Wasmtime: baixar versions anteriors

## 50.0.0

Released 2026-10-20.

### Added

• Wasmtime now supports the WebAssembly compact imports proposal, disabled by
default, via `Config::wasm_compact_imports`.
[#14335](https://github.com/bytecodealliance/wasmtime/pull/14335)

• The Wasmtime CLI now has options to configure unsafe intrinsics and
compile-time builtins.
[#14279](https://github.com/bytecodealliance/wasmtime/pull/14279)

• The Wasmtime CLI and C API can now enable the component model's canonical
names and accessors features.
[#14344](https://github.com/bytecodealliance/wasmtime/pull/14344)
[#14497](https://github.com/bytecodealliance/wasmtime/pull/14497)

• A new `Store::gc_heap_grow` method can be used to manually grow the GC heap
of a store.
[#14341](https://github.com/bytecodealliance/wasmtime/pull/14341)

• A new `ResourceAny::resource_drop_concurrent` method can be used to drop a
guest resource with only an `Accessor`.
[#14362](https://github.com/bytecodealliance/wasmtime/pull/14362)

• A new `Engine::release_idle_pool_memory` method can be used to release memory
kept resident by the pooling allocator for idle slots.
[#14419](https://github.com/bytecodealliance/wasmtime/pull/14419)
[#14507](https://github.com/bytecodealliance/wasmtime/pull/14507)

• A new off-by-default `task-group-hook` feature enables embedders to associate
guest-to-host calls with their corresponding host-to-guest calls when using
component-model-async.
[#14416](https://github.com/bytecodealliance/wasmtime/pull/14416)

• The `wasmtime-wasi` and `wasmtime-wasi-http` crates now support "named
imports", the `implements` field of the component model.
[#14275](https://github.com/bytecodealliance/wasmtime/pull/14275)

• The `wasmtime explore` command now supports components and has resizable
panes.
[#14426](https://github.com/bytecodealliance/wasmtime/pull/14426)
[#14427](https://github.com/bytecodealliance/wasmtime/pull/14427)
[#14458](https://github.com/bytecodealliance/wasmtime/pull/14458)

• The debugger now exposes shared memories to gdbstub.
[#14087](https://github.com/bytecodealliance/wasmtime/pull/14087)

• Winch now supports tail calls on x86_64 and AArch64.
[#14349](https://github.com/bytecodealliance/wasmtime/pull/14349)

• Cranelift has initial support for some x86_64 APX instructions.
[#13916](https://github.com/bytecodealliance/wasmtime/pull/13916)

• The `wasmtime serve` command can now inherit listening sockets from a service
manager (e.g. systemd socket units) with a new `--systemd-listenfd` option,
can serve on Unix sockets, and can automatically exit when idle with a new
`--idle-process-timeout` option.
[#14294](https://github.com/bytecodealliance/wasmtime/pull/14294)
[#14320](https://github.com/bytecodealliance/wasmtime/pull/14320)
[#14392](https://github.com/bytecodealliance/wasmtime/pull/14392)

### Changed

• Epoch deadline and call-hook callbacks now receive a `StoreHookState`
instead of a `StoreContextMut`, which only allows access to the `T` in a
`Store<T>`.
[#14386](https://github.com/bytecodealliance/wasmtime/pull/14386)

• The `wasmtime` CLI no longer enables WASIp0 (`wasi_unstable`) by default. It
can be enabled with `-Spreview0`.
[#14479](https://github.com/bytecodealliance/wasmtime/pull/14479)

• Winch no longer enables the GC types, exceptions, or tail-call proposals by
default as support for these is not yet Tier 1.
[#14449](https://github.com/bytecodealliance/wasmtime/pull/14449)
[#14502](https://github.com/bytecodealliance/wasmtime/pull/14502)

• `Accessor::spawn` now takes an async closure instead of an `AccessorTask`.
[#14376](https://github.com/bytecodealliance/wasmtime/pull/14376)

• Component-model-async has been updated to the latest specification：the
`cancellable` immediate has been removed from intrinsics, `subtask.cancel`
semantics have been refined, `task.cancel` now traps before the cancel event
is delivered, and use of stream/future handles after the other end has been
dropped now traps.
[#14244](https://github.com/bytecodealliance/wasmtime/

## 49.0.4

Released 2026-10-19.

### Fixed

• wasi-http：Guests can add conflicting content lengths to messages
[GHSA-r8xh-cgf7-392j](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-r8xh-cgf7-392j)
• wasi-http p3：forwarded trailers aren't checked against `is_forbidden_header` hook
[GHSA-jxcf-8qw5-5c33](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33)
• wasi-http p3：Guests can set incorrect content-length for spliced response bodies
[GHSA-9prg-84vf-g5fc](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9prg-84vf-g5fc)
• Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
[GHSA-mghf-wjfp-p5xm](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm)
• Update rustls to 0.23.46
[#14767](https://github.com/bytecodealliance/wasmtime/pull/14767)
• Panic lowering a host-created component model stream into a guest that expects a different payload type.
[GHSA-9pvw-hwfg-92h5](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5)

## 49.0.3

Released 2026-10-14.

### Fixed

• Out-of-bounds zero-length stream writes can panic.
[GHSA-93g3-36p8-x2gc](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc)

• Host panic when component `call_async` is cancelled under some conditions.
[GHSA-3r89-v5mq-j5xf](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf)

• Panic on erroneous call-to-host from guest realloc call.
[GHSA-7v24-42x9-pxf7](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7)

• Yielding in a component start function can lead to a host panic.
[GHSA-5hhx-4wrr-3j9g](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g)

• Panic when invoking an async-lifted function via `call`.
[GHSA-m6w2-jwq2-cv2c](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c)

• Panic when pending calls are run after a trap.
[GHSA-hmwq-g22x-qjw5](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5)

• Stack overflow dropping a long chain of recursive types.
[GHSA-wjc8-633q-pwxr](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr)

• Wasmtime may not properly enforce async-entrypoint requirement.
[GHSA-vcg5-q8m5-8379](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379)

• Panic viewing component model stream or future as the wrong type.
[GHSA-63h4-6cx9-pjfj](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj)

• Component-model handle tables are capped only per instance and charged to no
limit.
[GHSA-q554-3cjc-rx7p](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p)

• Exception tags can cause host data structures to be unaligned.
[GHSA-p79w-pv2r-29qp](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp)

• Filesystem sandbox escape when renaming symlinks with trailing slashes.
[GHSA-m9f7-9w4p-gv38](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38)

• Overlapping string transcode in a fused adapter can panic.
[GHSA-54p9-vhhq-8f7q](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q)

• Guests can send absolute-form HTTP requests to different hosts.
[GHSA-5qpp-g3j2-8frx](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx)

• `wasi-http`：Request with long url before query parameter crashes host.
[GHSA-w36r-2hch-9xp9](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9)

## 49.0.2

Released 2026-10-02.

### Fixed

• WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption.
[GHSA-j366-h8gg-77pm](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm)

• Excessive allocated memory on the host when guests don't have stdio.
[GHSA-gqmc-89g8-p25r](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r)

• `fd_readdir` copies uninitialized struct padding into guest memory.
[GHSA-96f6-r43r-8c24](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24)

• Guest can panic host through filesystem timestamp before the epoch on wasip3.
[GHSA-mr2v-56j5-cmfc](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc)

• Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow.
[GHSA-32h6-97mm-8q3c](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c)

• Mis-typed WebAssembly tag imports can lead to GC heap corruption.
[GHSA-cfhf-m2cr-62wj](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj)

• Wasmtime wasi:http implementation panics with a zero timeout supplied.
[GHSA-w4qr-p94g-mjhv](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv)

• Rooting for GC values live across `try_call` may be missing, causing GC heap corruption.
[GHSA-hw8m-q44c-ggrf](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf)

## 49.0.1

Released 2026-09-24.

### Fixed

• Do not drop fuel-spend accrued by callees of `call_ref` and callees that
return via exception throws.
[GHSA-m63x-6p34-q65x](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x)

• Fix fuel spend for dynamic record lifting.
[GHSA-jqpg-j7w6-42pr](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr)

• Fix host memory exhaustion on outgoing HTTP body write.
[GHSA-c9gc-w9vx-w86p](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p)

• wasmtime-wasi：Fix panic on out-of-range datetimes in WASI filesystem set-times, set-times-at.
[GHSA-j2g9-4prp-pf6h](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h)

## 49.0.0

Released 2026-09-21.

