowlson in #3478
• Fix test for spin up JSON output by @itowlson in #3480
• chore(Cargo.lock): bump openssl to 0.10.78 per cve(s) by @vdice in #3483
• Set blame on span for postgres and mysql by @rylev in #3482
• Add http-rust-p2 compatibility template by @fibonacci1729 in #3486
• Shell completions by @itowlson in #3481
• outbound-networking: Turn use_webpki_roots back on by default by @lann in #3491
• spin-telemetry: use rustls for OTLP HTTP exporter by @TheRayquaza in #3462
• Upgrading templates should remove ones that no longer exist by @itowlson in #3490
• Testing Go P3 CI failure by @itowlson in #3495
• fix(templates): Update build command for Go component by @adamreese in #3497
• fix(outbound-http): ensure tracing span records land on send_request span for P3 by @ChihweiLHBird in #3496
• Fix incorrect URL being shown to user during just-in-time plugin install by @itowlson in #3499
• open issues in js and python sdk repos to tag templates on new releases by @karthik2804 in #3500
• Update address of trigger plugins repo by @fibonacci1729 in #3507
• feat(factor-outbound-http): report http.response.body.size for WASI p3 responses by @ChihweiLHBird in #3506
• Plugin manager refactoring by @itowlson in #3505
• sqlite-inproc: Add allow_attach_file runtime config option by @lann in #3503
• Host target environment TOMLs in git instead of registry by @itowlson in #3508
• spin new -E and spin plugins -E by @itowlson in #3509
• Shell completions for the -E flag by @itowlson in #3513
• Remove target env TOMLs from main Spin repo by @itowlson in #3514
• add a generated comment to spin-dependencies.wit by @karthik2804 in #3515
• outbound-mqtt: Use forked rumqtt by @lann in #3511
• spin add should check existing targets for templates by @itowlson in #3512
• Adopt opentelemetry-semantic-conventions for OTel attribute names by @ChihweiLHBird in #3510
• Bump openssl from 0.10.78 to 0.10.79 by @dependabot[bot] in #3518
• Bump openssl from 0.10.78 to 0.10.80 in /examples/spin-timer by @dependabot[bot] in #3517
• Remove wagi examples by @lann in #3526
• Exit postgres query_async task if rows consumer has been dropped by @rylev in #3525
• Bump openssl from 0.10.79 to 0.10.80 by @dependabot[bot] in #3528
• Bump rand from 0.9.2 to 0.9.4 in /examples/open-ai-rust by @dependabot[bot] in #3527
• Bump rand from 0.9.2 to 0.9.4 in /examples/vault-variable-test by @dependabot[bot] in #3529
• Bump rand from 0.9.0 to 0.9.4 in /examples/spin-timer by @dependabot[bot] in #3519
• Remove obsolete licensing notice by @itowlson in #3532
• spin new -E: update unversioned environments if not recent by @itowlson in #3523
• Asyncify MySQL interface by @dicej in #3534
• fix: support falling back to webpki roots in default TLS config by @kate-goldenring in #3536
• Target envs: pull WITs direct from OCI by @itowlson in #3535
• When making an outbound connection include getting permit in connect timeout by @rylev in #3538
• Drop BetweenBytesTimeoutBody inner body eagerly when timeout happens by @rylev in #3540
• outbound-mqtt: add runtime config for mqtt max payload size by @kate-goldenring in #3543
• Bump tar from 0.4.43 to 0.4.46 by @dependabot[bot] in #3548
• Bump rand from 0.9.1 to 0.9.3 by @dependabot[bot] in #3553
• Skip allowed outbound host entries that are empty due to empty variable resolution by @itowlson in #3551
• Improve target error message by @fibonacci1729 in #3555
• ref(crates/oci): replace dkregistry with docker-registry by @vdice in #3560
• Connection limits by @rylev in #3552
• Make the right features line up by @rylev in #3564
• spin new -E should not fail just because template update fails by @itowlson in #3565
