fix(deps): require go-pkg v0.4.1 to stop GC in cabi_realloc

.github/workflows/airgapped.yaml

@@ -26,6 +26,8 @@ on:
       - "component/**"
       - "examples/components/**"
       - "templates/**"
+      # check-versions.sh reads its go-pkg pin.
+      - "plugin/go.mod"
   # Runs on every pull request so the required `airgapped-gate` check always
   # reports; the `changes` job skips the build when none of the paths changed.
   pull_request:
@@ -61,6 +63,7 @@ jobs:
               - "component/**"
               - "examples/components/**"
               - "templates/**"
+              - "plugin/go.mod"
 
   # Cheap and fast: catches BUILDING.md drifting from reality without building
   # anything. Runs first so a stale doc fails in seconds, not minutes.

BUILDING.md

@@ -15,7 +15,7 @@ every value from its real upstream source and fails if the two disagree.
 |---|---|
 | Go | 1.27.3 (`go.bytecodealliance.org/pkg` and `/wasi` declare `go 1.27.1`, the minimum) |
 | `go.wasmcloud.dev/component` | v0.1.6 |
-| `go.bytecodealliance.org/pkg` | v0.4.0 |
+| `go.bytecodealliance.org/pkg` | v0.4.1 |
 | `go.bytecodealliance.org/wasi` | v0.1.1 |
 | componentize-go | v0.4.3 (module and toolchain) |
 | wit-bindgen-go | 0.61.1 (rev `4f9a02d7`) |
@@ -72,13 +72,29 @@ the pinned module and fails if it does not match the module's own version.
 
 ## go-pkg and go-wasi
 
-`go.bytecodealliance.org/pkg` v0.4.0 is only the WIT runtime the generated
-bindings link against (`wit/types`, `wit/runtime`, `wit/async`). The
+Since v0.4.0, `go.bytecodealliance.org/pkg` is only the WIT runtime the
+generated bindings link against (`wit/types`, `wit/runtime`, `wit/async`). The
 vendor-neutral packages that used to live beside it — `wasihttp`, `wasilog`,
 `wasiconfig` and the `wasi:*` bindings — moved to
 [`go.bytecodealliance.org/wasi`](https://github.com/bytecodealliance/go-wasi)
 (go-wasi). Apps import those from go-wasi; this SDK does not wrap them.
 
+**v0.4.1 is the floor.** Before it, the Go garbage collector could start a
+cycle inside `cabi_realloc`, the allocator the host calls to copy a value into
+the component's memory. A GC cycle calls imports (clocks, I/O polling), and the
+component model forbids imports during `cabi_realloc`, so the component traps.
+It only shows up once a single value is large enough to trigger GC: a
+`list<record>` of ~40k records, or one multi-megabyte NATS KV value, with
+`gcStart` and `cabi_realloc` in the backtrace.
+[go-pkg#13](https://github.com/bytecodealliance/go-pkg/pull/13) defers GC work
+until the allocation returns. Every module here requires v0.4.1, so Go's
+minimum version selection picks it even under an SDK release that still names
+v0.4.0. If you copied an example before this, run
+`go get go.bytecodealliance.org/pkg@v0.4.1` in your module. That updates go.mod
+and go.sum together. Editing go.mod by hand does not, and the next build fails
+with `missing go.sum entry` (or, if you added a second `require` line,
+`go: updates to go.mod needed`).
+
 go-wasi carries its own `componentize-go.toml` and WIT, as this SDK does, and
 componentize-go loads both. The `wasi:*` packages under `component/wit/deps`
 are kept byte-identical to go-wasi's, so the two resolve to one package each.

airgap/Dockerfile

@@ -53,8 +53,12 @@ COPY . .
 
 # Fill GOMODCACHE for every module in the repo. Done before any build so a
 # failure here is unambiguously a module-resolution problem.
+#
+# component/ is seeded too: an in-repo SDK build replaces the released SDK
+# with it, so its own requirements must be here even when no example happens
+# to name the same versions.
 RUN set -eux; \
-    for mod in $(find examples/components templates -name go.mod); do \
+    for mod in $(find component examples/components templates -name go.mod); do \
       dir=$(dirname "$mod"); \
       echo "==> downloading deps for ${dir}"; \
       (cd "$dir" && go mod download all); \

