From f21f5c17867f6ff380c048761162e0c509bba774 Mon Sep 17 00:00:00 2001
From: Bailey Hayes <bailey@cosmonic.com>
Date: Sat, 7 Nov 2026 17:08:50 -0500
Subject: [PATCH 1/2] fix(deps): require go-pkg v0.4.1 to stop GC in
 cabi_realloc

go.bytecodealliance.org/pkg v0.4.0 lets the Go garbage collector start a
cycle inside cabi_realloc. A GC cycle calls imports (clocks, I/O polling),
which the component model forbids there, so the component traps. It shows
up once a single value is big enough to trigger GC: a list<record> of ~40k
records traps while 20k works, and reading one 8.8 MiB NATS KV value traps
with gcStart and cabi_realloc in the backtrace. v0.4.1
(bytecodealliance/go-pkg#13) pins the M while allocating, deferring GC
work until the allocation returns.

- component/ and plugin/ require v0.4.1.
- Every example and the template pin v0.4.1 too. They build against the
  released SDK v0.1.6, which still names v0.4.0, so MVS needs the pin to
  pick the fix; and the air-gapped image seeds GOMODCACHE from these
  modules alone, so without it the in-repo SDK build would go offline
  short of v0.4.1.
- airgap/versions.env and BUILDING.md record the new pin and why it is
  the floor; check-versions.sh now fails if any module names another
  go-pkg version.

No binding regeneration: generated code names go-pkg by import path only.
componentize-go stays at v0.4.3.

Signed-off-by: Bailey Hayes <bailey@cosmonic.com>
---
 BUILDING.md                                   | 19 ++++++++++++++++---
 airgap/check-versions.sh                      | 14 ++++++++++++++
 airgap/versions.env                           |  6 +++++-
 component/go.mod                              |  2 +-
 component/go.sum                              |  4 ++--
 examples/components/http-client/go.mod        |  2 +-
 examples/components/http-client/go.sum        |  4 ++--
 examples/components/http-keyvalue-crud/go.mod |  2 +-
 examples/components/http-keyvalue-crud/go.sum |  4 ++--
 examples/components/http-otel/go.mod          |  2 +-
 examples/components/http-otel/go.sum          |  4 ++--
 examples/components/http-p3-streaming/go.mod  |  2 +-
 examples/components/http-p3-streaming/go.sum  |  4 ++--
 .../components/http-password-checker/go.mod   |  2 +-
 .../components/http-password-checker/go.sum   |  4 ++--
 examples/components/http-server/go.mod        |  2 +-
 examples/components/http-server/go.sum        |  4 ++--
 .../components/nats-jetstream-orders/go.mod   |  2 +-
 .../components/nats-jetstream-orders/go.sum   |  4 ++--
 examples/components/nats-kv-watch/go.mod      |  2 +-
 examples/components/nats-kv-watch/go.sum      |  4 ++--
 .../nats-request-reply/gateway/go.mod         |  2 +-
 .../nats-request-reply/gateway/go.sum         |  4 ++--
 .../nats-request-reply/service/go.mod         |  2 +-
 .../nats-request-reply/service/go.sum         |  4 ++--
 examples/components/nats-stream-replay/go.mod |  2 +-
 examples/components/nats-stream-replay/go.sum |  4 ++--
 plugin/README.md                              |  2 +-
 plugin/go.mod                                 |  2 +-
 plugin/go.sum                                 |  4 ++--
 templates/http-hello-world/go.mod             |  5 +++--
 31 files changed, 78 insertions(+), 46 deletions(-)

diff --git a/BUILDING.md b/BUILDING.md
index 38e886f7..32d0d395 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -15,7 +15,7 @@ every value from its real upstream source and fails if the two disagree.
 |---|---|
 | Go | 1.27.3 (`go.bytecodealliance.org/pkg` and `/wasi` declare `go 1.27.1`, the minimum) |
 | `go.wasmcloud.dev/component` | v0.1.6 |
-| `go.bytecodealliance.org/pkg` | v0.4.0 |
+| `go.bytecodealliance.org/pkg` | v0.4.1 |
 | `go.bytecodealliance.org/wasi` | v0.1.1 |
 | componentize-go | v0.4.3 (module and toolchain) |
 | wit-bindgen-go | 0.61.1 (rev `4f9a02d7`) |
@@ -72,13 +72,26 @@ the pinned module and fails if it does not match the module's own version.
 
