From 9176746aba973d10e959a31f2e1b596f26524eb5 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Mon, 22 Dec 2025 15:06:09 +0100
Subject: [PATCH] vendor: github.com/tetratelabs/wazero v1.11.0

- Streamline build tags: remove tinygo, cgo
- Fix race condition in refCount initialization
- Simplify utimens. Use `syscall.UtimesNano` to avoid a macOS `go:linkname`.
- Change version policy to two versions.
- Update Wasm 2.0 spec tests.
- Use golang.org/x/sys

full diff: https://github.com/tetratelabs/wazero/compare/v1.10.1...v1.11.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 go.mod                                        |  2 +-
 go.sum                                        |  4 +-
 vendor/github.com/tetratelabs/wazero/Makefile | 24 ++---
 .../tetratelabs/wazero/RATIONALE.md           | 62 ++++++-------
 .../github.com/tetratelabs/wazero/README.md   | 11 +--
 .../wazero/experimental/sys/syscall_errno.go  |  2 +-
 .../experimental/sys/syscall_errno_windows.go | 55 +++---------
 .../engine/interpreter/interpreter.go         |  6 +-
 .../engine/wazevo/backend/isa/amd64/abi.go    |  2 +-
 .../wazevo/backend/isa/amd64/machine.go       | 12 +--
 .../engine/wazevo/backend/isa/arm64/abi.go    |  2 +-
 .../backend/isa/arm64/lower_constant.go       |  4 +-
 .../engine/wazevo/backend/isa/arm64/reg.go    |  4 +-
 .../wazero/internal/engine/wazevo/engine.go   |  8 +-
 .../internal/engine/wazevo/engine_cache.go    | 17 ++--
 .../engine/wazevo/entrypoint_amd64.go         |  2 -
 .../engine/wazevo/entrypoint_arm64.go         |  2 -
 ...trypoint_others.go => entrypoint_other.go} |  2 +-
 .../internal/engine/wazevo/wazevoapi/ptr.go   |  4 +-
 .../wazero/internal/leb128/leb128.go          |  8 +-
 .../wazero/internal/platform/cpuid.go         | 39 ++++----
 .../wazero/internal/platform/cpuid_amd64.go   | 88 +++----------------
 .../wazero/internal/platform/cpuid_amd64.s    | 16 ----
 .../wazero/internal/platform/cpuid_arm64.go   | 66 +++-----------
 .../wazero/internal/platform/cpuid_arm64.s    | 21 -----
 .../internal/platform/cpuid_unsupported.go    | 16 +---
 .../wazero/internal/platform/mmap_linux.go    | 20 ++---
 .../wazero/internal/platform/mmap_other.go    | 15 ++--
 .../wazero/internal/platform/mmap_unix.go     | 11 ++-
 .../internal/platform/mmap_unsupported.go     |  4 +-
 .../wazero/internal/platform/mmap_windows.go  | 73 ++-------------
 .../wazero/internal/platform/mprotect_bsd.go  | 24 -----
 .../internal/platform/mprotect_syscall.go     | 12 ---
 .../internal/platform/mprotect_unsupported.go | 10 ---
 .../wazero/internal/platform/platform.go      | 11 +--
 .../wazero/internal/platform/time_notcgo.go   |  7 --
 .../{time_cgo.go => time_notwindows.go}       |  2 +-
 .../wazero/internal/platform/time_windows.go  | 10 +--
 .../wazero/internal/sock/sock_supported.go    |  2 +-
 .../wazero/internal/sock/sock_unsupported.go  |  2 +-
 .../wazero/internal/sysfs/datasync_linux.go   |  2 -
 .../wazero/internal/sysfs/datasync_tinygo.go  | 13 ---
 .../wazero/internal/sysfs/dirfs.go            | 48 ++++++++--
 .../wazero/internal/sysfs/dirfs_supported.go  | 48 ----------
 .../internal/sysfs/dirfs_unsupported.go       | 34 -------
 .../wazero/internal/sysfs/file_unix.go        |  2 +-
 .../wazero/internal/sysfs/file_unsupported.go |  2 +-
 .../wazero/internal/sysfs/file_windows.go     | 76 ++++------------
 .../wazero/internal/sysfs/futimens.go         | 10 +--
 .../wazero/internal/sysfs/futimens_darwin.go  | 17 +---
 .../wazero/internal/sysfs/futimens_linux.go   | 19 +---
 .../internal/sysfs/futimens_unsupported.go    |  2 +-
 .../wazero/internal/sysfs/ino_tinygo.go       | 14 ---
 .../internal/sysfs/{ino.go => ino_unix.go}    |  2 +-
 .../{ino_plan9.go => ino_unsupported.go}      |  2 +
 .../wazero/internal/sysfs/nonblock_unix.go    |  2 +-
 .../internal/sysfs/nonblock_unsupported.go    |  2 +-
 ...{open_file_freebsd.go => open_file_bsd.go} |  2 +
 .../wazero/internal/sysfs/open_file_sun.go    | 31 -------
 ...n_file_linux.go => open_file_supported.go} |  2 +-
 .../wazero/internal/sysfs/open_file_tinygo.go | 25 ------
 ...n_file_notwindows.go => open_file_unix.go} |  2 +-
 .../internal/sysfs/open_file_unsupported.go   |  6 +-
 .../internal/sysfs/open_file_windows.go       |  2 +-
 .../wazero/internal/sysfs/osfile.go           |  2 +-
 .../tetratelabs/wazero/internal/sysfs/poll.go |  2 +-
 .../wazero/internal/sysfs/poll_linux.go       |  2 -
 .../wazero/internal/sysfs/poll_unsupported.go |  2 +-
 .../sysfs/{rename.go => rename_unix.go}       |  2 +-
 ...{rename_plan9.go => rename_unsupported.go} |  2 +
 .../wazero/internal/sysfs/sock_supported.go   |  2 +-
 .../wazero/internal/sysfs/sock_unix.go        |  2 +-
 .../wazero/internal/sysfs/sock_unsupported.go |  2 +-
 .../wazero/internal/sysfs/sock_windows.go     |  5 +-
 .../wazero/internal/sysfs/stat_bsd.go         | 37 --------
 .../{stat_linux.go => stat_supported.go}      |  2 +-
 .../wazero/internal/sysfs/stat_unsupported.go |  2 +-
 .../wazero/internal/sysfs/stat_windows.go     |  2 -
 .../sysfs/{unlink.go => unlink_unix.go}       |  2 +-
 ...{unlink_plan9.go => unlink_unsupported.go} |  6 +-
 .../wazero/internal/wasm/binary/decoder.go    | 38 +++++++-
 .../wazero/internal/wasm/func_validation.go   |  5 ++
 .../wazero/internal/wasm/memory.go            |  3 +-
 .../tetratelabs/wazero/internal/wasm/store.go |  2 +-
 .../tetratelabs/wazero/sys/stat_bsd.go        | 12 +--
 .../tetratelabs/wazero/sys/stat_linux.go      | 32 -------
 .../tetratelabs/wazero/sys/stat_posix.go      | 29 ++++++
 .../wazero/sys/stat_unsupported.go            |  2 +-
 .../tetratelabs/wazero/sys/stat_windows.go    |  2 -
 vendor/modules.txt                            |  4 +-
 90 files changed, 366 insertions(+), 884 deletions(-)
 rename vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/{entrypoint_others.go => entrypoint_other.go} (90%)
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_amd64.s
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_arm64.s
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_bsd.go
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_syscall.go
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_unsupported.go
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/platform/time_notcgo.go
 rename vendor/github.com/tetratelabs/wazero/internal/platform/{time_cgo.go => time_notwindows.go} (89%)
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/sysfs/datasync_tinygo.go
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs_supported.go
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs_unsupported.go
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_tinygo.go
 rename vendor/github.com/tetratelabs/wazero/internal/sysfs/{ino.go => ino_unix.go} (90%)
 rename vendor/github.com/tetratelabs/wazero/internal/sysfs/{ino_plan9.go => ino_unsupported.go} (90%)
 rename vendor/github.com/tetratelabs/wazero/internal/sysfs/{open_file_freebsd.go => open_file_bsd.go} (94%)
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_sun.go
 rename vendor/github.com/tetratelabs/wazero/internal/sysfs/{open_file_linux.go => open_file_supported.go} (92%)
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_tinygo.go
 rename vendor/github.com/tetratelabs/wazero/internal/sysfs/{open_file_notwindows.go => open_file_unix.go} (94%)
 rename vendor/github.com/tetratelabs/wazero/internal/sysfs/{rename.go => rename_unix.go} (84%)
 rename vendor/github.com/tetratelabs/wazero/internal/sysfs/{rename_plan9.go => rename_unsupported.go} (86%)
 delete mode 100644 vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_bsd.go
 rename vendor/github.com/tetratelabs/wazero/internal/sysfs/{stat_linux.go => stat_supported.go} (92%)
 rename vendor/github.com/tetratelabs/wazero/internal/sysfs/{unlink.go => unlink_unix.go} (86%)
 rename vendor/github.com/tetratelabs/wazero/internal/sysfs/{unlink_plan9.go => unlink_unsupported.go} (70%)
 delete mode 100644 vendor/github.com/tetratelabs/wazero/sys/stat_linux.go
 create mode 100644 vendor/github.com/tetratelabs/wazero/sys/stat_posix.go

diff --git a/go.mod b/go.mod
index 70c7dd4c26..909c5baed2 100644
--- a/go.mod
+++ b/go.mod
@@ -217,7 +217,7 @@ require (
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/spdx/tools-golang v0.5.5 // indirect
 	github.com/stretchr/testify v1.11.1 // indirect
-	github.com/tetratelabs/wazero v1.10.1 // indirect
+	github.com/tetratelabs/wazero v1.11.0 // indirect
 	github.com/tinylib/msgp v1.3.0 // indirect
 	github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 // indirect
 	github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f // indirect
diff --git a/go.sum b/go.sum
index 51a747d543..df93c9f4a8 100644
--- a/go.sum
+++ b/go.sum
@@ -602,8 +602,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tedsuo/ifrit v0.0.0-20230516164442-7862c310ad26 h1:mWCRvpoEMVlslxEvvptKgIUb35va9yj9Oq5wGw/er5I=
 github.com/tedsuo/ifrit v0.0.0-20230516164442-7862c310ad26/go.mod h1:0uD3VMXkZ7Bw0ojGCwDzebBBzPBXtzEZeXai+56BLX4=
-github.com/tetratelabs/wazero v1.10.1 h1:2DugeJf6VVk58KTPszlNfeeN8AhhpwcZqkJj2wwFuH8=
-github.com/tetratelabs/wazero v1.10.1/go.mod h1:DRm5twOQ5Gr1AoEdSi0CLjDQF1J9ZAuyqFIjl1KKfQU=
+github.com/tetratelabs/wazero v1.11.0 h1:+gKemEuKCTevU4d7ZTzlsvgd1uaToIDtlQlmNbwqYhA=
+github.com/tetratelabs/wazero v1.11.0/go.mod h1:eV28rsN8Q+xwjogd7f4/Pp4xFxO7uOGbLcD/LzB1wiU=
 github.com/tinylib/msgp v1.3.0 h1:ULuf7GPooDaIlbyvgAxBV/FI7ynli6LZ1/nVUNu+0ww=
 github.com/tinylib/msgp v1.3.0/go.mod h1:ykjzy2wzgrlvpDCRc4LA8UXy6D8bzMSuAF3WD57Gok0=
 github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 h1:r0p7fK56l8WPequOaR3i9LBqfPtEdXIQbUTzT55iqT4=
diff --git a/vendor/github.com/tetratelabs/wazero/Makefile b/vendor/github.com/tetratelabs/wazero/Makefile
index 0dd37bb2a6..5281e7cd82 100644
--- a/vendor/github.com/tetratelabs/wazero/Makefile
+++ b/vendor/github.com/tetratelabs/wazero/Makefile
@@ -108,28 +108,29 @@ internal/testing/dwarftestdata/testdata/rust/main.wasm.xz:
 	@mv $(@D)/target/$(cargo_target)/release/$(@F) $(@D)
 
 spectest_base_dir := internal/integration_test/spectest
+
 spectest_v1_dir := $(spectest_base_dir)/v1
 spectest_v1_testdata_dir := $(spectest_v1_dir)/testdata
 spec_version_v1 := wg-1.0
+
 spectest_v2_dir := $(spectest_base_dir)/v2
 spectest_v2_testdata_dir := $(spectest_v2_dir)/testdata
+spec_version_v2 := wg-2.0
 
-# Latest draft state as of March 12, 2024.
-spec_version_v2 := 1c5e5d178bd75c79b7a12881c529098beaee2a05
 spectest_threads_dir := $(spectest_base_dir)/threads
 spectest_threads_testdata_dir := $(spectest_threads_dir)/testdata
-# From https://github.com/WebAssembly/threads/tree/upstream-rebuild which has not been merged to main yet.
-# It will likely be renamed to main in the future - https://github.com/WebAssembly/threads/issues/216.
-spec_version_threads := 3635ca51a17e57e106988846c5b0e0cc48ac04fc
+spec_version_threads := ff17701446d8e2086142423ef77ae947a025e26f
 
 spectest_tail_call_dir := $(spectest_base_dir)/tail-call
 spectest_tail_call_testdata_dir := $(spectest_tail_call_dir)/testdata
-spec_version_tail_call := 4fd2339b5e9709e74b326797f69a88b13eac4d47
+spec_version_tail_call := 88e97b0f742f4c3ee01fea683da130f344dd7b02
 
 .PHONY: build.spectest
 build.spectest:
 	@$(MAKE) build.spectest.v1
 	@$(MAKE) build.spectest.v2
+	@$(MAKE) build.spectest.threads
+	@$(MAKE) build.spectest.tail_call
 
 .PHONY: build.spectest.v1
 build.spectest.v1: # Note: wabt by default uses >1.0 features, so wast2json flags might drift as they include more. See WebAssembly/wabt#1878
@@ -160,6 +161,7 @@ build.spectest.v1: # Note: wabt by default uses >1.0 features, so wast2json flag
 