### Added

• Winch now has initial experimental support for the WebAssembly
exception-handling proposal.
[#14066](https://github.com/bytecodealliance/wasmtime/pull/14066)
[#14081](https://github.com/bytecodealliance/wasmtime/pull/14081)
[#14132](https://github.com/bytecodealliance/wasmtime/pull/14132)
[#14149](https://github.com/bytecodealliance/wasmtime/pull/14149)
[#14180](https://github.com/bytecodealliance/wasmtime/pull/14180)
[#14209](https://github.com/bytecodealliance/wasmtime/pull/14209)

• Wasmtime's type reflection APIs for WebAssembly GC types now have dedicated
enums for `Heap{Top,Bottom}Type`s.
[#14208](https://github.com/bytecodealliance/wasmtime/pull/14208)

• Wasmtime now supports the use of environment variables to configure most CLI
arguments in addition to the preexisting CLI flags.
[#14217](https://github.com/bytecodealliance/wasmtime/pull/14217)

• Cranelift will now fold `u{add,mul}_overflow` results combined with `brif`
instructions for more optimal codegen.
[#14217](https://github.com/bytecodealliance/wasmtime/pull/14217)
[#14254](https://github.com/bytecodealliance/wasmtime/pull/14254)

• Components can be tested for equality with a new `Component::same` API.
[#14257](https://github.com/bytecodealliance/wasmtime/pull/14257)

• The Wasmtime C/C++ API now supports the `component-model-implements` feature.
[#14264](https://github.com/bytecodealliance/wasmtime/pull/14264)

• Cranelift will now emit the `{u,s}bfm` instructions on AArch64.
[#14187](https://github.com/bytecodealliance/wasmtime/pull/14187)

### Changed

• The wide-arithmetic WebAssembly proposal is now enabled by default.
[#14110](https://github.com/bytecodealliance/wasmtime/pull/14110)

• `Config::operator_cost` now applies to operators inside constant expressions
(global initializers, element and data segment offsets, element segment
expressions) and to the synthesized call to a module's `start` function.
Previously each of those was charged 1 fuel unit regardless of the configured
cost.
[#14215](https://github.com/bytecodealliance/wasmtime/pull/14215)

• Wasmtime's WASI implementation will no longer over-read stdin where possible.
[#14077](https://github.com/bytecodealliance/wasmtime/pull/14077)

• Wasmtime's WASIp2 implementation now maps host-level "broken pipe" errors to
`StreamError::Closed`.
[#14107](https://github.com/bytecodealliance/wasmtime/pull/14107)

• Wasmtime's WASIp2 implementation of `wasi:http` now validates ports in the
same manner as wasip3.
[#14123](https://github.com/bytecodealliance/wasmtime/pull/14123)

• Wasmtime's WASI implementation of `wasi:filesystem` now returns the
`is-directory` error in some situations when a file is provided.
[#14135](https://github.com/bytecodealliance/wasmtime/pull/14135)

• The `wasmtime-wasi-http` crate now has the `p3` feature enabled by default.
[#14137](https://github.com/bytecodealliance/wasmtime/pull/14137)

• Wasmtime's WASIp2 implementation of `wasi:http` now runs more hooks from the
`WasiHttpHooks` trait in the same manner as wasip3.
[#14167](https://github.com/bytecodealliance/wasmtime/pull/14167)

• Wasmtime now requires Rust 1.96.0 to compile.
[#14184](https://github.com/bytecodealliance/wasmtime/pull/14184)

• Adjustments have been made to the scheduling of threads w.r.t. trapping
behavior for cooperatively threaded components. These changes are made to
align with the upstream component-model specification.
[#14146](https://github.com/bytecodealliance/wasmtime/pull/14146)
[#14250](https://github.com/bytecodealliance/wasmtime/pull/14250)

• Fuel for bulk operations is now consumed after the bulk operation has
completed instead of up-front, restoring previous behavior where a failed very
large memory growth doesn't trap the original program.
[#14213](https://github.com/bytecodealliance/wasmtime/pull/14213)

• A number of future `poll` calls throughout the WASIp2 implementation now
explicitly opt-out of Tokio's per-task cooperative budget to bett

## 48.0.2

Released 2026-09-10.

### Changed

• Wasmtime's dependency on `cap-primitives` is now vendored within Wasmtime
itself.
[#14225](https://github.com/bytecodealliance/wasmtime/pull/14225)

### Fixed

• Code generated by `bindgen!` is now compatible with the latest Rust nightly by
default.
[#14307](https://github.com/bytecodealliance/wasmtime/pull/14307)

## 48.0.1

Released 2026-08-24.

### Fixed

• Context slots in component compositions are now correctly managed.
[#14139](https://github.com/bytecodealliance/wasmtime/pull/14139)

• The `Host` header is now set by default for HTTP requests sent with WASIp2.
[#14167](https://github.com/bytecodealliance/wasmtime/pull/14167)

## 48.0.0

Released 2026-08-20.

### Added

• Wasmtime has an initial implementation of the component model
fixed-length-lists feature.
[#12315](https://github.com/bytecodealliance/wasmtime/pull/12315)

• Wasmtime's reflection of component imports/exports now exposes `external-id`
information.
[#13874](https://github.com/bytecodealliance/wasmtime/pull/13874)

• Cranelift's alias analysis pass now eliminates dead stores.
[#13806](https://github.com/bytecodealliance/wasmtime/pull/13806)
[#13947](https://github.com/bytecodealliance/wasmtime/pull/13947)

• Winch now supports the wasm SIMD proposal on AArch64.
[#13911](https://github.com/bytecodealliance/wasmtime/pull/13911)
[#13921](https://github.com/bytecodealliance/wasmtime/pull/13921)
[#13928](https://github.com/bytecodealliance/wasmtime/pull/13928)
[#13937](https://github.com/bytecodealliance/wasmtime/pull/13937)
[#13945](https://github.com/bytecodealliance/wasmtime/pull/13945)
[#13938](https://github.com/bytecodealliance/wasmtime/pull/13938)
[#13946](https://github.com/bytecodealliance/wasmtime/pull/13946)
...

• Cranelift now supports an AVX512-VNNI lowering for the dot-product wasm
instruction and `usdot` on AArch64.
[#14006](https://github.com/bytecodealliance/wasmtime/pull/14006)
[#14054](https://github.com/bytecodealliance/wasmtime/pull/14054)

• Wasmtime's `bindgen!` macro now has an `include_component_type` option to
generate a `COMPONENT_TYPE` constant with the encoded type of the world being
bound.
[#14013](https://github.com/bytecodealliance/wasmtime/pull/14013)

• Wasmtime now supports configurable fuel costs for variable-length wasm
opcodes.
[#13931](https://github.com/bytecodealliance/wasmtime/pull/13931)

### Changed

• Host-implemented traits in `wasmtime-wasi-http` are now the same across
wasip2/wasip3 and no longer require separate implementations/structures.
[#13810](https://github.com/bytecodealliance/wasmtime/pull/13810)
[#13812](https://github.com/bytecodealliance/wasmtime/pull/13812)
[#13835](https://github.com/bytecodealliance/wasmtime/pull/13835)

• Wasmtime will now use the `process_madvise` syscall on Linux where available
which can improve the performance of the pooling allocator when the
deallocation batch size is configured to larger than 1.
[#13830](https://github.com/bytecodealliance/wasmtime/pull/13830)

• Synchronous cancellation of streams/futures/subtasks now traps if the waitable
was already in a waitable set.
[#13708](https://github.com/bytecodealliance/wasmtime/pull/13708)

• Winch is now flagged to be compatible with component-model-async.
[#13845](https://github.com/bytecodealliance/wasmtime/pull/13845)

• Wasmtime's pooling allocator now uses more sharding to reduce lock contention.
[#13840](https://github.com/bytecodealliance/wasmtime/pull/13840)

• Wasmtime now requires Rust 1.95.0 to build.
[#13853](https://github.com/bytecodealliance/wasmtime/pull/13853)

• Cranelift now has a uniform maximum size across all backends on the bounds of
a function's stack frame.
[#13783](https://github.com/bytecodealliance/wasmtime/pull/13783)

• Wasmtime's `LinkerInstance` for components now supports being reopened to
gradually add more items.
[#13908](https://github.com/bytecodealliance/wasmtime/pull/13908)

• The `wasmtime-wasi` crate's default configuration now denies creation of
TCP/UDP sockets by default.
[#13936](https://github.com/bytecodealliance/wasmtime/pull/13936)