 ## go-pkg and go-wasi
 
-`go.bytecodealliance.org/pkg` v0.4.0 is only the WIT runtime the generated
-bindings link against (`wit/types`, `wit/runtime`, `wit/async`). The
+Since v0.4.0, `go.bytecodealliance.org/pkg` is only the WIT runtime the
+generated bindings link against (`wit/types`, `wit/runtime`, `wit/async`). The
 vendor-neutral packages that used to live beside it — `wasihttp`, `wasilog`,
 `wasiconfig` and the `wasi:*` bindings — moved to
 [`go.bytecodealliance.org/wasi`](https://github.com/bytecodealliance/go-wasi)
 (go-wasi). Apps import those from go-wasi; this SDK does not wrap them.
 
+**v0.4.1 is the floor.** Before it, the Go garbage collector could start a
+cycle inside `cabi_realloc`, the allocator the host calls to copy a value into
+the component's memory. A GC cycle calls imports (clocks, I/O polling), and the
+component model forbids imports during `cabi_realloc`, so the component traps.
+It only shows up once a single value is large enough to trigger GC: a
+`list<record>` of ~40k records, or one multi-megabyte NATS KV value, with
+`gcStart` and `cabi_realloc` in the backtrace.
+[go-pkg#13](https://github.com/bytecodealliance/go-pkg/pull/13) defers GC work
+until the allocation returns. Every module here requires v0.4.1, so Go's
+minimum version selection picks it even under an SDK release that still names
+v0.4.0. If you copied an example before this, add
+`require go.bytecodealliance.org/pkg v0.4.1` to your own go.mod.
+
 go-wasi carries its own `componentize-go.toml` and WIT, as this SDK does, and
 componentize-go loads both. The `wasi:*` packages under `component/wit/deps`
 are kept byte-identical to go-wasi's, so the two resolve to one package each.
diff --git a/airgap/check-versions.sh b/airgap/check-versions.sh
index beda6ec5..2b1fcd7f 100755
--- a/airgap/check-versions.sh
+++ b/airgap/check-versions.sh
@@ -68,6 +68,20 @@ fi
 actual_gopkg=$(grep -oE 'go\.bytecodealliance\.org/pkg v[^ ]*' component/go.mod | awk '{print $2}')
 check "go-pkg" "$GO_PKG" "$actual_gopkg"
 
+# Every other module pins it too, though only indirectly needed: a released SDK
+# may still name an older go-pkg, and the air-gapped image seeds GOMODCACHE from
+# these modules alone, so a version only component/ names is never downloaded.
+# shellcheck disable=SC2207
+gopkg_pins=($(grep -rhoE 'go\.bytecodealliance\.org/pkg v[0-9][^ ]*' \
+  --include=go.mod examples templates plugin | awk '{print $2}' | sort -u))
+if [ "${#gopkg_pins[@]}" -eq 1 ] && [ "${gopkg_pins[0]}" = "$GO_PKG" ]; then
+  printf '  ok    %-28s all modules at %s\n' "go-pkg (module pins)" "$GO_PKG"
+else
+  printf '  DRIFT %-28s expected all at %s, found: %s\n' \
+    "go-pkg (module pins)" "$GO_PKG" "${gopkg_pins[*]}"
+  problems=$((problems + 1))
+fi
+
 # --- go-wasi ----------------------------------------------------------------
 # shellcheck disable=SC2207
 wasi_pins=($(grep -rhoE 'go\.bytecodealliance\.org/wasi v[0-9][^ ]*' \
diff --git a/airgap/versions.env b/airgap/versions.env
index 91aa84db..14bada6f 100644
--- a/airgap/versions.env
+++ b/airgap/versions.env
@@ -51,7 +51,11 @@ PATCHED_GO_TAG=go1.27.1-wasi-on-idle
 