 .PHONY: build.spectest.v2
 build.spectest.v2: # Note: SIMD cases are placed in the "simd" subdirectory.
+	@rm -rf $(spectest_v2_testdata_dir)
 	@mkdir -p $(spectest_v2_testdata_dir)
 	@cd $(spectest_v2_testdata_dir) \
 		&& curl -sSL 'https://api.github.com/repos/WebAssembly/spec/contents/test/core?ref=$(spec_version_v2)' | jq -r '.[]| .download_url' | grep -E ".wast" | xargs -Iurl curl -sJL url -O
@@ -173,19 +175,21 @@ build.spectest.v2: # Note: SIMD cases are placed in the "simd" subdirectory.
 # https://github.com/WebAssembly/wabt/issues/2348#issuecomment-1878003959
 .PHONY: build.spectest.threads
 build.spectest.threads:
+	@rm -rf $(spectest_threads_testdata_dir)
 	@mkdir -p $(spectest_threads_testdata_dir)
 	@cd $(spectest_threads_testdata_dir) \
-		&& curl -sSL 'https://api.github.com/repos/WebAssembly/threads/contents/test/core?ref=$(spec_version_threads)' | jq -r '.[]| .download_url' | grep -E "atomic.wast" | xargs -Iurl curl -sJL url -O
+		&& curl -sSL 'https://api.github.com/repos/WebAssembly/threads/contents/test/core/threads?ref=$(spec_version_threads)' | jq -r '.[]| .download_url' | grep -E "/atomic.wast" | xargs -Iurl curl -sJL url -O
 	@cd $(spectest_threads_testdata_dir) && for f in `find . -name '*.wast'`; do \
 		wast2json --enable-threads --debug-names $$f; \
 	done
 
 .PHONY: build.spectest.tail_call
 build.spectest.tail_call:
-	mkdir -p $(spectest_tail_call_testdata_dir)
-	cd $(spectest_tail_call_testdata_dir) \
+	@rm -rf $(spectest_tail_call_testdata_dir)
+	@mkdir -p $(spectest_tail_call_testdata_dir)
+	@cd $(spectest_tail_call_testdata_dir) \
 		&& curl -sSL 'https://api.github.com/repos/WebAssembly/testsuite/contents/proposals/tail-call?ref=$(spec_version_tail_call)' | jq -r '.[]| .download_url' | grep -E ".wast" | xargs -Iurl curl -sJL url -O
-	cd $(spectest_tail_call_testdata_dir) && for f in `find . -name '*.wast'`; do \
+	@cd $(spectest_tail_call_testdata_dir) && for f in `find . -name '*.wast'`; do \
 		wast2json --enable-tail-call --debug-names $$f; \
 	done
 
diff --git a/vendor/github.com/tetratelabs/wazero/RATIONALE.md b/vendor/github.com/tetratelabs/wazero/RATIONALE.md
index ffb1a299ef..27c955c8fe 100644
--- a/vendor/github.com/tetratelabs/wazero/RATIONALE.md
+++ b/vendor/github.com/tetratelabs/wazero/RATIONALE.md
@@ -7,24 +7,19 @@ have heavy impact usually due to CGO. By avoiding CGO, wazero avoids
 prerequisites such as shared libraries or libc, and lets users keep features
 like cross compilation.
 
-Avoiding go.mod dependencies reduces interference on Go version support, and
-size of a statically compiled binary. However, doing so brings some
+Avoiding most `go.mod` dependencies reduces interference on Go version support,
+and size of a statically compiled binary. However, doing so brings some
 responsibility into the project.
 
-Go's native platform support is good: We don't need platform-specific code to
+Go's native platform support is good: we don't need platform-specific code to
 get monotonic time, nor do we need much work to implement certain features
 needed by our compiler such as `mmap`. That said, Go does not support all
-common operating systems to the same degree. For example, Go 1.18 includes
-`Mprotect` on Linux and Darwin, but not FreeBSD.
+common operating systems to the same degree.
 
-The general tradeoff the project takes from a zero dependency policy is more
+The general tradeoff the project takes from a strict dependency policy is more
 explicit support of platforms (in the compiler runtime), as well a larger and
 more technically difficult codebase.
 
-At some point, we may allow extensions to supply their own platform-specific
-hooks. Until then, one end user impact/tradeoff is some glitches trying
-untested platforms (with the Compiler runtime).
-
 ### Why do we use CGO to implement system calls on darwin?
 
 wazero is dependency and CGO free by design. In some cases, we have code that
@@ -45,25 +40,20 @@ This plays to our advantage for system calls that aren't yet exposed in the Go
 standard library, notably `futimens` for nanosecond-precision timestamp
 manipulation.
 
-### Why not x/sys
+### Why x/sys
 
-Going beyond Go's SDK limitations can be accomplished with their [x/sys library](https://pkg.go.dev/golang.org/x/sys/unix).
-For example, this includes `zsyscall_freebsd_amd64.go` missing from the Go SDK.
+The [x/sys library](https://pkg.go.dev/golang.org/x/sys/unix) is currently
+our only `go.mod` dependency.
 
-However, like all dependencies, x/sys is a source of conflict. For example,
-x/sys had to be in order to upgrade to Go 1.18.
+That module is maintained by the Go authors, and covers OSes that the syscall
+package neglects.
 
-If we depended on x/sys, we could get more precise functionality needed for
-features such as clocks or more platform support for the compiler runtime.
+After [heavy consideration](https://github.com/wazero/wazero/issues/2434) we
+decided to it as a dependency.
 
-That said, formally supporting an operating system may still require testing as
-even use of x/sys can require platform-specifics. For example, [mmap-go](https://github.com/edsrzf/mmap-go)
-uses x/sys, but also mentions limitations, some not surmountable with x/sys
-alone.
-
-Regardless, we may at some point introduce a separate go.mod for users to use
-x/sys as a platform plugin without forcing all users to maintain that
-dependency.
+Using was shown to improve the experience of using wazero on older,
+or less common, OSes without increasing the maintenance work, or creating
+deployment issues for users of wazero.
 
 ## Project structure
 
@@ -756,7 +746,7 @@ value (possibly `PWD`). Those unable to control the compiled code should only
 use absolute paths in configuration.
 
 See
-* https://github.com/golang/go/blob/go1.20/src/syscall/fs_js.go#L324
+* https://github.com/golang/go/blob/go1.24.0/src/syscall/fs_js.go#L341
 * https://github.com/WebAssembly/wasi-libc/pull/214#issue-673090117
 * https://github.com/ziglang/zig/blob/53a9ee699a35a3d245ab6d1dac1f0687a4dcb42c/src/main.zig#L32
 
@@ -1064,7 +1054,7 @@ reason, wazero adds overhead to synthesize dot entries despite it being
 unnecessary for most users.
 
 See https://pubs.opengroup.org/onlinepubs/9699919799/functions/readdir.html
-See https://github.com/golang/go/blob/go1.20/src/os/dir_unix.go#L108-L110
+See https://github.com/golang/go/blob/go1.24.0/src/os/dir_unix.go#L122-L124
 See https://github.com/bytecodealliance/preview2-prototyping/blob/e4c04bcfbd11c42c27c28984948d501a3e168121/crates/wasi-preview1-component-adapter/src/lib.rs#L1026-L1041
 
 ### Why don't we pre-populate an inode for the dot-dot ("..") entry?
@@ -1150,7 +1140,7 @@ See
  * https://linux.die.net/man/3/getdents
  * https://www.unix.com/man-page/osx/2/getdirentries/
  * https://man.openbsd.org/OpenBSD-5.4/getdirentries.2
- * https://github.com/golang/go/blob/go1.20/src/syscall/dirent.go#L60-L102
+ * https://github.com/golang/go/blob/go1.24.0/src/syscall/dirent.go#L57-L101
  * https://go-review.googlesource.com/c/go/+/507915
 
 ## sys.Walltime and Nanotime
@@ -1201,7 +1191,7 @@ See https://go.googlesource.com/proposal/+/master/design/12914-monotonic.md
 WebAssembly time imports do not have the same concern. In fact even Go's
 imports for clocks split walltime from nanotime readings.
 
-See https://github.com/golang/go/blob/go1.20/misc/wasm/wasm_exec.js#L243-L255
+See https://github.com/golang/go/blob/go1.24.0/lib/wasm/wasm_exec.js#L258-L268
 
 Finally, Go's clock is not an interface. WebAssembly users who want determinism
 or security need to be able to substitute an alternative clock implementation
@@ -1215,13 +1205,13 @@ value. For now, we return fixed values of 1us for realtime and 1ns for monotonic
 often lower precision than monotonic clocks. In the future, this could be improved by having OS+arch specific assembly
 to make syscalls.
 
-For example, Go implements time.Now for linux-amd64 with this [assembly](https://github.com/golang/go/blob/go1.20/src/runtime/time_linux_amd64.s).
+For example, Go implements time.Now for linux-amd64 with this [assembly](https://github.com/golang/go/blob/go1.24.0/src/runtime/time_linux_amd64.s).
 Because retrieving resolution is not generally called often, unlike getting time, it could be appropriate to only
 implement the fallback logic that does not use VDSO (executing syscalls in user mode). The syscall for clock_getres
 is 229 and should be usable. https://pkg.go.dev/syscall#pkg-constants.
 
-If implementing similar for Windows, [mingw](https://github.com/mirror/mingw-w64/blob/6a0e9165008f731bccadfc41a59719cf7c8efc02/mingw-w64-libraries/winpthreads/src/clock.c#L77
-) is often a good source to find the Windows API calls that correspond
+If implementing similar for Windows, [mingw](https://github.com/mirror/mingw-w64/blob/v12.0.0/mingw-w64-libraries/winpthreads/src/clock.c#L54)
+is often a good source to find the Windows API calls that correspond
 to a POSIX method.
 
 Writing assembly would allow making syscalls without CGO, but comes with the cost that it will require implementations
@@ -1490,7 +1480,7 @@ This is due to the same reason for the limitation on the number of functions abo
 
 While the the spec does not clarify a limitation of function stack values, wazero limits this to 2^27 = 134,217,728.
 The reason is that we internally represent all the values as 64-bit integers regardless of its types (including f32, f64), and 2^27 values means
-1 GiB = (2^30). 1 GiB is the reasonable for most applications [as we see a Goroutine has 250 MB as a limit on the stack for 32-bit arch](https://github.com/golang/go/blob/go1.20/src/runtime/proc.go#L152-L159), considering that WebAssembly is (currently) 32-bit environment.
+1 GiB = (2^30). 1 GiB is the reasonable for most applications [as we see a Goroutine has 250 MB as a limit on the stack for 32-bit arch](https://github.com/golang/go/blob/go1.24.0/src/runtime/proc.go#L154-L161), considering that WebAssembly is (currently) 32-bit environment.
 
 All the functions are statically analyzed at module instantiation phase, and if a function can potentially reach this limit, an error is returned.
 
@@ -1523,8 +1513,8 @@ since it tries to interrupt the execution of Goroutine at any point of function,
 Fortunately, our runtime-generated machine codes do not need to take the async preemption into account.
 All the assembly codes are entered via the trampoline implemented as Go Assembler Function (e.g. [arch_amd64.s](./arch_amd64.s)),
 and as of Go 1.20, these assembler functions are considered as _unsafe_ for async preemption:
-- https://github.com/golang/go/blob/go1.20rc1/src/runtime/preempt.go#L406-L407
-- https://github.com/golang/go/blob/9f0234214473dfb785a5ad84a8fc62a6a395cbc3/src/runtime/traceback.go#L227
+- https://github.com/golang/go/blob/go1.24.0/src/runtime/preempt.go#L407-L408
+- https://github.com/golang/go/blob/go1.24.0/src/runtime/traceback.go#L350
 
 From the Go runtime point of view, the execution of runtime-generated machine codes is considered as a part of
 that trampoline function. Therefore, runtime-generated machine code is also correctly considered unsafe for async preemption.
@@ -1582,6 +1572,6 @@ In lieu of formal documentation, we infer this pattern works from other sources
  * `sync.WaitGroup` by definition must support calling `Add` from other goroutines. Internally, it uses atomics.
  * rsc in golang/go#5045 writes "atomics guarantee sequential consistency among the atomic variables".
 
-See https://github.com/golang/go/blob/go1.20/src/sync/waitgroup.go#L64
+See https://github.com/golang/go/blob/go1.24.0/src/sync/waitgroup.go#L76
 See https://github.com/golang/go/issues/5045#issuecomment-252730563
 See https://www.youtube.com/watch?v=VmrEG-3bWyM
diff --git a/vendor/github.com/tetratelabs/wazero/README.md b/vendor/github.com/tetratelabs/wazero/README.md
index 5cd933d37e..ceacae584a 100644
--- a/vendor/github.com/tetratelabs/wazero/README.md
+++ b/vendor/github.com/tetratelabs/wazero/README.md
@@ -76,19 +76,13 @@ Please give us a [star][10] if you end up using wazero!
 
 ### Go
 
-wazero has no dependencies except Go, so the only source of conflict in your
-project's use of wazero is the Go version.
+wazero has no dependencies except Go and [`x/sys`][12], so the only source of
+conflict in your project's use of wazero is the Go version.
 
 wazero follows the same version policy as Go's [Release Policy][5]: two
 versions. wazero will ensure these versions work and bugs are valid if there's
 an issue with a current Go version.
 
