Wasmtime

Latest version: v20.0.0

Safety actively analyzes 630656 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 7 of 17

9.0.0

Not secure
Released 2023-05-22.

Added

* Initial integration of the Winch baseline compiler into Wasmtime is
implemented. Note that Winch still does not support much of WebAssembly, but
intrepid explorers may have an easier time playing around with it now.
[6119](https://github.com/bytecodealliance/wasmtime/pull/6119)

* The `wasmtime` CLI now has flags to limit memory, instances, and tables. For
example `--max-memory-size` or `--max-tables`. Additionally it has a new
`--trap-on-grow-failure` option to force a trap whenever a `memory.grow` would
otherwise fail which can be useful for debugging modules which may be
encountering OOM.
[6149](https://github.com/bytecodealliance/wasmtime/pull/6149)

* An initial implementation of the wasi-http proposal was added to Wasmtime in
the shape of a new `wasmtime-wasi-http` crate and a
`--wasi-modules=experimental-wasi-http` CLI flag. Note that this is not
on-by-default and still in an experimental status at this time.
[5929](https://github.com/bytecodealliance/wasmtime/pull/5929)

* Wasmtime's `bindgen!` macro for components now has `interfaces` and
`with` options to configure use of interfaces defined externally in separate
crates.
[6160](https://github.com/bytecodealliance/wasmtime/pull/6160)
[6210](https://github.com/bytecodealliance/wasmtime/pull/6210)

* Wasmtime's `bindgen!` macro emits trace events for arguments and results
when enabled.
[6209](https://github.com/bytecodealliance/wasmtime/pull/6209)

* A new `Engine::precompile_compatibility_hash` method has been added to assist
with hashing artifacts to be compatible with versions of Wasmtime.
[5826](https://github.com/bytecodealliance/wasmtime/pull/5826)

* Wasmtime's C API now has functions for enabling the WebAssembly relaxed-simd
proposal.
[6292](https://github.com/bytecodealliance/wasmtime/pull/6292)

* A new `--emit-clif` flag has been added to `wasmtime compile` to see the CLIF
corresponding to a WebAssembly module to be used for debugging.
[6307](https://github.com/bytecodealliance/wasmtime/pull/6307)

* Support for an in-process sampling-based profiler has been added to Wasmtime.
This is intended to be used in conjunction with epochs to enable relatively
simple implementations of profiling a guest module.
[6282](https://github.com/bytecodealliance/wasmtime/pull/6282)

Changed

* Overhauled the way that Wasmtime calls into Wasm and Wasm calls back out to
the host. Instead of chaining together trampolines to convert between calling
conventions, we now represent `funcref`s with multiple function pointers, one
per calling convention. This paves the way for supporting Wasm tail calls and
also results in ~10% speed ups to a variety of function call benchmarks,
however there are some slight compiled Wasm module code size regressions
(which can be alleviated by disabling optional `.eh_frame`
generation). Additionally, in the C API the `wasmtime_func_call_unchecked`
function gained one more parameter, which is the capacity of the
args-and-results
buffer.
[6262](https://github.com/bytecodealliance/wasmtime/pull/6262)

* The `wasmtime compile` command will now default to producing executables for
the native host and its CPU features instead of the baseline feature set of
the host's architecture.
[6152](https://github.com/bytecodealliance/wasmtime/pull/6152)

* The `ResourceLimiter` trait and its `async` equivalent now support returning
errors from growth to force a trap in the wasm module rather than reporting
-1 to the wasm module. Note that this is primarily intended for debugging.
[6149](https://github.com/bytecodealliance/wasmtime/pull/6149)

* The non-egraph-based optimization pipeline has been removed from Cranelift,
and the corresponding `Config::use_egraphs` option is also removed.
[6167](https://github.com/bytecodealliance/wasmtime/pull/6167)

* Generated types for WIT files now always generates owned types by default.
[6189](https://github.com/bytecodealliance/wasmtime/pull/6189)

* Wasmtime's baseline x86\_64 CPU features required for SIMD support has been
lowered from SSE 4.2 to SSE 4.1.
[6206](https://github.com/bytecodealliance/wasmtime/pull/6206)

* The `fd_allocate` implementation in Wasmtime will now always fail with
`ENOTSUP`.
[6217](https://github.com/bytecodealliance/wasmtime/pull/6217)

* The "rights" system in WASI has been removed and rights are no longer
inspected in the implementation of any WASI functions.
[6265](https://github.com/bytecodealliance/wasmtime/pull/6265)

Fixed

* WASI can now open directories without `O_DIRECTORY`.
[6163](https://github.com/bytecodealliance/wasmtime/pull/6163)

* The `poll_oneoff` function has been fixed when handling non-regular files.
[6258](https://github.com/bytecodealliance/wasmtime/pull/6258)

* The behavior of `path_readlink` on too-small buffers has been fixed to
truncate.
[6225](https://github.com/bytecodealliance/wasmtime/pull/6225)

Cranelift changes

> Note: this section documents changes to Cranelift, a code generator backend
> that Wasmtime uses. These changes are not always applicable to Wasmtime as a
> WebAssembly runtime but may be interesting to other projects which embed or
> use Cranelift.

