diff --git a/package-lock.json b/package-lock.json index 9614900..d4a99c1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -120,7 +120,6 @@ "resolved": "https://registry.npmjs.org/@astrojs/starlight/-/starlight-0.37.6.tgz", "integrity": "sha512-wQrKwH431q+8FsLBnNQeG+R36TMtEGxTQ2AuiVpcx9APcazvL3n7wVW8mMmYyxX0POjTnxlcWPkdMGR3Yj1L+w==", "license": "MIT", - "peer": true, "dependencies": { "@astrojs/markdown-remark": "^6.3.1", "@astrojs/mdx": "^4.2.3", @@ -1842,7 +1841,6 @@ "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz", "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==", "license": "MIT", - "peer": true, "bin": { "acorn": "bin/acorn" }, @@ -2003,7 +2001,6 @@ "resolved": "https://registry.npmjs.org/astro/-/astro-5.17.1.tgz", "integrity": "sha512-oD3tlxTaVWGq/Wfbqk6gxzVRz98xa/rYlpe+gU2jXJMSD01k6sEDL01ZlT8mVSYB/rMgnvIOfiQQ3BbLdN237A==", "license": "MIT", - "peer": true, "dependencies": { "@astrojs/compiler": "^2.13.0", "@astrojs/internal-helpers": "0.7.5", @@ -3692,7 +3689,6 @@ "resolved": "https://registry.npmjs.org/marked/-/marked-15.0.12.tgz", "integrity": "sha512-8dD6FusOQSrpv9Z1rdNMdlSgQOIP880DHqnohobOmYLElGEqAL/JvxvuxZO16r4HtjTlfPRDC1hbvxC9dPN2nA==", "license": "MIT", - "peer": true, "bin": { "marked": "bin/marked.js" }, @@ -5081,7 +5077,6 @@ } ], "license": "MIT", - "peer": true, "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", @@ -5547,7 +5542,6 @@ "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.57.1.tgz", "integrity": "sha512-oQL6lgK3e2QZeQ7gcgIkS2YZPg5slw37hYufJ3edKlfQSGGm8ICoxswK15ntSzF/a8+h7ekRy7k7oWc3BQ7y8A==", "license": "MIT", - "peer": true, "dependencies": { "@types/estree": "1.0.8" }, @@ -6342,7 +6336,6 @@ "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.1.tgz", "integrity": "sha512-+Oxm7q9hDoLMyJOYfUYBuHQo+dkAloi33apOPP56pzj+vsdJDzr+j1NISE5pyaAuKL4A3UD34qd0lx5+kfKp2g==", "license": "MIT", - "peer": true, "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.4.4", @@ -6541,7 +6534,6 @@ "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz", "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==", "license": "MIT", - "peer": true, "funding": { "url": "https://github.com/sponsors/colinhacks" } diff --git a/src/content/docs/blog/hyperlight-0.17.0.mdx b/src/content/docs/blog/hyperlight-0.17.0.mdx new file mode 100644 index 0000000..893b2d8 --- /dev/null +++ b/src/content/docs/blog/hyperlight-0.17.0.mdx @@ -0,0 +1,100 @@ +--- +title: "Announcing Hyperlight 0.17.0" +date: 2026-08-31 +--- + +_Hyperlight is a lightweight Virtual Machine Manager (VMM) designed to be +embedded directly in applications. It enables safe execution of untrusted code +with low latency and minimal overhead._ + +Hyperlight 0.17.0 has been released! This release introduces macOS support for +Hyperlight, a new `SandboxBuilder` API, better component bindgen, and security +improvements. + +## macOS support for Hyperlight + +Hyperlight now runs on Apple Silicon using Apple’s Hypervisor.framework API. +This makes macOS the third major platform for Hyperlight, following Linux and +Windows. All Apple Silicon CPU families are supported (M1 and later). + +macOS support is however currently more limited than on our other platforms. On +macOS we map multiple sandboxes to a single VM in the host process, swapping +them out as needed. This means losing out on parallelism, and in turn results in +worse performance than on our other targets. But on the upside it does mean we +can support even the oldest Apple Silicon CPUs (M1 + M2). + +We do plan to eventually optimize performance for Apple M3 and later, which +should be able to achieve performance similar to our other supported platforms. +But as a starting point we figured we should prioritize compatibility +over performance, since macOS is used more for development than for deployment. + +## `SandboxBuilder` API + +Constructing sandboxes is now more ergonomic thanks to the `SandboxBuilder` API. +Setting up a sandbox used to require mutating a `SandboxConfiguration`, using +that to construct an `UninitializedSandbox`, and then calling the `evolve` +method to obtain a final `MultiUseSandbox`: + +```rust +let mut config = SandboxConfiguration::default(); +config.set_heap_size(256 * 1024); + +let guest = GuestBinary::FilePath(guest_path); +let mut sandbox = UninitializedSandbox::new(guest, Some(config))?; +sandbox.register("Add", |a: i32, b: i32| a + b)?; +let mut sandbox: MultiUseSandbox = sandbox.evolve()?; + +assert_eq!(sandbox.call("Add", (7, 8))?, 15); +``` + +With the new builder API, all these steps become a single chained call: + +```rust +let mut sandbox = SandboxBuilder::from_file(guest_path) + .heap_size(256 * 1024) + .host_function("Add", |a: i32, b: i32| Ok(a + b)) + .build()?; + +assert_eq!(sandbox.call("Add", (7, 8))?, 15); +``` + +## Improvements to the component bindgen macro + +The `hyperlight_component_macro` crate generates the glue between the Hyperlight +guest and the host. In this release we've made some updates to that system, most +notably: guest calls on the host side now return a `Result`. This makes it +possible to gracefully handle cases where something went wrong while calling +into the guest, where previously the host would panic. + +Hyperlight macros can now also operate directly on WIT IDL files. Doing this is +as easy as pointing the `host_bindgen!` macro at a `.wit` file, which will then +be parsed and expanded into a typed interface for the host: + +```rust +// A single WIT file +hyperlight_component_macro::host_bindgen!(wit: "wit/world.wit"); +``` + +## Guest MSR state no longer leaks between restore calls + +Model-Specific Register (MSR) state used to be able to persist in guests between +calls to `MultiUseSandbox::restore`. After almost a year of work, we have +finally fixed this problem, and guest MSR state no longer leaks between +restores. + +Guest MSR state is now part of the snapshot state instead, which can be declared +up-front when constructing a sandbox. You can do this either by using +`SandboxConfiguration::guest_msrs`, or with the newer +`SandboxBuilder::guest_msrs` API. + +```rust +let mut sandbox = SandboxBuilder::from_file(guest_path) + .guest_msrs(&[0x174, 0x175, 0x176])? // ← SYSENTER CS, ESP, EIP + .build()?; +``` + +Read more about this in our docs: [MSR state across restore](https://github.com/hyperlight-dev/hyperlight/blob/944bb16ba855e9f723fab5e883f76d4ed73b5e33/docs/msr.md). + +## Other changes + +Check out everything that changed in [Hyperlight](https://github.com/hyperlight-dev/hyperlight/releases/tag/v0.17.0).