 # --- other libraries -------------------------------------------------------
 
-GO_PKG=v0.4.0
+# go.bytecodealliance.org/pkg: the WIT runtime the generated bindings link
+# against. v0.4.1 is the floor: earlier releases let the GC run inside
+# cabi_realloc and trap on large payloads. component/go.mod, the plugin, and
+# every example and template must pin exactly this. See BUILDING.md.
+GO_PKG=v0.4.1
 
 # go.bytecodealliance.org/wasi (bytecodealliance/go-wasi): wasihttp, wasilog,
 # wasiconfig and the wasi:* bindings, split out of go-pkg at v0.4.0. Every
diff --git a/component/go.mod b/component/go.mod
index eee90f0c..c91d929c 100644
--- a/component/go.mod
+++ b/component/go.mod
@@ -2,4 +2,4 @@ module go.wasmcloud.dev/component
 
 go 1.27.1
 
-require go.bytecodealliance.org/pkg v0.4.0
+require go.bytecodealliance.org/pkg v0.4.1
diff --git a/component/go.sum b/component/go.sum
index 64a17079..e07555fd 100644
--- a/component/go.sum
+++ b/component/go.sum
@@ -1,2 +1,2 @@
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
diff --git a/examples/components/http-client/go.mod b/examples/components/http-client/go.mod
index 7d4170a2..1f23276b 100644
--- a/examples/components/http-client/go.mod
+++ b/examples/components/http-client/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 
diff --git a/examples/components/http-client/go.sum b/examples/components/http-client/go.sum
index acf9a6ab..0a784cd9 100644
--- a/examples/components/http-client/go.sum
+++ b/examples/components/http-client/go.sum
@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
diff --git a/examples/components/http-keyvalue-crud/go.mod b/examples/components/http-keyvalue-crud/go.mod
index dc1e26d5..91eebd60 100644
--- a/examples/components/http-keyvalue-crud/go.mod
+++ b/examples/components/http-keyvalue-crud/go.mod
@@ -4,7 +4,7 @@ go 1.27.1
 
 require (
 	github.com/julienschmidt/httprouter v1.3.0
-	go.bytecodealliance.org/pkg v0.4.0
+	go.bytecodealliance.org/pkg v0.4.1
 	go.bytecodealliance.org/wasi v0.1.1
 	go.wasmcloud.dev/component v0.1.6
 )
diff --git a/examples/components/http-keyvalue-crud/go.sum b/examples/components/http-keyvalue-crud/go.sum
index c58bfd24..7356113a 100644
--- a/examples/components/http-keyvalue-crud/go.sum
+++ b/examples/components/http-keyvalue-crud/go.sum
@@ -14,8 +14,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
diff --git a/examples/components/http-otel/go.mod b/examples/components/http-otel/go.mod
index 538e36e4..bc91befb 100644
--- a/examples/components/http-otel/go.mod
+++ b/examples/components/http-otel/go.mod
@@ -3,7 +3,7 @@ module github.com/wasmCloud/go/examples/components/http-otel
 go 1.27.1
 
