What's Changed

• Add implements to canary builds. by @jfleitz in #5305
• chore: move back to wash from wkg by @ricochet in #5310
• fix: default backends for wasmcloud:{keyvalue,blobstore} by @ricochet in #5309
• ci(release): chart and app in lockstep by @ricochet in #5307
• chore(codeowners): only req example maintainers for new example by @ricochet in #5313
• chore(deps): bump the all-github-actions group across 4 directories with 8 updates by @dependabot[bot] in #5319
• chore(deps): bump the all-go group across 1 directory with 4 updates by @dependabot[bot] in #5318
• chore: bump for cargo-audit by @ricochet in #5321
• feat: wasmcloud:postgres async by @ricochet in #5315
• oci reg example by @ricochet in #5311
• feat(washlet): add ClusterHost::start that passes back API control by @vados-cosmonic in #5323
• feat(wash): resolve WIT and wkg config by @ricochet in #5324
• fix(wash-runtime): recognize P3 wasi:http/handler as host-served HTTP by @ricochet in #5325
• release: v2.5.2 by @automation-wasmcloud in #5326

Full Changelog: v2.5.1...v2.5.2

What's Changed

• test(runtime-operator): cover host controller reconcile paths by @ricochet in #5300
• Add endpointslices/restricted virtual resource to RBAC by @jfleitz in #5302
• async backends by @ricochet in #5297
• chore: wasm-pkg-client by @ricochet in #5304
• release: v2.5.1 by @automation-wasmcloud in #5306
• release: v2.5.1 by @automation-wasmcloud in #5308

Full Changelog: v2.5.0...v2.5.1

What's Changed

• ci: set CARGO_NET_RETRY by @ricochet in #5265
• fix(wit): accept package-level refs in validate_interface_ref, fix remove with version by @immanuwell in #5247
• fix(wash-runtime): stream P3 HTTP responses and release timed-out gRPC bodies by @ricochet in #5264
• chore(deps): bump the all-github-actions group across 3 directories with 2 updates by @dependabot[bot] in #5274
• feat(wash-runtime): make engine config composable via WasmProposal by @Aditya1404Sal in #5254
• chore(deps): bump the all-go group across 2 directories with 4 updates by @dependabot[bot] in #5273
• feat(examples): add http-hello-world-persistent-storage by @ericgregory in #5272
• fix: rust-sec-2026-0185 quinn-proto by @ricochet in #5277
• chore(templates): drop redundant wasi:http export from http-hello-world world.wit by @ericgregory in #5278
• feat: update to wasmtime 46 and enable wasip3 by default by @ricochet in #5258
• fix: ignore trailing slashes when deriving wash new project names by @immanuwell in #5269
• ci: run jobs when their workflow file is modified by @ricochet in #5281
• surface wasm proposals to cli and chart by @ricochet in #5276
• Operator caching->server side apply fix by @jfleitz in #5282
• ci: add s390x binary by @ricochet in #5283
• fix(docs): update readme for wasmCloud v2 by @ericgregory in #5288
• feat(wit): add async wasmcloud:keyvalue and wasmcloud:blobstore by @ricochet in #5286
• feat(wash-runtime): multiplex wasi:keyvalue via (implements ..) imports by @ricochet in #5279
• implements e2e operator by @ricochet in #5285
• feat(charts): lint and harden the runtime-operator chart by @ricochet in #5287
• fix(wash): support Windows-style paths in wash new names by @immanuwell in #5290
• ci(wit): publish to namespaced OCI path so packages resolve by @ricochet in #5292
• feat(wash-runtime): multiplex wasmcloud:postgres via (implements ..) imports by @ricochet in #5291
• feat(wash-runtime): multiplex wasmcloud:messaging/consumer by @ricochet in #5289
• chore(deps): bump the all-go group across 2 directories with 5 updates by @dependabot[bot] in #5293
• chore(deps): bump the all-github-actions group across 2 directories with 3 updates by @dependabot[bot] in #5294
• feat(wit)!: share keyvalue bucket via a types interface by @ricochet in #5296
• fix: support multiline world declarations in wash wit add by @immanuwell in #5295
• feat(runtime): support wasip3 cross-component streams via dynamic linker by @Aditya1404Sal in #5171
• Only update LastSeen if no change to metadata by @jfleitz in #5298
• fix(runtime): wrap ephemeral tasks to AbortOnDrop by @ricochet in #5299
• release: v2.5.0 by @automation-wasmcloud in #5301