-Additionally, wazero intentionally delays usage of language or standard library
-features one additional version. For example, when Go 1.29 is released, wazero
-can use language features or standard libraries added in 1.27. This is a
-convenience for embedders who have a slower version policy than Go. However,
-only supported Go versions may be used to raise support issues.
-
 ### Platform
 
 wazero has two runtime modes: Interpreter and Compiler. The only supported operating
@@ -138,3 +132,4 @@ wazero is a registered trademark of Tetrate.io, Inc. in the United States and/or
 [9]: https://wazero.io/community/users/
 [10]: https://github.com/wazero/wazero/stargazers
 [11]: https://github.com/wazero/wazero/issues/2393
+[12]: https://pkg.go.dev/golang.org/x/sys
\ No newline at end of file
diff --git a/vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno.go b/vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno.go
index ea511ec257..86808cc741 100644
--- a/vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno.go
+++ b/vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno.go
@@ -1,4 +1,4 @@
-//go:build !plan9 && !aix
+//go:build !(plan9 || aix)
 
 package sys
 
diff --git a/vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno_windows.go b/vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno_windows.go
index 5ebc1780f4..8d9486683c 100644
--- a/vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno_windows.go
+++ b/vendor/github.com/tetratelabs/wazero/experimental/sys/syscall_errno_windows.go
@@ -1,61 +1,32 @@
 package sys
 
-import "syscall"
-
-// These are errors not defined in the syscall package. They are prefixed with
-// underscore to avoid exporting them.
-//
-// See https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes--0-499-
-const (
-	// _ERROR_INVALID_HANDLE is a Windows error returned by syscall.Write
-	// instead of syscall.EBADF
-	_ERROR_INVALID_HANDLE = syscall.Errno(6)
-
-	// _ERROR_INVALID_NAME is a Windows error returned by open when a file
-	// path has a trailing slash
-	_ERROR_INVALID_NAME = syscall.Errno(0x7B)
-
-	// _ERROR_NEGATIVE_SEEK is a Windows error returned by os.Truncate
-	// instead of syscall.EINVAL
-	_ERROR_NEGATIVE_SEEK = syscall.Errno(0x83)
-
-	// _ERROR_DIRECTORY is a Windows error returned by syscall.Rmdir
-	// instead of syscall.ENOTDIR
-	_ERROR_DIRECTORY = syscall.Errno(0x10B)
-
-	// _ERROR_NOT_A_REPARSE_POINT is a Windows error returned by os.Readlink
-	// instead of syscall.EINVAL
-	_ERROR_NOT_A_REPARSE_POINT = syscall.Errno(0x1126)
-
-	// _ERROR_INVALID_SOCKET is a Windows error returned by winsock_select
-	// when a given handle is not a socket.
-	_ERROR_INVALID_SOCKET = syscall.Errno(0x2736)
-)
+import "golang.org/x/sys/windows"
 
 func errorToErrno(err error) Errno {
 	switch err := err.(type) {
 	case Errno:
 		return err
-	case syscall.Errno:
+	case windows.Errno:
 		// Note: In windows, _ERROR_PATH_NOT_FOUND(0x3) maps to syscall.ENOTDIR
 		switch err {
-		case syscall.ERROR_ALREADY_EXISTS:
+		case windows.ERROR_ALREADY_EXISTS, windows.ERROR_FILE_EXISTS:
 			return EEXIST
-		case _ERROR_DIRECTORY:
+		case windows.ERROR_DIRECTORY:
+			// ERROR_DIRECTORY is returned by syscall.Rmdir.
 			return ENOTDIR
-		case syscall.ERROR_DIR_NOT_EMPTY:
+		case windows.ERROR_DIR_NOT_EMPTY:
 			return ENOTEMPTY
-		case syscall.ERROR_FILE_EXISTS:
-			return EEXIST
-		case _ERROR_INVALID_HANDLE, _ERROR_INVALID_SOCKET:
-			return EBADF
-		case syscall.ERROR_ACCESS_DENIED:
+		case windows.ERROR_INVALID_HANDLE, windows.WSAENOTSOCK, windows.ERROR_ACCESS_DENIED:
+			// WSAENOTSOCK is returned by winsock_select when a given handle is not a socket.
 			// POSIX read and write functions expect EBADF, not EACCES when not
 			// open for reading or writing.
 			return EBADF
-		case syscall.ERROR_PRIVILEGE_NOT_HELD:
+		case windows.ERROR_PRIVILEGE_NOT_HELD:
 			return EPERM
-		case _ERROR_NEGATIVE_SEEK, _ERROR_INVALID_NAME, _ERROR_NOT_A_REPARSE_POINT:
+		case windows.ERROR_NEGATIVE_SEEK, windows.ERROR_NOT_A_REPARSE_POINT, windows.ERROR_INVALID_NAME:
+			// ERROR_NEGATIVE_SEEK is returned by os.Truncate.
+			// ERROR_NOT_A_REPARSE_POINT is returned by os.Readlink.
+			// ERROR_INVALID_NAME is returned by open when a file path has a trailing slash.
 			return EINVAL
 		}
 		errno, _ := syscallToErrno(err)
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/interpreter/interpreter.go b/vendor/github.com/tetratelabs/wazero/internal/engine/interpreter/interpreter.go
index 6f2fa949aa..70183e23b7 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/interpreter/interpreter.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/interpreter/interpreter.go
@@ -84,6 +84,10 @@ func (e *engine) deleteCompiledFunctions(module *wasm.Module) {
 func (e *engine) addCompiledFunctions(module *wasm.Module, fs []compiledFunction) {
 	e.mux.Lock()
 	defer e.mux.Unlock()
+	if c, ok := e.compiledFunctions[module.ID]; ok {
+		c.refCount++
+		return
+	}
 	e.compiledFunctions[module.ID] = &compiledFunctionWithCount{funcs: fs, refCount: 1}
 }
 
@@ -250,7 +254,7 @@ func functionFromUintptr(ptr uintptr) *function {
 	//
 	// For example, if we have (*function)(unsafe.Pointer(ptr)) instead, then the race detector's "checkptr"
 	// subroutine wanrs as "checkptr: pointer arithmetic result points to invalid allocation"
-	// https://github.com/golang/go/blob/1ce7fcf139417d618c2730010ede2afb41664211/src/runtime/checkptr.go#L69
+	// https://github.com/golang/go/blob/go1.24.0/src/runtime/checkptr.go#L69
 	var wrapped *uintptr = &ptr
 	return *(**function)(unsafe.Pointer(wrapped))
 }
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/abi.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/abi.go
index 130f8c6210..dc6df3109f 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/abi.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/abi.go
@@ -7,7 +7,7 @@ import (
 )
 
 // For the details of the ABI, see:
-// https://github.com/golang/go/blob/49d42128fd8594c172162961ead19ac95e247d24/src/cmd/compile/abi-internal.md#amd64-architecture
+// https://github.com/golang/go/blob/go1.24.0/src/cmd/compile/abi-internal.md#amd64-architecture
 
 var (
 	intArgResultRegs   = []regalloc.RealReg{rax, rbx, rcx, rdi, rsi, r8, r9, r10, r11}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine.go
index 57d9bb7317..66901f776e 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine.go
@@ -17,7 +17,7 @@ import (
 // NewBackend returns a new backend for arm64.
 func NewBackend() backend.Machine {
 	m := &machine{
-		cpuFeatures:                         platform.CpuFeatures(),
+		cpuFeatures:                         platform.CpuFeatures,
 		regAlloc:                            regalloc.NewAllocator[*instruction, *labelPosition, *regAllocFn](regInfo),
 		spillSlots:                          map[regalloc.VRegID]int64{},
 		amodePool:                           wazevoapi.NewPool[amode](nil),
@@ -1067,7 +1067,7 @@ func (m *machine) LowerInstr(instr *ssa.Instruction) {
 		dst := m.c.VRegOf(instr.Return())
 
 		// At this point, the ptr is ensured to be aligned, so using a normal load is atomic.
-		// https://github.com/golang/go/blob/adead1a93f472affa97c494ef19f2f492ee6f34a/src/runtime/internal/atomic/atomic_amd64.go#L30
+		// https://github.com/golang/go/blob/go1.24.0/src/internal/runtime/atomic/atomic_amd64.go#L29
 		mem := newOperandMem(m.lowerToAddressMode(ptr, 0))
 		load := m.allocateInstr()
 		switch size {
@@ -1410,7 +1410,7 @@ func (m *machine) lowerVconst(dst regalloc.VReg, lo, hi uint64) {
 }
 
 func (m *machine) lowerCtz(instr *ssa.Instruction) {
-	if m.cpuFeatures.HasExtra(platform.CpuExtraFeatureAmd64ABM) {
+	if m.cpuFeatures.Has(platform.CpuFeatureAmd64BMI1) {
 		m.lowerUnaryRmR(instr, unaryRmROpcodeTzcnt)
 	} else {
 		// On processors that do not support TZCNT, the BSF instruction is
@@ -1464,7 +1464,7 @@ func (m *machine) lowerCtz(instr *ssa.Instruction) {
 }
 
 func (m *machine) lowerClz(instr *ssa.Instruction) {
-	if m.cpuFeatures.HasExtra(platform.CpuExtraFeatureAmd64ABM) {
+	if m.cpuFeatures.Has(platform.CpuFeatureAmd64ABM) {
 		m.lowerUnaryRmR(instr, unaryRmROpcodeLzcnt)
 	} else {
 		// On processors that do not support LZCNT, we combine BSR (calculating
@@ -1892,8 +1892,8 @@ func (m *machine) lowerCall(si *ssa.Instruction) {
 
 	if isMemmove {
 		// Go's memmove *might* use all xmm0-xmm15, so we need to release them.
-		// https://github.com/golang/go/blob/49d42128fd8594c172162961ead19ac95e247d24/src/cmd/compile/abi-internal.md#architecture-specifics
-		// https://github.com/golang/go/blob/49d42128fd8594c172162961ead19ac95e247d24/src/runtime/memmove_amd64.s#L271-L286
+		// https://github.com/golang/go/blob/go1.24.0/src/cmd/compile/abi-internal.md#architecture-specifics
+		// https://github.com/golang/go/blob/go1.24.0/src/runtime/memmove_amd64.s#L286-L301
 		for i := regalloc.RealReg(0); i < 16; i++ {
 			m.insert(m.allocateInstr().asDefineUninitializedReg(regInfo.RealRegToVReg[xmm0+i]))
 		}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/abi.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/abi.go
index c300c3d617..f9e7be9052 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/abi.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/abi.go
@@ -7,7 +7,7 @@ import (
 )
 
 // References:
-// * https://github.com/golang/go/blob/49d42128fd8594c172162961ead19ac95e247d24/src/cmd/compile/abi-internal.md#arm64-architecture
+// * https://github.com/golang/go/blob/go1.24.0/src/cmd/compile/abi-internal.md#arm64-architecture
 // * https://developer.arm.com/documentation/102374/0101/Procedure-Call-Standard
 
 var (
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/lower_constant.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/lower_constant.go
index 6c6824fb0a..7725631442 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/lower_constant.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/lower_constant.go
@@ -96,7 +96,7 @@ func (m *machine) lowerConstantI32(dst regalloc.VReg, c int32) {
 
 func (m *machine) lowerConstantI64(dst regalloc.VReg, c int64) {
 	// Following the logic here:
-	// https://github.com/golang/go/blob/release-branch.go1.15/src/cmd/internal/obj/arm64/asm7.go#L1798-L1852
+	// https://github.com/golang/go/blob/go1.24.0/src/cmd/internal/obj/arm64/asm7.go#L2161-L2215
 	if c >= 0 && (c <= 0xfff || (c&0xfff) == 0 && (uint64(c>>12) <= 0xfff)) {
 		if isBitMaskImmediate(uint64(c), true) {
 			m.lowerConstViaBitMaskImmediate(uint64(c), dst, true)
@@ -188,7 +188,7 @@ func const16bitAligned(v int64) (ret int) {
 // load64bitConst loads a 64-bit constant into the register, following the same logic to decide how to load large 64-bit
 // consts as in the Go assembler.
 //
-// See https://github.com/golang/go/blob/release-branch.go1.15/src/cmd/internal/obj/arm64/asm7.go#L6632-L6759
+// See https://github.com/golang/go/blob/go1.24.0/src/cmd/internal/obj/arm64/asm7.go#L7555-L7682
 func (m *machine) load64bitConst(c int64, dst regalloc.VReg) {
 	var bits [4]uint64
 	var zeros, negs int
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/reg.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/reg.go
index 45737516d8..9cbac0af78 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/reg.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/arm64/reg.go
@@ -160,8 +160,8 @@ var (
 	// tmpReg is used to perform spill/load on large stack offsets, and load large constants.
 	// Therefore, be cautious to use this register in the middle of the compilation, especially before the register allocation.
 	// This is the same as golang/go, but it's only described in the source code:
-	// https://github.com/golang/go/blob/18e17e2cb12837ea2c8582ecdb0cc780f49a1aac/src/cmd/compile/internal/ssa/_gen/ARM64Ops.go#L59
-	// https://github.com/golang/go/blob/18e17e2cb12837ea2c8582ecdb0cc780f49a1aac/src/cmd/compile/internal/ssa/_gen/ARM64Ops.go#L13-L15
+	// https://github.com/golang/go/blob/go1.24.0/src/cmd/compile/internal/ssa/_gen/ARM64Ops.go#L59
+	// https://github.com/golang/go/blob/go1.24.0/src/cmd/compile/internal/ssa/_gen/ARM64Ops.go#L13-L15
 	tmpRegVReg = regalloc.FromRealReg(tmp, regalloc.RegTypeInt)
 	v28VReg    = regalloc.FromRealReg(v28, regalloc.RegTypeFloat)
 	v29VReg    = regalloc.FromRealReg(v29, regalloc.RegTypeFloat)
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/engine.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/engine.go
index a603dbdd7f..f09dd1791b 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/engine.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/engine.go
@@ -150,7 +150,7 @@ func (e *engine) CompileModule(ctx context.Context, module *wasm.Module, listene
 	if err != nil {
 		return err
 	}
-	if err = e.addCompiledModule(module, cm); err != nil {
+	if cm, err = e.addCompiledModule(module, cm); err != nil {
 		return err
 	}
 
@@ -372,7 +372,7 @@ func (e *engine) compileModule(ctx context.Context, module *wasm.Module, listene
 
 	relocator.resolveRelocations(machine, executable, importedFns)
 