 require (
-	go.bytecodealliance.org/pkg v0.4.0
+	go.bytecodealliance.org/pkg v0.4.1
 	go.bytecodealliance.org/wasi v0.1.1
 	go.opentelemetry.io/otel v1.45.0
 	go.opentelemetry.io/otel/sdk v1.45.0
diff --git a/examples/components/http-otel/go.sum b/examples/components/http-otel/go.sum
index f70fa972..a56f32ec 100644
--- a/examples/components/http-otel/go.sum
+++ b/examples/components/http-otel/go.sum
@@ -22,8 +22,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
diff --git a/examples/components/http-p3-streaming/go.mod b/examples/components/http-p3-streaming/go.mod
index 1c91c4bd..496e3bf6 100644
--- a/examples/components/http-p3-streaming/go.mod
+++ b/examples/components/http-p3-streaming/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 
diff --git a/examples/components/http-p3-streaming/go.sum b/examples/components/http-p3-streaming/go.sum
index acf9a6ab..0a784cd9 100644
--- a/examples/components/http-p3-streaming/go.sum
+++ b/examples/components/http-p3-streaming/go.sum
@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
diff --git a/examples/components/http-password-checker/go.mod b/examples/components/http-password-checker/go.mod
index 0c4a9f06..965203c8 100644
--- a/examples/components/http-password-checker/go.mod
+++ b/examples/components/http-password-checker/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 
diff --git a/examples/components/http-password-checker/go.sum b/examples/components/http-password-checker/go.sum
index 9ecd1b4b..6d87fe89 100644
--- a/examples/components/http-password-checker/go.sum
+++ b/examples/components/http-password-checker/go.sum
@@ -14,8 +14,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/wagslane/go-password-validator v0.3.0 h1:vfxOPzGHkz5S146HDpavl0cw1DSVP061Ry2PX0/ON6I=
 github.com/wagslane/go-password-validator v0.3.0/go.mod h1:TI1XJ6T5fRdRnHqHt14pvy1tNVnrwe7m3/f1f2fDphQ=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
diff --git a/examples/components/http-server/go.mod b/examples/components/http-server/go.mod
index ccefca04..ea65a43e 100644
--- a/examples/components/http-server/go.mod
+++ b/examples/components/http-server/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 
diff --git a/examples/components/http-server/go.sum b/examples/components/http-server/go.sum
index c58bfd24..7356113a 100644
--- a/examples/components/http-server/go.sum
+++ b/examples/components/http-server/go.sum
@@ -14,8 +14,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
diff --git a/examples/components/nats-jetstream-orders/go.mod b/examples/components/nats-jetstream-orders/go.mod
index 5dfbaa03..f7c716d7 100644
--- a/examples/components/nats-jetstream-orders/go.mod
+++ b/examples/components/nats-jetstream-orders/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 
diff --git a/examples/components/nats-jetstream-orders/go.sum b/examples/components/nats-jetstream-orders/go.sum
index 0cc487dd..b569ead8 100644
--- a/examples/components/nats-jetstream-orders/go.sum
+++ b/examples/components/nats-jetstream-orders/go.sum
@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
 go.wasmcloud.dev/component v0.1.6/go.mod h1:Q3NOrAqEnNxNCGmow0GzTcXI/6a+d90sEO0Lv1QdGhE=
 golang.org/x/sys v0.0.0-20190509141414-a5b02f93d862/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
diff --git a/examples/components/nats-kv-watch/go.mod b/examples/components/nats-kv-watch/go.mod
index e8818514..2c46e570 100644
--- a/examples/components/nats-kv-watch/go.mod
+++ b/examples/components/nats-kv-watch/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 
diff --git a/examples/components/nats-kv-watch/go.sum b/examples/components/nats-kv-watch/go.sum
index acf9a6ab..0a784cd9 100644
--- a/examples/components/nats-kv-watch/go.sum
+++ b/examples/components/nats-kv-watch/go.sum
@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
diff --git a/examples/components/nats-request-reply/gateway/go.mod b/examples/components/nats-request-reply/gateway/go.mod
index 32a24072..ce8f37f9 100644
--- a/examples/components/nats-request-reply/gateway/go.mod
+++ b/examples/components/nats-request-reply/gateway/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 
diff --git a/examples/components/nats-request-reply/gateway/go.sum b/examples/components/nats-request-reply/gateway/go.sum
index acf9a6ab..0a784cd9 100644
--- a/examples/components/nats-request-reply/gateway/go.sum
+++ b/examples/components/nats-request-reply/gateway/go.sum
@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
diff --git a/examples/components/nats-request-reply/service/go.mod b/examples/components/nats-request-reply/service/go.mod
index 71f179c8..805473a4 100644
--- a/examples/components/nats-request-reply/service/go.mod
+++ b/examples/components/nats-request-reply/service/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 
diff --git a/examples/components/nats-request-reply/service/go.sum b/examples/components/nats-request-reply/service/go.sum
index acf9a6ab..0a784cd9 100644
--- a/examples/components/nats-request-reply/service/go.sum
+++ b/examples/components/nats-request-reply/service/go.sum
@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
diff --git a/examples/components/nats-stream-replay/go.mod b/examples/components/nats-stream-replay/go.mod
index c879e00b..5e686253 100644
--- a/examples/components/nats-stream-replay/go.mod
+++ b/examples/components/nats-stream-replay/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 
diff --git a/examples/components/nats-stream-replay/go.sum b/examples/components/nats-stream-replay/go.sum
index acf9a6ab..0a784cd9 100644
--- a/examples/components/nats-stream-replay/go.sum
+++ b/examples/components/nats-stream-replay/go.sum
@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
diff --git a/plugin/README.md b/plugin/README.md
index 7373a457..0e2a6c73 100644
--- a/plugin/README.md
+++ b/plugin/README.md
@@ -69,7 +69,7 @@ under `wit/` and provides:
    same release this module does:
 
