TakalaWang · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026
@@ -4,6 +4,31 @@ All notable changes to WASM-OJ are recorded here. Releases follow
 [Semantic Versioning](https://semver.org/) and the contract/package versioning policy in
 [the versioning policy](docs/versioning.md).
 
+## Unreleased
+
+- Upgraded `@wasmer/sdk` from 0.10.0 to 0.19.0. Clang, rustc, TypeScript, and Python
+  runtime-file preparation now run to exit in per-build SDK sandboxes, which removes the
+  0.10.0 race that could leave a finished process waiting forever for output EOF and stall
+  Python preparation or TypeScript compilation under load. Compiled artifacts are unchanged.
+- The server compiler child and its rustc stage serve sequential builds and keep their loaded
+  toolchain packages, so the SDK's package load is paid once per child instead of once per build.
+  Cancellation, timeout, or failure discards the child; an idle child exits after 30 s, and either
+  child exits when its parent goes away. The rustc stage is replaced after the browser's stage
+  budget (two builds).
+- `@wasm-oj/browser` ships the SDK's browser runtime files unbundled under
+  `assets/wasmer-sdk-<digest>/` and no longer installs `@wasmer/sdk`. Hosts that copy the
+  package's `dist/assets/` must copy that directory recursively. The SDK's WISP networking
+  module is not shipped, and its host-function trampoline is built without `eval`, so
+  execution still works under a strict Content Security Policy.
+- Python execution reads the interpreter module directly from the pinned WEBC package and
+  verifies its digest.
+- Raw Clang output names `/workspace/...` instead of `/project/...` source paths. Parsed
+  diagnostics and emitted artifacts are unchanged.
+- The runtime identity changes with the SDK, so artifacts cached by earlier releases are
+  rebuilt.
+- `@wasmer/sdk` 0.19.0 is distributed under Wasmer's Modified MIT License, which adds an
+  attribution condition for large commercial deployments; see `THIRD_PARTY_NOTICES.md`.
+
 ## 0.2.3 - 2026-10-05
 
 - Download pinned browser toolchain assets before the compiler timeout starts, so slow

@@ -49,21 +49,28 @@ canonical Go module `h1:` hash over module ZIP entries.
 
 ### Wasmer JavaScript SDK
 
-- Component: `@wasmer/sdk` 0.10.0
-- npm integrity: `sha512-YQ+s5tGag6P/I8kp9BTH+XhjoS9UFvWiZJvnWEEovClHffhYToKhprWr4UJG7wLP7c/2HQpGkF7ZrjoUvKjdmA==`
-- Source revision: `wasmerio/wasmer-js@93b8b738ebd3ee57e118da0f0eb795b97d5b999e`
+- Component: `@wasmer/sdk` 0.19.0
+- npm integrity: `sha512-4gdWiIlne8ti3dQl1yD6jrLLNKrQXmZXA6iy6ta/6sgYpixPLwymeGqhMzjAIHqhmwrD+SjPFpZ5ugd9SytDrQ==`
+- Source revision: `wasmerio/wasmer-sdk@7e69332b7f65dbc5584d64bb79f547eaf4302b69`
 - Locked Rust graph: `Cargo.lock` SHA-256
-  `d352926f3f05e3d4308c4e261711d07db568e5c2b4387067180f920da074791f`
-- Source: <https://github.com/wasmerio/wasmer-js/tree/93b8b738ebd3ee57e118da0f0eb795b97d5b999e>
-- License: MIT
-- License material: `licenses/wasmer-sdk-MIT.txt`,
+  `34156a76319127aa4152e8b25bd92a5657f7ddc0669ba3e26209cc57053f56a1`
+- Source: <https://github.com/wasmerio/wasmer-sdk/tree/7e69332b7f65dbc5584d64bb79f547eaf4302b69>
+- License: Wasmer Modified MIT License. It adds one condition to MIT: a commercial product or
+  service with more than 1 million monthly active users or more than 1 million US dollars in
+  monthly revenue must prominently display "Wasmer" in its user interface.
+- Bundled JavaScript dependency: `acorn` 8.18.0 (MIT), shipped in the SDK's wasm-bindgen snippets
+- License material: `licenses/wasmer-sdk-LICENSE.txt`, `licenses/wasmer-sdk-acorn-MIT.txt`,
   `licenses/wasmer-sdk-dependencies.html`, and
   `licenses/wasmer-sdk-dependencies.json`
 
-WASM-OJ consumes the official npm artifact without patching the installed
-package. The generated dependency report covers every package in the pinned
-normal Cargo dependency graph selected for `wasm32-unknown-unknown`; its compact
-inventory binds all 332 package identities and the exact HTML report digest.
+WASM-OJ ships the official npm runtime files unbundled. Its only modification replaces the
+wasm-bindgen glue's `new Function` construction of Wasmer's fixed host-function trampoline with
+the equivalent closure so the SDK runs under a strict Content Security Policy. The browser build
+omits the SDK's WISP networking module, the only path to its AGPL-3.0 `@mercuryworkshop/wisp-js`
+dependency, which WASM-OJ therefore does not distribute. The generated dependency report covers
+every package in the pinned normal Cargo dependency graph of the SDK's `wasmer-sdk-js` crate
+selected for `wasm32-unknown-unknown`; its compact inventory binds all 316 package identities and
+the exact HTML report digest.
 