-	if err = platform.MprotectRX(executable); err != nil {
+	if err = platform.MprotectCodeSegment(executable); err != nil {
 		return nil, err
 	}
 	cm.sharedFunctions = e.sharedFunctions
@@ -615,7 +615,7 @@ func (e *engine) compileHostModule(ctx context.Context, module *wasm.Module, lis
 		wazevoapi.PerfMap.Flush(uintptr(unsafe.Pointer(&executable[0])), cm.functionOffsets)
 	}
 
-	if err = platform.MprotectRX(executable); err != nil {
+	if err = platform.MprotectCodeSegment(executable); err != nil {
 		return nil, err
 	}
 	e.setFinalizer(cm.executables, executablesFinalizer)
@@ -877,7 +877,7 @@ func mmapExecutable(src []byte) []byte {
 
 	copy(executable, src)
 
-	if err = platform.MprotectRX(executable); err != nil {
+	if err = platform.MprotectCodeSegment(executable); err != nil {
 		panic(err)
 	}
 	return executable
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/engine_cache.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/engine_cache.go
index e0446e08a6..eba1ac9633 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/engine_cache.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/engine_cache.go
@@ -32,7 +32,7 @@ func fileCacheKey(m *wasm.Module) (ret filecache.Key) {
 	s.Write(magic)
 	// Write the CPU features so that we can cache the compiled module for the same CPU.
 	// This prevents the incompatible CPU features from being used.
-	cpu := platform.CpuFeatures().Raw()
+	cpu := platform.CpuFeatures.Raw()
 	// Reuse the `ret` buffer to write the first 8 bytes of the CPU features so that we can avoid the allocation.
 	binary.LittleEndian.PutUint64(ret[:8], cpu)
 	s.Write(ret[:8])
@@ -41,10 +41,10 @@ func fileCacheKey(m *wasm.Module) (ret filecache.Key) {
 	return
 }
 
-func (e *engine) addCompiledModule(module *wasm.Module, cm *compiledModule) (err error) {
-	e.addCompiledModuleToMemory(module, cm)
+func (e *engine) addCompiledModule(module *wasm.Module, cm *compiledModule) (c *compiledModule, err error) {
+	c = e.addCompiledModuleToMemory(module, cm)
 	if !module.IsHostModule && e.fileCache != nil {
-		err = e.addCompiledModuleToCache(module, cm)
+		err = e.addCompiledModuleToCache(module, c)
 	}
 	return
 }
@@ -84,13 +84,18 @@ func (e *engine) getCompiledModule(module *wasm.Module, listeners []experimental
 	return
 }
 
-func (e *engine) addCompiledModuleToMemory(m *wasm.Module, cm *compiledModule) {
+func (e *engine) addCompiledModuleToMemory(m *wasm.Module, cm *compiledModule) *compiledModule {
 	e.mux.Lock()
 	defer e.mux.Unlock()
+	if c, ok := e.compiledModules[m.ID]; ok {
+		c.refCount++
+		return c.compiledModule
+	}
 	e.compiledModules[m.ID] = &compiledModuleWithCount{compiledModule: cm, refCount: 1}
 	if len(cm.executable) > 0 {
 		e.addCompiledModuleToSortedList(cm)
 	}
+	return cm
 }
 
 func (e *engine) getCompiledModuleFromMemory(module *wasm.Module, increaseRefCount bool) (cm *compiledModule, ok bool) {
@@ -252,7 +257,7 @@ func deserializeCompiledModule(wazeroVersion string, reader io.ReadCloser) (cm *
 			return nil, false, fmt.Errorf("compilationcache: checksum mismatch (expected %d, got %d)", expected, checksum)
 		}
 
-		if err = platform.MprotectRX(executable); err != nil {
+		if err = platform.MprotectCodeSegment(executable); err != nil {
 			return nil, false, err
 		}
 		cm.executable = executable
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_amd64.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_amd64.go
index 18f60af3a0..6cb0c457e2 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_amd64.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_amd64.go
@@ -1,5 +1,3 @@
-//go:build amd64 && !tinygo
-
 package wazevo
 
 import _ "unsafe"
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_arm64.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_arm64.go
index e16d64f65e..0b8b55335c 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_arm64.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_arm64.go
@@ -1,5 +1,3 @@
-//go:build arm64 && !tinygo
-
 package wazevo
 
 import _ "unsafe"
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_others.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_other.go
similarity index 90%
rename from vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_others.go
rename to vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_other.go
index 8f9d64b2b1..10cf5d4e13 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_others.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/entrypoint_other.go
@@ -1,4 +1,4 @@
-//go:build (!arm64 && !amd64) || tinygo
+//go:build !(arm64 || amd64)
 
 package wazevo
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/ptr.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/ptr.go
index f21e1a5d8d..c17d665b6f 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/ptr.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/wazevoapi/ptr.go
@@ -8,8 +8,8 @@ func PtrFromUintptr[T any](ptr uintptr) *T {
 	// Wraps ptrs as the double pointer in order to avoid the unsafe access as detected by race detector.
 	//
 	// For example, if we have (*function)(unsafe.Pointer(ptr)) instead, then the race detector's "checkptr"
-	// subroutine wanrs as "checkptr: pointer arithmetic result points to invalid allocation"
-	// https://github.com/golang/go/blob/1ce7fcf139417d618c2730010ede2afb41664211/src/runtime/checkptr.go#L69
+	// subroutine warns as "checkptr: pointer arithmetic result points to invalid allocation"
+	// https://github.com/golang/go/blob/go1.24.0/src/runtime/checkptr.go#L69
 	var wrapped *uintptr = &ptr
 	return *(**T)(unsafe.Pointer(wrapped))
 }
diff --git a/vendor/github.com/tetratelabs/wazero/internal/leb128/leb128.go b/vendor/github.com/tetratelabs/wazero/internal/leb128/leb128.go
index a31051724c..7fc0eb9c77 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/leb128/leb128.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/leb128/leb128.go
@@ -109,7 +109,7 @@ func LoadUint32(buf []byte) (ret uint32, bytesRead uint64, err error) {
 }
 
 func decodeUint32(next nextByte) (ret uint32, bytesRead uint64, err error) {
-	// Derived from https://github.com/golang/go/blob/go1.20/src/encoding/binary/varint.go
+	// Derived from https://github.com/golang/go/blob/go1.24.0/src/encoding/binary/varint.go
 	// with the modification on the overflow handling tailored for 32-bits.
 	var s uint32
 	for i := 0; i < maxVarintLen32; i++ {
@@ -124,7 +124,7 @@ func decodeUint32(next nextByte) (ret uint32, bytesRead uint64, err error) {
 			}
 			return ret | uint32(b)<<s, uint64(i) + 1, nil
 		}
-		ret |= (uint32(b) & 0x7f) << s
+		ret |= uint32(b&0x7f) << s
 		s += 7
 	}
 	return 0, 0, errOverflow32
@@ -136,7 +136,7 @@ func LoadUint64(buf []byte) (ret uint64, bytesRead uint64, err error) {
 		return 0, 0, io.EOF
 	}
 
-	// Derived from https://github.com/golang/go/blob/go1.20/src/encoding/binary/varint.go
+	// Derived from https://github.com/golang/go/blob/go1.24.0/src/encoding/binary/varint.go
 	var s uint64
 	for i := 0; i < maxVarintLen64; i++ {
 		if i >= bufLen {
@@ -150,7 +150,7 @@ func LoadUint64(buf []byte) (ret uint64, bytesRead uint64, err error) {
 			}
 			return ret | uint64(b)<<s, uint64(i) + 1, nil
 		}
-		ret |= (uint64(b) & 0x7f) << s
+		ret |= uint64(b&0x7f) << s
 		s += 7
 	}
 	return 0, 0, errOverflow64
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid.go b/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid.go
index 0220d56fd4..fb9a34bc47 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid.go
@@ -1,35 +1,26 @@
 package platform
 
 // CpuFeatureFlags exposes methods for querying CPU capabilities
-type CpuFeatureFlags interface {
-	// Has returns true when the specified flag (represented as uint64) is supported
-	Has(cpuFeature CpuFeature) bool
-	// HasExtra returns true when the specified extraFlag (represented as uint64) is supported
-	HasExtra(cpuFeature CpuFeature) bool
-	// Raw returns the raw bitset that represents CPU features used by wazero. This can be used for cache keying.
-	// For now, we only use four features, so uint64 is enough.
-	Raw() uint64
-}
-
-type CpuFeature uint64
+type CpuFeatureFlags uint64
 
 const (
-	// CpuFeatureAmd64SSE3 is the flag to query CpuFeatureFlags.Has for SSEv3 capabilities on amd64
-	CpuFeatureAmd64SSE3 CpuFeature = 1
 	// CpuFeatureAmd64SSE4_1 is the flag to query CpuFeatureFlags.Has for SSEv4.1 capabilities on amd64
-	CpuFeatureAmd64SSE4_1 CpuFeature = 1 << 19
-	// CpuFeatureAmd64SSE4_2 is the flag to query CpuFeatureFlags.Has for SSEv4.2 capabilities on amd64
-	CpuFeatureAmd64SSE4_2 CpuFeature = 1 << 20
-	// Note: when adding new features, ensure that the feature is included in CpuFeatureFlags.Raw.
-)
-
-const (
-	// CpuExtraFeatureAmd64ABM is the flag to query CpuFeatureFlags.HasExtra for Advanced Bit Manipulation capabilities (e.g. LZCNT) on amd64
-	CpuExtraFeatureAmd64ABM CpuFeature = 1 << 5
-	// Note: when adding new features, ensure that the feature is included in CpuFeatureFlags.Raw.
+	CpuFeatureAmd64SSE4_1 = 1 << iota
+	// CpuFeatureAmd64BMI1 is the flag to query CpuFeatureFlags.Has for Bit Manipulation Instruction Set 1 (e.g. TZCNT) on amd64
+	CpuFeatureAmd64BMI1
+	// CpuExtraFeatureABM is the flag to query CpuFeatureFlags.Has for Advanced Bit Manipulation capabilities (e.g. LZCNT) on amd64
+	CpuFeatureAmd64ABM
 )
 
 const (
 	// CpuFeatureArm64Atomic is the flag to query CpuFeatureFlags.Has for Large System Extensions capabilities on arm64
-	CpuFeatureArm64Atomic CpuFeature = 1 << 21
+	CpuFeatureArm64Atomic CpuFeatureFlags = 1 << iota
 )
+
+func (c CpuFeatureFlags) Has(f CpuFeatureFlags) bool {
+	return c&f != 0
+}
+
+func (c CpuFeatureFlags) Raw() uint64 {
+	return uint64(c)
+}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_amd64.go b/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_amd64.go
index 3619eecd42..9e7cf4f05b 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_amd64.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_amd64.go
@@ -1,82 +1,22 @@
-//go:build gc
-
 package platform
 
-import "sync"
+import "golang.org/x/sys/cpu"
 
-// CpuFeatures exposes the capabilities for this CPU, queried via the Has, HasExtra methods.
-var CpuFeatures = sync.OnceValue(loadCpuFeatureFlags)
+// CpuFeatures exposes the capabilities for this CPU, queried via the Has method.
+var CpuFeatures = loadCpuFeatureFlags()
 
-// cpuFeatureFlags implements CpuFeatureFlags interface.
-type cpuFeatureFlags struct {
-	flags      uint64
-	extraFlags uint64
-}
-
-// cpuid exposes the CPUID instruction to the Go layer (https://www.amd.com/system/files/TechDocs/25481.pdf)
-// implemented in cpuid_amd64.s
-func cpuid(arg1, arg2 uint32) (eax, ebx, ecx, edx uint32)
-
-// cpuidAsBitmap combines the result of invoking cpuid to uint64 bitmap.
-func cpuidAsBitmap(arg1, arg2 uint32) uint64 {
-	_ /* eax */, _ /* ebx */, ecx, edx := cpuid(arg1, arg2)
-	return (uint64(edx) << 32) | uint64(ecx)
-}
-
-// loadStandardRange load flags from the standard range, panics otherwise.
-func loadStandardRange(id uint32) uint64 {
-	// ensure that the id is in the valid range, returned by cpuid(0,0)
-	maxRange, _, _, _ := cpuid(0, 0)
-	if id > maxRange {
-		panic("cannot query standard CPU flags")
+func loadCpuFeatureFlags() (flags CpuFeatureFlags) {
+	if cpu.X86.HasSSE41 {
+		flags |= CpuFeatureAmd64SSE4_1
 	}
-	return cpuidAsBitmap(id, 0)
-}
-
-// loadStandardRange load flags from the extended range, panics otherwise.
-func loadExtendedRange(id uint32) uint64 {
-	// ensure that the id is in the valid range, returned by cpuid(0x80000000,0)
-	maxRange, _, _, _ := cpuid(0x80000000, 0)
-	if id > maxRange {
-		panic("cannot query extended CPU flags")
+	if cpu.X86.HasBMI1 {
+		flags |= CpuFeatureAmd64BMI1
 	}
-	return cpuidAsBitmap(id, 0)
-}
-
-func loadCpuFeatureFlags() CpuFeatureFlags {
-	return &cpuFeatureFlags{
-		flags:      loadStandardRange(1),
-		extraFlags: loadExtendedRange(0x80000001),
+	// x/sys/cpu does not track the ABM explicitly.
+	// LZCNT combined with BMI1 and BMI2 completes the expanded ABM instruction set.
+	// Intel includes LZCNT in BMI1, and all AMD CPUs with POPCNT also have LZCNT.
+	if cpu.X86.HasBMI1 && cpu.X86.HasBMI2 && cpu.X86.HasPOPCNT {
+		flags |= CpuFeatureAmd64ABM
 	}
-}
-
-// Has implements the same method on the CpuFeatureFlags interface.
-func (f *cpuFeatureFlags) Has(cpuFeature CpuFeature) bool {
-	return (f.flags & uint64(cpuFeature)) != 0
-}
-
-// HasExtra implements the same method on the CpuFeatureFlags interface.
-func (f *cpuFeatureFlags) HasExtra(cpuFeature CpuFeature) bool {
-	return (f.extraFlags & uint64(cpuFeature)) != 0
-}
-
-// Raw implements the same method on the CpuFeatureFlags interface.
-func (f *cpuFeatureFlags) Raw() uint64 {
-	// Below, we only set bits for the features we care about,
-	// instead of setting all the unnecessary bits obtained from the
-	// CPUID instruction.
-	var ret uint64
-	if f.Has(CpuFeatureAmd64SSE3) {
-		ret = 1 << 0
-	}
-	if f.Has(CpuFeatureAmd64SSE4_1) {
-		ret |= 1 << 1
-	}
-	if f.Has(CpuFeatureAmd64SSE4_2) {
-		ret |= 1 << 2
-	}
-	if f.HasExtra(CpuExtraFeatureAmd64ABM) {
-		ret |= 1 << 3
-	}
-	return ret
+	return
 }
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_amd64.s b/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_amd64.s
deleted file mode 100644
index 4950ee6293..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_amd64.s
+++ /dev/null
@@ -1,16 +0,0 @@
-//go:build gc
-
-#include "textflag.h"
-
-// lifted from github.com/intel-go/cpuid and src/internal/cpu/cpu_x86.s
-
-// func cpuid(arg1, arg2 uint32) (eax, ebx, ecx, edx uint32)
-TEXT ·cpuid(SB), NOSPLIT, $0-24
-	MOVL arg1+0(FP), AX
-	MOVL arg2+4(FP), CX
-	CPUID
-	MOVL AX, eax+8(FP)
-	MOVL BX, ebx+12(FP)
-	MOVL CX, ecx+16(FP)
-	MOVL DX, edx+20(FP)
-	RET
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_arm64.go b/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_arm64.go
index 583b2941e4..af06dab9e8 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_arm64.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_arm64.go
@@ -1,28 +1,15 @@
-//go:build gc
-
 package platform
 
 import (
 	"runtime"
-	"sync"
+
+	"golang.org/x/sys/cpu"
 )
 