airgap/check-versions.sh

@@ -32,6 +32,28 @@ check() {
 
 note() { printf '  --    %-28s %s\n' "$1" "$2"; }
 
+# check_module_pins <label> <module-path-regex> <expected> <dir>...
+#
+# Every go.mod under <dir>... that names the module must pin exactly <expected>.
+# Plain word-splitting rather than mapfile: this script runs on developer
+# machines, and macOS still ships bash 3.2.
+check_module_pins() {
+  local label=$1 module_re=$2 expected=$3
+  shift 3
+  local -a pins
+  # shellcheck disable=SC2207
+  pins=($(grep -rhoE "${module_re} v[0-9][^ ]*" --include=go.mod "$@" \
+    | awk '{print $2}' | sort -u))
+  if [ "${#pins[@]}" -eq 1 ] && [ "${pins[0]}" = "$expected" ]; then
+    printf '  ok    %-28s all modules at %s\n' "$label" "$expected"
+  else
+    # :-none, because bash 3.2 treats an empty array as unset under `set -u`.
+    printf '  DRIFT %-28s expected all at %s, found: %s\n' \
+      "$label" "$expected" "${pins[*]:-none}"
+    problems=$((problems + 1))
+  fi
+}
+
 echo "Resolving pinned versions from their sources..."
 echo
 
@@ -51,34 +73,23 @@ else
 fi
 
 # --- every consumer module must require exactly that ------------------------
-# Plain word-splitting rather than mapfile: this script runs on developer
-# machines, and macOS still ships bash 3.2.
-# shellcheck disable=SC2207
-sdk_pins=($(grep -rhoE 'go\.wasmcloud\.dev/component v[0-9][^ ]*' \
-  --include=go.mod examples templates | awk '{print $2}' | sort -u))
-if [ "${#sdk_pins[@]}" -eq 1 ] && [ "${sdk_pins[0]}" = "$SDK_VERSION" ]; then
-  printf '  ok    %-28s all modules at %s\n' "SDK (module pins)" "$SDK_VERSION"
-else
-  printf '  DRIFT %-28s expected all at %s, found: %s\n' \
-    "SDK (module pins)" "$SDK_VERSION" "${sdk_pins[*]}"
-  problems=$((problems + 1))
-fi
+check_module_pins "SDK (module pins)" 'go\.wasmcloud\.dev/component' \
+  "$SDK_VERSION" examples templates
 
 # --- go-pkg -----------------------------------------------------------------
 actual_gopkg=$(grep -oE 'go\.bytecodealliance\.org/pkg v[^ ]*' component/go.mod | awk '{print $2}')
 check "go-pkg" "$GO_PKG" "$actual_gopkg"
 
+# Every other module pins the same go-pkg. The examples and the template build
+# against the released SDK, which may still name an older one, so only their
+# own requirement makes Go's minimum version selection pick the pinned
+# version. The plugin SDK moves in lockstep with component/.
+check_module_pins "go-pkg (module pins)" 'go\.bytecodealliance\.org/pkg' \
+  "$GO_PKG" examples templates plugin
+
 # --- go-wasi ----------------------------------------------------------------
-# shellcheck disable=SC2207
-wasi_pins=($(grep -rhoE 'go\.bytecodealliance\.org/wasi v[0-9][^ ]*' \
-  --include=go.mod examples templates | awk '{print $2}' | sort -u))
-if [ "${#wasi_pins[@]}" -eq 1 ] && [ "${wasi_pins[0]}" = "$GO_WASI" ]; then
-  printf '  ok    %-28s all modules at %s\n' "go-wasi (module pins)" "$GO_WASI"
-else
-  printf '  DRIFT %-28s expected all at %s, found: %s\n' \
-    "go-wasi (module pins)" "$GO_WASI" "${wasi_pins[*]}"
-  problems=$((problems + 1))
-fi
+check_module_pins "go-wasi (module pins)" 'go\.bytecodealliance\.org/wasi' \
+  "$GO_WASI" examples templates
 
 # --- componentize-go: module vs binary --------------------------------------
 actual_cg_mod=$(grep -rhoE 'github\.com/bytecodealliance/componentize-go v[^ ]*' \
@@ -199,9 +210,11 @@ fi
 echo
 echo "Checking BUILDING.md agrees..."
 echo
+# go-pkg is matched against its table row: the prose names the v0.4.1 floor on
+# purpose, so a bare version match would pass with a stale table.
 for pair in \
   "SDK:${SDK_VERSION}" \
-  "go-pkg:${GO_PKG}" \
+  "go-pkg:| \`go.bytecodealliance.org/pkg\` | ${GO_PKG} |" \
   "go-wasi:${GO_WASI}" \
   "SDK wit-bindgen:${SDK_WIT_BINDGEN}" \
   "componentize-go module:${COMPONENTIZE_GO_MODULE}" \

airgap/versions.env

@@ -51,7 +51,11 @@ PATCHED_GO_TAG=go1.27.1-wasi-on-idle
 
 # --- other libraries -------------------------------------------------------
 
-GO_PKG=v0.4.0
+# go.bytecodealliance.org/pkg: the WIT runtime the generated bindings link
+# against. v0.4.1 is the floor: earlier releases let the GC run inside
+# cabi_realloc and trap on large payloads. component/go.mod, the plugin, and
+# every example and template must pin exactly this. See BUILDING.md.
+GO_PKG=v0.4.1
 