    ```
-   require go.bytecodealliance.org/pkg v0.4.0
+   require go.bytecodealliance.org/pkg v0.4.1
    ```
 
 3. **Build** with componentize-go (async support is enabled automatically
diff --git a/plugin/go.mod b/plugin/go.mod
index 508efc0f..eec7e8c0 100644
--- a/plugin/go.mod
+++ b/plugin/go.mod
@@ -2,4 +2,4 @@ module go.wasmcloud.dev/plugin
 
 go 1.27.1
 
-require go.bytecodealliance.org/pkg v0.4.0
+require go.bytecodealliance.org/pkg v0.4.1
diff --git a/plugin/go.sum b/plugin/go.sum
index 64a17079..e07555fd 100644
--- a/plugin/go.sum
+++ b/plugin/go.sum
@@ -1,2 +1,2 @@
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
diff --git a/templates/http-hello-world/go.mod b/templates/http-hello-world/go.mod
index 0063c8f3..598358ee 100644
--- a/templates/http-hello-world/go.mod
+++ b/templates/http-hello-world/go.mod
@@ -15,8 +15,9 @@ require (
 	// See BUILDING.md.
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	// Pseudo-version of go-pkg main (post-#12); bump to the next tagged release.
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	// v0.4.1 stops the GC running inside cabi_realloc, which traps on large
+	// payloads (bytecodealliance/go-pkg#13). Do not go below it.
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 

From c38e62278d71a0c9a22cb34fa39dffef64f54ec1 Mon Sep 17 00:00:00 2001
From: Bailey Hayes <bailey@cosmonic.com>
Date: Sat, 7 Nov 2026 18:44:00 -0500
Subject: [PATCH 2/2] fix(airgap): seed component deps and tighten go-pkg
 checks

Follow-ups from review of the go-pkg v0.4.1 bump:

- airgap/Dockerfile seeds GOMODCACHE from component/ as well. An in-repo
  SDK build replaces the released SDK with it, so its requirements must
  be cached offline even when no example names the same versions.
- check-versions.sh: the SDK, go-pkg and go-wasi module-pin checks share
  one check_module_pins helper, which also no longer trips `set -u` on
  bash 3.2 when nothing matches. The go-pkg rationale comment now gives
  the real reason (MVS under the released SDK; plugin in lockstep).
- The BUILDING.md go-pkg check matches the table row. The prose names
  the v0.4.1 floor, so a bare version match passed with a stale table.
- airgapped.yaml runs on plugin/go.mod changes, which the check reads.
- BUILDING.md tells users to run `go get ...@v0.4.1` rather than edit
  go.mod by hand, which fails the next build on go.sum.

Signed-off-by: Bailey Hayes <bailey@cosmonic.com>
---
 .github/workflows/airgapped.yaml |  3 ++
 BUILDING.md                      |  7 +++-
 airgap/Dockerfile                |  6 ++-
 airgap/check-versions.sh         | 71 ++++++++++++++++----------------
 4 files changed, 48 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/airgapped.yaml b/.github/workflows/airgapped.yaml
index fb3fd4ee..ada93900 100644
--- a/.github/workflows/airgapped.yaml
+++ b/.github/workflows/airgapped.yaml
@@ -26,6 +26,8 @@ on:
       - "component/**"
       - "examples/components/**"
       - "templates/**"
+      # check-versions.sh reads its go-pkg pin.
+      - "plugin/go.mod"
   # Runs on every pull request so the required `airgapped-gate` check always
   # reports; the `changes` job skips the build when none of the paths changed.
   pull_request:
@@ -61,6 +63,7 @@ jobs:
               - "component/**"
               - "examples/components/**"
               - "templates/**"
+              - "plugin/go.mod"
 
