Releases

Runtime leak fixes: treesitter native cleanup, HTTP body channel buffering, and ratelimit request-driven cleanup.

Adds dedicated WASM worker-class scheduling with optional CPU isolation, ships the latest wasm-runtime with preview1 WASI env/mount support for core modules, centralizes entry/env config resolution, expands hub package inspection and cache management, fixes large and streaming S3 multipart uploads, and moves frame-context option application behind generic fail-closed resolvers for function and process dispatch.

Adds a bounded-memory Lua archive module with random access for zip/tar, streaming read/write support for zip/tar/tar.gz/tar.zst, guarded extraction, archive limits, and app integration tests. Exports app runtime profiles from .wippy.yaml into packed metadata while keeping profile selection app-scoped. Adds bounded process exec support, fixes WASI preview2 fs/clocks for Rust std components, and refreshes AWS/sqlite dependencies.

Guards cyclic Lua table conversion against infinite recursion (#390). Adds a lint error for require() of modules not declared in an entry's imports/modules, with the ambient module set single-sourced and shared by the runtime and linter (#393).

Added runtime config profiles, per-chunk Lua/import privilege scoping, and an eval compile cache, with a fix for wasm runtime reactor start issues.

Release 0.3.10a ships retained WASM worker recycling after high-water memory use, global binary byte-list result handling for WASM/Lua payloads, the updated wasm-runtime pin, and Go dependency refreshes for OpenTelemetry OTLP exporters, coder/websocket, and klauspost/compress.

Harden live runtime updates and security-context propagation: SQL/CDC env-backed configuration now fails safely, SQL pools swap live without dropping active borrows, contracts/functions preserve ambient actor and scope, scheduler upgrades keep process identity, and embedded pack, hub integrity/download, and Rust-std WASI component fixes are included.

Fix Temporal workflow and activity type names for namespace-less/external workflows, and harden embedded filesystem module updates so live installs, unpacking, and pack swaps preserve runtime files safely.

Expose memberlist probe and ping tuning for clustered runtimes, including probe interval, probe timeout, TCP timeout, and suspicion multiplier configuration.

Adds CDC Lua stream subscriptions, native Postgres CDC fanout, CRDT tombstone GC hardening, registry/hub dependency resolution hardening, command registration hardening, and dependency updates.