Read the last message on a subject, read with timestamps, and see stream creation and stored times.
Purge by subject (optionally keeping some messages) and delete by sequence. Both sit behind a new stream-delete-allow grant, which denies by default.
KV create-with-ttl (expiring leases) and delete-by-revision (conditional release).
⚡ Performance and density
Fixed the v2.11 service-bench regression (about 9%) (#5737). It was caused by a scheduling change in wasmtime 48.0.6. p3 HTTP response bodies now go straight to hyper instead of being relayed frame by frame.
New --max-memories and --total-core-instances flags.
Pool totals now follow the memory count, so the core-instance limit no longer runs out at a quarter of the memories reserved.
Messaging admission now reserves real pool resources. Before, a stock host admitted only 133 in-flight messages against a pool sized for 1000 instances.
A host density benchmark (scale_density) now runs in CI (#5708, #5739). Its results are published on arewefastyet.
On cgroup v1 hosts with no memory limit, the detected limit came out at about 8 EiB. It is now capped at RAM plus swap (#5710).
🛠️ Fixes and hardening
Values above the semaphore capacity are refused instead of crashing the host. This covers the NATS max-in-flight and subscription-capacity settings and the ingress and start limits (#5718).
Plugin-served WASI overrides that aren't supported are refused when the plugin registers (#5721).
Community:wasmcloud:postgres refuses a parameter whose type doesn't match, from Srinivas Chippagiri (#5732).
Community: corrected the reclaim_min_instances docs (it disables reclaim), from Shreya Deshannavar (#5569, #5731).
OpenTelemetry HTTP span names now match each other (#5579).
Dependency security fixes: zstd-sys (RUSTSEC-2026-0410) and ctutils. wasi-gfx 0.3.1 now comes from crates.io instead of a git patch.
🏛️ Project health, security and governance
THREAT_MODEL.md covers trust boundaries, security goals, the settings that weaken them, and what counts as a vulnerability.