   # Cheap and fast: catches BUILDING.md drifting from reality without building
   # anything. Runs first so a stale doc fails in seconds, not minutes.
diff --git a/BUILDING.md b/BUILDING.md
index 32d0d395..44511d52 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -89,8 +89,11 @@ It only shows up once a single value is large enough to trigger GC: a
 [go-pkg#13](https://github.com/bytecodealliance/go-pkg/pull/13) defers GC work
 until the allocation returns. Every module here requires v0.4.1, so Go's
 minimum version selection picks it even under an SDK release that still names
-v0.4.0. If you copied an example before this, add
-`require go.bytecodealliance.org/pkg v0.4.1` to your own go.mod.
+v0.4.0. If you copied an example before this, run
+`go get go.bytecodealliance.org/pkg@v0.4.1` in your module. That updates go.mod
+and go.sum together. Editing go.mod by hand does not, and the next build fails
+with `missing go.sum entry` (or, if you added a second `require` line,
+`go: updates to go.mod needed`).
 
 go-wasi carries its own `componentize-go.toml` and WIT, as this SDK does, and
 componentize-go loads both. The `wasi:*` packages under `component/wit/deps`
diff --git a/airgap/Dockerfile b/airgap/Dockerfile
index f40e45c5..1590695a 100644
--- a/airgap/Dockerfile
+++ b/airgap/Dockerfile
@@ -53,8 +53,12 @@ COPY . .
 
 # Fill GOMODCACHE for every module in the repo. Done before any build so a
 # failure here is unambiguously a module-resolution problem.
+#
+# component/ is seeded too: an in-repo SDK build replaces the released SDK
+# with it, so its own requirements must be here even when no example happens
+# to name the same versions.
 RUN set -eux; \
-    for mod in $(find examples/components templates -name go.mod); do \
+    for mod in $(find component examples/components templates -name go.mod); do \
       dir=$(dirname "$mod"); \
       echo "==> downloading deps for ${dir}"; \
       (cd "$dir" && go mod download all); \
diff --git a/airgap/check-versions.sh b/airgap/check-versions.sh
index 2b1fcd7f..d2391977 100755
--- a/airgap/check-versions.sh
+++ b/airgap/check-versions.sh
@@ -32,6 +32,28 @@ check() {
 
 note() { printf '  --    %-28s %s\n' "$1" "$2"; }
 
+# check_module_pins <label> <module-path-regex> <expected> <dir>...
+#
+# Every go.mod under <dir>... that names the module must pin exactly <expected>.
+# Plain word-splitting rather than mapfile: this script runs on developer
+# machines, and macOS still ships bash 3.2.
+check_module_pins() {
+  local label=$1 module_re=$2 expected=$3
+  shift 3
+  local -a pins
+  # shellcheck disable=SC2207
+  pins=($(grep -rhoE "${module_re} v[0-9][^ ]*" --include=go.mod "$@" \
+    | awk '{print $2}' | sort -u))
+  if [ "${#pins[@]}" -eq 1 ] && [ "${pins[0]}" = "$expected" ]; then
+    printf '  ok    %-28s all modules at %s\n' "$label" "$expected"
+  else
+    # :-none, because bash 3.2 treats an empty array as unset under `set -u`.
+    printf '  DRIFT %-28s expected all at %s, found: %s\n' \
+      "$label" "$expected" "${pins[*]:-none}"
+    problems=$((problems + 1))
+  fi
+}
+
 echo "Resolving pinned versions from their sources..."
 echo
 