* New `{u,s}{add,sub,mul}_overflow` instructions have been added.
[5784](https://github.com/bytecodealliance/wasmtime/pull/5784)

* The `iadd_cout` and `isub_bout` instructions have been removed.
[6198](https://github.com/bytecodealliance/wasmtime/pull/6198)

* ISLE now supports binary and octal integer literals.
[6234](https://github.com/bytecodealliance/wasmtime/pull/6234)

* An implementation of SIMD for RISC-V has started.
[6240](https://github.com/bytecodealliance/wasmtime/pull/6240)
[6266](https://github.com/bytecodealliance/wasmtime/pull/6266)
[6268](https://github.com/bytecodealliance/wasmtime/pull/6268)

--------------------------------------------------------------------------------

8.0.1

Not secure
Released 2023-04-27.

Changed

* Breaking: Files opened using Wasmtime's implementation of WASI on Windows now
cannot be deleted until the file handle is closed. This was already true for
open directories. The change was necessary for the bug fix in
[6163](https://github.com/bytecodealliance/wasmtime/pull/6163).

Fixed

* Fixed wasi-common's implementation of the `O_DIRECTORY` flag to match POSIX.
[6163](https://github.com/bytecodealliance/wasmtime/pull/6163)

* Undefined Behavior in Rust runtime functions
[GHSA-ch89-5g45-qwc7](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ch89-5g45-qwc7)

--------------------------------------------------------------------------------

8.0.0

Not secure
Released 2023-04-20

Added

* Allow the MPL-2.0 and OpenSSL licenses in dependencies of wasmtime.
[6136](https://github.com/bytecodealliance/wasmtime/pull/6136)

* Add a bounds-checking optimization for dynamic memories and guard pages.
[6031](https://github.com/bytecodealliance/wasmtime/pull/6031)

* Add support for generating perf maps for simple perf profiling. Additionally,
the `--jitdump` and `--vtune` flags have been replaced with a single
`--profile` flags that accepts `perfmap`, `jitdump`, and `vtune` arguments.
[6030](https://github.com/bytecodealliance/wasmtime/pull/6030)

* Validate faulting addresses are valid to fault on. As a mitigation to CVEs
like `GHSA-ff4p-7xrq-q5r8`, check that the address involved in a fault is one
that could be contained in a `Store`, or print a scary message and abort
immediately.
[6028](https://github.com/bytecodealliance/wasmtime/pull/6028)

* Add the `--default-values-unknown-imports` option to define unknown function
imports as functions that return the default value for their result type.
[6010](https://github.com/bytecodealliance/wasmtime/pull/6010)

* Add `Clone` for `component::InstancePre`.
[5996](https://github.com/bytecodealliance/wasmtime/issues/5996)

* Add `--dynamic-memory-reserved-for-growth` cli flag.
[5980](https://github.com/bytecodealliance/wasmtime/issues/5980)

* Introduce the `wasmtime-explorer` crate for investigating the compilation of
wasm modules. This functionality is also exposed via the `wasmtime explore`
command.
[5975](https://github.com/bytecodealliance/wasmtime/pull/5975)

* Added support for the Relaxed SIMD proposal.
[5892](https://github.com/bytecodealliance/wasmtime/pull/5892)

* Cranelift gained many new machine-independent optimizations.
[5909](https://github.com/bytecodealliance/wasmtime/pull/5909)
[6032](https://github.com/bytecodealliance/wasmtime/pull/6032)
[6033](https://github.com/bytecodealliance/wasmtime/pull/6033)
[6034](https://github.com/bytecodealliance/wasmtime/pull/6034)
[6037](https://github.com/bytecodealliance/wasmtime/pull/6037)
[6052](https://github.com/bytecodealliance/wasmtime/pull/6052)
[6053](https://github.com/bytecodealliance/wasmtime/pull/6053)
[6072](https://github.com/bytecodealliance/wasmtime/pull/6072)
[6095](https://github.com/bytecodealliance/wasmtime/pull/6095)
[6130](https://github.com/bytecodealliance/wasmtime/pull/6130)

Changed

* Derive `Copy` on `wasmtime::ValType`.
[6138](https://github.com/bytecodealliance/wasmtime/pull/6138)

* Make `StoreContextMut` accessible in the epoch deadline callback.
[6075](https://github.com/bytecodealliance/wasmtime/pull/6075)

* Take SIGFPE signals for divide traps on `x86_64`.
[6026](https://github.com/bytecodealliance/wasmtime/pull/6026)

