What's Changed

• feat(wash): workload env/config/secrets by @ricochet in #5117
• bench infra by @ricochet in #5153
• feat(wash-runtime): namespace host plugin spans by WIT package by @ricochet in #5188
• ci: unblock off-cycle dispatch and de-flake gates by @ricochet in #5192
• ci(release-tag): pin previous_tag_name when generating release notes by @ricochet in #5191
• ci(runtime-operator): guard RBAC drift by @ricochet in #5187
• chore: wasmtime 44.0.2 security patch by @ricochet in #5195
• ci: reclaim space by @ricochet in #5196
• fix(wash): git detect_source_type by @ricochet in #5197
• chore(deps): bump zizmorcore/zizmor-action from 0.5.4 to 0.5.5 in the all-github-actions group across 1 directory by @dependabot[bot] in #5199
• chore(deps): bump the all-docker group across 2 directories with 1 update by @dependabot[bot] in #5198
• feat(examples/otel-config): demo workload env/config/secrets by @ricochet in #5127
• chore(deps): bump the all-go group across 1 directory with 4 updates by @dependabot[bot] in #5202
• chore(deps): bump the all-github-actions group across 2 directories with 2 updates by @dependabot[bot] in #5203
• fix: support commit SHAs in wash new --git-ref by @immanuwell in #5201
• test(wash-runtime): stub egress in allowed_hosts integration by @ricochet in #5204
• chore: upgrade wasmtime to 45 by @ricochet in #5206
• wasi-otel rc2 by @ricochet in #5205
• Support runtime.wasmcloud.dev apiGroup RBAC to be namespaced vs Cluster by @jfleitz in #5208
• chore(wash-runtime): use format string interpolation and fix eprintln in error handlers by @immanuwell in #5207
• feat(wash-runtime): record HTTP response status on request spans by @ricochet in #5210
• test(runtime-operator): cover watchNamespaces RBAC scoping by @ricochet in #5209
• refactor(bench): rename iai-callgrind → gungraun and bump to 0.19.1 by @ricochet in #5211
• chore: lowercase error context messages to match conventions by @immanuwell in #5212
• fix(bench): mark shell scripts executable by @ricochet in #5213
• chore(deps): bump the all-go group across 2 directories with 2 updates by @dependabot[bot] in #5216
• chore(deps): bump the all-github-actions group across 5 directories with 7 updates by @dependabot[bot] in #5217
• test(runtime-operator): add fuzz tests by @ricochet in #5172
• chore(lint): inline format args and enforce lowercase context casing by @ricochet in #5215
• ci: CodeQL free-disk-space by @ricochet in #5221
• chore(lint): pin Rust to 1.96.0 and make clippy --all-targets clean by @ricochet in #5225
• ci(wash): build and publish a wasip3 canary image by @ricochet in #5227
• refactor(wash-runtime): harden p3 sockets by @ricochet in #5222
• refactor(wash-runtime): build wasm test fixtures via xtask by @ricochet in #5220
• Fix In-memory blobstore default by @ricochet in #5223
• chore: test dynamic router removes aliases by @ricochet in #5224
• feat(examples): demonstrate cross-workload OTel trace roll-up by @ricochet in #5226
• fix(deps): patch reported security advisories by @ricochet in #5230
• fix(release-train): derive Cargo.lock guard allowlist by @ricochet in #5231
• release: v2.3.0 by @automation-wasmcloud in #5232
• ci: install rust targets by @ricochet in #5233 New Contributors
• @immanuwell made their first contribution in #5201 Full Changelog: v2.2.1...v2.3.0