Spin v2.0.0 🚀

We are excited to announce the release of Spin 2.0! This is the latest major release of Spin
which focuses on improving key scenarios for running WebAssembly applications.

What's new 💅

• Component support

  Spin 2.0 now supports running composed WebAssembly Components.
  Dive into the examples mentioned below for a demonstration of this functionality.

• Polyglot

  Thanks to composition, Spin application developers can build polyglot applications incorporating components
  built from any language with support for compiling into a WebAssembly component.

• Portability

  Spin has now standardized on wasi-http. This means components
  built by Spin can be run by other runtimes supporting the same wasi-http version.

• Performance

  Spin 2.0 brings a big performance boost, utilizing wasmtime's pooling allocator and no longer
  copying Request and Response bodies. In some cases, we've seen 10x the performance when compared to Spin 1.0!

  Note: For Linux hosts, there is a known pending performance fix in wasmtime#7475
  that will be ported to Spin as soon as available.

Check out the examples 👀

• Dive into the Http Auth Middleware example for a demonstration of
  using component composition to integrate an http auth middleware component into a Spin application.

• Experimental streaming support also ships in this release, enabling a whole new suite of scenarios for Spin
  application developers. See the Spin fileserver component for an example using this functionality.

Breaking changes ⚠️

• OCI distribution: We've updated the way we distribute Spin apps to enable upstream scenarios
  such as containerd and Kubernetes. This means pre-2.0 Spin clients won’t be able to pull or run Spin apps published by 2.0 Spin clients
  • Fix: update to the 2.0 version of Spin
• spin new / spin add - syntax is now spin new -t <template> <name>.
  • spin new <template> no longer works; however, spin new and spin new <template> <name> still do
• C# templates won’t work with Spin 2 yet (more generally, templates with custom filters won't, but to our knowledge C# was the only one)
• v2 SDK and manifest related changes:
  • After upgrading to use the v2 manifest,
    applications which use Postgres, MySQL or outbound Redis must provide an allowed_outbound_hosts configuration
  • Multiple Rust API changes: outbound HTTP, outbound Redis, application variables
  • Go has a new API for Redis
  • Go key_value package has been renamed to kv and has a new API

Highlights since Spin 1.0 ✨

Here are some highlights you may have missed that shipped in the releases between 1.0 and 2.0:

• DevEx/CLI
  • spin watch to automatically rebuild and restart
    you Spin application when files change
  • spin doctor to detect and fix issues with your Spin application
  • All spin cloud commands now ship via the Spin Cloud Plugin which is automatically installed when you install Spin
• Persistence/Data services
  • Key Value Storage
  • SQLite Storage
  • Serverless AI
• Runtime improvements
  • Enabling wasmtime's pooling allocator for increased performance.
• Language support
  • Python SDK
  • Go SDK adds support for outbound MySQL and Postgres

Thank you! ❤️

As always, many thanks to contributors old and new for helping improve Spin on a daily basis! 🎉 The 2.0 release represents
a huge milestone for the Spin project and we couldn't have done it without you.

Verifying the Release Signature 🔏

After downloading the v2.0.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.0.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha e4bb2357067d29f053b2d039476180ffa31222b2 \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