• Wasmtime now configures async task context fields on `realloc` calls to zero.
[#13949](https://github.com/bytecodealliance/wasmtime/pull/13949)

• Work has continued on continuous verification of Cranelift's lowering rules
on AArch64.
[#13935](https://github.com/bytecodealliance/wasmtime/pull/13935)
[#13929](https://github.com/bytecodealliance/wasmtime/pull/13929)
[#13998](https://github.com/bytecodealliance/wasmtime/pull/13998)

• Codegen for loads on AArch64 has been optimized slightly to improve sharing
common sub-expressions.
[#13766](https://github.com/bytecodealliance/w

47.0.0
Released 2026-07-20.
Added
• Wasmtime now has the WebAssembly GC proposal enabled by default.
#13594
• Wasmtime now has the WebAssembly exception-handling proposal enabled by
default.
#13603
• Cranelift now supports the compact unwind format on Mach-O platforms.
#13586
• Wasmtime now supports bounds-checked unsafe intrinsics which take spectre
mitigations into account.
#13597
• The wasmtime::Engine type now supports reflection to determine the value of
most Config options that were selected during creation.
#13671
• Support for fibers on unsupported architectures is now supported through an
opt-in compile time Cargo feature defining a C API embedders can implement.
#13620
• Embedders can now create an ArrayRef with a memcpy-style constructor.
#13716
• A new Accessor::poll_ready_for_concurrent_call API can be used to detect
when backpressure indicates that a function is ready to be invoked.
#13683
Changed
• Support for wasi-threads and Wasmtime's wasi-common crate have been removed.
For more information see the associated RFC in Wasmtime.
#13558
• The call_indirect instruction of final super types has been optimized when
the GC proposal is enabled.
#13572
• Cranelift's *_imm builder helpers have been deprecated in favor of
*_imm_{s,u} helpers.
#13583
• The wasmtime CLI's syntax supported for --invoke with components now
supports fully qualified WIT interface names.
#13564
• Cranelift's stack_{load,store} instructions have been removed.
#13580
• Cranelift's {band,bor,bxor}_not instructions have been removed.
#13590
• Cranelift's global_value instruction has been removed.
#13682
• The wasmtime wizer subcommand now supports specifying the initialization
function with WAVE for components.
#13582
• Wasmtime's codegen on aarch64 for the i32x4.relaxed_dot_i8x16_i7x16_add_s
wasm instruction now uses a single sdot instruction where possible.
#13640
• Wasmtime's .wasmtime{traps,addrmap} sections in *.cwasm files are now
significantly smaller.
#13628
• Wasmtime now supports removing symbols from *.cwasm files and additionally
has a documentation page about producing minimally-sized *.cwasm outputs.
#13630
• Wasmtime now suports resources in the named_imports option of bindgen!.
#13666
• Wasmtime now invokes the host's socket_addr_check callback for implicit
binds performed in WASIp3.
#13677
• Wasmtime's component-to-component sync-to-sync fused adapters have been
optimized.
#13695
• Cranelift now supports RISC-V's Zvbb extension.
#13738
Fixed
• The IPV6_V6ONLY option is now set for UDP sockets.
#13596
• Uncaught wasm exceptions at component boundaries are now turned into traps to
prevent components catching exceptions from other components.
#13613
• Addresses being sent do with WASIp3 and UDP are now validated as they are in
WASIp2.
#13631
• GC roots on component model fiber stacks are now properly traced.
#13693
• An unaligned load when reading debug state slot values has been fixed.
#13791

47.0.0
Released 2026-07-20.
Added
- Wasmtime now has the WebAssembly GC proposal enabled by default.
#13594
- Wasmtime now has the WebAssembly exception-handling proposal enabled by
default.
#13603
- Cranelift now supports the compact unwind format on Mach-O platforms.
#13586
- Wasmtime now supports bounds-checked unsafe intrinsics which take spectre
mitigations into account.
#13597
- The wasmtime::Engine type now supports reflection to determine the value of
most Config options that were selected during creation.
#13671
- Support for fibers on unsupported architectures is now supported through an
opt-in compile time Cargo feature defining a C API embedders can implement.
#13620
- Embedders can now create an ArrayRef with a memcpy-style constructor.
#13716
- A new Accessor::poll_ready_for_concurrent_call API can be used to detect
when backpressure indicates that a function is ready to be invoked.
#13683
Changed
- Support for wasi-threads and Wasmtime's wasi-common crate have been removed.
For more information see the associated RFC in Wasmtime.
#13558
- The call_indirect instruction of final super types has been optimized when
the GC proposal is enabled.
#13572
- Cranelift's *_imm builder helpers have been deprecated in favor of
*_imm_{s,u} helpers.
#13583
- The wasmtime CLI's syntax supported for --invoke with components now
supports fully qualified WIT interface names.
#13564
- Cranelift's stack_{load,store} instructions have been removed.
#13580
- Cranelift's {band,bor,bxor}_not instructions have been removed.
#13590
- Cranelift's global_value instruction has been removed.
#13682
- The wasmtime wizer subcommand now supports specifying the initialization
function with WAVE for components.
#13582
- Wasmtime's codegen on aarch64 for the i32x4.relaxed_dot_i8x16_i7x16_add_s
wasm instruction now uses a single sdot instruction where possible.
#13640
- Wasmtime's .wasmtime{traps,addrmap} sections in *.cwasm files are now
significantly smaller.
#13628
- Wasmtime now supports removing symbols from *.cwasm files and additionally
has a documentation page about producing minimally-sized *.cwasm outputs.
#13630
- Wasmtime now suports resources in the named_imports option of bindgen!.
#13666
- Wasmtime now invokes the host's socket_addr_check callback for implicit
binds performed in WASIp3.
#13677
- Wasmtime's component-to-component sync-to-sync fused adapters have been
optimized.
#13695
- Cranelift now supports RISC-V's Zvbb extension.
#13738
Fixed
- The IPV6_V6ONLY option is now set for UDP sockets.
#13596
- Uncaught wasm exceptions at component boundaries are now turned into traps to
prevent components catching exceptions from other components.
#13613
- Addresses being sent do with WASIp3 and UDP are now validated as they are in
WASIp2.
#13631
- GC roots on component model fiber stacks are now properly traced.
#13693
- An unaligned load when reading debug state slot values has been fixed.
#13791

46.0.1
Released 2026-06-24.
Fixed
- WASI hard links and renames check wasmtime-wasi's FilePerms for destination
GHSA-4ch3-9j33-3pmj
- Explicit hint for generic call in wasmtime wit-bindgen.
#13719

46.0.0
Released 2026-06-22.
Added
- Added opt-in support for the WebAssembly branch-hinting proposal: the
metadata.code.branch_hint custom section is parsed and used to mark cold
blocks during Cranelift compilation, behind Config::wasm_branch_hinting
(off by default).
#13459
- Wasmtime's C API now supports type reflection of GC values.
#13268
- Wasmtime now supports being compiled to arm64_32 platforms.
#13259
- The cranelift-frontend crate,the RISC-V Cranelift backend, and Wasmtime's
component-model-async feature now support no_std.
#13401
#13479
#13533
- Wasmtime has initial support for the component model (implements "...")
feature.
#13361
#13497
#13513
- The wasmtime CLI now supports configuring the initial-cwd property of
WASI.
#13468
- The wasmtime serve subcommand now supports --header to set headers for the
guest.
#13471
- Wasmtime supports WASI 0.2.12, which notably includes exit-with-code in
stable.
#13536
- Wasmtime's component-model-async-bytes feature was renamed to
component-model-bytes and now lifting/lowering using Bytes and BytesMut
is directly supported.
#13366
- Wasmtime now exposes the async call stack of components through its public API
which can be used to determine which root task performed an import call.
#13510
- Wasmtime now supports WASI 0.3.0 by default and the component-model-async
wasm feature is now enabled by default.
#13612
Changed
- Performance of bulk-data-transfer instructions such as
{array,table,memory}.{copy,fill,init} have been improved.
#13312
#13367
#13368
#13382
#13407
#13424
#13438
#13460
#13524
- Codegen for conditions based on ctz or clz has been optimized.
#13332
#13343
- Cranelift now optimizes conditional branches of constant conditions into
unconditional jumps.
#13267
#13391
- Wasmtime's copying collector now has an in-wasm fast path for its bump
allocator.
#13323
- Wasmtime's GC implementation has been hardened in the face of GC heap
corruption to avoid panicking or aborting. Corruption is returned as a
WasmtimeBug type for embedders to detect and safely tear down the
store/instance.
#13321
#13320
- Cranelift's MemFlags type is now renamed to MemFlagsData, and
AliasRegions are now stored in the DFG.
#13353
#13354
- Wasmtime now handles OOM gracefully in more situations.
#13371
#13372
#13374
#13375
#13376
#13377
#13378
#13379
#13388
#13413
#13412
#13414
- Cranelift's egraph rewrite pass now uses a concept of fuel to avoid
exponential blowup of rewrites.
#13390
- Wasmtime now consumes fuel in bulk-data-transfer instructions proportional to
the size of the transfer.
#13393
#13448
- Cranelift's ISLE format now supports structs as well as tuple fields for
structs/enums.
#13319
#13335
- Wasmtime's implementation of passive element and data segments is now
optimized to perform more work in wasm itself and has a refactored
representation on the host.
#13394
#13444
- Heuristics for triggering GC in the DRC collector have been adjusted to avoid
blowups seen in the wild.
#13422
- Wasmtime's default garbage collector is now the copying collector instead of
the deferred-reference-counting collector. This collector should be more
performant in most situations and additionally have the ability to collect
cycles.
#13439
- Wasmtime now traps if a waitable is being waited on synchronously and
additionally added to a waitable-set.
#13415
- Wasmtime's behavior with subtask.cancel is now adjusted to resume the
cancelled task immediately instead of always yielding.
#13443
- The wasmtime_wasi_http::handler module has had its interface overhauled to
better handle configuring the lifecycle of a request as it flows through
the system in terms of timeouts and such.
#13404
- Most of Wasmtime's instance initialization is now compiled into a per-module
initialization function rather than happening through the host in Wasmtime.
#13487
- The InstanceExportLookup trait has been generalized into ExportLookup, and
this is now optionally implemented for wit_parser::ItemName with the
wit-parser crate feature.
#1

