Spin - v2.5.0

Spin v2.5

The v2.5 release of Spin brings a number of features, improvements and bug fixes.

Some highlights in v2.5.0 at a glance:
- Support for application-internal private endpoints, which allows you to avoid exposing internal components on public routes while still splitting them out to their own microservices. https://github.com/fermyon/spin/pull/2418
- Spin now allows you to specify routes with more granularity https://github.com/fermyon/spin/pull/2464
- Improved support for OpenTelemetry https://github.com/fermyon/spin/pull/2463
- Azure Key Vault Application Variable Provider https://github.com/fermyon/spin/pull/2472

As always, thanks to contributors old and new for helping improve Spin on a daily basis! 🎉

Verifying the Release Signature

After downloading the 2.5.0 release of Spin, either via the artifact attached to this release corresponding to your OS/architecture combination or via the installation method of your choice, you are ready to verify the release signature.

First, install cosign. This is the tool we'll use to perform signature verification. Then run the following command:

cosign verify-blob \
    --signature spin.sig --certificate crt.pem \
    --certificate-identity https://github.com/fermyon/spin/.github/workflows/release.yml@refs/tags/v2.5.0 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository fermyon/spin \
    spin

If the verification passed, you should see:

Verified OK

What's Changed

• chore(release): update versions for v2.5.0-pre0 by @kate-goldenring in https://github.com/fermyon/spin/pull/2400
• ci: Run macos builds on M1 by @lann in https://github.com/fermyon/spin/pull/2404
• Improved rumqttc event loop check. by @suneetnangia in https://github.com/fermyon/spin/pull/2362
• Add recent SIPs to the index document by @tschneidereit in https://github.com/fermyon/spin/pull/2403
• chore(trigger-http): bump tls-listener by @vdice in https://github.com/fermyon/spin/pull/2409
• feat(oci): deduplicate layers prior to push; archive if needed by @vdice in https://github.com/fermyon/spin/pull/2395
• feat(oci): set token expiration for oci client by @vdice in https://github.com/fermyon/spin/pull/2417
• feat: add support for setting the pushed oci image manifest annotations by @rgl in https://github.com/fermyon/spin/pull/2254
• feat(*): Add tracing to some more host components by @calebschoepp in https://github.com/fermyon/spin/pull/2398
• use template from v2.0 branch of spin-python-sdk in test by @dicej in https://github.com/fermyon/spin/pull/2421
• Fix outbound-mqtt bug with QoS 2 by @fibonacci1729 in https://github.com/fermyon/spin/pull/2420
• Rationalise plugin install prompts by @itowlson in https://github.com/fermyon/spin/pull/2412
• Warn when sending bare 404 response by @itowlson in https://github.com/fermyon/spin/pull/2410
• Private endpoints by @itowlson in https://github.com/fermyon/spin/pull/2418
• Accept runtime config in either JSON or TOML by @lann in https://github.com/fermyon/spin/pull/2427
• build(deps): bump h2 from 0.3.24 to 0.3.26 by @dependabot in https://github.com/fermyon/spin/pull/2430
• ci(dispatch.yml): dispatch to fermyon/homebrew-tap by @vdice in https://github.com/fermyon/spin/pull/2428
• ci(release): fix dispatch conditional by @vdice in https://github.com/fermyon/spin/pull/2434
• chore(spin-timer): bump whoami per GHSA-w5w5-8vfh-xcjq by @vdice in https://github.com/fermyon/spin/pull/2431
• chore(*): bump h2 per GHSA-q6cp-qfwq-4gcv by @vdice in https://github.com/fermyon/spin/pull/2432
• ci(build/release): restore mac amd64 builds by @vdice in https://github.com/fermyon/spin/pull/2435
• Trace some more host components by @calebschoepp in https://github.com/fermyon/spin/pull/2437
• Trace db host components by @calebschoepp in https://github.com/fermyon/spin/pull/2439