Full Changelog: v2.4.0...v2.5.0

What's Changed

• ci(bench): wait for host load to settle by @ricochet in #5234
• Have container health use NATs connectivity status by @jfleitz in #5235
• runtime-operator chart: optional hostGroups passthrough fields by @CharlesV1234 in #5219
• docs: fix stale wash project structure in contributing guide by @immanuwell in #5218
• chore(deps): bump the all-github-actions group across 2 directories with 3 updates by @dependabot[bot] in #5240
• chore(deps): bump the all-docker group across 2 directories with 1 update by @dependabot[bot] in #5238
• fix(wash): scope new.command to template config by @immanuwell in #5241
• feat: build wash for s390x-unknown-linux-gnu by @LiamRandall in #5236
• fix(dev): deliver workload values to every dev component by @ricochet in #5242
• multiple subscription workloads by @ricochet in #5243
• Add Autoscaling support for WorkloadDeployments by @jfleitz in #5244
• chore(deps): update postgres crates for RUSTSEC-2026-0178/1079/0180 by @jfleitz in #5250
• Allow for extra args and nats url to be set by @jfleitz in #5246
• chore(deps): bump the all-go group across 2 directories with 3 updates by @dependabot[bot] in #5251
• chore(deps): bump the all-github-actions group across 2 directories with 4 updates by @dependabot[bot] in #5253
• fix: create bucket on open by @Mees-Molenaar in #5229
• refactor(wash-runtime): improve host plugin API ergonomics by @if0ne in #5237
• chore: bump wasmtime to 45.0.2 by @Aditya1404Sal in #5256
• release: v2.4.0 by @automation-wasmcloud in #5255
• disable webgpu for s390 by @jfleitz in #5260
• Add s390 check in all webgpu locations by @jfleitz in #5262
• release main by @ricochet in #5261
• ci: remove s390 by @ricochet in #5263