45.0.2
Released 2026-06-15.
Fixed
- Leak in WASIp1 fd_renumber implementation.
GHSA-3p27-qvp9-27qf

45.0.1
Released 2026-06-05.
Fixed
- Fixed regression with WASIp2 zero-delay clocks/timers: allow repeat calls to
.ready() to make progress.
#13511

45.0.0
Released 2026-05-21.
Added
- Winch now respects the enable_nan_canonicalization setting.
#12939
- Initial support for invoking component functions asynchronously has been added
to the C API.
#12973
- Cranelift's s390x backend implements more instructions from z17 and also
implements more CLIF arithmetic overflow instructions.
#12523
#12707
- Wasmtime's support for handling OOM in more APIs has expanded and is now
documented as well.
#12993
#12988
#13017
#13047
#13049
#13051
#13074
#13083
#13088
#13224
- The Component type now offers reflection APIs over the compiled in-memory
view of instructions in the same manner Module does.
#13073
- The wasmtime CLI now has a hot-blocks subcommand to explore a
perf-recorded output and show hot basic blocks of WebAssembly instructions.
#13077
- Wasmtime now has an initial implementation of a copying collector for GC,
which notably enables collecting cycles unlike the DRC collector.
#13093
#13107
- The WASI inherit_network and allow_ip_name_lookup options were added to
the C API.
#13145
- The C API now has the ability to select Winch as well as the
RegallocAlgorithm in use.
#13155
- The Wasmtime CLI now has a -Dmax-backtrace=N argument to control the number
of frames captured.
#13218
- Wasmtime now tracks whether there are any active async tasks within a store
and provides an embedder API to learn when there are none left.
#13246
- Cranelift now has an idempotent-store elimination pass.
#13251
Changed
- Wasmtime's DRC collector has received some optimizations to get some wins on
local benchmarking.
#12969
#12974
- Wasmtime's C API can now be built without the gc crate feature of Wasmtime.
#12805
- Wasmtime now has an implemented and improved grow-vs-collect heuristic to
improve behavior of GC-using programs.
#12942
- Cranelift on aarch64 now uses a more optimized frame layout for tail-call-only
functions.
#11608
- Wasmtime now supports a separate set of GC tunables different from the main
set of tunables for linear memory to enable configuring it separately.
#13080
- Wasmtime no longer uses pointer authentication instructions for the
implementation of fibers due to issues on Android.
#13118
- Wasmtime now requires Rust 1.93.0 to compile.
#13127
- The behavior of using Wasmtime as a CMake subproject has been improved.
#13157
- Reference types in the C/C++ API have been refactored and reorganized.
#13154
#13235
- The Wasmtime CLI now warns about usage of wasi-common or wasi-threads as these
components are slated for removal in Wasmtime 47.0.0. For more information see
the associated RFC.
#13264
- Inlining in Wasmtime now has a different set of configuration options, notably
more values are packed into -Cinlining=....
#13250
Fixed
- The WASIp1-to-WASIp2 adapter now handles nonblocking I/O in fd_{read,write}
more appropriately.
#13111
- The Host header is injected less often for wasmtime-wasi-http.
#13138
- Downcasts of funcref values now uses the correct type for imported
functions.
#13161
- The DRC allocator's memory usage during tracing has been reduced when there
are large arrays.
#13192
- The performance of reading stdin in WASI has been improved.
#13256
- WASI path_open(TRUNCATE) bypasses FilePerms::WRITE host restriction.
GHSA-2r75-cxrj-cmph

44.0.1
Released 2026-04-30.
Fixed
- Panic when allocating a table exceeding the size of the host's address space.
GHSA-p8xm-42r7-89xg

44.0.0
Released 2026-04-20.
Added
- The wasmtime CLI now supports a -g flag which runs a built-in wasm program
to host a gdbstub-compatible server (can be connected to with LLDB) to debug
guest programs.
#12756
#12771
#12856
#12859
- Wasmtime now has experimental support for the map<K, V> type in the
component model.
#12216
- Wasmtime's C API now supports wasm tag types.
#12763
#12803
- Wasmtime's C API now supports exceptions.
#12861
- Wasmtime's C API has more support for the GC proposal.
#12914
#12915
#12916
#12917
- An initial implementation of the wasi:tls proposal for the 0.3.0-draft
version has been added.
#12834
Changed
- The demangle Cargo feature of the wasmtime crate is now compatible with
no_std targets.
#12740
- The wasmtime-wasi-tls-* crates are now merged into one crate with feature
flags for each backend.
#12780
- Wasmtime now requires Rust 1.92.0 or later to build.
#12828
- The cranelift-codegen crate now compiles for no_std targets.
#12812
- The csdb instruction, a defense-in-depth measure for spectre, is no longer
emitted by default on aarch64 to match what peer runtimes are doing. In some
situations this is known to provide up to a 6x performance boost on macOS as
well.
#12932
Fixed
- Wasmtime's native DWARF has been improved on aarch64 to support recovering
values more frequently.
#12779
- A significant number of minor issues have been fixed throughout this release.
In addition to the security advisories found by LLMs there have also
been a large number of other issues identified as well. Many minor fixes are
present in this release for various situations for issues found in this
manner.

43.0.1
Released 2026-04-09.
Fixed
- Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift.
GHSA-jhxm-h53p-jm7w
- Wasmtime with Winch compiler backend may allow a sandbox-escaping memory
access.
GHSA-xx5w-cvp6-jv83
- Out-of-bounds write or crash when transcoding component model strings.
GHSA-394w-hwhg-8vgm
- Host panic when Winch compiler executes table.fill.
GHSA-q49f-xg75-m9xw
- Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator
on x86-64.
GHSA-qqfj-4vcm-26hv
- Improperly masked return value from table.grow with Winch compiler backend.
GHSA-f984-pcp8-v2p7
- Panic when transcoding misaligned utf-16 strings.
GHSA-jxhv-7h78-9775
- Panic when lifting flags component value.
GHSA-m758-wjhj-p3jq
- Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding.
GHSA-hx6p-xpx3-jvvv
- Use-after-free bug after cloning wasmtime::Linker.
GHSA-hfr4-7c6c-48w2
- Data leakage between pooling allocator instances.
GHSA-6wgr-89rj-399p
- Host data leakage with 64-bit tables and Winch.
GHSA-m9w2-8782-2946