 ### QuickJS guest Node standard I/O libraries
 

@@ -51,9 +51,9 @@ flowchart LR
 
 Browser requests cross dedicated module-Worker boundaries. C/C++ retains bounded immutable Clang
 and content-addressed graph state; Rust and Go use serialized nested stages with bounded generation
-lifetime. Python and JavaScript package source files directly. Server builds use a fresh isolated child. Cancellation,
-restart, timeout, cache clearing, disposal, family switch, and stage-budget exhaustion establish a
-complete browser Worker-generation boundary.
+lifetime. Python and JavaScript package source files directly. Server builds run one at a time in a
+reusable isolated child. Cancellation, restart, timeout, cache clearing, disposal, family switch,
+and stage-budget exhaustion establish a complete browser Worker-generation boundary.
 
 The runner is one Rust codebase compiled to browser Wasm and native executables. Both forms admit
 the same artifacts, deterministic inputs, resource limits, denied capabilities, filesystem model,
@@ -79,20 +79,22 @@ arguments for `wasm32-unknown-wasip1`. Both public `wasip1` and `wasix` profiles
 compiler ABI; `wasix` changes artifact/cache/runtime-profile identity, not emitted bytes for
 identical input. The runner validates actual module imports.
 
-Browser compilation directly invokes packaged atoms. Successful clean translation units enter a
-content-addressed dependency graph. The browser persists a digest-verified graph in IndexedDB;
-warning-producing units are rebuilt because diagnostics cannot be reconstructed faithfully.
+Browser compilation directly invokes packaged atoms in a per-build SDK sandbox whose project root is
+`/workspace`; macro and debug prefix maps keep the pinned `/project` paths in emitted objects.
+Successful clean translation units enter a content-addressed dependency graph. The browser persists
+a digest-verified graph in IndexedDB; warning-producing units are rebuilt because diagnostics cannot
+be reconstructed faithfully.
 `wasm-oj.pch.hpp` selects a separately pinned debug/release libc++ PCH only when its content equals
 `WASM_OJ_LIBCXX_PCH_HEADER` exactly.
 
 ### Rust
 
 The Rust package contains rustc 1.91.1-dev, its matching `wasm32-wasip1-threads` standard library,
-and pinned wasm-ld resources. A browser stage keeps verified immutable package/command handles warm
-while creating fresh project directories and command instances for each build. rustc emits the
-crate object plus allocator bitcode; a fresh linker command produces the standalone Wasm artifact.
-The generation is recycled before its output-ready stage budget is exceeded. Server compilation
-uses the same content and arguments in a one-shot child.
+and pinned wasm-ld resources. A browser stage keeps its SDK client and verified immutable package
+warm while creating a fresh sandbox for each build. rustc emits the crate object plus allocator
+bitcode; a fresh linker process produces the standalone Wasm artifact. The generation is recycled
+before its stage budget is exceeded. Server compilation uses the same content and arguments in a
+child that keeps the loaded package for sequential builds and is replaced under the same budget.
 
 The resulting shared-memory module remains a `wasip1` artifact. The host supplies imported memory
 but denies guest thread spawning.

@@ -102,6 +102,10 @@ The page must be cross-origin isolated: COOP `same-origin`, COEP `require-corp`,
 `same-origin`, and `worker-src 'self' blob:` are required. Cross-origin asset servers must emit
 compatible CORS/CORP headers.
 
+`@wasm-oj/browser` resolves its Workers and the `assets/wasmer-sdk-<digest>/` runtime directory
+relative to its own `dist/assets/` files. Hosts that copy those assets instead of bundling them must
+copy the directory recursively and keep its layout.
+
 ### Prefetching a toolchain
 
 `BrowserCompiler` downloads a build's pinned toolchain assets before its build boundary (60 s for

@@ -125,9 +125,15 @@ nested stages with bounded lifetime. Python and JavaScript package source files
 crossing a stage budget, cancellation, timeout, restart, cache clearing, disposal, or infrastructure
 failure establishes a complete Worker-generation boundary.
 
-Wasmer secondary Workers are host implementation details. They use the SDK's supported `workerUrl`
-protocol and do not grant guest thread-spawn capability. The host page must be cross-origin
-isolated.
+Compiler and runtime-preparation processes use the official `@wasmer/sdk`. `@wasm-oj/browser` ships
+its browser runtime files unbundled under `assets/wasmer-sdk-<digest>/`, without the SDK's WISP
+networking module, and Workers import the SDK from there. SDK thread Workers are host implementation
+details: they start from the same same-origin blob bootstrap as other module Workers and do not
+grant guest thread-spawn capability. The host page must be cross-origin isolated.
+
+SDK processes run to exit; WASM-OJ never calls the SDK's process kill or client shutdown, which
+terminate threads at arbitrary points. Cancellation and timeouts discard the whole Worker generation
+or server child instead.
 