-// CpuFeatures exposes the capabilities for this CPU, queried via the Has, HasExtra methods.
-var CpuFeatures = sync.OnceValue(loadCpuFeatureFlags)
+// CpuFeatures exposes the capabilities for this CPU, queried via the Has method.
+var CpuFeatures = loadCpuFeatureFlags()
 
-// cpuFeatureFlags implements CpuFeatureFlags interface.
-type cpuFeatureFlags struct {
-	isar0 uint64
-	isar1 uint64
-}
-
-// implemented in cpuid_arm64.s
-func getisar0() uint64
-
-// implemented in cpuid_arm64.s
-func getisar1() uint64
-
-func loadCpuFeatureFlags() CpuFeatureFlags {
+func loadCpuFeatureFlags() (flags CpuFeatureFlags) {
 	switch runtime.GOOS {
 	case "darwin", "windows":
 		// These OSes do not allow userland to read the instruction set attribute registers,
@@ -31,44 +18,11 @@ func loadCpuFeatureFlags() CpuFeatureFlags {
 		//   and the M1 is a ARMv8.4.
 		// - "windows" requires them from Windows 11, see page 12
 		//   https://download.microsoft.com/download/7/8/8/788bf5ab-0751-4928-a22c-dffdc23c27f2/Minimum%20Hardware%20Requirements%20for%20Windows%2011.pdf
-		return &cpuFeatureFlags{
-			isar0: uint64(CpuFeatureArm64Atomic),
-			isar1: 0,
-		}
-	case "linux", "freebsd":
-		// These OSes allow userland to read the instruction set attribute registers,
-		// which is otherwise restricted to EL0:
-		// https://kernel.org/doc/Documentation/arm64/cpu-feature-registers.txt
-		// See these for contents of the registers:
-		// https://developer.arm.com/documentation/ddi0601/latest/AArch64-Registers/ID-AA64ISAR0-EL1--AArch64-Instruction-Set-Attribute-Register-0
-		// https://developer.arm.com/documentation/ddi0601/latest/AArch64-Registers/ID-AA64ISAR1-EL1--AArch64-Instruction-Set-Attribute-Register-1
-		return &cpuFeatureFlags{
-			isar0: getisar0(),
-			isar1: getisar1(),
-		}
+		flags |= CpuFeatureArm64Atomic
 	default:
-		return &cpuFeatureFlags{}
+		if cpu.ARM64.HasATOMICS {
+			flags |= CpuFeatureArm64Atomic
+		}
 	}
-}
-
-// Has implements the same method on the CpuFeatureFlags interface.
-func (f *cpuFeatureFlags) Has(cpuFeature CpuFeature) bool {
-	return (f.isar0 & uint64(cpuFeature)) != 0
-}
-
-// HasExtra implements the same method on the CpuFeatureFlags interface.
-func (f *cpuFeatureFlags) HasExtra(cpuFeature CpuFeature) bool {
-	return (f.isar1 & uint64(cpuFeature)) != 0
-}
-
-// Raw implements the same method on the CpuFeatureFlags interface.
-func (f *cpuFeatureFlags) Raw() uint64 {
-	// Below, we only set bits for the features we care about,
-	// instead of setting all the unnecessary bits obtained from the
-	// instruction set attribute registers.
-	var ret uint64
-	if f.Has(CpuFeatureArm64Atomic) {
-		ret = 1 << 0
-	}
-	return ret
+	return
 }
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_arm64.s b/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_arm64.s
deleted file mode 100644
index 98305ad474..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_arm64.s
+++ /dev/null
@@ -1,21 +0,0 @@
-//go:build gc
-
-#include "textflag.h"
-
-// lifted from github.com/golang/sys and cpu/cpu_arm64.s
-
-// func getisar0() uint64
-TEXT ·getisar0(SB), NOSPLIT, $0-8
-	// get Instruction Set Attributes 0 into x0
-	// mrs x0, ID_AA64ISAR0_EL1 = d5380600
-	WORD $0xd5380600
-	MOVD R0, ret+0(FP)
-	RET
-
-// func getisar1() uint64
-TEXT ·getisar1(SB), NOSPLIT, $0-8
-	// get Instruction Set Attributes 1 into x0
-	// mrs x0, ID_AA64ISAR1_EL1 = d5380620
-	WORD $0xd5380620
-	MOVD R0, ret+0(FP)
-	RET
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_unsupported.go
index 5f90094538..8f748ff8d1 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/cpuid_unsupported.go
@@ -1,17 +1,5 @@
-//go:build !(amd64 || arm64) || !gc
+//go:build !(amd64 || arm64)
 
 package platform
 
-var CpuFeatures = func() CpuFeatureFlags { return &cpuFeatureFlags{} }
-
-// cpuFeatureFlags implements CpuFeatureFlags for unsupported platforms.
-type cpuFeatureFlags struct{}
-
-// Has implements the same method on the CpuFeatureFlags interface.
-func (c *cpuFeatureFlags) Has(cpuFeature CpuFeature) bool { return false }
-
-// HasExtra implements the same method on the CpuFeatureFlags interface.
-func (c *cpuFeatureFlags) HasExtra(cpuFeature CpuFeature) bool { return false }
-
-// Raw implements the same method on the CpuFeatureFlags interface.
-func (c *cpuFeatureFlags) Raw() uint64 { return 0 }
+const CpuFeatures CpuFeatureFlags = 0
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_linux.go b/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_linux.go
index 3e2f435dc7..f3eabde21e 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_linux.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_linux.go
@@ -6,13 +6,8 @@ import (
 	"sort"
 	"strconv"
 	"strings"
-	"syscall"
-)
 
-const (
-	// https://man7.org/linux/man-pages/man2/mmap.2.html
-	__MAP_HUGE_SHIFT = 26
-	__MAP_HUGETLB    = 0x40000
+	"golang.org/x/sys/unix"
 )
 
 var hugePagesConfigs []hugePagesConfig
@@ -50,7 +45,7 @@ func init() {
 		n *= 1024
 		hugePagesConfigs = append(hugePagesConfigs, hugePagesConfig{
 			size: int(n),
-			flag: int(bits.TrailingZeros64(n)<<__MAP_HUGE_SHIFT) | __MAP_HUGETLB,
+			flag: int(bits.TrailingZeros64(n)<<unix.MAP_HUGE_SHIFT) | unix.MAP_HUGETLB,
 		})
 	}
 
@@ -60,15 +55,12 @@ func init() {
 }
 
 func mmapCodeSegment(size int) ([]byte, error) {
-	flag := syscall.MAP_ANON | syscall.MAP_PRIVATE
-	prot := syscall.PROT_READ | syscall.PROT_WRITE
-	if noopMprotectRX {
-		prot = syscall.PROT_READ | syscall.PROT_WRITE | syscall.PROT_EXEC
-	}
+	flag := unix.MAP_ANON | unix.MAP_PRIVATE
+	prot := unix.PROT_READ | unix.PROT_WRITE
 
 	for _, hugePagesConfig := range hugePagesConfigs {
 		if hugePagesConfig.match(size) {
-			b, err := syscall.Mmap(-1, 0, size, prot, flag|hugePagesConfig.flag)
+			b, err := unix.Mmap(-1, 0, size, prot, flag|hugePagesConfig.flag)
 			if err != nil {
 				continue
 			}
@@ -76,5 +68,5 @@ func mmapCodeSegment(size int) ([]byte, error) {
 		}
 	}
 
-	return syscall.Mmap(-1, 0, size, prot, flag)
+	return unix.Mmap(-1, 0, size, prot, flag)
 }
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_other.go b/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_other.go
index ee2d870226..9502e13133 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_other.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_other.go
@@ -1,22 +1,19 @@
 // Separated from linux which has support for huge pages.
-//go:build darwin || freebsd || netbsd || dragonfly || solaris
+
+//go:build unix && !linux
 
 package platform
 
-import "syscall"
+import "golang.org/x/sys/unix"
 
 func mmapCodeSegment(size int) ([]byte, error) {
-	prot := syscall.PROT_READ | syscall.PROT_WRITE
-	if noopMprotectRX {
-		prot = syscall.PROT_READ | syscall.PROT_WRITE | syscall.PROT_EXEC
-	}
-	return syscall.Mmap(
+	return unix.Mmap(
 		-1,
 		0,
 		size,
-		prot,
+		unix.PROT_READ|unix.PROT_WRITE,
 		// Anonymous as this is not an actual file, but a memory,
 		// Private as this is in-process memory region.
-		syscall.MAP_ANON|syscall.MAP_PRIVATE,
+		unix.MAP_ANON|unix.MAP_PRIVATE,
 	)
 }
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_unix.go b/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_unix.go
index 6b7c617b24..c4be92c39e 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_unix.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_unix.go
@@ -1,9 +1,14 @@
-//go:build (linux || darwin || freebsd || netbsd || dragonfly || solaris) && !tinygo
+//go:build unix
 
 package platform
 
-import "syscall"
+import "golang.org/x/sys/unix"
 
 func munmapCodeSegment(code []byte) error {
-	return syscall.Munmap(code)
+	return unix.Munmap(code)
+}
+
+// MprotectCodeSegment is like unix.Mprotect with RX permission.
+func MprotectCodeSegment(b []byte) (err error) {
+	return unix.Mprotect(b, unix.PROT_READ|unix.PROT_EXEC)
 }
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_unsupported.go
index 06517b7b6c..6223053ac6 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_unsupported.go
@@ -1,4 +1,4 @@
-//go:build !(linux || darwin || freebsd || netbsd || dragonfly || solaris || windows) || tinygo
+//go:build !(unix || windows)
 
 package platform
 
@@ -17,6 +17,6 @@ func mmapCodeSegment(size int) ([]byte, error) {
 	panic(errUnsupported)
 }
 
-func MprotectRX(b []byte) (err error) {
+func MprotectCodeSegment(b []byte) (err error) {
 	panic(errUnsupported)
 }
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_windows.go b/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_windows.go
index 68b11ad38e..80f01802bb 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_windows.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/mmap_windows.go
@@ -1,63 +1,21 @@
 package platform
 
 import (
-	"fmt"
-	"syscall"
 	"unsafe"
-)
 
-var (
-	kernel32           = syscall.NewLazyDLL("kernel32.dll")
-	procVirtualAlloc   = kernel32.NewProc("VirtualAlloc")
-	procVirtualProtect = kernel32.NewProc("VirtualProtect")
-	procVirtualFree    = kernel32.NewProc("VirtualFree")
-)
-
-const (
-	windows_MEM_COMMIT             uintptr = 0x00001000
-	windows_MEM_RELEASE            uintptr = 0x00008000
-	windows_PAGE_READWRITE         uintptr = 0x00000004
-	windows_PAGE_EXECUTE_READ      uintptr = 0x00000020
-	windows_PAGE_EXECUTE_READWRITE uintptr = 0x00000040
+	"golang.org/x/sys/windows"
 )
 
 func munmapCodeSegment(code []byte) error {
-	return freeMemory(code)
-}
-
-// allocateMemory commits the memory region via the "VirtualAlloc" function.
-// See https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualalloc
-func allocateMemory(size uintptr, protect uintptr) (uintptr, error) {
-	address := uintptr(0) // system determines where to allocate the region.
-	alloctype := windows_MEM_COMMIT
-	if r, _, err := procVirtualAlloc.Call(address, size, alloctype, protect); r == 0 {
-		return 0, fmt.Errorf("compiler: VirtualAlloc error: %w", ensureErr(err))
-	} else {
-		return r, nil
-	}
-}
-
-// freeMemory releases the memory region via the "VirtualFree" function.
-// See https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualfree
-func freeMemory(code []byte) error {
 	address := unsafe.Pointer(&code[0])
 	size := uintptr(0) // size must be 0 because we're using MEM_RELEASE.
-	freetype := windows_MEM_RELEASE
-	if r, _, err := procVirtualFree.Call(uintptr(address), size, freetype); r == 0 {
-		return fmt.Errorf("compiler: VirtualFree error: %w", ensureErr(err))
-	}
-	return nil
-}
-
-func virtualProtect(address, size, newprotect uintptr, oldprotect *uint32) error {
-	if r, _, err := procVirtualProtect.Call(address, size, newprotect, uintptr(unsafe.Pointer(oldprotect))); r == 0 {
-		return fmt.Errorf("compiler: VirtualProtect error: %w", ensureErr(err))
-	}
-	return nil
+	return windows.VirtualFree(uintptr(address), size, windows.MEM_RELEASE)
 }
 
 func mmapCodeSegment(size int) ([]byte, error) {
-	p, err := allocateMemory(uintptr(size), windows_PAGE_READWRITE)
+	address := uintptr(0) // system determines where to allocate the region.
+	p, err := windows.VirtualAlloc(address, uintptr(size),
+		windows.MEM_COMMIT, windows.PAGE_READWRITE)
 	if err != nil {
 		return nil, err
 	}
@@ -65,22 +23,9 @@ func mmapCodeSegment(size int) ([]byte, error) {
 	return unsafe.Slice((*byte)(unsafe.Pointer(p)), size), nil
 }
 