• Bring back Python smoke test by @itowlson in #3573
• Set spin new target environment via environment variable by @itowlson in #3572
• Miscellaneous integration test fixes by @ChihweiLHBird in #3571
• Update OpenTelemetry dependencies and use experimental semantic convention constants by @ChihweiLHBird in #3567
• Add AGENTS.md by @ChihweiLHBird in #3569
• Fix HTTP test port race and self-request origin by @ChihweiLHBird in #3570
• Add metrics to connection semaphore by @rylev in #3580
• Update CI to Rust 1.94 by @itowlson in #3578
• chore(MAINTAINERS.md): update vdice as emeritus by @vdice in #3581
• Every month, update Wasmtime to latest pre-release by @itowlson in #3577
• First crack at fixing the "bump Wasmtime" workflow by @itowlson in #3582
• chore(.github): rename spinframeworkbot PR PAT by @vdice in #3584
• Set package.license.workspace on all crates by @lann in #3585
• chore(deps): bump/use upstream rust-oci-client by @vdice in #3574
• Fix IPv6 allowed outbound host parsing by @ChihweiLHBird in #3579
• Use P3-friendly wac in spin-environments by @itowlson in #3587
• Use latest wkg to publish WITs by @itowlson in #3593
• HTTP middleware using WASIp3 by @itowlson in #3384
• Set rustls crypto provider explicitly by @ChihweiLHBird in #3590
• Explicitly declare directly used dependency features by @ChihweiLHBird in #3594
• Miscellaneous Cleanups by @ChihweiLHBird in #3597
• telemetry: Reduce cardinality of some otel span names by @lann in #3558
• Update to Wasmtime 46 and WASI 0.3.0, retaining support for 0.3.0-rc-2026-03-15 by @dicej in #3595
• Add async MySQL to deny adapter by @itowlson in #3601
• Re-enable the review-dependencies action with the problem GHSA excluded by @itowlson in #3604
• add Alex Crichton as a maintiner by @dicej in #3600
• Fix wasmtime bump regexes by @itowlson in #3606
• Add a hard request deadline config for embedded HTTP servers by @carsonfarmer in #3610
• P3 service chaining by @lann in #3591
• spin build -c should validate env only for selected components by @itowlson in #3614
• Miscellaneous improvements and cleanup (batch 2) by @ChihweiLHBird in #3612
• Migrate lazy_static to LazyLock in Rust stdlib by @ChihweiLHBird in #3616
• core: Add Engine::check_component method by @lann in #3615
• OCD tidying by @fibonacci1729 in #3620
• WASI P3 - non-core migration bits by @itowlson in #3603
• Fix bump-wasmtime workflow not bumping the timer example by @itowlson in #3622
• Run bump-wasmtime workflow 12 hours after Wasmtime branch schedule by @fibonacci1729 in #3625
• Bump Wasmtime to v47.0.0 by @spinframeworkbot in #3605
• Limit the blast radius when updating Wasmtime by @itowlson in #3628
• spin targets command to list/update envs by @itowlson in #3630
• Workflow to finalize Wasmtime upgrade by @fibonacci1729 in #3627
• Update Rust version for newer wasmtime by @ChihweiLHBird in #3631
• Fix duration parsing order in ParsedDuration implementation by @ChihweiLHBird in #3636
• Update actions that are giving Node 20 warnings by @itowlson in #3638
• remove single trigger compatibility validation by @michelleN in #3629
• remove obsolete experimental CLI options by @dicej in #3643
• Bump bytes from 1.5.0 to 1.12.1 in /examples/vault-variable-test by @dependabot[bot] in #3640
• Bump aws-sdk-dynamodb from 1.96.0 to 1.98.0 by @dependabot[bot] in #3641
• feat(kv): support configuring concurrent operation limits by @kate-goldenring in #3644
• Bump time from 0.3.45 to 0.3.54 by @dependabot[bot] in #3642
• Emit otel metrics directly instead of through tracing by @rylev in #3623
• Utilize itertools to simplify implementations when possible by @ChihweiLHBird in #3646
• WAGI future deprecation alert by @itowlson in #3652
