smolvm

v1.0.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Virtualization

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

containers crun libkrun microvm rust virtual-machine

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 1mo

Patch vitest to version 4.1.8 to remediate CVE‑2026‑47429. Remove reliance on the built‑in store; the VM now depends exclusively on host environment and files.

Why it matters: CVE‑2026‑47429 (severity 90) requires upgrading vitest ≥ 4.1.8 immediately; breaking change eliminates the built‑in store, forcing all deployments to manage state externally.

Summary

AI summary

Updates feat, fix, and registry across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Patch CVE-2026-47429 by bumping vitest from 1 to 4.1.8. Patch CVE-2026-47429 by bumping vitest from 1 to 4.1.8. Source: llm_adapter@2026-06-05 Confidence: high	—
Breaking	High	Remove built‑in store; VM now relies on host environment/files only. Remove built‑in store; VM now relies on host environment/files only. Source: llm_adapter@2026-06-05 Confidence: low	—
Feature
Feature	Medium	Add fast VM fork with checkpoint/restore and copy‑on‑write clones. Add fast VM fork with checkpoint/restore and copy‑on‑write clones. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Introduce copy‑on‑write block disks for fork clones. Introduce copy‑on‑write block disks for fork clones. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Enable GPU support for interactive sessions. Enable GPU support for interactive sessions. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Add OCI image‑index support allowing one tag to fan out by platform. Add OCI image‑index support allowing one tag to fan out by platform. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Add Nix flake packaging and dev shell. Add Nix flake packaging and dev shell. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Extract bundled rootfs tarball at runtime. Extract bundled rootfs tarball at runtime. Source: llm_adapter@2026-06-05 Confidence: high	—
Bugfix	Medium	Reject non‑regular files in read_file to prevent directory poisoning and device hangs. Reject non‑regular files in read_file to prevent directory poisoning and device hangs. Source: llm_adapter@2026-06-05 Confidence: high	—
Bugfix	Medium	Persist .smolmachine layers per VM, rebasing change #336. Persist .smolmachine layers per VM, rebasing change #336. Source: llm_adapter@2026-06-05 Confidence: high	—

Full changelog

What's Changed

fix(crates): version-pin smolvm-protocol dep in smolfile + pack by @BinSquare in https://github.com/smol-machines/smolvm/pull/349
feat: fast VM fork (checkpoint/restore + CoW clones) by @BinSquare in https://github.com/smol-machines/smolvm/pull/344
feat: copy-on-write block disks for fork clones by @BinSquare in https://github.com/smol-machines/smolvm/pull/332
refactor: drop built-in store outside responsibility of vm; refs are host env/file only by @BinSquare in https://github.com/smol-machines/smolvm/pull/352
fix: reap orphaned smol-vmm on parent death + bound pack cache by @BinSquare in https://github.com/smol-machines/smolvm/pull/353
feat(registry): OCI image-index support — one tag fans out by platform by @BinSquare in https://github.com/smol-machines/smolvm/pull/351
fix(agent): reject non-regular files in read_file (dir poison + dev hang) by @BinSquare in https://github.com/smol-machines/smolvm/pull/354
feat: add Nix flake packaging and dev shell by @LukeTandjung in https://github.com/smol-machines/smolvm/pull/298
feat: extract bundled rootfs tarball by @BinSquare in https://github.com/smol-machines/smolvm/pull/356
fix: pack inspect resolves image indexes like pull by @BinSquare in https://github.com/smol-machines/smolvm/pull/355
Enable gpus for interactive sessions by @anderspitman in https://github.com/smol-machines/smolvm/pull/350
fix: exec edge cases — idempotent delete + clear error on large output by @BinSquare in https://github.com/smol-machines/smolvm/pull/357
fix(libkrun): re-vendor .so with block-CoW disk-overlay symbol by @BinSquare in https://github.com/smol-machines/smolvm/pull/358
fix(deps): bump vitest 1 -> 4.1.8 (CVE-2026-47429) by @BinSquare in https://github.com/smol-machines/smolvm/pull/359
fix(registry): resolve multi-arch pull by guest arch, not host platform by @BinSquare in https://github.com/smol-machines/smolvm/pull/360
fix: persist .smolmachine layers per VM (rebased #336) by @BinSquare in https://github.com/smol-machines/smolvm/pull/362
bump: v1.0.0 by @BinSquare in https://github.com/smol-machines/smolvm/pull/361

New Contributors

@LukeTandjung made their first contribution in https://github.com/smol-machines/smolvm/pull/298
@anderspitman made their first contribution in https://github.com/smol-machines/smolvm/pull/350

Full Changelog: https://github.com/smol-machines/smolvm/compare/v0.9.0...v1.0.0

Breaking Changes

drop built-in store; refs are now host env/file only

Security Fixes

dep: vitest bumped to 4.1.8 (CVE-2026-47429)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track smolvm

Get notified when new releases ship.

About smolvm

Tool to build & run portable, lightweight, self-contained virtual machines.

All releases →

Related context

Related tools

Related CVEs

CVE-2026-47429 NVD KEV EPSS