-var old = uint32(windows_PAGE_READWRITE)
+var old = uint32(windows.PAGE_READWRITE)
 
-func MprotectRX(b []byte) (err error) {
-	err = virtualProtect(uintptr(unsafe.Pointer(&b[0])), uintptr(len(b)), windows_PAGE_EXECUTE_READ, &old)
-	return
-}
-
-// ensureErr returns syscall.EINVAL when the input error is nil.
-//
-// We are supposed to use "GetLastError" which is more precise, but it is not safe to execute in goroutines. While
-// "GetLastError" is thread-local, goroutines are not pinned to threads.
-//
-// See https://docs.microsoft.com/en-us/windows/win32/api/errhandlingapi/nf-errhandlingapi-getlasterror
-func ensureErr(err error) error {
-	if err != nil {
-		return err
-	}
-	return syscall.EINVAL
+func MprotectCodeSegment(b []byte) (err error) {
+	address := unsafe.Pointer(&b[0])
+	return windows.VirtualProtect(uintptr(address), uintptr(len(b)), windows.PAGE_EXECUTE_READ, &old)
 }
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_bsd.go b/vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_bsd.go
deleted file mode 100644
index d9b264863c..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_bsd.go
+++ /dev/null
@@ -1,24 +0,0 @@
-//go:build (freebsd || netbsd || dragonfly) && !tinygo
-
-package platform
-
-import (
-	"syscall"
-	"unsafe"
-)
-
-const noopMprotectRX = false
-
-// MprotectRX is like syscall.Mprotect with RX permission, defined locally so that BSD compiles.
-func MprotectRX(b []byte) (err error) {
-	var _p0 unsafe.Pointer
-	if len(b) > 0 {
-		_p0 = unsafe.Pointer(&b[0])
-	}
-	const prot = syscall.PROT_READ | syscall.PROT_EXEC
-	_, _, e1 := syscall.Syscall(syscall.SYS_MPROTECT, uintptr(_p0), uintptr(len(b)), uintptr(prot))
-	if e1 != 0 {
-		err = syscall.Errno(e1)
-	}
-	return
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_syscall.go b/vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_syscall.go
deleted file mode 100644
index 71baabb44e..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_syscall.go
+++ /dev/null
@@ -1,12 +0,0 @@
-//go:build (linux || darwin) && !tinygo
-
-package platform
-
-import "syscall"
-
-const noopMprotectRX = false
-
-// MprotectRX is like syscall.Mprotect with RX permission.
-func MprotectRX(b []byte) (err error) {
-	return syscall.Mprotect(b, syscall.PROT_READ|syscall.PROT_EXEC)
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_unsupported.go
deleted file mode 100644
index e367b20308..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/mprotect_unsupported.go
+++ /dev/null
@@ -1,10 +0,0 @@
-//go:build solaris && !tinygo
-
-package platform
-
-const noopMprotectRX = true
-
-func MprotectRX(b []byte) error {
-	// Assume we already called mmap with at least RX.
-	return nil
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/platform.go b/vendor/github.com/tetratelabs/wazero/internal/platform/platform.go
index 35806f6e40..722ac1243d 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/platform.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/platform.go
@@ -1,7 +1,4 @@
 // Package platform includes runtime-specific code needed for the compiler or otherwise.
-//
-// Note: This is a dependency-free alternative to depending on parts of Go's x/sys.
-// See /RATIONALE.md for more context.
 package platform
 
 import (
@@ -18,16 +15,16 @@ func CompilerSupported() bool {
 
 func CompilerSupports(features api.CoreFeatures) bool {
 	switch runtime.GOOS {
-	case "linux", "darwin", "freebsd", "netbsd", "dragonfly", "windows":
+	case "linux", "darwin", "freebsd", "netbsd", "windows":
 		if runtime.GOARCH == "arm64" {
 			if features.IsEnabled(experimental.CoreFeaturesThreads) {
-				return CpuFeatures().Has(CpuFeatureArm64Atomic)
+				return CpuFeatures.Has(CpuFeatureArm64Atomic)
 			}
 			return true
 		}
 		fallthrough
-	case "solaris", "illumos":
-		return runtime.GOARCH == "amd64" && CpuFeatures().Has(CpuFeatureAmd64SSE4_1)
+	case "dragonfly", "solaris", "illumos":
+		return runtime.GOARCH == "amd64" && CpuFeatures.Has(CpuFeatureAmd64SSE4_1)
 	default:
 		return false
 	}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/time_notcgo.go b/vendor/github.com/tetratelabs/wazero/internal/platform/time_notcgo.go
deleted file mode 100644
index 0697b7c700..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/time_notcgo.go
+++ /dev/null
@@ -1,7 +0,0 @@
-//go:build !cgo && !windows
-
-package platform
-
-func nanotime() int64 {
-	return nanotimePortable()
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/time_cgo.go b/vendor/github.com/tetratelabs/wazero/internal/platform/time_notwindows.go
similarity index 89%
rename from vendor/github.com/tetratelabs/wazero/internal/platform/time_cgo.go
rename to vendor/github.com/tetratelabs/wazero/internal/platform/time_notwindows.go
index ff01d90cea..a1bdc8d5d4 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/time_cgo.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/time_notwindows.go
@@ -1,4 +1,4 @@
-//go:build cgo && !windows
+//go:build !windows
 
 package platform
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/time_windows.go b/vendor/github.com/tetratelabs/wazero/internal/platform/time_windows.go
index 58731fc8e7..53bf421a60 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/time_windows.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/time_windows.go
@@ -4,11 +4,13 @@ package platform
 
 import (
 	"math/bits"
+	"syscall"
 	"time"
 	"unsafe"
 )
 
 var (
+	kernel32                   = syscall.NewLazyDLL("kernel32.dll")
 	_QueryPerformanceCounter   = kernel32.NewProc("QueryPerformanceCounter")
 	_QueryPerformanceFrequency = kernel32.NewProc("QueryPerformanceFrequency")
 )
@@ -21,13 +23,11 @@ func init() {
 
 // On Windows, time.Time handled in time package cannot have the nanosecond precision.
 // The reason is that by default, it doesn't use QueryPerformanceCounter[1], but instead, use "interrupt time"
-// which doesn't support nanoseconds precision (though it is a monotonic) [2, 3, 4, 5].
+// which doesn't support nanoseconds precision (though it is a monotonic) [2, 3].
 //
 // [1] https://learn.microsoft.com/en-us/windows/win32/api/profileapi/nf-profileapi-queryperformancecounter
-// [2] https://github.com/golang/go/blob/0cd309e12818f988693bf8e4d9f1453331dcf9f2/src/runtime/sys_windows_amd64.s#L297-L298
-// [3] https://github.com/golang/go/blob/0cd309e12818f988693bf8e4d9f1453331dcf9f2/src/runtime/os_windows.go#L549-L551
-// [4] https://github.com/golang/go/blob/master/src/runtime/time_windows.h#L7-L13
-// [5] http://web.archive.org/web/20210411000829/https://wrkhpi.wordpress.com/2007/08/09/getting-os-information-the-kuser_shared_data-structure/
+// [2] https://github.com/golang/go/blob/go1.24.0/src/runtime/sys_windows_amd64.s#L279-L284
+// [3] https://github.com/golang/go/blob/go1.24.0/src/runtime/time_windows.h#L7-L13
 //
 // Therefore, on Windows, we directly invoke the syscall for QPC instead of time.Now or runtime.nanotime.
 // See https://github.com/golang/go/issues/31160 for example.
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sock/sock_supported.go b/vendor/github.com/tetratelabs/wazero/internal/sock/sock_supported.go
index e317be8320..32f9bc4b6d 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sock/sock_supported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sock/sock_supported.go
@@ -1,4 +1,4 @@
-//go:build !plan9 && !js && !tinygo
+//go:build !(plan9 || js)
 
 package sock
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sock/sock_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/sock/sock_unsupported.go
index 77026754f3..76ec031efa 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sock/sock_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sock/sock_unsupported.go
@@ -1,4 +1,4 @@
-//go:build plan9 || js || tinygo
+//go:build plan9 || js
 
 package sock
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/datasync_linux.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/datasync_linux.go
index 5a8a415c55..792d0db2e9 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/datasync_linux.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/datasync_linux.go
@@ -1,5 +1,3 @@
-//go:build linux && !tinygo
-
 package sysfs
 
 import (
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/datasync_tinygo.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/datasync_tinygo.go
deleted file mode 100644
index e58fc91420..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/datasync_tinygo.go
+++ /dev/null
@@ -1,13 +0,0 @@
-//go:build tinygo
-
-package sysfs
-
-import (
-	"os"
-
-	"github.com/tetratelabs/wazero/experimental/sys"
-)
-
-func datasync(f *os.File) sys.Errno {
-	return sys.ENOSYS
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs.go
index 04384038f4..aba7a65e24 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs.go
@@ -3,6 +3,7 @@ package sysfs
 import (
 	"io/fs"
 	"os"
+	"path"
 
 	experimentalsys "github.com/tetratelabs/wazero/experimental/sys"
 	"github.com/tetratelabs/wazero/internal/platform"
@@ -63,6 +64,48 @@ func (d *dirFS) Mkdir(path string, perm fs.FileMode) (errno experimentalsys.Errn
 	return
 }
 
+// Chmod implements the same method as documented on sys.FS
+func (d *dirFS) Chmod(path string, perm fs.FileMode) experimentalsys.Errno {
+	err := os.Chmod(d.join(path), perm)
+	return experimentalsys.UnwrapOSError(err)
+}
+
+// Rename implements the same method as documented on sys.FS
+func (d *dirFS) Rename(from, to string) experimentalsys.Errno {
+	from, to = d.join(from), d.join(to)
+	return rename(from, to)
+}
+
+// Rmdir implements the same method as documented on sys.FS
+func (d *dirFS) Rmdir(path string) experimentalsys.Errno {
+	return rmdir(d.join(path))
+}
+
+// Unlink implements the same method as documented on sys.FS
+func (d *dirFS) Unlink(path string) (err experimentalsys.Errno) {
+	return unlink(d.join(path))
+}
+
+// Link implements the same method as documented on sys.FS
+func (d *dirFS) Link(oldName, newName string) experimentalsys.Errno {
+	err := os.Link(d.join(oldName), d.join(newName))
+	return experimentalsys.UnwrapOSError(err)
+}
+
+// Symlink implements the same method as documented on sys.FS
+func (d *dirFS) Symlink(oldName, link string) experimentalsys.Errno {
+	// Creating a symlink with an absolute path string fails with a "not permitted" error.
+	// https://github.com/WebAssembly/wasi-filesystem/blob/v0.2.0/path-resolution.md#symlinks
+	if path.IsAbs(oldName) {
+		return experimentalsys.EPERM
+	}
+	// Note: do not resolve `oldName` relative to this dirFS. The link result is always resolved
+	// when dereference the `link` on its usage (e.g. readlink, read, etc).
+	// https://github.com/bytecodealliance/cap-std/blob/v1.0.4/cap-std/src/fs/dir.rs#L404-L409
+	err := os.Symlink(oldName, d.join(link))
+	return experimentalsys.UnwrapOSError(err)
+}
+
 // Readlink implements the same method as documented on sys.FS
 func (d *dirFS) Readlink(path string) (string, experimentalsys.Errno) {
 	// Note: do not use syscall.Readlink as that causes race on Windows.
@@ -74,11 +117,6 @@ func (d *dirFS) Readlink(path string) (string, experimentalsys.Errno) {
 	return platform.ToPosixPath(dst), 0
 }
 