43.0.0
Released 2026-03-20.
Added
- Wasmtime now supports the WASIp3 snapshot 0.3.0-rc-2026-03-15.
#12557
- The number of frames captured in backtrace collection can now be configured.
#12542
- Wasmtime now supports fine-grained operator cost configuration for when fuel
is enabled.
#12541
- Configuring the gc_support option is now possible through the C API.
#12630
- Configuring the concurrency_support option is now possible through the C
API.
#12703
- Debugging-related APIs have been added to access all modules and instances on
a store.
#12637
- All store entities now expose a "unique ID" for debugging purposes.
#12645
- Cranelift's x64 backend now supports the cls instruction for all integer
types.
#12644
Changed
- Internal refactoring and support necessary for handling OOM gracefully
throughout the runtime is proceeding apace. New APIs such as
FuncType::try_new are available in addition to many internal changes.
#12530
#12537
(... and many more ...)
- Wasmtime's representation of stack frames in the debugging API no longer
borrows the store itself and is instead represented as a handle.
#12566
- Wasmtime now unconditionally sets SO_REUSEADDR for guest-bound sockets.
#12597
- Cranelift now supports more VRegs which means effectively that larger
functions will be compilable by default rather than returning a "function too
large" error.
#12611
- WASIp3 implementations now limit returned memory by default for randomness and
HTTP headers.
#12745
#12761
Fixed
- Running wasmtime wizer over components with modules that contain an
_initialize function no longer removes the function to preserve the validity
of the component.
#12540
- Borrow state for host async tasks is now handled more correctly throughout
Wasmtime, especially in the face of cancellation.
#12550
- Bindings generation now accounts for the fact that future and stream are
not cloneable types.
#12155
- The impementation of UDP in WASIp2 has had some wakeup-related bugs fixed.
#12629
- Cancellation of host subtasks for component-model-async has been improved and
works more reliably.
#12640
- Subtask management for component-model-async now no longer reparents which
fixes a number spec-related divergences.
#12570
- Converting a wasmtime::Error into anyhow::Error and using downcast has
been fixed.
#12689
- Async stream/future read/write cancellation has had some corner cases fixed.
#12704
- Cranelift's timing infrastructure is now more robust in the face of buggy
system clocks.
#12709
- The currently running guest task has been corrected in a number of cases
related to component-model-async and cooperative threading.
#12718
#12735
#12736
#12737
- An issue of lost wakeups with the WASIp3 stdin implementation has been fixed.
#12745

42.0.1
Released 2026-02-25.
Fixed
- Fix some minor bindgen! issues with anyhow: true
#12658

42.0.0
Released 2026-02-20.
Added
- Cranelift now supports bitwise operations on floats on aarch64.
#12326
- Cranelift now supports NaN canonicalization of f16 and f128.
#12337
- Wasmtime has gained minimal support to implement fixed-length lists in the
component model being communicated between composed components.
#10619
- Wasmtime's Error and Result types are now built-in to the wasmtime crate
and are no longer defined by the anyhow crate. Wasmtime exports a
mostly-compatible anyhow-like API at wasmtime::error which is used
instead. Wasmtime's own Error handles OOM internally and is foundational
part of Wasmtime's work-in-progress support to gracefully handle OOM.
#12309
- Wasmtime now exports an extension trait to convert anyhow::Result<T> into
wasmtime::Result<T>.
#12255
- Wasmtime supports a new bindgen! option to generate bindings specifically
with anyhow::Result instead of wasmtime::Result.
#12331
- The Nvidia-Cuda execution provider is now supported for the wasi-nn onnx
backend.
#12044
- Non-exported and private entities can now be accessed through the debugger
API.
#12367
- A new Store::try_new API has been added which handles OOM.
#12415
- Initial configuration knobs for record-and-replay support have been added.
#12375
- Cranelift's s390x backend now has support for instructions added in z17.
#12319
- Wasmtime's implementation of fibers can now be compiled on riscv32imac
platforms.
#12506
- Wasmtime's implementation of WASI now correctly limits resource consumption on
behalf of the guest, such as host-allocated memory, by default. This means
that some behaviors previously allowed by Wasmtime are now disallowed by
default if they rely on transferring a large amount of data from the guest to
the host. Additionally calls to wasi:random/random.get-random-bytes, for
example, now have limits in place by default to avoid allocating too much
memory on the host. For more information on this see the related security
advisory with further details on knobs added and what behaviors are now
restricted by default.
GHSA-852m-cvvp-9p4w
Changed
- Reentrance rules for WebAssembly components have changed in accordance with
upstream specification changes. Embeddings are not expected to be affected,
but please reach out if you find problems.
#12349
- Wasmtime's Config::async_support option is now removed and no longer
necessary. Embeddings can likely just remove turning this on and everything
should keep working like normal.
#12371
- Wasmtime now supports Config::concurrency_support as a knob to enable or
disable *_concurrent APIs at runtime when the component-model-async crate
feature is enabled.
#12416
- The post_return-style functions in Wasmtime's API are now noops and will be
removed in the future.
#12498
- Translation of global.get of a defined, immutable global is now turned into
a CLIF constant.
#12234
- The wasmtime-wasi-nn crate's dependency on ort has been updated.
#12162
- Error bounds requiring using hyper::Error in wasmtime-wasi-http have been
relaxed to taking E: Into<ErrorCode> instead.
#12227
- The cranelift-assembler-x64, and cranelift-isle crates now supports
no_std targets. The cranelift-codegen crate now mostly supports no_std,
but not entirely.
#12222
#12235
#12236
- Android release binaries are now compiled with a larger page size configured.
#12246
- Implicit binds are now allowed for WASIp3 sockets.
#12225
- Wasmtime's implementation of component-model-async now correctly checks for
whether tasks are allowed to block in all guest-to-guest situations.
#12282
- The wasmtime-wasi-tls crate now has an OpenSSL backend.
#12228
- Wasmtime's OutOfMemory error now keeps track of the attempted allocation
size that failed.
#12351
- Wasmtime's *_unchecked functions now work with MaybeUninit<ValRaw> instead
of ValRaw directly.
#12366
- Wasmtime now requires Rust 1.91.0 to compile.
#12392
- Wasmtime's management of component-model-async tasks is now consistently done
in all boundaries between guest/host tasks.
#12379
Fixed
- 

41.0.3
Released 2026-02-04.
Fixed
- Fix an incorrect mid-end optimization rule that could cause a compiler panic
due to mismatched types.
#12504

41.0.2
Released 2026-02-03.
Fixed
- Reduce the dependencies of the wasmtime-internal-jit-icache-coherence crate.
#12446

41.0.1
Released 2026-01-26.
Fixed
- Fixed a bug in lowering of f64.copysign on x86-64 whereby when combined
with an f64.load, the resulting machine code could read 16 bytes rather
than 8 bytes. This could result in a segfault when Wasmtime is configured
without signals-based traps.

41.0.0
Released 2026-01-20.
Added
- Support for {Future,Stream}Any in the component model has improved.
#12142
- Wasmtime has initial support for breakpoints and single-stepping with the
debug feature for guest programs.
#12133
- Wasmtime has begun adding a new Error type which is similar to
anyhow::Error but supports gracefully handling OOM. Wasmtime still uses
anyhow::Error but this will change in the future to wasmtime::Error which
will be a distinct type.
#12163
- An initial top-level crate for async-debugging guest programs has been added.
#12183
Changed
- Cranelift now optimizes redundant select + icmp instructions.
#12135
- Synchronous component model functions can no longer block before returning.
This implements a change in the upstream specification to the upcoming async
support in the component model which places stricter restrictions on
non-async functions and their ability to perform blocking operations.
#12043
- Frame iteration in debug mode now visits all activations which enables
seeing all frames from recursive wasm calls.
#12176
- Wasmtime now requires Rust 1.90.0 or later.
#12167
- Intra-component stream/future reads/writes are now allowed for simple data
types.
#12181
- The POLL callback code has been removed from the canonical ABI for async
functions and the waitable-set.poll function no longer yields.
#12182
- Guest-to-guest adapters injected by Wasmtime now have improved trapping error
messages.
#12215
Fixed
- #[derive(Lift)] for enums with exactly 256 cases has been fixed.
#12140
- With component-model-async support recursively calling a guest from a host
function has now been fixed.
#12152

40.0.2
Released 2026-01-14.
Fixed
- A possible stack overflow in the x64 backend with cmp emission has been
fixed.
#12333
- Some ISLE optimization rules which created erroneous IR for vector inputs have
been fixed.
#12179
#12335
- The x64 lowering of shld has been fixed for some edge caxes.
#12321

40.0.1
Released 2026-01-07.
Changed
- This release is a test of Wasmtime's CI-based crate publishing infrastructure.
Wasmtime is switching to crates.io-based trusted publishing for this release
and is testing that everything works.
#12257