• feat(templates): update sdk to v1.5.0 by @github-actions in #1765
• chore(*): pre-release version bumps by @vdice in #1764
• docs(README.md): sqlite storage is now supported in the go SDK by @vdice in #1757
• chore(tests): add empty and one-byte assets to assets-test by @vdice in #1754
• use upstream release-action and update version from 1.10.0 to 1.13.0 by @rajatjindal in #1769
• sip: Update SIP 005 by @lann in #1753
• When spin watch terminates spin up, allow it to delete its temp dir by @itowlson in #1723
• sqlite: Add split module by @lann in #1772
• Update MSRV to reflect Wasmtime requirement by @itowlson in #1782
• Add spin up --build option by @itowlson in #1776
• Don't run e2e that requires big runners on forks by @itowlson in #1789
• Add llm support for wit-bindgen 0.2 based modules by @rylev in #1752
• upload spin linux amd64 artifacts to S3 by @rajatjindal in #1777
• Add llm import to other worlds by @itowlson in #1788
• Skip AWS interaction on forks by @itowlson in #1792
• syntax fix to run only on linux/amd64 by @rajatjindal in #1793
• Refactor llm and add http compute option by @karthik2804 in #1790
• Fix syntax to not configure AWS credentials on forks by @itowlson in #1798
• separate out build and run e2e tests step by @rajatjindal in #1800
• http: Make base = "/" the default by @lann in #1803
• Create .spin/sqlite_db.db only if needed by @itowlson in #1799
• Update to wasmtime 13 by @rylev in #1763
• add backport example to release-process.md by @michelleN in #1810
• feat(templates): update sdk to v1.5.1 by @github-actions in #1814
• add CARGO_TARGET_DIR/{debug,release} to path by @rajatjindal in #1422
• e2e-tests: disable connection pool by @rajatjindal in #1815
• Make local llm support an on-by-default feature by @rylev in #1802
• chore(docs): re-add base config to spin.toml by @vdice in #1820
• Fix Postgres NULL attempting type conversion by @itowlson in #1816
• Rescue space for Linux unit tests to run for now by @itowlson in #1829
• Remove Hippo dependency by @itowlson in #1824
• reuse sqlite connection in golang sdk by @rajatjindal in #1827
• Plugins search by @itowlson in #1823
• Respect SPIN_ALWAYS_BUILD on registry push by @itowlson in #1830
• Expose an API to push a LockedApp to a registry by @itowlson in #1825
• feat(oci): inline content when applicable by default by @vdice in #1821
• Reconfigure spin watch on manifest change by @itowlson in #1784
• Bump versions to 2.0.0-pre0 by @lann in #1834
• Remove template custom filters feature by @itowlson in #1822
• Remove bindle by @lann in #1835
• Always print warning on blocked outbound HTTP by @itowlson in #1833
• Replace foo-bar header with content-type by @itowlson in #1843
• makefile and CI tweaks by @dicej in #1846
• Update spin-componentize to f29cdb2 by @rylev in #1848
• Move manifest tests from spin-loader to spin-trigger by @lann in #1842
• Log use of remote LLM by @itowlson in #1851
• Handle locally installed plugin with same name and version as a registry one by @itowlson in #1853
• Allow other ai models besides while known ones by @rylev in #1795
• If command matches non-installed plugin, offer install by @itowlson in #1813
• chore(templates): bump redirect wasm version; update usage by @vdice in #1862
• sqlite sdk throws "database full" error when too many connections are opened by @rajatjindal in #1828
• ci: Embiggen build runner by @lann in #1859
• Make redirect template newable by @itowlson in #1865
• Allow spin add to add variables to the manifest by @itowlson in #1864
• Resources in Spin by @rylev in #1854
• Enable loading pre-pulled OCI artifact by @jsturtevant in #1874
• No need for 'legacy host components by @rylev in #1876
• Add wasi-http trigger support based on wasmtime-wasi-http take 2 by @rylev in #1877
• Another spin-componentize update by @rylev in #1878
• fix(oci): push archive layers if layer count exceeds max by @vdice in #1847
• Changes to the spin new experience by @itowlson in #1872
• chore(oci/Cargo.toml): explicitly use compat feature from tokio-util by @vdice in #1883
• Bump webpki from 0.22.1 to 0.22.4 by @dependabot in #1879
• fix dependency conflicts related to wit-bindgen by @dicej in #1888
• Run lints on Rust test cases by @rylev in #1884
• Check in Cargo.lock files for examples and test apps by @rylev in #1885
• Changes to outbound redis interfaces by @rylev in #1873
• Key value interface changes by @rylev in #1880
• Update wit-bindgen to latest upstream by @lann in #1889
• Update wasm-tools deps by @rylev in #1893
• Use resources for Postgres API by @rylev in #1886
• chore(oci): pub client and utils crates by @vdice in #1890
• Fail the CI lint if running linting dirties work tree by @rylev in #1894
• chore(templates/tests): bump spin-fileserver version by @vdice in #1897
• feat(sdk/go): implement llm SDK for TinyGo by @adamreese in #1831
• feat(sdk/go): implement mysql SDK for TinyGo by @Patrick0308 in #1794
• ci: Print dirty lint paths by @lann in #1903
• Manifest V2 by @lann in #1780
• Rust SDK http handler macro improvements by @rylev in #1887
• Add make command for updating all lock files by @rylev in #1907
• Move mysql interface to resources by @rylev in #1900
• CI: give permissions to lint job to cancel entire workflow by @rylev in #1908