New Contributors

• @Mees-Molenaar made their first contribution in #5229

Full Changelog: v2.3.0...v2.4.0

What's Changed

• feat(wash): workload env/config/secrets by @ricochet in #5117
• bench infra by @ricochet in #5153
• feat(wash-runtime): namespace host plugin spans by WIT package by @ricochet in #5188
• ci: unblock off-cycle dispatch and de-flake gates by @ricochet in #5192
• ci(release-tag): pin previous_tag_name when generating release notes by @ricochet in #5191
• ci(runtime-operator): guard RBAC drift by @ricochet in #5187
• chore: wasmtime 44.0.2 security patch by @ricochet in #5195
• ci: reclaim space by @ricochet in #5196
• fix(wash): git detect_source_type by @ricochet in #5197
• chore(deps): bump zizmorcore/zizmor-action from 0.5.4 to 0.5.5 in the all-github-actions group across 1 directory by @dependabot[bot] in #5199
• chore(deps): bump the all-docker group across 2 directories with 1 update by @dependabot[bot] in #5198
• feat(examples/otel-config): demo workload env/config/secrets by @ricochet in #5127
• chore(deps): bump the all-go group across 1 directory with 4 updates by @dependabot[bot] in #5202
• chore(deps): bump the all-github-actions group across 2 directories with 2 updates by @dependabot[bot] in #5203
• fix: support commit SHAs in wash new --git-ref by @immanuwell in #5201
• test(wash-runtime): stub egress in allowed_hosts integration by @ricochet in #5204
• chore: upgrade wasmtime to 45 by @ricochet in #5206
• wasi-otel rc2 by @ricochet in #5205
• Support runtime.wasmcloud.dev apiGroup RBAC to be namespaced vs Cluster by @jfleitz in #5208
• chore(wash-runtime): use format string interpolation and fix eprintln in error handlers by @immanuwell in #5207
• feat(wash-runtime): record HTTP response status on request spans by @ricochet in #5210
• test(runtime-operator): cover watchNamespaces RBAC scoping by @ricochet in #5209
• refactor(bench): rename iai-callgrind → gungraun and bump to 0.19.1 by @ricochet in #5211
• chore: lowercase error context messages to match conventions by @immanuwell in #5212
• fix(bench): mark shell scripts executable by @ricochet in #5213
• chore(deps): bump the all-go group across 2 directories with 2 updates by @dependabot[bot] in #5216
• chore(deps): bump the all-github-actions group across 5 directories with 7 updates by @dependabot[bot] in #5217
• test(runtime-operator): add fuzz tests by @ricochet in #5172
• chore(lint): inline format args and enforce lowercase context casing by @ricochet in #5215
• ci: CodeQL free-disk-space by @ricochet in #5221
• chore(lint): pin Rust to 1.96.0 and make clippy --all-targets clean by @ricochet in #5225
• ci(wash): build and publish a wasip3 canary image by @ricochet in #5227
• refactor(wash-runtime): harden p3 sockets by @ricochet in #5222
• refactor(wash-runtime): build wasm test fixtures via xtask by @ricochet in #5220
• Fix In-memory blobstore default by @ricochet in #5223
• chore: test dynamic router removes aliases by @ricochet in #5224
• feat(examples): demonstrate cross-workload OTel trace roll-up by @ricochet in #5226
• fix(deps): patch reported security advisories by @ricochet in #5230
• fix(release-train): derive Cargo.lock guard allowlist by @ricochet in #5231
• release: v2.3.0 by @automation-wasmcloud in #5232
• ci: install rust targets by @ricochet in #5233

New Contributors

• @immanuwell made their first contribution in #5201

Full Changelog: v2.2.1...v2.3.0

What's Changed

• ci(release-tag): dispatch wasmcloud.com on release to bump docs version by @ericgregory in #5189
• Update RBAC to ensure Update verb for Wasm objects by @jfleitz in #5186

Full Changelog: v2.0.5...v2.2.1

v2.2.0

wash-runtime

• Add WASI Preview 3 wasi:tls support (#5113)

wash CLI

• Extend wash config with init formats, cleanup, and validation (#5140)
• Honor --non-interactive in wash new (#5154)
• Improve install.sh error messages (#5144)
• Handle musl-on-glibc systems correctly (#5135)

runtime-operator

• WorkloadRouteReconciler writes pod IP instead of OS hostname (#5155)
• Use namespace role when watchNamespaces is set (#5138)

HTTP runtime

• New OutgoingHandler trait for customizable outgoing request handling (#5014)

WIT interfaces

• Publish wasmCloud interfaces to GHCR (#5149)

CI / release infrastructure

• Release-train automation, canary build hardening, codeql, scorecard, status-gate pattern, OCI promote idempotency, skip-propagation fixes (PRs #5121, #5139, #5142,
  #5143, #5145–5151, #5158–5184, plus ~15 dependabot bumps)