40.0.0
Released 2025-12-20.
Added
- WASIp3 support for wasi:http now implements Response::from_http to convert
from standard Rust types to WASI types.
#12063
- Cranelift now supports a "patchable" ABI which has a maximum number of
arguments and clobbers no registers. This is paired as well with a new
patchable_call instruction which supports being turned into NOPs at runtime.
#12061
#12101
Changed
- Support for the WebAssembly threads proposal is now classified as tier 2 by
default. Additionally creation of SharedMemory is disabled by deafult behind
a new config knob/CLI flag.
#12036
- A variety of peephole-style optimizations have been added to Cranelift's
optimization passes.
#11994
#11995
#11996
#11997
#11998
#11999
#12000
#12006
#12008
- Component host functions have been slightly optimized to remove an Arc clone
and reduce contention.
#11987
- Support for component-model-async has been updated to account for the
changes specified in WebAssembly/component-model#578.
This means that historical binaries using WASIp3, for example, are no longer
valid. Recompilation of historical components will be required and
source-level changes may also be required in some circumstances.
#12031
#12043
- The UnsyncBoxBody type is now used everywhere in wasmtime-wasi-http instead
of just in the wasip3 support.
#12060
- Initial groundwork for gracefully handling OOM (e.g. returning an error
instead of aborting) has been added.
#12070
#12089
- Wasmtime will create a private copy of code memory when guest debugging is
enabled to assist with modifying code when adding/removing breakpoints.
#12051
- The ResourceTable type will no longer use Tombstone when compiled in debug
mode.
#12114
- Intra-component future/stream reads/writes will now trap instead of
accidentally being allowed.
#12117
- Cranelift optimization rules have been tweaked after it was discovered that
they could pessimize code containing long chains of computations.
#12116
Fixed
- Compilation of i8x16.popcnt has been fixed in Winch for some potential
inputs.
#12010
- A panic in Instance::prepare_call for some component-model-async situations
has been fixed.
#12054
- An off-by-one error for lifting/lowering enums/variants with 255 cases has
been fixed.
#12066
- Restarting the read of a host future after cancellation has been fixed.
#12093
- Compilation for OpenBSD on x86_64 has been fixed.
#12097
- Components containing a module type which exoprts a tag are now supported.
#12125

39.0.1
Released 2025-11-24.
Fixed
- Compiling the debug feature without the gc feature enabled has been fixed.
#12074

39.0.0
Released 2025-11-20.
Added
- Initial work has begun to support WebAssembly-level debugging natively in
Wasmtime. This is intended to complement today's preexisting DWARF-level
debugging, but this work will be portable and operate at the WebAssembly level
of abstraction rather than the machine-level. Note that this work is not yet
complete at this time but is expected to get filled out over the coming
releases.
#11768
#11769
#11873
#11892
#11895
- The pooling allocator now exposes more metrics about unused slots.
#11789
- The Wizer and component-init projects have been merged into Wasmtime under
a new wasmtime wizer CLI subcommand and wasmtime-wizer crate. This is
mostly a drop-in replacement for both with a minor caveat that the
initialization function is now called wizer-initialize instead of
wizer.initialize to be compatible with components.
#11805
#11851
#11853
#11855
#11857
#11863
#11866
#11867
#11877
#11876
#11878
#11891
#11897
#11898
- The Config::wasm_feature method is now public.
#11812
- Enabling the wasm exceptions proposal is now exposed in the C API.
#11861
- The wasmtime crate now has a custom-sync-primitives Cargo feature which
enables using custom synchronization primitives defined by the embedder. This
is useful in no_std targets where the default panic-on-contention primitives
are not appropriate.
#11836
- Wasmtime now supports unsafe intrinsics to be used for compile-time builtins.
This can be used to provide give low-level access to host APIs/memory to a
guest program in a controlled fashion.
#11825
#11918
- The signals_based_traps configuration option is now exposed in the C API.
#11879
- A new EqRef::from_i31 function has been added.
#11884
- The wasmtime serve subcommand will, by default, now reuse instances when
used with WASIp3 components. This increases throughput and additionally
showcases the concurrent features of WASIp3. This can be opted-out-of on the
CLI as well.
#11807
- The C++ API for components has been filled out and implemented.
#11880
#11889
#11988
- A new ResourceDynamic type, similar to Resource<T>, has been added to
support host resources that have a dynamic tag at runtime rather than a
statically known tag at compile time. This is then used to implement resources
in the C/C++ API as well.
#11885
#11920
- The C/C++ API of Wasmtime now supports the custom-page-sizes wasm proposal.
#11890
- Initial support has been added for the cooperative multithreading component
model proposal in Wasmtime, built on async primitives.
#11751
- The epoch_deadline_callback Rust API has been bound in C++.
#11945
- A new Request::into_http helper has been added to the WASIp3 implementation
of wasi:http.
#11843
- A define_unknown_imports_as_traps function has been added to the C API.
#11962
- A callback-based implementation of stdout and stderr has been added to the
C API for WASI configuration.
#11965
Changed
- Running async functions in the component model now operates at the
Store-level of abstraction rather than an Instance.
#11796
- The wasmtime serve subcommand no longer mistakenly spawns an epoch thread
per-request and instead uses a single epoch thread.
#11817
- The component-model-async Cargo feature is now on-by-default. Note that it
is still gated at runtime by default. Also note that Wasmtime 39 does not include
#12031 which means
that components using async produced with the latest wasm-tools will not run
in Wasmtime 39. To run async components it's recommended to pin to a
historical version of wasm-tools and guest toolchains for now.
#11822
- Bindings generated by wiggle no longer use async_trait.
#11839
- Wasmtime's documentation now has an example of a plugin system using Wasmtime.
#11848
- Profiling with perfmap or jitdump now uses O_APPEND to be more amenable to
other engines in the same process also using perfmap/jitdump.
#11865
- The wasmtime-wasi-http crate now uses UnsyncBoxBody to clarify that Sync
is not required.
#11941
- A . character is now used instead of / int he bindgen! m

38.0.4
Released 2025-11-11.
Fixed
- Prevent using shared memories with Memory.
CVE-2025-64345

38.0.2
Released 2025-10-21.
Changed
- This repository is attempting to start out using GitHub's "Immutable Releases"
feature with this release, and this'll be the first release, assuming all goes
well, that has this enabled.
#11901
Fixed
- Fix compatibility with the Go runtime on Windows for exceptions.
#11892

38.0.1
Released 2025-10-20.
Fixed
- Fixed some automation that went wrong with the 38.0.0 release.

37.0.2
Released 2025-10-07.
Fixed
- Fix a memory leak in the C API when using anyref or externref.
CVE-2025-61670.

37.0.1
Released 2025-09-23.
Fixed
- Cranelift's cranelift-jit crate now properly applies relocations to ADRP
instructions on aarch64; a zero-extension on the offset was fixed to properly
sign-extend instead.
#11734

37.0.0
Released 2025-09-20.
Added
- Wasmtime now fully implements the WebAssembly exception-handling proposal.
Support is still disabled by default but is ready for testing. The proposal
will be enabled by default in a future release of Wasmtime.
#11326
- An initial implementation of WASIp3 is available for the 0.3.0-rc-2025-08-15
tag made for the WASIp3 release. Note that this is not production ready yet
but is an excellent time to start kicking the tires in preparation for an
upcoming officialy WASIp3 0.3.0 release. Users of the CLI can opt-in with
-Sp3 -Wcomponent-model-async.
#11406
#11423
#11443
- Wasmtime has initial support for the Linux PAGEMAP_SCAN ioctl which can
greatly improve instantiation throughput in scenarios with a high number of
instantiations and short instance lifetime. This support is disabled by
default but will likely be enabled by default in a future release.
#11372
#11433
- GC support can now be configured in Config and not only through crate
features through Config::gc_support.
#11463
- Wasmtime now supports reading metrics of the pooling allocator at runtime.
#11490
- The ManuallyRooted type is now replaced with OwnedRooted which is intended
to make management of GC object lifetimes on the host easier.
#11514
- Wasmtime's documentation of the C++ embedding API and examples has been
expanded.
#11569
- Wasmtime's support for the stack-switching WebAssembly proposal continues to
progress on x86_64 Linux.
#11003
Changed
- The preview0 and preview1 modules and features in the wasmtime-wasi
crate are now called p0 and p1.
#11380
- Release artifacts for the C API are now unconditionally built with unwind
tables.
#11383
- Wasmtime now requires Rust 1.87.0 or later to build.
#11396
- The component-model-async gated AbortHandle is now named JoinHandle.
#11414
- Wasmtime's internal implementation details are now async in many more
locations to help ensure the implementation is more sound.
#11411
#11416
#11442
#11444
#11457
#11460
#11461
#11468
#11470
#11481
#11496
- Component-model-async primitives such as streams, tasks, etc, now use the same
table as resources in a component. This means that guest-visible allocated
indices are updated slightly.
#11374
- Wasmtime's precompiled binaries available from CI now include the
component-model-async feature.
#11429
- C API release artifacts are now built with LTO so they have a smaller size.
#11483
- Code can no longer be loaded on x86_64-unknown-none by default without
opting-in to a contract that either the host is compiled with SSE2 support or
wasm is compiled with enough features that libcalls aren't used.
#11553
- Host support for component model async futures/streams has been updated to a
new API.
#11515
Fixed
- GC of dead DWARF has been improved.
#11402
- Wasm-gc branching instructions now correctly check for fuel.
#11426
- The array.new_default instruction now checks for fuel/epochs in its inner
loop.
#11428
- The "min" C API artifacts now have correct headers.
#11479
- GC OOM during const eval no longer panics.
#11557
- Wasmtime now properly respects a disabled std feature even on targets which
have std available.
#11568

## 36.0.18

Released 2026-10-14.