-// Rmdir implements the same method as documented on sys.FS
-func (d *dirFS) Rmdir(path string) experimentalsys.Errno {
-	return rmdir(d.join(path))
-}
-
 // Utimens implements the same method as documented on sys.FS
 func (d *dirFS) Utimens(path string, atim, mtim int64) experimentalsys.Errno {
 	return utimens(d.join(path), atim, mtim)
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs_supported.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs_supported.go
deleted file mode 100644
index a949bd54dc..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs_supported.go
+++ /dev/null
@@ -1,48 +0,0 @@
-//go:build !tinygo
-
-package sysfs
-
-import (
-	"io/fs"
-	"os"
-	"path"
-
-	experimentalsys "github.com/tetratelabs/wazero/experimental/sys"
-)
-
-// Link implements the same method as documented on sys.FS
-func (d *dirFS) Link(oldName, newName string) experimentalsys.Errno {
-	err := os.Link(d.join(oldName), d.join(newName))
-	return experimentalsys.UnwrapOSError(err)
-}
-
-// Unlink implements the same method as documented on sys.FS
-func (d *dirFS) Unlink(path string) (err experimentalsys.Errno) {
-	return unlink(d.join(path))
-}
-
-// Rename implements the same method as documented on sys.FS
-func (d *dirFS) Rename(from, to string) experimentalsys.Errno {
-	from, to = d.join(from), d.join(to)
-	return rename(from, to)
-}
-
-// Chmod implements the same method as documented on sys.FS
-func (d *dirFS) Chmod(path string, perm fs.FileMode) experimentalsys.Errno {
-	err := os.Chmod(d.join(path), perm)
-	return experimentalsys.UnwrapOSError(err)
-}
-
-// Symlink implements the same method as documented on sys.FS
-func (d *dirFS) Symlink(oldName, link string) experimentalsys.Errno {
-	// Creating a symlink with an absolute path string fails with a "not permitted" error.
-	// https://github.com/WebAssembly/wasi-filesystem/blob/v0.2.0/path-resolution.md#symlinks
-	if path.IsAbs(oldName) {
-		return experimentalsys.EPERM
-	}
-	// Note: do not resolve `oldName` relative to this dirFS. The link result is always resolved
-	// when dereference the `link` on its usage (e.g. readlink, read, etc).
-	// https://github.com/bytecodealliance/cap-std/blob/v1.0.4/cap-std/src/fs/dir.rs#L404-L409
-	err := os.Symlink(oldName, d.join(link))
-	return experimentalsys.UnwrapOSError(err)
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs_unsupported.go
deleted file mode 100644
index 98b1a3b841..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/dirfs_unsupported.go
+++ /dev/null
@@ -1,34 +0,0 @@
-//go:build tinygo
-
-package sysfs
-
-import (
-	"io/fs"
-
-	experimentalsys "github.com/tetratelabs/wazero/experimental/sys"
-)
-
-// Link implements the same method as documented on sys.FS
-func (d *dirFS) Link(oldName, newName string) experimentalsys.Errno {
-	return experimentalsys.ENOSYS
-}
-
-// Unlink implements the same method as documented on sys.FS
-func (d *dirFS) Unlink(path string) (err experimentalsys.Errno) {
-	return experimentalsys.ENOSYS
-}
-
-// Rename implements the same method as documented on sys.FS
-func (d *dirFS) Rename(from, to string) experimentalsys.Errno {
-	return experimentalsys.ENOSYS
-}
-
-// Chmod implements the same method as documented on sys.FS
-func (d *dirFS) Chmod(path string, perm fs.FileMode) experimentalsys.Errno {
-	return experimentalsys.ENOSYS
-}
-
-// Symlink implements the same method as documented on sys.FS
-func (d *dirFS) Symlink(oldName, link string) experimentalsys.Errno {
-	return experimentalsys.ENOSYS
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_unix.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_unix.go
index f201e813d9..92eaf35423 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_unix.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_unix.go
@@ -1,4 +1,4 @@
-//go:build unix && !tinygo
+//go:build unix
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_unsupported.go
index a028b94795..d75cb38415 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_unsupported.go
@@ -1,4 +1,4 @@
-//go:build !(unix || windows) || tinygo
+//go:build !(unix || windows)
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_windows.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_windows.go
index 37870ea36f..2048d0db9e 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_windows.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/file_windows.go
@@ -5,26 +5,20 @@ import (
 	"syscall"
 	"unsafe"
 
+	"golang.org/x/sys/windows"
+
 	"github.com/tetratelabs/wazero/experimental/sys"
 )
 
 const (
 	nonBlockingFileReadSupported  = true
 	nonBlockingFileWriteSupported = false
-
-	_ERROR_IO_INCOMPLETE = syscall.Errno(996)
 )
 
-var kernel32 = syscall.NewLazyDLL("kernel32.dll")
-
-// procPeekNamedPipe is the syscall.LazyProc in kernel32 for PeekNamedPipe
 var (
-	// procPeekNamedPipe is the syscall.LazyProc in kernel32 for PeekNamedPipe
+	kernel32 = syscall.NewLazyDLL("kernel32.dll")
+	// procPeekNamedPipe exposes PeekNamedPipe from kernel32.
 	procPeekNamedPipe = kernel32.NewProc("PeekNamedPipe")
-	// procGetOverlappedResult is the syscall.LazyProc in kernel32 for GetOverlappedResult
-	procGetOverlappedResult = kernel32.NewProc("GetOverlappedResult")
-	// procCreateEventW is the syscall.LazyProc in kernel32 for CreateEventW
-	procCreateEventW = kernel32.NewProc("CreateEventW")
 )
 
 // readFd returns ENOSYS on unsupported platforms.
@@ -52,7 +46,7 @@ func readFd(fd uintptr, buf []byte) (int, sys.Errno) {
 	return un, sys.UnwrapOSError(err)
 }
 
-func writeFd(fd uintptr, buf []byte) (int, sys.Errno) {
+func writeFd(uintptr, []byte) (int, sys.Errno) {
 	return -1, sys.ENOSYS
 }
 
@@ -60,7 +54,7 @@ func readSocket(h uintptr, buf []byte) (int, sys.Errno) {
 	// Poll the socket to ensure that we never perform a blocking/overlapped Read.
 	//
 	// When the socket is closed by the remote peer, wsaPoll will return n=1 and
-	// errno=0, and syscall.ReadFile will return n=0 and errno=0 -- which indicates
+	// errno=0, and windows.ReadFile will return n=0 and errno=0 -- which indicates
 	// io.EOF.
 	if n, errno := wsaPoll(
 		[]pollFd{newPollFd(h, _POLLIN, 0)}, 0); !errors.Is(errno, sys.Errno(0)) {
@@ -81,25 +75,25 @@ func readSocket(h uintptr, buf []byte) (int, sys.Errno) {
 	//
 	// We are currently skipping checking if hFile was opened with FILE_FLAG_OVERLAPPED but using
 	// both lpOverlapped and lpNumberOfBytesRead.
-	var overlapped syscall.Overlapped
+	var overlapped windows.Overlapped
 
 	// Create an event to wait on.
-	if hEvent, err := createEventW(nil, true, false, nil); err != 0 {
+	if hEvent, err := windows.CreateEvent(nil, 1, 0, nil); err != nil {
 		return 0, sys.UnwrapOSError(err)
 	} else {
-		overlapped.HEvent = syscall.Handle(hEvent)
+		overlapped.HEvent = windows.Handle(hEvent)
 	}
 
 	var done uint32
-	errno := syscall.ReadFile(syscall.Handle(h), buf, &done, &overlapped)
-	if errors.Is(errno, syscall.ERROR_IO_PENDING) {
-		errno = syscall.CancelIo(syscall.Handle(h))
+	errno := windows.ReadFile(windows.Handle(h), buf, &done, &overlapped)
+	if errors.Is(errno, windows.ERROR_IO_PENDING) {
+		errno = windows.CancelIo(windows.Handle(h))
 		if errno != nil {
 			return 0, sys.UnwrapOSError(errno) // This is a fatal error. CancelIo failed.
 		}
 
-		done, errno = getOverlappedResult(syscall.Handle(h), &overlapped, true) // wait for I/O to complete(cancel or finish). Overwrite done and errno.
-		if errors.Is(errno, syscall.ERROR_OPERATION_ABORTED) {
+		errno = windows.GetOverlappedResult(windows.Handle(h), &overlapped, &done, true) // wait for I/O to complete(cancel or finish). Overwrite done and errno.
+		if errors.Is(errno, windows.ERROR_OPERATION_ABORTED) {
 			return int(done), sys.EAGAIN // This is one of the expected behavior, I/O was cancelled(completed) before finished.
 		}
 	}
@@ -109,9 +103,9 @@ func readSocket(h uintptr, buf []byte) (int, sys.Errno) {
 
 func writeSocket(fd uintptr, buf []byte) (int, sys.Errno) {
 	var done uint32
-	var overlapped syscall.Overlapped
-	errno := syscall.WriteFile(syscall.Handle(fd), buf, &done, &overlapped)
-	if errors.Is(errno, syscall.ERROR_IO_PENDING) {
+	var overlapped windows.Overlapped
+	errno := windows.WriteFile(windows.Handle(fd), buf, &done, &overlapped)
+	if errors.Is(errno, windows.ERROR_IO_PENDING) {
 		errno = syscall.EAGAIN
 	}
 	return int(done), sys.UnwrapOSError(errno)
@@ -137,39 +131,3 @@ func rmdir(path string) sys.Errno {
 	err := syscall.Rmdir(path)
 	return sys.UnwrapOSError(err)
 }
-
-func getOverlappedResult(handle syscall.Handle, overlapped *syscall.Overlapped, wait bool) (uint32, syscall.Errno) {
-	var totalBytesAvail uint32
-	var bwait uintptr
-	if wait {
-		bwait = 0xFFFFFFFF
-	}
-	totalBytesPtr := unsafe.Pointer(&totalBytesAvail)
-	_, _, errno := syscall.SyscallN(
-		procGetOverlappedResult.Addr(),
-		uintptr(handle),                     // [in]  HANDLE       hFile,
-		uintptr(unsafe.Pointer(overlapped)), // [in]  LPOVERLAPPED lpOverlapped,
-		uintptr(totalBytesPtr),              // [out] LPDWORD      lpNumberOfBytesTransferred,
-		bwait)                               // [in]  BOOL         bWait
-	return totalBytesAvail, errno
-}
-
-func createEventW(lpEventAttributes *syscall.SecurityAttributes, bManualReset bool, bInitialState bool, lpName *uint16) (uintptr, syscall.Errno) {
-	var manualReset uintptr
-	var initialState uintptr
-	if bManualReset {
-		manualReset = 1
-	}
-	if bInitialState {
-		initialState = 1
-	}
-	handle, _, errno := syscall.SyscallN(
-		procCreateEventW.Addr(),
-		uintptr(unsafe.Pointer(lpEventAttributes)), // [in]     LPSECURITY_ATTRIBUTES lpEventAttributes,
-		manualReset,                     // [in]     BOOL                  bManualReset,
-		initialState,                    // [in]     BOOL                  bInitialState,
-		uintptr(unsafe.Pointer(lpName)), // [in, opt]LPCWSTR               lpName,
-	)
-
-	return handle, errno
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens.go
index 7f6b110941..7a647bff3a 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens.go
@@ -1,21 +1,13 @@
-//go:build (linux || darwin) && !tinygo
+//go:build linux || darwin
 
 package sysfs
 
 import (
 	"syscall"
-	"unsafe"
 
 	"github.com/tetratelabs/wazero/experimental/sys"
 )
 
-func timesToPtr(times *[2]syscall.Timespec) unsafe.Pointer { //nolint:unused
-	if times != nil {
-		return unsafe.Pointer(&times[0])
-	}
-	return unsafe.Pointer(nil)
-}
-
 func timesToTimespecs(atim int64, mtim int64) (times *[2]syscall.Timespec) {
 	// When both inputs are omitted, there is nothing to change.
 	if atim == sys.UTIME_OMIT && mtim == sys.UTIME_OMIT {
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_darwin.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_darwin.go
index 88e4008f0a..d97fc3531d 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_darwin.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_darwin.go
@@ -2,28 +2,19 @@ package sysfs
 
 import (
 	"syscall"
-	_ "unsafe"
+	"unsafe"
 
 	experimentalsys "github.com/tetratelabs/wazero/experimental/sys"
 )
 
-const (
-	_AT_FDCWD            = -0x2
-	_AT_SYMLINK_NOFOLLOW = 0x0020
-	_UTIME_OMIT          = -2
-)
-
-//go:noescape
-//go:linkname utimensat syscall.utimensat
-func utimensat(dirfd int, path string, times *[2]syscall.Timespec, flags int) error
+const _UTIME_OMIT = -2
 
 func utimens(path string, atim, mtim int64) experimentalsys.Errno {
 	times := timesToTimespecs(atim, mtim)
 	if times == nil {
 		return 0
 	}
-	var flags int
-	return experimentalsys.UnwrapOSError(utimensat(_AT_FDCWD, path, times, flags))
+	return experimentalsys.UnwrapOSError(syscall.UtimesNano(path, times[:]))
 }
 
 func futimens(fd uintptr, atim, mtim int64) experimentalsys.Errno {
@@ -31,7 +22,7 @@ func futimens(fd uintptr, atim, mtim int64) experimentalsys.Errno {
 	if times == nil {
 		return 0
 	}
-	_p0 := timesToPtr(times)
+	_p0 := unsafe.Pointer(&times[0])
 
 	// Warning: futimens only exists since High Sierra (10.13).
 	_, _, e1 := syscall_syscall6(libc_futimens_trampoline_addr, fd, uintptr(_p0), 0, 0, 0, 0)
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_linux.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_linux.go
index db3b1b8b63..a53af60bba 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_linux.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_linux.go
@@ -1,33 +1,22 @@
-//go:build !tinygo
-
 package sysfs
 
 import (
 	"syscall"
 	"unsafe"
-	_ "unsafe"
+
+	"golang.org/x/sys/unix"
 
 	experimentalsys "github.com/tetratelabs/wazero/experimental/sys"
 )
 
-const (
-	_AT_FDCWD   = -0x64
-	_UTIME_OMIT = (1 << 30) - 2
-)
+const _UTIME_OMIT = unix.UTIME_OMIT
 
 func utimens(path string, atim, mtim int64) experimentalsys.Errno {
 	times := timesToTimespecs(atim, mtim)
 	if times == nil {
 		return 0
 	}
-
-	var flags int
-	var _p0 *byte
-	_p0, err := syscall.BytePtrFromString(path)
-	if err == nil {
-		err = utimensat(_AT_FDCWD, uintptr(unsafe.Pointer(_p0)), times, flags)
-	}
-	return experimentalsys.UnwrapOSError(err)
+	return experimentalsys.UnwrapOSError(syscall.UtimesNano(path, times[:]))
 }
 