New Contributors

• @dutchaiagency in #5121
• @CharlesV1234 in #5155

Full Changelog: v2.1.0...v2.2.0

What's Changed

• fix(http): return typed RouteError with accurate HTTP status codes by @Aditya1404Sal in #5082
• chore: rm passing wash prefix to brew by @dphilla in #5083
• feat: Expand DevRouter and DynamicRouter Tests by @Aditya1404Sal in #5064
• chore: upgrade async-nats to 0.47 by @ricochet in #5087
• [bugfix] Add port name to hello-world by @jfleitz in #5090
• Fix workload readiness for NATS subs by @ricochet in #5086
• docs(templates): reorganize Rust templates and add HTTP handler set by @ericgregory in #5084
• ci: re-enable dependabot for main and release-1.9.x by @officialasishkumar in #5035
• chore(deps): bump the all-docker group across 2 directories with 1 update by @dependabot[bot] in #5091
• chore: upgrade to go 1.26 by @ricochet in #5095
• chore(deps): bump the all-github-actions group across 6 directories with 24 updates by @dependabot[bot] in #5093
• chore(deps): bump the all-go group across 2 directories with 12 updates by @dependabot[bot] in #5092
• fix(test): wait on the host by @ricochet in #5100
• fix(operator): gate WorkloadDeployment Ready on replica availability by @ricochet in #5101
• chore(security): bump wasmtime, drop rustls-pemfile, add cargo audit by @ricochet in #5102
• ci: automated release train by @ricochet in #5098
• ci: disable 1.9 dependabot by @ricochet in #5097
• fix: remove canary-v2 now that canary exists by @ricochet in #5104
• chore(deps): bump the all-go group across 1 directory with 3 updates by @dependabot[bot] in #5103
• ci: fix sed for release-train by @ricochet in #5105
• backout publishing wash-runtime by @ricochet in #5106
• release: v2.0.6 by @automation-wasmcloud in #5107
• harden release train CI by @ricochet in #5108
• pass sha input for release-tag by @ricochet in #5109
• chore(deps): bump the all-github-actions group across 2 directories with 1 update by @dependabot[bot] in #5112
• chore(deps): bump go.wasmcloud.dev/runtime-operator/v2 from 2.0.5 to 2.0.6 in /runtime-gateway in the all-go group across 1 directory by @dependabot[bot] in #5111
• ci: make package-manager publishing best-effort by @ricochet in #5110
• fix(dev): friendly url by @ricochet in #5114
• ci: OpenSSF Scorecard workflow by @ricochet in #5115
• ci: fix scorecard publish and harden workflows by @ricochet in #5118
• Revert "ci: fix scorecard publish and harden workflows" by @ricochet in #5119
• ci: lint workflows and actions by @ricochet in #5120
• ci(zizmor): grant write for security upload by @ricochet in #5123
• release: v2.0.7 by @automation-wasmcloud in #5124
• feat: support plugins in services by @MendyBerger in #5122
• Add micro benchmarks for http invocation by @ricochet in #5063
• docs(governance): MAINTAINERS.md with ci-maintainers by @ricochet in #5130
• ci: hardening with zizmor by @ricochet in #5129
• ci: docker images without the v by @ricochet in #5131
• Add Host location and namespace deployment support by @jfleitz in #5128
• ci: add codeql workflow by @ricochet in #5133
• release: v2.1.0 by @automation-wasmcloud in #5134

New Contributors

• @officialasishkumar made their first contribution in #5035
• @MendyBerger made their first contribution in #5122

