dev

Fix link text (#12072)

v39.0.0: Release Wasmtime 39.0.0 (#12050)

39.0.0

Released 2025-11-20.

Added

• Initial work has begun to support WebAssembly-level debugging natively in
  Wasmtime. This is intended to complement today's preexisting DWARF-level
  debugging, but this work will be portable and operate at the WebAssembly level
  of abstraction rather than the machine-level. Note that this work is not yet
  complete at this time but is expected to get filled out over the coming
  releases.
  #11768
  #11769
  #11873
  #11892
  #11895

• The pooling allocator now exposes more metrics about unused slots.
  #11789

• The Wizer and component-init projects have been merged into Wasmtime under
  a new wasmtime wizer CLI subcommand and wasmtime-wizer crate. This is
  mostly a drop-in replacement for both with a minor caveat that the
  initialization function is now called wizer-initialize instead of
  wizer.initialize to be compatible with components.
  #11805
  #11851
  #11853
  #11855
  #11857
  #11863
  #11866
  #11867
  #11877
  #11876
  #11878
  #11891
  #11897
  #11898

• The Config::wasm_feature method is now public.
  #11812

• Enabling the wasm exceptions proposal is now exposed in the C API.
  #11861

• The wasmtime crate now has a custom-sync-primitives Cargo feature which
  enables using custom synchronization primitives defined by the embedder. This
  is useful in no_std targets where the default panic-on-contention primitives
  are not appropriate.
  #11836

• Wasmtime now supports unsafe intrinsics to be used for compile-time builtins.
  This can be used to provide give low-level access to host APIs/memory to a
  guest program in a controlled fashion.
  #11825
  #11918

• The signals_based_traps configuration option is now exposed in the C API.
  #11879

• A new EqRef::from_i31 function has been added.
  #11884

• The wasmtime serve subcommand will, by default, now reuse instances when
  used with WASIp3 components. This increases throughput and additionally
  showcases the concurrent features of WASIp3. This can be opted-out-of on the
  CLI as well.
  #11807

• The C++ API for components has been filled out and implemented.
  #11880
  #11889
  #11988

• A new ResourceDynamic type, similar to Resource<T>, has been added to
  support host resources that have a dynamic tag at runtime rather than a
  statically known tag at compile time. This is then used to implement resources
  in the C/C++ API as well.
  #11885
  #11920

• The C/C++ API of Wasmtime now supports the custom-page-sizes wasm proposal.
  #11890

• Initial support has been added for the cooperative multithreading component
  model proposal in Wasmtime, built on async primitives.
  #11751

• The epoch_deadline_callback Rust API has been bound in C++.
  #11945

• A new Request::into_http helper has been added to the WASIp3 implementation
  of wasi:http.
  #11843

• A define_unknown_imports_as_traps function has been added to the C API.
  #11962

• A callback-based implementation of stdout and stderr has been added to the
  C API for WASI configuration.
  #11965

Changed

• Running async functions in the component model now operates at the
  Store-level of abstraction rather than an Instance.
  #11796

• The wasmtime serve subcommand no longer mistakenly spawns an epoch thread
  per-request and instead uses a single epoch thread.
  #11817

• The component-model-async Cargo feature is now on-by-default. Note that it
  is still gated at runtime by default. Also note that Wasmtime 39 does not include
  #12031 which means
  that components using async produced with the latest wasm-tools will not run
  in Wasmtime 39. To run async components it's recommended to pin to a
  historical version of wasm-tools and guest toolchains for now.
  #11822

• Bindings generated by wiggle no longer use async_trait.
  #11839

• Wasmtime's documentation now has an example of a plugin system using Wasmtime.
  #11848

• Profiling with perfmap or jitdump now uses O_APPEND to be more amenable to
  other engines in the same process also using perfmap/jitdump.
  #11865

• The wasmtime-wasi-http crate now uses UnsyncBoxBody to clarify that Sync
  is not required.
  #11941

• A . character is now used instead of / int he bindgen! macro to separate
  interface members.
  #11947

• The func_new function for component linkers now provides the type to the
  callee so it knows the type that the component that imported it is using.
  #11944

• The component::Func type now has a type accessor and the old params/result
  accessors were deleted.
  #11943

• Wasmtime now requires Rust 1.89.0 or later to compile.
  #11959

Fixed

• Some panics handling shapes of components with resources in various locations
  has been fixed.
  #11798

• Bitwise float operations in Cranelift have been fixed on aarch64.
  #11811

• An off-by-one in the bounds check of wasm atomic operations has been fixed.
  #11977

• Bounds-check elision now happens again with 4 GiB guard pages.
  #11973

v38.0.4: Release Wasmtime 38.0.4 (#12024)

38.0.4

Released 2025-11-11.

Fixed

• Prevent using shared memories with Memory.
  CVE-2025-64345

v37.0.3: Release Wasmtime 37.0.3 (#12025)

37.0.3

Released 2025-11-11.

Fixed

• Prevent using shared memories with Memory.
  CVE-2025-64345

v36.0.3: Release Wasmtime 36.0.3 (#12023)

36.0.3

Released 2025-11-11.

Fixed

• Prevent using shared memories with Memory.
  CVE-2025-64345

v24.0.5: Release Wasmtime 24.0.5 (#12026)

24.0.5

Released 2025-11-11.

Fixed

• Prevent using shared memories with Memory.
  CVE-2025-64345

v38.0.3: Release Wasmtime 38.0.3 (#11934)

38.0.3

Released 2025-10-24.

Fixed

• Fix possible host crash with host-to-wasm component intrinsics
  CVE-2025-62711

v38.0.2: Release Wasmtime 38.0.2 (#11903)

38.0.2

Released 2025-10-21.

Changed

• This repository is attempting to start out using GitHub's "Immutable Releases"
  feature with this release, and this'll be the first release, assuming all goes
  well, that has this enabled.
  #11901

Fixed

• Fix compatibility with the Go runtime on Windows for exceptions.
  #11892

v38.0.1: Release Wasmtime 38.0.1 (#11888)

38.0.1

Released 2025-10-20.

Fixed

• Fixed some automation that went wrong with the 38.0.0 release.

v37.0.2: Release Wasmtime 37.0.2 (#11767)

37.0.2

Released 2025-10-07.

Fixed

• Fix a memory leak in the C API when using anyref or externref.
  CVE-2025-61670.