 ## Server execution boundary
 
@@ -136,10 +142,12 @@ isolated.
 Initialization verifies executable regular files and every descriptor asset before constructing
 the engine.
 
-Each server build uses a fresh isolated compiler child. Each execution uses the native Rust runtime
-process and a bounded request/response transport. Server startup never provisions binaries,
-downloads assets, invokes a host compiler for user source, follows a symlink-owned toolchain path,
-or falls back to another directory.
+Server builds run one at a time in an isolated compiler child that keeps its loaded toolchain
+packages and creates a fresh SDK sandbox for each build. Cancellation, timeout, or failure discards
+the child; it exits after a short idle period or when its parent goes away. Each execution uses
+the native Rust runtime process and a bounded request/response transport. Server startup never
+provisions binaries, downloads assets, invokes a host compiler for user source, follows a
+symlink-owned toolchain path, or falls back to another directory.
 
 The default writable cache root is `.wasm-oj` below the current working directory when the caller
 does not provide `cacheDirectory`; a filesystem root is never accepted.

@@ -773,40 +773,44 @@
     {
       "id": "wasmer-sdk",
       "name": "Wasmer JavaScript SDK and locked Rust dependency closure",
-      "version": "0.10.0",
+      "version": "0.19.0",
       "source": {
-        "url": "https://github.com/wasmerio/wasmer-js",
-        "revision": "93b8b738ebd3ee57e118da0f0eb795b97d5b999e"
+        "url": "https://github.com/wasmerio/wasmer-sdk",
+        "revision": "7e69332b7f65dbc5584d64bb79f547eaf4302b69"
       },
       "distributions": [
         {
           "kind": "file",
           "path": "licenses/wasmer-sdk-dependencies.html",
-          "sha256": "ec4b0175b4d1affb0f97996cb6661ec6fa1c5959dbce637d89b39cf3559b079a"
+          "sha256": "93d2898132e31cd7634c1470a587a7b0f54e887bcb0a968742260f2f985f643d"
         },
         {
           "kind": "file",
           "path": "licenses/wasmer-sdk-dependencies.json",
-          "sha256": "4fb0d9e02e29f98b5c0ec047fa041cce870d98b9fdfecf2c02436a19842d0977"
+          "sha256": "39cac76585998208f43bb66076840c6fddc4e91eb7ef4cc2d9b1f90287b461f3"
         },
         {
           "kind": "npm",
-          "package": "@wasmer/sdk@0.10.0",
-          "integrity": "sha512-YQ+s5tGag6P/I8kp9BTH+XhjoS9UFvWiZJvnWEEovClHffhYToKhprWr4UJG7wLP7c/2HQpGkF7ZrjoUvKjdmA=="
+          "package": "@wasmer/sdk@0.19.0",
+          "integrity": "sha512-4gdWiIlne8ti3dQl1yD6jrLLNKrQXmZXA6iy6ta/6sgYpixPLwymeGqhMzjAIHqhmwrD+SjPFpZ5ugd9SytDrQ=="
         }
       ],
       "licenseFiles": [
         {
-          "path": "licenses/wasmer-sdk-MIT.txt",
-          "sha256": "76dc7d305458d07478bc62669fe53dbfd3b94b95c5e00fbb45af1f492cbd7284"
+          "path": "licenses/wasmer-sdk-LICENSE.txt",
+          "sha256": "6350e730ed61a3ec83b5843634aa0a476505ec9b96792600606ced736835b45c"
+        },
+        {
+          "path": "licenses/wasmer-sdk-acorn-MIT.txt",
+          "sha256": "76a876cf886ff9be2a8b5e2e86514fed06223c8c9f0c1e9ee9606e93841e00b7"
         },
         {
           "path": "licenses/wasmer-sdk-dependencies.html",
-          "sha256": "ec4b0175b4d1affb0f97996cb6661ec6fa1c5959dbce637d89b39cf3559b079a"
+          "sha256": "93d2898132e31cd7634c1470a587a7b0f54e887bcb0a968742260f2f985f643d"
         },
         {
           "path": "licenses/wasmer-sdk-dependencies.json",
-          "sha256": "4fb0d9e02e29f98b5c0ec047fa041cce870d98b9fdfecf2c02436a19842d0977"
+          "sha256": "39cac76585998208f43bb66076840c6fddc4e91eb7ef4cc2d9b1f90287b461f3"
         }
       ]
     }

@@ -0,0 +1,27 @@
+Modified MIT License
+
+Copyright (c) 2026 Wasmer, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the “Software”), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Our only modification part is that, if the Software (or any derivative works
+thereof) is used for any of your commercial products or services that have
+more than 1 million monthly active users, or more than 1 million US dollars
+(or equivalent in other currencies) in monthly revenue, you shall prominently
+display "Wasmer" on the user interface of such product or service.
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2019-present Wasmer, Inc. and its affiliates.
+Copyright (C) 2012-2022 by various contributors (see AUTHORS)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -9,13 +9,13 @@ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.