@@ -51,48 +73,23 @@ else
 fi
 
 # --- every consumer module must require exactly that ------------------------
-# Plain word-splitting rather than mapfile: this script runs on developer
-# machines, and macOS still ships bash 3.2.
-# shellcheck disable=SC2207
-sdk_pins=($(grep -rhoE 'go\.wasmcloud\.dev/component v[0-9][^ ]*' \
-  --include=go.mod examples templates | awk '{print $2}' | sort -u))
-if [ "${#sdk_pins[@]}" -eq 1 ] && [ "${sdk_pins[0]}" = "$SDK_VERSION" ]; then
-  printf '  ok    %-28s all modules at %s\n' "SDK (module pins)" "$SDK_VERSION"
-else
-  printf '  DRIFT %-28s expected all at %s, found: %s\n' \
-    "SDK (module pins)" "$SDK_VERSION" "${sdk_pins[*]}"
-  problems=$((problems + 1))
-fi
+check_module_pins "SDK (module pins)" 'go\.wasmcloud\.dev/component' \
+  "$SDK_VERSION" examples templates
 
 # --- go-pkg -----------------------------------------------------------------
 actual_gopkg=$(grep -oE 'go\.bytecodealliance\.org/pkg v[^ ]*' component/go.mod | awk '{print $2}')
 check "go-pkg" "$GO_PKG" "$actual_gopkg"
 
-# Every other module pins it too, though only indirectly needed: a released SDK
-# may still name an older go-pkg, and the air-gapped image seeds GOMODCACHE from
-# these modules alone, so a version only component/ names is never downloaded.
-# shellcheck disable=SC2207
-gopkg_pins=($(grep -rhoE 'go\.bytecodealliance\.org/pkg v[0-9][^ ]*' \
-  --include=go.mod examples templates plugin | awk '{print $2}' | sort -u))
-if [ "${#gopkg_pins[@]}" -eq 1 ] && [ "${gopkg_pins[0]}" = "$GO_PKG" ]; then
-  printf '  ok    %-28s all modules at %s\n' "go-pkg (module pins)" "$GO_PKG"
-else
-  printf '  DRIFT %-28s expected all at %s, found: %s\n' \
-    "go-pkg (module pins)" "$GO_PKG" "${gopkg_pins[*]}"
-  problems=$((problems + 1))
-fi
+# Every other module pins the same go-pkg. The examples and the template build
+# against the released SDK, which may still name an older one, so only their
+# own requirement makes Go's minimum version selection pick the pinned
+# version. The plugin SDK moves in lockstep with component/.
+check_module_pins "go-pkg (module pins)" 'go\.bytecodealliance\.org/pkg' \
+  "$GO_PKG" examples templates plugin
 
 # --- go-wasi ----------------------------------------------------------------
-# shellcheck disable=SC2207
-wasi_pins=($(grep -rhoE 'go\.bytecodealliance\.org/wasi v[0-9][^ ]*' \
-  --include=go.mod examples templates | awk '{print $2}' | sort -u))
-if [ "${#wasi_pins[@]}" -eq 1 ] && [ "${wasi_pins[0]}" = "$GO_WASI" ]; then
-  printf '  ok    %-28s all modules at %s\n' "go-wasi (module pins)" "$GO_WASI"
-else
-  printf '  DRIFT %-28s expected all at %s, found: %s\n' \
-    "go-wasi (module pins)" "$GO_WASI" "${wasi_pins[*]}"
-  problems=$((problems + 1))
-fi
+check_module_pins "go-wasi (module pins)" 'go\.bytecodealliance\.org/wasi' \
+  "$GO_WASI" examples templates
 
 # --- componentize-go: module vs binary --------------------------------------
 actual_cg_mod=$(grep -rhoE 'github\.com/bytecodealliance/componentize-go v[^ ]*' \
@@ -213,9 +210,11 @@ fi
 echo
 echo "Checking BUILDING.md agrees..."
 echo
+# go-pkg is matched against its table row: the prose names the v0.4.1 floor on
+# purpose, so a bare version match would pass with a stale table.
 for pair in \
   "SDK:${SDK_VERSION}" \
-  "go-pkg:${GO_PKG}" \
+  "go-pkg:| \`go.bytecodealliance.org/pkg\` | ${GO_PKG} |" \
   "go-wasi:${GO_WASI}" \
   "SDK wit-bindgen:${SDK_WIT_BINDGEN}" \
   "componentize-go module:${COMPONENTIZE_GO_MODULE}" \