• Middleware example by @itowlson in #3645
• Middleware host requirement by @itowlson in #3649
• Do not pass Connection header to guest by @itowlson in #3651
• SIP-024: spin deps cli dx by @fibonacci1729 in #3453
• fix link in SIP by @michelleN in #3657
• Add SIP for target world validation by @tschneidereit in #3217
• Renumber SIP by @fibonacci1729 in #3661
• Revise Spin Project Meeting details in README by @michelleN in #3667
• Enforce kebab IDs in spin new and spin add by @itowlson in #3666
• Add a link from old docs' README to the new docs repo by @ChihweiLHBird in #3665
• Accept boolish values for env-settable bool flags by @ChihweiLHBird in #3668
• update project roles in project Governance by @michelleN in #3658
• Update CoC by @michelleN in #3675
• Use async (tokio) tar crate for OCI by @itowlson in #3655
• Bump Wasmtime to v48.0.0 by @spinframeworkbot in #3653
• Allow embedders flexibility in how they register their metrics by @rylev in #3663
• Allow an environment to constrain component permissions by @itowlson in #3679
• Allow false in compose CLI argument by @ChihweiLHBird in #3670
• Middleware: forbidden headers are no longer forbidden by @itowlson in #3684
• Fix sync Postgres deadlocking on empty result set by @itowlson in #3673
• [Backport v4.1] Push trigger dependencies when composition is disabled by @fibonacci1729 in #3687
• Bump for v4.1 release by @fibonacci1729 in #3685

New Contributors

• @TheRayquaza made their first contribution in #3462
• @carsonfarmer made their first contribution in #3610

Full Changelog: v4.0.0...v4.1.0

What's Changed

• Bump version for next anticipated release by @fibonacci1729 in #3470
• Bump rust version in CI by @fibonacci1729 in #3473
• Update CI rust version (again) by @fibonacci1729 in #3475
• Bump opentelemetry-wasi off missing version by @itowlson in #3474
• spin: update from wasm32-wasip1 to wasm32-wasip2 by @gdamjan in #3471
• chore(rust-sdk-release): bump Spin Rust SDK to v6.0.0 by @spinframeworkbot in #3472
• Update to Wasmtime 44.0.0 by @alexcrichton in #3476
• Update schemars by @itowlson in #3477
• Update to Rust 2024 by @itowlson in #3478
• Fix test for spin up JSON output by @itowlson in #3480
• chore(Cargo.lock): bump openssl to 0.10.78 per cve(s) by @vdice in #3483
• Set blame on span for postgres and mysql by @rylev in #3482
• Add http-rust-p2 compatibility template by @fibonacci1729 in #3486
• Shell completions by @itowlson in #3481
• outbound-networking: Turn use_webpki_roots back on by default by @lann in #3491
• spin-telemetry: use rustls for OTLP HTTP exporter by @TheRayquaza in #3462
• Upgrading templates should remove ones that no longer exist by @itowlson in #3490
• Testing Go P3 CI failure by @itowlson in #3495
• fix(templates): Update build command for Go component by @adamreese in #3497
• fix(outbound-http): ensure tracing span records land on send_request span for P3 by @ChihweiLHBird in #3496
• Fix incorrect URL being shown to user during just-in-time plugin install by @itowlson in #3499
• open issues in js and python sdk repos to tag templates on new releases by @karthik2804 in #3500
• Update address of trigger plugins repo by @fibonacci1729 in #3507
• feat(factor-outbound-http): report http.response.body.size for WASI p3 responses by @ChihweiLHBird in #3506
• Plugin manager refactoring by @itowlson in #3505
• sqlite-inproc: Add allow_attach_file runtime config option by @lann in #3503
• Host target environment TOMLs in git instead of registry by @itowlson in #3508
• spin new -E and spin plugins -E by @itowlson in #3509
• Shell completions for the -E flag by @itowlson in #3513
• Remove target env TOMLs from main Spin repo by @itowlson in #3514
