spinframework/spin v3.5.0

on GitHub

Support for the WASI Preview 3 release candidate (wasi@0.3.0-rc-2025-09-16) has landed in Spin v3.5.0! This means folks can take advantage of first class composable concurrency and other underlying advancements to the Component Model, a whole host of simplified APIs, and better integration with language ecosystem libraries and frameworks. Read more in depth on advancements with WASIp3 here.

Please note this is an unstable feature in Spin and to start experimenting with WASIp3, opt-in by adding executor = { type = "wasip3-unstable" } to the appropriate [[trigger.http]] section of your spin.toml file. The latest Spin Rust SDK also has support for WASIp3. See examples of WASIp3 in action here.

Other notable changes:

• Limit max number of concurrent outbound requests a guest can make via runtime config #3285
• Satisfy dependencies by component ID references #3290.
• Pass file content as a value to spin up —variable: spin up --variable foo=@bar.txt #3319
• Define static HTTP responses for http triggers in spin.toml. #3250
• Many quality of life and housekeeping improvements

As always, a big thank you to contributors old and new for helping improve Spin on a daily basis! 🎉

Verifying the Release Signature

After downloading the v3.5.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/spinframework/spin/.github/workflows/release.yml@refs/tags/v3.5.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-sha 0ca21ceaa8c1eeef00bd8ccf3cc4359e777f818e \
    --certificate-github-workflow-repository spinframework/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

• Bump version for next release by @fibonacci1729 in #3245
• cli: Resolve clap/deprecated warnings by @lann in #3228
• Update to Wasmtime 36.0.2 by @lann in #3252
• Bump spin-sdk version in rust templates to 5.0.0 by @ThorstenHans in #3251
• Workflow to bump rust templates sdk dependency by @fibonacci1729 in #3255
• Add spin-trigger-cron to release notes for tracking by @fibonacci1729 in #3257
• trigger-http: Fix otel context propagation by @calebschoepp in #3260
• Allow non-kebab-case names in component ai_models by @seun-ja in #3259
• outbound-http: Improve test assertion logging by @lann in #3247
• chore: bump redis to v0.32.5 by @kate-goldenring in #3261
• Make KeyValueRedis type public by @kate-goldenring in #3262
• trigger-http: Don't panic on unknown service chaining component ID by @lann in #3263
• factor-outbound-http: Refactor wasi impls by @lann in #3268
• factor-outbound-http: Add InterceptRequest::override_connect_host by @lann in #3269
• Expand wildcard service chaining during spin up by @itowlson in #3266
• Static HTTP responses by @itowlson in #3250
• chore(examples): Update Spin Rust SDK and other dependencies by @tschneidereit in #3276
• factor-outbound-http: Update override_connect_host by @lann in #3279
• Spin up checks required variables for some Providers by @seun-ja in #3265
• Implement open ai api llm backend by @seun-ja in #3238
• chore(ci): Restrict use of rust-cache to longest-running jobs by @tschneidereit in #3277
• Ignore flaky test on Mac by @itowlson in #3286
• Add WASIp3 support by @dicej in #3272
• variables: Refactor Provider::kind into ::may_resolve by @lann in #3282
• Fix dead code warnings by @itowlson in #3288
• Skip load_instance_pre for components not referenced by the trigger by @itowlson in #3280
• MacOS 13 retirement by @itowlson in #3287
• Ignore the flaky private IPs test on all platforms by @itowlson in #3289
• Sort builds if dependency relation between manifest components by @itowlson in #3284
• Fix Ubuntu tests often failing first time... by @itowlson in #3297
• Workflow for publishing spin:up WIT package by @fibonacci1729 in #3300
• Make spin deploy breaking change warning more emphatic by @itowlson in #3299
• Dependencies by component ID reference by @itowlson in #3290
• Try Rust 1.90 to fix CI woe by @itowlson in #3304
• Fix the publish-wit ci workflow by @fibonacci1729 in #3305
• Version the docker/login-action, er, action by @itowlson in #3306
• Update WIT world to WASI P3 RC by @itowlson in #3295
• Use temporary GITHUB_TOKEN for publishing to ghcr by @fibonacci1729 in #3308
• ignore Trap::AsyncDeadlock when running WASIp3 handlers by @dicej in #3309
• Another attempt to fix the publish-wit workflow by @fibonacci1729 in #3310
• Another attempt now that toggles have been toggled by @fibonacci1729 in #3311
• Revert "Another attempt now that toggles have been toggled" by @fibonacci1729 in #3312
• Set a limit on max number of concurrent outbound http requests by @rylev in #3285
• Use forked wkg to publish WITs for now by @itowlson in #3316
• Install wasm-tools in publish-wit by @fibonacci1729 in #3317
• Revise Spin Project Meeting details in README by @mikkelhegn in #3314
• Allow spin up --variable to pass file content as a value by @itowlson in #3319
• bump deps with cargo audit fix by @dicej in #3320
• Environment definitions starter pack by @itowlson in #3301
• outbound-networking: More BlockedNetworks integration by @lann in #3324
• Rename the DNS resolver types by @rylev in #3327
• Add opt-in to unstable wasip3 and warn when in use by @fibonacci1729 in #3322
• Bump version for v3.5 release by @fibonacci1729 in #3329

Full Changelog: v3.4.1...v3.5.0