 # go.bytecodealliance.org/wasi (bytecodealliance/go-wasi): wasihttp, wasilog,
 # wasiconfig and the wasi:* bindings, split out of go-pkg at v0.4.0. Every

component/go.mod

@@ -2,4 +2,4 @@ module go.wasmcloud.dev/component
 
 go 1.27.1
 
-require go.bytecodealliance.org/pkg v0.4.0
+require go.bytecodealliance.org/pkg v0.4.1

component/go.sum

@@ -1,2 +1,2 @@
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=

examples/components/http-client/go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 

examples/components/http-client/go.sum

@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=

examples/components/http-keyvalue-crud/go.mod

@@ -4,7 +4,7 @@ go 1.27.1
 
 require (
 	github.com/julienschmidt/httprouter v1.3.0
-	go.bytecodealliance.org/pkg v0.4.0
+	go.bytecodealliance.org/pkg v0.4.1
 	go.bytecodealliance.org/wasi v0.1.1
 	go.wasmcloud.dev/component v0.1.6
 )

examples/components/http-keyvalue-crud/go.sum

@@ -14,8 +14,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=

examples/components/http-otel/go.mod

@@ -3,7 +3,7 @@ module github.com/wasmCloud/go/examples/components/http-otel
 go 1.27.1
 
 require (
-	go.bytecodealliance.org/pkg v0.4.0
+	go.bytecodealliance.org/pkg v0.4.1
 	go.bytecodealliance.org/wasi v0.1.1
 	go.opentelemetry.io/otel v1.45.0
 	go.opentelemetry.io/otel/sdk v1.45.0

examples/components/http-otel/go.sum

@@ -22,8 +22,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=

examples/components/http-p3-streaming/go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 

examples/components/http-p3-streaming/go.sum

@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=

examples/components/http-password-checker/go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 

examples/components/http-password-checker/go.sum

@@ -14,8 +14,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/wagslane/go-password-validator v0.3.0 h1:vfxOPzGHkz5S146HDpavl0cw1DSVP061Ry2PX0/ON6I=
 github.com/wagslane/go-password-validator v0.3.0/go.mod h1:TI1XJ6T5fRdRnHqHt14pvy1tNVnrwe7m3/f1f2fDphQ=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=

examples/components/http-server/go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 

examples/components/http-server/go.sum

@@ -14,8 +14,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=

examples/components/nats-jetstream-orders/go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 

examples/components/nats-jetstream-orders/go.sum

@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=
 go.wasmcloud.dev/component v0.1.6/go.mod h1:Q3NOrAqEnNxNCGmow0GzTcXI/6a+d90sEO0Lv1QdGhE=
 golang.org/x/sys v0.0.0-20190509141414-a5b02f93d862/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

examples/components/nats-kv-watch/go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )
 

examples/components/nats-kv-watch/go.sum

@@ -12,8 +12,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-go.bytecodealliance.org/pkg v0.4.0 h1:oB0kfk9XGmNAe+TBWOyy61ys3TuCOpF/YBB7PboS2YI=
-go.bytecodealliance.org/pkg v0.4.0/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
+go.bytecodealliance.org/pkg v0.4.1 h1:adtvExJ42Lg3s46Hs2REAW0PeVrdF6wj9VKK83OwNOQ=
+go.bytecodealliance.org/pkg v0.4.1/go.mod h1:3Y4rSI/nLUEb57ZMXbEWDbblC/GWfZPRMh/qdxJTmMM=
 go.bytecodealliance.org/wasi v0.1.1 h1:3GrKL1iUq4JT8cWjp9HeOU9EG7kdTcyI09Vbh6TH1d0=
 go.bytecodealliance.org/wasi v0.1.1/go.mod h1:CQwMNxvQKsW2V4JOLrFlrzLOfXdYIcL+5Ua+L4xplsQ=
 go.wasmcloud.dev/component v0.1.6 h1:ppSQf1A/5AtUmZqjIkAQ3GqMoNmeuFPOsr2b9QwICWk=

examples/components/nats-request-reply/gateway/go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/apparentlymart/go-userdirs v0.0.0-20200915174352-b0c018a67c13 // indirect
 	github.com/bytecodealliance/componentize-go v0.4.3 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
-	go.bytecodealliance.org/pkg v0.4.0 // indirect
+	go.bytecodealliance.org/pkg v0.4.1 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 )