v2.6.0

Spin 2.6.0

The 2.6.0 release of Spin brings a number of features, improvements and bug fixes. There are also a few notable deprecations and breaking changes.

🚀 Some highlights in 2.6.0 at a glance

• Dynamic detection of support for Wasmtime's pooling allocator: #2508
• Components in a Spin App manifest can now be referenced by registry: #2524
• Spin can now run a wasm file as a Spin App without requiring a manifest: #2479
• Spin's listening address can now be overidden via SPIN_HTTP_LISTEN_ADDR: #2547
• Spin's data directory can now be overidden via SPIN_DATA_DIR: #2568

🐞 Notable fixes

• Validation of the Spin App manifest at build-time: #2527
• Validation of variable keys at build-time: #2530
• Ensure the Spin application name is in kebab-case: #2531 (Thank you @brehen!)
• Fixes issues around spin watch build exclusions: #2554

💅 Miscellaneous

• Wasmtime has been upgraded to 21.0.1: #2531

⚠️ Deprecations

• Wasm modules compiled with wasi-sdk version < 19 are likely to contain a critical memory safety bug.
  Spin has deprecated execution of these modules and they will stop working in a future release.
  For more information, see: #2552

🚨 Breaking changes

• The upgrade to wasmtime 21 includes a breaking change to how headers are handled.
  Spin app guest modules can no longer set the Host header on outbound requests: #2575

As always, thanks to contributors old and new for helping improve Spin on a daily basis! 🎉

Verifying the Release Signature

After downloading the 2.6.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.6.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha a4ddd3921d9ea3d694774858408e918f3e5cec60 \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

Full changelog

• ref(*): Standardize on using tracing::* instead of tracing::log::* by @calebschoepp in #2498
• fix(docs): update release process to remove spin-macro consideration by @kate-goldenring in #2500
• Bump version to v2.6.0-pre0 by @kate-goldenring in #2499
• ref(telemetry): Provide the abililty to turn off the tracing-log compat layer in tracing-subscriber dep of telemetry by @calebschoepp in #2501
• spin templates install: allow --repo by @itowlson in #2504
• spin templates install: allow repo name instead of URL by @itowlson in #2505
• Dynamically detect support for Wasmtime's pooling allocator by @alexcrichton in #2508
• Update Wasmtime to 20.0.2 by @alexcrichton in #2512
• Lift http handler type discovery up a layer by @alexcrichton in #2373
• feat(oci/client.rs): add registry_from_input helper by @vdice in #2513
• Update to Wasmtime 21.0.0 by @alexcrichton in #2521
• feat(telemetry): Add a compatibility layer that emits app logs as tracing events. by @calebschoepp in #2511
• Try to load manifest during spin build by @itowlson in #2527
• Load components from a registry by @itowlson in #2524
• ref(oci/client): update unpack_archive_layer to take cache; make pub by @vdice in #2523
• Run a Wasm file as an application without a manifest by @itowlson in #2479
• Validate variable keys as part of schema by @itowlson in #2530
• fix(templates/../spin.toml): skewer spin application name like a kebab by @brehen in #2531
• spin build: build inline components by @itowlson in #2533
• feat(telemetry): Send logs to OTel collector directly using OTel libraries by @calebschoepp in #2516
• Upgrade to wasmtime 21.0.1 by @lann in #2538
• chore(loader): bump wasm-pkg-tools by @vdice in #2539
• feat(oci): add env var to force use of archive layers on push by @vdice in #2540
• allow overriding listen addr using env variable by @rajatjindal in #2547
• Strip trailing slash in allowed_outbound_hosts config. by @rylev in #2548
• fix StoreBuilder::inherit_limited_network by @dicej in #2541
• Fix exclusions in build.watch getting applied to all components by @itowlson in #2554
• Don't prompt to install templates if not interactive by @itowlson in #2558
• Run conformance tests by @rylev in #2542
• Update conformance test by @rylev in #2562
• Override local data directory via env variable by @itowlson in #2568
• [Backport v2.6] Add deprecation warning for uncomponentizable modules by @vdice in #2578
• chore(release): bumps for 2.6 release by @vdice in #2573

New Contributors

• @brehen made their first contribution in #2531

Full Changelog: v2.5.1...v2.6.0