• style(linting): Fix some linting rules by @calebschoepp in https://github.com/fermyon/spin/pull/2442
• Update Rust templates and bump Spin SDK version from 2.2.0 to 3.0.1 by @ThorstenHans in https://github.com/fermyon/spin/pull/2445
• Option to suppress plugin on-run compatibility warnings by @itowlson in https://github.com/fermyon/spin/pull/2426
• Review new dependencies for known vulnerabilities by @itowlson in https://github.com/fermyon/spin/pull/2440
• Add that Python SDK does support Redis Trigger by @tpmccallum in https://github.com/fermyon/spin/pull/2429
• ci(build.yml): gate dependency review on PRs only by @vdice in https://github.com/fermyon/spin/pull/2450
• ref(*): Refactor host components to avoid returning Result> if they don't trap by @calebschoepp in https://github.com/fermyon/spin/pull/2433
• Don't print plugin prerelease warning in middle of help by @itowlson in https://github.com/fermyon/spin/pull/2452
• Trigger tracing by @calebschoepp in https://github.com/fermyon/spin/pull/2441
• Allow template to have tmpl extension by @rylev in https://github.com/fermyon/spin/pull/2456
• Summarise runtime config by @itowlson in https://github.com/fermyon/spin/pull/2453
• Bikeshed private endpoint UI by @itowlson in https://github.com/fermyon/spin/pull/2451
• Add Redis components to existing app by @itowlson in https://github.com/fermyon/spin/pull/2446
• ref(outbound-http): Add a small hack to improve the tracing of outbound http requests through spin core by @calebschoepp in https://github.com/fermyon/spin/pull/2459
• Check for illegal file name when copying single file by @itowlson in https://github.com/fermyon/spin/pull/2460
• feat(telemetry): Make telemetry support http/protobuf protocol in addition to grpc protocol by @calebschoepp in https://github.com/fermyon/spin/pull/2463
• Refactor expressions Resolver to provide sync API by @rylev in https://github.com/fermyon/spin/pull/2458
• fixed logic in spin doctor to display 'No problems found' properly by @garikAsplund in https://github.com/fermyon/spin/pull/2466
• Setup a docker compose file that creates an o11y stack for Spin to use by @calebschoepp in https://github.com/fermyon/spin/pull/2465
• chore(crates): address lint errs when rust is at 1.77+ by @vdice in https://github.com/fermyon/spin/pull/2474
• added local_addr() to listeners to display random port numbers by @garikAsplund in https://github.com/fermyon/spin/pull/2473
• Don't attempt to cancel workflow if lints fail by @itowlson in https://github.com/fermyon/spin/pull/2476
• Taking a first crack at implementing metrics by @calebschoepp in https://github.com/fermyon/spin/pull/2475
• Add SIP for configuring and emitting observability by @calebschoepp in https://github.com/fermyon/spin/pull/2303
• Granular route matching by @itowlson in https://github.com/fermyon/spin/pull/2464
• Fix watch not picking up manifest changes by @itowlson in https://github.com/fermyon/spin/pull/2481
• feat: Add Azure Key Vault Variable Provider by @ThorstenHans in https://github.com/fermyon/spin/pull/2472
• core: Add note to find_host_component_handle docs by @lann in https://github.com/fermyon/spin/pull/2484
• telemetry: Nicen layer return types by @lann in https://github.com/fermyon/spin/pull/2488
• Fix incorrect base passed in service chaining by @itowlson in https://github.com/fermyon/spin/pull/2489
• Fix 1.78 lints by @itowlson in https://github.com/fermyon/spin/pull/2491
• Update version for v2.5.0 release by @kate-goldenring in https://github.com/fermyon/spin/pull/2497

New Contributors

• @rgl made their first contribution in https://github.com/fermyon/spin/pull/2254
• @garikAsplund made their first contribution in https://github.com/fermyon/spin/pull/2466

Full Changelog: https://github.com/fermyon/spin/compare/v2.4.3...v2.5.0