• add a generated comment to spin-dependencies.wit by @karthik2804 in #3515
• outbound-mqtt: Use forked rumqtt by @lann in #3511
• spin add should check existing targets for templates by @itowlson in #3512
• Adopt opentelemetry-semantic-conventions for OTel attribute names by @ChihweiLHBird in #3510
• Bump openssl from 0.10.78 to 0.10.79 by @dependabot[bot] in #3518
• Bump openssl from 0.10.78 to 0.10.80 in /examples/spin-timer by @dependabot[bot] in #3517
• Remove wagi examples by @lann in #3526
• Exit postgres query_async task if rows consumer has been dropped by @rylev in #3525
• Bump openssl from 0.10.79 to 0.10.80 by @dependabot[bot] in #3528
• Bump rand from 0.9.2 to 0.9.4 in /examples/open-ai-rust by @dependabot[bot] in #3527
• Bump rand from 0.9.2 to 0.9.4 in /examples/vault-variable-test by @dependabot[bot] in #3529
• Bump rand from 0.9.0 to 0.9.4 in /examples/spin-timer by @dependabot[bot] in #3519
• Remove obsolete licensing notice by @itowlson in #3532
• spin new -E: update unversioned environments if not recent by @itowlson in #3523
• Asyncify MySQL interface by @dicej in #3534
• fix: support falling back to webpki roots in default TLS config by @kate-goldenring in #3536
• Target envs: pull WITs direct from OCI by @itowlson in #3535
• When making an outbound connection include getting permit in connect timeout by @rylev in #3538
• Drop BetweenBytesTimeoutBody inner body eagerly when timeout happens by @rylev in #3540
• outbound-mqtt: add runtime config for mqtt max payload size by @kate-goldenring in #3543
• Bump tar from 0.4.43 to 0.4.46 by @dependabot[bot] in #3548
• Bump rand from 0.9.1 to 0.9.3 by @dependabot[bot] in #3553
• Skip allowed outbound host entries that are empty due to empty variable resolution by @itowlson in #3551
• Improve target error message by @fibonacci1729 in #3555
• ref(crates/oci): replace dkregistry with docker-registry by @vdice in #3560
• Connection limits by @rylev in #3552
• Make the right features line up by @rylev in #3564
• spin new -E should not fail just because template update fails by @itowlson in #3565
• Bring back Python smoke test by @itowlson in #3573
• Set spin new target environment via environment variable by @itowlson in #3572
• Miscellaneous integration test fixes by @ChihweiLHBird in #3571
• Update OpenTelemetry dependencies and use experimental semantic convention constants by @ChihweiLHBird in #3567
• Add AGENTS.md by @ChihweiLHBird in #3569
• Fix HTTP test port race and self-request origin by @ChihweiLHBird in #3570
• Add metrics to connection semaphore by @rylev in #3580
• Update CI to Rust 1.94 by @itowlson in #3578
• chore(MAINTAINERS.md): update vdice as emeritus by @vdice in #3581
• Every month, update Wasmtime to latest pre-release by @itowlson in #3577
• First crack at fixing the "bump Wasmtime" workflow by @itowlson in #3582
• chore(.github): rename spinframeworkbot PR PAT by @vdice in #3584
• Set package.license.workspace on all crates by @lann in #3585
• chore(deps): bump/use upstream rust-oci-client by @vdice in #3574
• Fix IPv6 allowed outbound host parsing by @ChihweiLHBird in #3579
• Use P3-friendly wac in spin-environments by @itowlson in #3587
• Use latest wkg to publish WITs by @itowlson in #3593
• HTTP middleware using WASIp3 by @itowlson in #3384
• Set rustls crypto provider explicitly by @ChihweiLHBird in #3590
• Explicitly declare directly used dependency features by @ChihweiLHBird in #3594
• Miscellaneous Cleanups by @ChihweiLHBird in #3597
• telemetry: Reduce cardinality of some otel span names by @lann in #3558
• Update to Wasmtime 46 and WASI 0.3.0, retaining support for 0.3.0-rc-2026-03-15 by @dicej in #3595