* Use more specialized AVX instructions in the `x86_64` backend.
[5924](https://github.com/bytecodealliance/wasmtime/pull/5924)
[5930](https://github.com/bytecodealliance/wasmtime/pull/5930)
[5931](https://github.com/bytecodealliance/wasmtime/pull/5931)
[5982](https://github.com/bytecodealliance/wasmtime/pull/5982)
[5986](https://github.com/bytecodealliance/wasmtime/pull/5986)
[5999](https://github.com/bytecodealliance/wasmtime/pull/5999)
[6023](https://github.com/bytecodealliance/wasmtime/pull/6023)
[6025](https://github.com/bytecodealliance/wasmtime/pull/6025)
[6060](https://github.com/bytecodealliance/wasmtime/pull/6060)
[6086](https://github.com/bytecodealliance/wasmtime/pull/6086)
[6092](https://github.com/bytecodealliance/wasmtime/pull/6092)

* Generate more cache-friendly code for traps.
[6011](https://github.com/bytecodealliance/wasmtime/pull/6011)

Fixed

* Fixed suboptimal code generation in the `aarch64` backend.
[5976](https://github.com/bytecodealliance/wasmtime/pull/5976)
[5977](https://github.com/bytecodealliance/wasmtime/pull/5977)
[5987](https://github.com/bytecodealliance/wasmtime/pull/5987)
[5997](https://github.com/bytecodealliance/wasmtime/pull/5997)
[6078](https://github.com/bytecodealliance/wasmtime/pull/6078)

* Fixed suboptimal code generation in the `riscv64` backend.
[5854](https://github.com/bytecodealliance/wasmtime/pull/5854)
[5857](https://github.com/bytecodealliance/wasmtime/pull/5857)
[5919](https://github.com/bytecodealliance/wasmtime/pull/5919)
[5951](https://github.com/bytecodealliance/wasmtime/pull/5951)
[5964](https://github.com/bytecodealliance/wasmtime/pull/5964)
[6087](https://github.com/bytecodealliance/wasmtime/pull/6087)


--------------------------------------------------------------------------------

7.0.1

Released 2023-04-27.

Fixed

* Undefined Behavior in Rust runtime functions
[GHSA-ch89-5g45-qwc7](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ch89-5g45-qwc7)

--------------------------------------------------------------------------------

7.0.0

Not secure
Released 2023-03-20

Added

* An initial implementation of the wasi-threads proposal has been implemented
and landed in the Wasmtime CLI. This is available behind a
`--wasi-modules experimental-wasi-threads` flag.
[5484](https://github.com/bytecodealliance/wasmtime/pull/5484)

* Support for WASI sockets has been added to the C API.
[5624](https://github.com/bytecodealliance/wasmtime/pull/5624)

* Support for limiting `Store`-based resource usage, such as memory, tables,
etc, has been added to the C API.
[5761](https://github.com/bytecodealliance/wasmtime/pull/5761)

* A top level alias of `anyhow::Result` as `wasmtime::Result` has been added to
avoid the need to explicitly depend on `anyhow`.
[5853](https://github.com/bytecodealliance/wasmtime/pull/5853)

* Initial support for the WebAssembly core dump format has been added to the CLI
with a `--coredump-on-trap` flag.
[5868](https://github.com/bytecodealliance/wasmtime/pull/5868)

Changed

* The `S` type parameter on component-related methods has been removed.
[5722](https://github.com/bytecodealliance/wasmtime/pull/5722)

* Selection of a `world` to bindgen has been updated to select any `default
world` in a WIT package if there is only one.
[5779](https://github.com/bytecodealliance/wasmtime/pull/5779)

* WASI preopened file descriptors can now be closed.
[5828](https://github.com/bytecodealliance/wasmtime/pull/5828)

* The host traits generated by the `bindgen!` macro are now always named `Host`,
but are still scoped to each individual module.
[5890](https://github.com/bytecodealliance/wasmtime/pull/5890)

Fixed

* Components which have `type` imports are now supported better and error/panic
in fewer cases.
[5777](https://github.com/bytecodealliance/wasmtime/pull/5777)

* Types referred to by `wasmtime::component::Val` are now reexported under
`wasmtime::component`.
[5790](https://github.com/bytecodealliance/wasmtime/pull/5790)

* A panic due to a race between `memory.atomic.{wait32,wait64,notify}`
instructions has been fixed.
[5871](https://github.com/bytecodealliance/wasmtime/pull/5871)

* Guest-controlled out-of-bounds read/write on x86\_64
[GHSA-ff4p-7xrq-q5r8](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ff4p-7xrq-q5r8)

* Miscompilation of `i8x16.select` with the same inputs on x86\_64
[GHSA-xm67-587q-r2vw](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xm67-587q-r2vw)

--------------------------------------------------------------------------------

6.0.2

Released 2023-04-27.

Fixed

* Undefined Behavior in Rust runtime functions
[GHSA-ch89-5g45-qwc7](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-ch89-5g45-qwc7)

--------------------------------------------------------------------------------

Page 7 of 17

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.