Full Changelog: v2.0.5...v2.1.0

What's Changed

• fix(http): return typed RouteError with accurate HTTP status codes by @Aditya1404Sal in #5082
• chore: rm passing wash prefix to brew by @dphilla in #5083
• feat: Expand DevRouter and DynamicRouter Tests by @Aditya1404Sal in #5064
• chore: upgrade async-nats to 0.47 by @ricochet in #5087
• [bugfix] Add port name to hello-world by @jfleitz in #5090
• Fix workload readiness for NATS subs by @ricochet in #5086
• docs(templates): reorganize Rust templates and add HTTP handler set by @ericgregory in #5084
• ci: re-enable dependabot for main and release-1.9.x by @officialasishkumar in #5035
• chore(deps): bump the all-docker group across 2 directories with 1 update by @dependabot[bot] in #5091
• chore: upgrade to go 1.26 by @ricochet in #5095
• chore(deps): bump the all-github-actions group across 6 directories with 24 updates by @dependabot[bot] in #5093
• chore(deps): bump the all-go group across 2 directories with 12 updates by @dependabot[bot] in #5092
• fix(test): wait on the host by @ricochet in #5100
• fix(operator): gate WorkloadDeployment Ready on replica availability by @ricochet in #5101
• chore(security): bump wasmtime, drop rustls-pemfile, add cargo audit by @ricochet in #5102
• ci: automated release train by @ricochet in #5098
• ci: disable 1.9 dependabot by @ricochet in #5097
• fix: remove canary-v2 now that canary exists by @ricochet in #5104
• chore(deps): bump the all-go group across 1 directory with 3 updates by @dependabot[bot] in #5103
• ci: fix sed for release-train by @ricochet in #5105
• backout publishing wash-runtime by @ricochet in #5106
• release: v2.0.6 by @automation-wasmcloud in #5107
• harden release train CI by @ricochet in #5108
• pass sha input for release-tag by @ricochet in #5109
• chore(deps): bump the all-github-actions group across 2 directories with 1 update by @dependabot[bot] in #5112
• chore(deps): bump go.wasmcloud.dev/runtime-operator/v2 from 2.0.5 to 2.0.6 in /runtime-gateway in the all-go group across 1 directory by @dependabot[bot] in #5111
• ci: make package-manager publishing best-effort by @ricochet in #5110
• fix(dev): friendly url by @ricochet in #5114
• ci: OpenSSF Scorecard workflow by @ricochet in #5115
• ci: fix scorecard publish and harden workflows by @ricochet in #5118
• Revert "ci: fix scorecard publish and harden workflows" by @ricochet in #5119
• ci: lint workflows and actions by @ricochet in #5120
• ci(zizmor): grant write for security upload by @ricochet in #5123
• release: v2.0.7 by @automation-wasmcloud in #5124

New Contributors

• @officialasishkumar made their first contribution in #5035

Full Changelog: v2.0.5...v2.0.7

What's Changed

• fix(http): return typed RouteError with accurate HTTP status codes by @Aditya1404Sal in #5082
• chore: rm passing wash prefix to brew by @dphilla in #5083
• feat: Expand DevRouter and DynamicRouter Tests by @Aditya1404Sal in #5064
• chore: upgrade async-nats to 0.47 by @ricochet in #5087
• [bugfix] Add port name to hello-world by @jfleitz in #5090
• Fix workload readiness for NATS subs by @ricochet in #5086
• docs(templates): reorganize Rust templates and add HTTP handler set by @ericgregory in #5084
• ci: re-enable dependabot for main and release-1.9.x by @officialasishkumar in #5035
• chore(deps): bump the all-docker group across 2 directories with 1 update by @dependabot[bot] in #5091
• chore: upgrade to go 1.26 by @ricochet in #5095
• chore(deps): bump the all-github-actions group across 6 directories with 24 updates by @dependabot[bot] in #5093
• chore(deps): bump the all-go group across 2 directories with 12 updates by @dependabot[bot] in #5092
• fix(test): wait on the host by @ricochet in #5100
• fix(operator): gate WorkloadDeployment Ready on replica availability by @ricochet in #5101
• chore(security): bump wasmtime, drop rustls-pemfile, add cargo audit by @ricochet in #5102
• ci: automated release train by @ricochet in #5098
• ci: disable 1.9 dependabot by @ricochet in #5097
• fix: remove canary-v2 now that canary exists by @ricochet in #5104
• chore(deps): bump the all-go group across 1 directory with 3 updates by @dependabot[bot] in #5103
• ci: fix sed for release-train by @ricochet in #5105
• backout publishing wash-runtime by @ricochet in #5106
• release: v2.0.6 by @automation-wasmcloud in #5107

New Contributors

• @officialasishkumar made their first contribution in #5035

Full Changelog: v2.0.5...v2.0.6