• log and quit on I/O error when echoing in wasi-http example by @dicej in #1910
• Make OCI crate not depend on trigger crate by @itowlson in #1905
• Decouple LockedApp schema from spin-core by @itowlson in #1906
• oci: Client improvements by @lann in #1911
• manifest: Remove outbound-http dep by @lann in #1909
• Point templates on main at SDKs on main by @itowlson in #1775
• Fix "duplicate package" warning when referencing Spin crates by @itowlson in #1914
• Templates for Manifest v2 and SDK v2 by @itowlson in #1916
• Break loader dependency on wasmtime by @itowlson in #1913
• Report cargo fmt and clippy errors more quickly by @itowlson in #1919
• Update redis-* and http-go templates by @itowlson in #1921
• Move from git sha to official wit-bindgen 13 release by @rylev in #1917
• No more http and inbound-http interfaces by @rylev in #1901
• Respect CARGO_TARGET_DIR in integration tests by @rylev in #1924
• doctor: Unbreak spin doctor for Manifest V2 by @lann in #1927
• Rename config to variables by @fibonacci1729 in #1918
• fix(sdk/go): fix TinyGo example paths in Makefile by @adamreese in #1935
• fix(sdk/go): Fix compile error on Redis Go SDK by @adamreese in #1936
• Require user to add redis host to list of allowed listed hosts by @rylev in #1933
• Improve the builtin Request/Response types by @rylev in #1939
• Improve the OutParam API for wasi-http by @rylev in #1940
• feat(loader/cache): add data dir fallback if wasm layer not found by @vdice in #1941
• Fix broken template by @fibonacci1729 in #1948
• Update remaining templates to manifest v2 by @itowlson in #1949
• feat(sdk/go): implement pg SDK for TinyGo by @Patrick0308 in #1922
• Break http crate dependency on wasmtime by @itowlson in #1944
• Fix unused import in http-rust template by @itowlson in #1956
• fix http.Headers to outboundHeaders by @rajatjindal in #1925
• Fix v1 config error propagation by @fibonacci1729 in #1951
• Add example for streaming a file in Rust by @radu-matei in #1930
• Fix main branch by @rylev in #1960
• ci/docs(releasing): updates for release candidates by @vdice in #1942
• trigger-http: Fix base routing without leading slash by @lann in #1946
• Support v1 syntax for spin new and spin add by @itowlson in #1953
• Bump the instance table size to 20 by @fibonacci1729 in #1964
• Add into_inner for chaining by @fibonacci1729 in #1965
• chore(examples): rm comments re: outbound/self http by @vdice in #1968
• chore(examples): migrate to v2 manifest by @vdice in #1962
• Fix duplicate samples by @itowlson in #1971
• rust: Hide macro preamble from user code by @lann in #1969
• Potentially final wit changes for 2.0.0 by @rylev in #1958
• feat(sdk/go): Refactor the key/value Go SDK to be more idiomatic by @adamreese in #1845
• ref(sdk/go): Refactor the Redis Go SDK to be more idiomatic by @adamreese in #1844
• Add address checks for mysql and postgres by @rylev in #1959
• chore(examples): Update Go import paths to v2 by @adamreese in #1976
• replace MyStd{in|out}Stream with shareable streams by @dicej in #1982
• Fix outbound http in the Rust SDK (take 2) by @rylev in #1975
• add global value convertor for mysql and sqlite go sdk by @Patrick0308 in #1955
• Fix spin up --help for unbuilt apps by @lann in #1980
• fix(sdk/go): update missed v2 import paths by @adamreese in #1984
• Fix watchexec missing files in subdirectories by @itowlson in #1983
• Update wasmtime to 14.0.3 by @lann in #1989
• chore(templates): Update TinyGo templates to v2 by @adamreese in #1990
• remove component model support warning by @michelleN in #1993
• rust: Add some convenience methods/impls to http types by @lann in #1977
• Link with llm v2 by @rylev in #1997
• feat(oci): manifest/config updates to support containerd by @vdice in #1882
• For postgres and mysql Connection::open- don't use v2 impl in v1 by @rylev in #1987
• chore(sdk/go): rename config to variables by @adamreese in #2002
• chore(.github/gh-checktags): update to support v2 by @adamreese in #2003
• Allow for hyperium requests to be fed into router by @rylev in #2001
• Get rid of allowed_http_hosts in v2 manifest by @rylev in #1988
• add test/example for outbound request body streaming by @dicej in #1991
• Move to deny-by-default for everything but v1 SDKs and v1 manifests by @rylev in #2004
• [Backport v2.0] ci(release): only config aws creds + upload to s3 if main by @vdice in #2010
• chore(*): bump to 2.0.0-rc.1 by @vdice in #2007
• feat(templates): update sdk to v2.0.0-rc.1 by @github-actions in #2012
• [Backport v2.0] fix warning message on spin add by @vdice in #2017
• [Backport v2.0] Fix misleading guidance on disallowed host by @itowlson in #2020
• [Backport v2.0] Templates makefile: handle prerelease origin, handle Go v2 by @vdice in #2024
• [Backport v2.0] fix comment for disabling wasmtime pooling by @itowlson in #2029
• [Backport v2.0] Don't allow v2 components to be added to v1 manifest by @itowlson in #2028
• [Backport v2.0] log error if wasi:http/incoming-handler#handle fails post-response by @vdice in #2034
• [Backport v2.0] outbound-networking: More permissive allow-all by @lann in #2041
• [Backport] #2042 into v2.0 by @vdice in #2043
• Update Spin crate version to 2.0 by @adamreese in #2046

New Contributors

• @jsturtevant made their first contribution in #1874

Full Changelog: v1.5.1...v2.0.0