### Fixed

• Component-model handle tables are capped only per instance and charged to no limit.
[GHSA-q554-3cjc-rx7p](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p)

• Filesystem sandbox escape when renaming symlinks with trailing slashes.
[GHSA-m9f7-9w4p-gv38](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38)

• Guests can send absolute-form HTTP requests to different hosts.
[GHSA-5qpp-g3j2-8frx](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx)

36.0.9
Released 2026-05-05.
Fixed
- Cranelift's timing infrastructure is now more robust in the face of buggy system clocks.
#12709
#13253

36.0.2
Released 2025-08-26.
Fixed
- Wasmtime will no longer panic in the pooling allocator when in near-OOM
conditions related to resetting the linear memory of a slot.
#11510

36.0.1
Released 2025-08-21.
Added
- Accessors for internal WASI-related contexts are added to
wasmtime_wasi::WasiCtx to account for refactorings that happened in this
release.
#11473
Changed
- Release artifacts for the C API are now smaller than the previous release to
assist with redistribution as-is.
#11483

36.0.0
Released 2025-08-20.
Added
- Cranelift's has initial support for inlining between functions. Wasmtime
additionally now has support for inlining as well, for example between modules
in a component.
#11210
#11239
#11228
#11269
#11283
- The async proposal for the Component Model is now fully implemented in
Wasmtime with a number of WASIp3 interfaces implemented. The implementation
is still off-by-default and the implementation of WASIp3 is not fully
complete, but is remains suitable for testing.
#11127
#11136
#11137
#11238
#11221
#11250
#11257
#11291
#11325
Changed
- Users who implemented WasiHttpView::is_forbidden_header from
wasmtime-wasi-http now need to include DEFAULT_FORBIDDEN_HEADERS, e.g.
DEFAULT_FORBIDDEN_HEADERS.contains(name) || name.as_str() == "custom-forbidden-header"
#11292
- Cranelift's incremental cache has received some optimizations.
#11186
- Wasmtime's internal implementations of WebAssembly primitives has been
refactored to be modeled with safer internal primitives.
#11211
#11212
#11216
#11229
#11215
#11254
#11255
#11319
#11320
- Detection of native hardware features has been refactored on s390x.
#11220
- Further progress has been made towards an implementation of the WebAssembly
exceptions proposal, although it is not yet complete.
#11230
#11321
- Cranelift's assembler for x64 now supports EVEX encoding.
#11153
#11270
#11303
- The default implementation of send_request in the wasmtime-wasi-http crate
is now behind an on-by-default feature gate.
#11323
- Configuration of the bindgen! macro has been redesigned to more consistently
configure per-function options such as whether or not it's async.
#11328
- Initial support fo mutatis has been added to Wasmtime's fuzzers.
#11290
- The debug-builtins crate feature of wasmtime no compiles on no_std
targets.
#11304
Fixed
- Deserializing external modules no long unnecessarily requires the allocation
to be aligned.
#11306
- A CMake linker error and warning when using the C API on macOS has been fixed.
#11293
#11315
- The C API declaration of wasmtime_component_linker_instance_add_func has
been fixed.
#11327
- The calculation of reachable DWARF has been fixed.
#11338

35.0.0
Released 2025-07-22.
Added
- A new InputFile type has been added for specifying stdin as a file in WASI.
#10968
- Conditional branches to unconditional traps are now translated to conditional
traps during legalization.
#10988
- The TE HTTP header can now be specified by guests.
#11002
- Winch on AArch64 should now pass all WebAssembly MVP tests. Note that it is
still not yet Tier 1 at this time, however.
#10829
#11013
#11031
#11051
- The x64 backend now has lowering rules for {add,sub,or,and} mem, imm
#11043
- Initial support for WASIp2 in the C API has started to land.
#11055
#11172
- Initial support for GC support in the component model has started to land
(note that it is not finished yet).
#10967
#11020
- The wasmtime-wasi-nn crate now has a feature to use a custom ONNX runtime.
#11060
- Cranelift now optimizes division-by-constant operations to no longer use
division.
#11129
- A native-tls backend has been added for the wasi-tls implementation.
#11064
Changed
- Many more instructions for the x64 backend in Cranelift were migrated to the
new assembler.
#10927
#10928
#10918
#10946
#10954
#10958
#10971
#10942
#10975
#11017
#10898
#10836
... (and more)
- Wasmtime internally uses Pin for VM data structures to make the internal
implementations more sound to use. This has no effect on the public API of
Wasmtime.
#10934
#10937
#10943
#10959
#11042
- Fused adapters between components now transfer the enum component model type
more efficiently.
#10939
- Filenames of --emit-clif now match the symbol names found in *.cwasm
artifacts and include the function name as well.
#10947
#11040
- Wasmtime-internal crates are now all named wasmtime-internal-* to even
further discourage their use.
#10963
- Codegen of conditional traps with float compares has been improved.
#10966
- More patterns are now optimized in ISLE mid-end rules.
#10978
#10979
#11173
- Winch's support for constants/scratch registers has been improved internally.
#10986
#10998
- The C API artifacts on Windows are now produced with Clang instead of
cl.exe.
#10890
- WebAssembly operand types are now taken into account during translation to
optimize codegen better in the face of subtyping.
#11030
- The behavior of blocking-write-and-flush has been updated during flushing
when closed is found.
#11018
- WASI WITs have been updated to 0.2.6.
#11049
- OpenVINO has been updated to v2025.1.
#11054
- The size of the wasmtime.addrmap section in *.cwasm artifacts has been
shrunk slightly.
#11126
- Authorities in wasmtime-wasi-http can now contain the : character.
#11145
- Wasmtime now requires Rust 1.86 to compile.
#11142
- Wasmtime's DRC collector has been optimized and has a new more efficient means
of managing the set of over-approximated roots on the stack.
#11144
#11148
#11167
#11168
#11169
#11175
- The ComponentType trait in Wasmtime now requires the Send and Sync
bounds for all implementors.
#11160
- The V128 type is now usable on platforms other than aarch64 and x86_64.
#11165
- Wasmtime's policy on unsafe code and guidelines has been added.
#11177
- The std crate will no longer implicitly be used on cfg(unix) and
cfg(windows) targets when the std Cargo feature is disabled. This means
that these platforms now require std to be enabled to use the
platform-specific implementation of linear memory, for example.
#11152
Fixed
- A panic when optimizing icmp with vectors has been fixed.
#10948
- A panic when lowering scalar_to_vector with i16x8 types has been fixed.
#10949
- The vector state register is now considered clobbered by calls on riscv64 to
ensure it's updated across calls.
#11048
- An instance of gdb crashing on DWARF emitted by Wasmtime has been fixed.
#11077
- Fix a panic in the host caused by preview1 guests using fd_renumber.
CVE-2025-53901.
- Fix a panic in the preview1 adapter caused by guests using fd_renumber.
#11277

34.0.1
Released 2025-06-24.
Fixed
- Fix a panic with host-defined tables/globals and concrete reference
types.
#11103

33.0.2
Released 2025-07-18.
Fixed
- Fix a panic in the host caused by preview1 guests using fd_renumber.
CVE-2025-53901.
- Fix a panic in the preview1 adapter caused by guests using fd_renumber.
#11277
33.0.1
Released 2025-06-24.
Fixed
- Fix a panic with host-defined tables/globals and concrete reference
types.
#11103