• Add async MySQL to deny adapter by @itowlson in #3601
• Re-enable the review-dependencies action with the problem GHSA excluded by @itowlson in #3604
• add Alex Crichton as a maintiner by @dicej in #3600
• Fix wasmtime bump regexes by @itowlson in #3606
• Add a hard request deadline config for embedded HTTP servers by @carsonfarmer in #3610
• P3 service chaining by @lann in #3591
• spin build -c should validate env only for selected components by @itowlson in #3614
• Miscellaneous improvements and cleanup (batch 2) by @ChihweiLHBird in #3612
• Migrate lazy_static to LazyLock in Rust stdlib by @ChihweiLHBird in #3616
• core: Add Engine::check_component method by @lann in #3615
• OCD tidying by @fibonacci1729 in #3620
• WASI P3 - non-core migration bits by @itowlson in #3603
• Fix bump-wasmtime workflow not bumping the timer example by @itowlson in #3622
• Run bump-wasmtime workflow 12 hours after Wasmtime branch schedule by @fibonacci1729 in #3625
• Bump Wasmtime to v47.0.0 by @spinframeworkbot in #3605
• Limit the blast radius when updating Wasmtime by @itowlson in #3628
• spin targets command to list/update envs by @itowlson in #3630
• Workflow to finalize Wasmtime upgrade by @fibonacci1729 in #3627
• Update Rust version for newer wasmtime by @ChihweiLHBird in #3631
• Fix duration parsing order in ParsedDuration implementation by @ChihweiLHBird in #3636
• Update actions that are giving Node 20 warnings by @itowlson in #3638
• remove single trigger compatibility validation by @michelleN in #3629
• remove obsolete experimental CLI options by @dicej in #3643
• Bump bytes from 1.5.0 to 1.12.1 in /examples/vault-variable-test by @dependabot[bot] in #3640
• Bump aws-sdk-dynamodb from 1.96.0 to 1.98.0 by @dependabot[bot] in #3641
• feat(kv): support configuring concurrent operation limits by @kate-goldenring in #3644
• Bump time from 0.3.45 to 0.3.54 by @dependabot[bot] in #3642
• Emit otel metrics directly instead of through tracing by @rylev in #3623
• Utilize itertools to simplify implementations when possible by @ChihweiLHBird in #3646
• WAGI future deprecation alert by @itowlson in #3652
• Middleware example by @itowlson in #3645
• Middleware host requirement by @itowlson in #3649
• Do not pass Connection header to guest by @itowlson in #3651
• SIP-024: spin deps cli dx by @fibonacci1729 in #3453
• fix link in SIP by @michelleN in #3657
• Add SIP for target world validation by @tschneidereit in #3217
• Renumber SIP by @fibonacci1729 in #3661
• Revise Spin Project Meeting details in README by @michelleN in #3667
• Enforce kebab IDs in spin new and spin add by @itowlson in #3666
• Add a link from old docs' README to the new docs repo by @ChihweiLHBird in #3665
• Accept boolish values for env-settable bool flags by @ChihweiLHBird in #3668
• update project roles in project Governance by @michelleN in #3658
• Update CoC by @michelleN in #3675
• Use async (tokio) tar crate for OCI by @itowlson in #3655
• Bump Wasmtime to v48.0.0 by @spinframeworkbot in #3653
• Allow embedders flexibility in how they register their metrics by @rylev in #3663
• Allow an environment to constrain component permissions by @itowlson in #3679
• Allow false in compose CLI argument by @ChihweiLHBird in #3670
• Middleware: forbidden headers are no longer forbidden by @itowlson in #3684
• Fix sync Postgres deadlocking on empty result set by @itowlson in #3673
• [Backport v4.1] Push trigger dependencies when composition is disabled by @fibonacci1729 in #3687
• Bump for v4.1 release by @fibonacci1729 in #3685

New Contributors

• @TheRayquaza made their first contribution in #3462
• @carsonfarmer made their first contribution in #3610

Full Changelog: v4.0.2...v4.1.0