Releases

Fix Hub dependency install/update/uninstall reliability by canonicalizing dependency root IDs.

Fix profile-safe Hub dependency install/update planning and registry history replay.

Runtime dependency uninstall now preserves live imported entries during Hub uninstall/update planning.

Runtime leak fixes: treesitter native cleanup, HTTP body channel buffering, and ratelimit request-driven cleanup.

Adds dedicated WASM worker-class scheduling with optional CPU isolation, ships the latest wasm-runtime with preview1 WASI env/mount support for core modules, centralizes entry/env config resolution, expands hub package inspection and cache management, fixes large and streaming S3 multipart uploads, and moves frame-context option application behind generic fail-closed resolvers for function and process dispatch.

Adds a bounded-memory Lua archive module with random access for zip/tar, streaming read/write support for zip/tar/tar.gz/tar.zst, guarded extraction, archive limits, and app integration tests. Exports app runtime profiles from .wippy.yaml into packed metadata while keeping profile selection app-scoped. Adds bounded process exec support, fixes WASI preview2 fs/clocks for Rust std components, and refreshes AWS/sqlite dependencies.

Guards cyclic Lua table conversion against infinite recursion (#390). Adds a lint error for require() of modules not declared in an entry's imports/modules, with the ambient module set single-sourced and shared by the runtime and linter (#393).

Added runtime config profiles, per-chunk Lua/import privilege scoping, and an eval compile cache, with a fix for wasm runtime reactor start issues.

Release 0.3.10a ships retained WASM worker recycling after high-water memory use, global binary byte-list result handling for WASM/Lua payloads, the updated wasm-runtime pin, and Go dependency refreshes for OpenTelemetry OTLP exporters, coder/websocket, and klauspost/compress.

Harden live runtime updates and security-context propagation: SQL/CDC env-backed configuration now fails safely, SQL pools swap live without dropping active borrows, contracts/functions preserve ambient actor and scope, scheduler upgrades keep process identity, and embedded pack, hub integrity/download, and Rust-std WASI component fixes are included.