33.0.0
Released 2025-05-20.
Added
- Cranelift now has initial support for try_call and try_call_indirect
instructions, to be used in the future for the WebAssembly exception-handling
proposal. Wasmtime does not yet implement this proposal yet.
#10510
#10557
#10593
- Cranelift can now optimize some simple possibly-side-effectful instructions,
such as division.
#10524
- Wasmtime now supports --invoke for components using the WAVE format.
#10054
- Initial support for the Component Model has landed in Wasmtime's C API. Note
that the API is not yet feature-complete, however.
#10566
#10598
#10651
#10675
- Wasmtime's C++ API is now available from this repository and the
bytecodealliance/wasmtime-cpp repository has been archived. Additionally the
monolithic wasmtime.hh header file has been split into separate header
files.
#10582
#10600
- Wasmtime's cookbook-style documentation has been expanded.
#10630
- Wasmtime's now supports custom yield behavior when using epoch interrupts.
#10671
Changed
- Wasmtime's bindgen now type-checks export functions in the constructor of
the generated {Worldname}Pre or {Worldname} structs, rather than at the
call of the export function.
#10610
- Wasmtime's component::Component and component::Instance now have consistient
get_export and get_export_index methods, which return (ComponentItem, ComponentExportIndex) and ComponentExportIndex, respectively.
#10597
- On failure, wasmtime serve gives an internal server error response, rather
than closing the connection.
#10645
- Cranelift's single-pass allocator has been disabled due to being unable to
support internal refactorings in preparation for the WebAssembly exceptions
proposal. Re-enabling this allocator is tracked at
regalloc2#217 for
those interested.
#10554
- Wasmtime's {Array,Extern,Struct}Ref functions will now automatically trigger
a GC.
#10560
- Wasmtime's GC heaps now use the same translation techniques as linear memories
meaning they have far fewer bounds-checks than before.
#10503
- Wasmtime's implementation of WASIp2 has moved to wasmtime_wasi::p2 from the
root of the crate.
#10073
- Wasmtime will no longer emit calls to Cranelift-defined "libcalls" and instead
everything goes through Wasmtime's libcall mechanism instead, paving the way
for a future change for more efficient stack limit checking in wasm. This can
also improve deserialize-from-disk times and improve page cache usage for
modules that use libcalls as relocations are no longer necessary.
#10657
- Configuration of caching can now be done through an API instead of exclusively
through a configuration file. Additionally cache-related APIs in Config have
changed.
#10665
- Resources in the Component Model are now stored in a single table per-instance
instead of per-type tables. Guests will see a different pattern of index
allocation but this is not expected to cause any issues at runtime.
#10701
Fixed
- Some math intrinsics have been fixed when compiled by Rust 1.87+.
#10534
- Component model libcalls correctly handle platform-specific argument extension
in ABIs.
#10540
- An off-by-one issue with DWARF debuginfo has been fixed.
#10570
- The Config::target method is no longer gated by a #[cfg] for an enabled
compiler, it can be used when only the runtime feature is available.
#10618
- An issue with "simulated" DWARF has been fixed.
#10681
- C/C++ headers are now tested that they can be included in isolation, and a
number of issues have been fixed.
#10694

32.0.1
Released 2025-06-24.
Fixed
- Fix a panic with host-defined tables/globals and concrete reference
types.
#11103

32.0.0
Released 2025-04-21.
Added
- {Module,Component}::deserialize_raw can now be used to deserialize an
in-memory module while relying on external management of the memory.
#10321
- An initial implementation of wasi-tls has been added.
#10249
- The wasmtime CLI now supports hexadecimal integer CLI arguments.
#10360
- Cranelift now supports a log2_min_function_alignment flag.
#10391
- A new wasmtime objdump subcommand has been added to help explore and debug
*.cwasm files.
#10405
- Support for the pooling allocator has been added to the C API.
#10484
- Support for the guest profiler with the component model has been added.
#10507
Changed
- Cranelift MemFlags now has a can_move flag which restricts whether a load
or store can be moved.
#10340
- The .text size of Pulley *.cwasm files should be smaller with less
padding.
#10285
- The wasmtime serve subcommand now implements a graceful shutdown on ctrl-c.
#10394
- Stack maps used for GC are now stored in a serialized binary format that is
faster to deserialize.
#10404
- The aegraph implementation in Cranelift has been simplified to remove the
union-find and canonical eclass IDs.
#10471
- The store_list and load_list helpers have been specialized in components
for f32 and f64.
#9892
- Cranelift now removes block params on critical-edge blocks.
#10485
- The Linker::define_unknown_imports_as_default_values API now supports
defining defaults for more kinds of items.
#10500
- Wasmtime now requires Rust 1.84.0 to compile.
#10520
Fixed
- Winch compilation of extadd instructions has been fixed.
#10337
- Fix an issue with DRC collector's barriers.
#10371
- Loads on (ref null none) that can trap are now performed.
#10372
- Fix reference count management in AnyRef::from_raw.
#10374
- An issue with multi-value returns in Winch has been fixed.
#10370
- A panic at compile-time from an overflowing shift has been fixed when
targeting aarch64.
#10382
- The wasmtime serve command no longer panics when handle returns before
calling set.
#10387
- Winch compilation of replace_lane instructions with floats has been fixed.
#10393
- An invalid integer-shift optimization on vector types has been removed.
#10413
- The DWARF loclist to exprloc optimization has been fixed.
#10400
- Objects in the DRC collector are now transitively dec-ref's when collected.
#10401
- A bug with GC rec gropus and registration in an Engine has been fixed.
#10435
- A bug related to GC arrays of GC refs misreported their count of GC edges has
been fixed.
#10453
- A bug related to appropriately adding stack maps for all GC variables has been
fixed.
#10456
#10468
- A bug with array.fill has been fixed.
#10470
- GC structs are no longer reordered to optimize their size to fix subtyping.
#10463
- Panics related to exceptions and components being mixed has been fixed.
#10473
- Winch stack parameter alignment has been fixed.
#10513
- Rendering inline function frames in a trap backtrace has been fixed.
#10523

31.0.0
Released 2025-03-20.
Added
- Winch's implementation of the SIMD proposal for WebAssembly is now
feature-complete (but still being fuzzed).
#10180
#10170
#10203
#10202
#10210
#10213
#10224
#10205
#10226
#10228
#10236
#10241
#10243
#10247
#10271
#10284
#10288
#10296
- The pytorch implementation in wasmtime-wasi-nn now has GPU support.
#10204
- Cranelift now supports emitting the AArch64 extr instruction.
#10229
- Cranelift now supports emitting the x64 shld instruction.
#10233
- Initial support for the stack-switching proposal has started to land, but it
is not complete just yet.
#10251
#10265
#10255
Changed
- Pulley's implementation of loads/stores to linear memory has changed to
better support optimizations and reduction of interpreter opcodes in the
final binary.
#10154
- Cranelift's verifier now ensures that integers used as address types have the
correct width.
#10209
- Wasmtime and Cranelift's minimum supported version of Rust is now 1.83.0.
#10264
- Wasmtime now mentions the filename when the input cannot be opened on the CLI.
#10292
- All types are now generated in component::bindgen!, even if they're not
reachable.
#10311
- Tables allocated with the system allocator now use alloc_zeroed (aka
calloc) for allocation.
#10313
Fixed
- GC: the is-null-or-i31ref checks have been fixed.
#10221
- GC: an incorrect assertion and canonicalized types for runtime usage has been
fixed.
#10223
- GC: subtype checks for imported globals during instantiation have been fixed.
#10304
- GC: exposing references to wasm in the gc_alloc_raw libcall has been fixed.
#10322
- Winch's fuel checks correctly sync fuel before the check now.
#10231
- Winch's treatment of stores and other trapping ops has been fixed on AArch64.
#10201
- Winch's handling of the shadow stack pointer has been fixed on AArch64.
#10263
- Winch's handling of address calculations has been fixed on AArch64.
#10297
- Winch's handling of multivalue return of constants has ben fixed.
#10315

29.0.1
Released 2025-01-21.
Fixed
- Fix a missing increment in WASIp1-to-WASIp2 adapter which affected WASI
configurations that have multiple preopened directories.
#10064

24.0.9
Released 2026-05-21.
Fixed
- WASI path_open(TRUNCATE) bypasses FilePerms::WRITE host restriction.
GHSA-2r75-cxrj-cmph