 // On linux, implement futimens via utimensat with the NUL path.
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_unsupported.go
index 69d5649429..668f3a61e1 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/futimens_unsupported.go
@@ -1,4 +1,4 @@
-//go:build (!windows && !linux && !darwin) || tinygo
+//go:build !(windows || linux || darwin)
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_tinygo.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_tinygo.go
deleted file mode 100644
index 2099231cf1..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_tinygo.go
+++ /dev/null
@@ -1,14 +0,0 @@
-//go:build tinygo
-
-package sysfs
-
-import (
-	"io/fs"
-
-	experimentalsys "github.com/tetratelabs/wazero/experimental/sys"
-	"github.com/tetratelabs/wazero/sys"
-)
-
-func inoFromFileInfo(_ string, info fs.FileInfo) (sys.Inode, experimentalsys.Errno) {
-	return 0, experimentalsys.ENOTSUP
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_unix.go
similarity index 90%
rename from vendor/github.com/tetratelabs/wazero/internal/sysfs/ino.go
rename to vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_unix.go
index 8344cd16ff..969fcd63f8 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_unix.go
@@ -1,4 +1,4 @@
-//go:build !windows && !plan9 && !tinygo
+//go:build unix
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_plan9.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_unsupported.go
similarity index 90%
rename from vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_plan9.go
rename to vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_unsupported.go
index 9c669a475c..64bdebdf3a 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_plan9.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/ino_unsupported.go
@@ -1,3 +1,5 @@
+//go:build !(unix || windows)
+
 package sysfs
 
 import (
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/nonblock_unix.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/nonblock_unix.go
index 4477ee977f..568ded18d9 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/nonblock_unix.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/nonblock_unix.go
@@ -1,4 +1,4 @@
-//go:build !windows && !plan9 && !tinygo
+//go:build unix
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/nonblock_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/nonblock_unsupported.go
index 3e141a7b5e..52caa4e4bb 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/nonblock_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/nonblock_unsupported.go
@@ -1,4 +1,4 @@
-//go:build plan9 || tinygo
+//go:build !(unix || windows)
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_freebsd.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_bsd.go
similarity index 94%
rename from vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_freebsd.go
rename to vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_bsd.go
index 42adaa2140..755f98525a 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_freebsd.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_bsd.go
@@ -1,3 +1,5 @@
+//go:build freebsd || dragonfly
+
 package sysfs
 
 import (
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_sun.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_sun.go
deleted file mode 100644
index bdf7dd84d2..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_sun.go
+++ /dev/null
@@ -1,31 +0,0 @@
-//go:build illumos || solaris
-
-package sysfs
-
-import (
-	"syscall"
-
-	"github.com/tetratelabs/wazero/experimental/sys"
-)
-
-const supportedSyscallOflag = sys.O_DIRECTORY | sys.O_DSYNC | sys.O_NOFOLLOW | sys.O_NONBLOCK | sys.O_RSYNC
-
-func withSyscallOflag(oflag sys.Oflag, flag int) int {
-	if oflag&sys.O_DIRECTORY != 0 {
-		// See https://github.com/illumos/illumos-gate/blob/edd580643f2cf1434e252cd7779e83182ea84945/usr/src/uts/common/sys/fcntl.h#L90
-		flag |= 0x1000000
-	}
-	if oflag&sys.O_DSYNC != 0 {
-		flag |= syscall.O_DSYNC
-	}
-	if oflag&sys.O_NOFOLLOW != 0 {
-		flag |= syscall.O_NOFOLLOW
-	}
-	if oflag&sys.O_NONBLOCK != 0 {
-		flag |= syscall.O_NONBLOCK
-	}
-	if oflag&sys.O_RSYNC != 0 {
-		flag |= syscall.O_RSYNC
-	}
-	return flag
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_linux.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_supported.go
similarity index 92%
rename from vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_linux.go
rename to vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_supported.go
index 3fe2bb6e12..4443696a4e 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_linux.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_supported.go
@@ -1,4 +1,4 @@
-//go:build !tinygo
+//go:build linux || netbsd || openbsd || solaris
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_tinygo.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_tinygo.go
deleted file mode 100644
index ccf6847c07..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_tinygo.go
+++ /dev/null
@@ -1,25 +0,0 @@
-//go:build tinygo
-
-package sysfs
-
-import (
-	"io/fs"
-	"os"
-
-	"github.com/tetratelabs/wazero/experimental/sys"
-)
-
-const supportedSyscallOflag = sys.Oflag(0)
-
-func withSyscallOflag(oflag sys.Oflag, flag int) int {
-	// O_DIRECTORY not defined
-	// O_DSYNC not defined
-	// O_NOFOLLOW not defined
-	// O_NONBLOCK not defined
-	// O_RSYNC not defined
-	return flag
-}
-
-func openFile(path string, oflag sys.Oflag, perm fs.FileMode) (*os.File, sys.Errno) {
-	return nil, sys.ENOSYS
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_notwindows.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_unix.go
similarity index 94%
rename from vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_notwindows.go
rename to vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_unix.go
index 670e359102..9ae1e2bcdb 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_notwindows.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_unix.go
@@ -1,4 +1,4 @@
-//go:build !windows && !tinygo
+//go:build !windows
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_unsupported.go
index 9f7a6d0885..234fa46874 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_unsupported.go
@@ -1,10 +1,8 @@
-//go:build !darwin && !linux && !windows && !illumos && !solaris && !freebsd
+//go:build !(freebsd || dragonfly || darwin || linux || netbsd || openbsd || solaris || windows)
 
 package sysfs
 
-import (
-	"github.com/tetratelabs/wazero/experimental/sys"
-)
+import "github.com/tetratelabs/wazero/experimental/sys"
 
 const supportedSyscallOflag = sys.Oflag(0)
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_windows.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_windows.go
index 4788517297..f5a3710b05 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_windows.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/open_file_windows.go
@@ -57,7 +57,7 @@ func openFile(path string, oflag sys.Oflag, perm fs.FileMode) (*os.File, sys.Err
 
 const supportedSyscallOflag = sys.O_NONBLOCK
 
-// Map to synthetic values here https://github.com/golang/go/blob/go1.20/src/syscall/types_windows.go#L34-L48
+// Map to synthetic values here https://github.com/golang/go/blob/go1.24.0/src/syscall/types_windows.go#L35-L52
 func withSyscallOflag(oflag sys.Oflag, flag int) int {
 	// O_DIRECTORY not defined in windows
 	// O_DSYNC not defined in windows
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/osfile.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/osfile.go
index 32d6ebb371..981f7139d0 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/osfile.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/osfile.go
@@ -89,7 +89,7 @@ func (f *osFile) SetAppend(enable bool) (errno experimentalsys.Errno) {
 	}
 
 	// appendMode cannot be changed later, so we have to re-open the file
-	// https://github.com/golang/go/blob/go1.23/src/os/file_unix.go#L60
+	// https://github.com/golang/go/blob/go1.24.0/src/os/file_unix.go#L65
 	return fileError(f, f.closed, f.reopen())
 }
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll.go
index a2e1103e01..f5c9829529 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll.go
@@ -1,4 +1,4 @@
-//go:build windows || (linux && !tinygo) || darwin
+//go:build windows || linux || darwin
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll_linux.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll_linux.go
index 49bf4fd06d..dab7bb2cab 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll_linux.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll_linux.go
@@ -1,5 +1,3 @@
-//go:build !tinygo
-
 package sysfs
 
 import (
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll_unsupported.go
index 2301a067ea..53d09d8af6 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/poll_unsupported.go
@@ -1,4 +1,4 @@
-//go:build !(linux || darwin || windows) || tinygo
+//go:build !(linux || darwin || windows)
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/rename.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/rename_unix.go
similarity index 84%
rename from vendor/github.com/tetratelabs/wazero/internal/sysfs/rename.go
rename to vendor/github.com/tetratelabs/wazero/internal/sysfs/rename_unix.go
index 37c53571d3..d3d75fc580 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/rename.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/rename_unix.go
@@ -1,4 +1,4 @@
-//go:build !windows && !plan9 && !tinygo
+//go:build unix
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/rename_plan9.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/rename_unsupported.go
similarity index 86%
rename from vendor/github.com/tetratelabs/wazero/internal/sysfs/rename_plan9.go
rename to vendor/github.com/tetratelabs/wazero/internal/sysfs/rename_unsupported.go
index 474cc7595e..49c8360eb1 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/rename_plan9.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/rename_unsupported.go
@@ -1,3 +1,5 @@
+//go:build !(unix || windows)
+
 package sysfs
 
 import (
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_supported.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_supported.go
index 6c976fb868..165dcf2929 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_supported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_supported.go
@@ -1,4 +1,4 @@
-//go:build (linux || darwin || windows) && !tinygo
+//go:build linux || darwin || windows
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_unix.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_unix.go
index 99ef018a4e..0f570f37b7 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_unix.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_unix.go
@@ -1,4 +1,4 @@
-//go:build (linux || darwin) && !tinygo
+//go:build linux || darwin
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_unsupported.go
index 8c27fed7fd..cd53b070a4 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_unsupported.go
@@ -1,4 +1,4 @@
-//go:build (!linux && !darwin && !windows) || tinygo
+//go:build !(linux || darwin || windows)
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_windows.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_windows.go
index 703df42fcc..b1e04af038 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_windows.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/sock_windows.go
@@ -7,6 +7,8 @@ import (
 	"syscall"
 	"unsafe"
 
+	"golang.org/x/sys/windows"
+
 	"github.com/tetratelabs/wazero/experimental/sys"
 	"github.com/tetratelabs/wazero/internal/fsapi"
 	socketapi "github.com/tetratelabs/wazero/internal/sock"
@@ -14,8 +16,7 @@ import (
 
 const (
 	// MSG_PEEK is the flag PEEK for syscall.Recvfrom on Windows.
-	// This constant is not exported on this platform.
-	MSG_PEEK = 0x2
+	MSG_PEEK = windows.MSG_PEEK
 	// _FIONBIO is the flag to set the O_NONBLOCK flag on socket handles using ioctlsocket.
 	_FIONBIO = 0x8004667e
 )
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_bsd.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_bsd.go
deleted file mode 100644
index 254e204cd9..0000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_bsd.go
+++ /dev/null
@@ -1,37 +0,0 @@
-//go:build (amd64 || arm64) && (darwin || freebsd)
-
-package sysfs
-
-import (
-	"io/fs"
-	"os"
-
-	experimentalsys "github.com/tetratelabs/wazero/experimental/sys"
-	"github.com/tetratelabs/wazero/sys"
-)
-
-// dirNlinkIncludesDot is true because even though os.File filters out dot
-// entries, the underlying syscall.Stat includes them.
-//
-// Note: this is only used in tests
-const dirNlinkIncludesDot = true
-
-func lstat(path string) (sys.Stat_t, experimentalsys.Errno) {
-	if info, err := os.Lstat(path); err != nil {
-		return sys.Stat_t{}, experimentalsys.UnwrapOSError(err)
-	} else {
-		return sys.NewStat_t(info), 0
-	}
-}
-
-func stat(path string) (sys.Stat_t, experimentalsys.Errno) {
-	if info, err := os.Stat(path); err != nil {
-		return sys.Stat_t{}, experimentalsys.UnwrapOSError(err)
-	} else {
-		return sys.NewStat_t(info), 0
-	}
-}
-
-func statFile(f fs.File) (sys.Stat_t, experimentalsys.Errno) {
-	return defaultStatFile(f)
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_linux.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_supported.go
similarity index 92%
rename from vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_linux.go
rename to vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_supported.go
index 4ca5c3b865..93b63906dc 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_linux.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_supported.go
@@ -1,4 +1,4 @@
-//go:build (amd64 || arm64 || ppc64le || riscv64 || s390x) && linux
+//go:build linux || darwin || freebsd || netbsd || openbsd || dragonfly || solaris
 
 // Note: This expression is not the same as compiler support, even if it looks
 // similar. Platform functions here are used in interpreter mode as well.
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_unsupported.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_unsupported.go
index b966c43330..d73027fab1 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_unsupported.go
@@ -1,4 +1,4 @@
-//go:build (!((amd64 || arm64 || ppc64le || riscv64 || s390x) && linux) && !((amd64 || arm64) && (darwin || freebsd)) && !((amd64 || arm64) && windows)) || js
+//go:build !(linux || darwin || freebsd || netbsd || openbsd || dragonfly || solaris || windows)
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_windows.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_windows.go
index 4456dd7828..23e76a9869 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_windows.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/stat_windows.go
@@ -1,5 +1,3 @@
-//go:build (amd64 || arm64) && windows
-
 package sysfs
 
 import (
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink_unix.go
similarity index 86%
rename from vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink.go
rename to vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink_unix.go
index e3f0510082..14e4a9f720 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink_unix.go
@@ -1,4 +1,4 @@
-//go:build !windows && !plan9 && !tinygo
+//go:build unix
 
 package sysfs
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink_plan9.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink_unsupported.go
similarity index 70%
rename from vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink_plan9.go
rename to vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink_unsupported.go
index 16ed06ab2a..cc36502e81 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink_plan9.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/unlink_unsupported.go
@@ -1,12 +1,14 @@
+//go:build !(unix || windows)
+
 package sysfs
 
 import (
-	"syscall"
+	"os"
 
 	"github.com/tetratelabs/wazero/experimental/sys"
 )
 
 func unlink(name string) sys.Errno {
-	err := syscall.Remove(name)
+	err := os.Remove(name)
 	return sys.UnwrapOSError(err)
 }
diff --git a/vendor/github.com/tetratelabs/wazero/internal/wasm/binary/decoder.go b/vendor/github.com/tetratelabs/wazero/internal/wasm/binary/decoder.go
index c4191dae95..8eca1d1498 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/wasm/binary/decoder.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/wasm/binary/decoder.go
@@ -38,6 +38,7 @@ func DecodeModule(
 	memSizer := newMemorySizer(memoryLimitPages, memoryCapacityFromMax)
 
 	m := &wasm.Module{}
+	var lastSectionID wasm.SectionID
 	var info, line, str, abbrev, ranges []byte // For DWARF Data.
 	for {
 		// TODO: except custom sections, all others are required to be in order, but we aren't checking yet.
@@ -54,6 +55,12 @@ func DecodeModule(
 			return nil, fmt.Errorf("get size of section %s: %v", wasm.SectionIDName(sectionID), err)
 		}
 
+		var ok bool
+		lastSectionID, ok = checkSectionOrder(sectionID, lastSectionID)
+		if !ok {
+			return nil, errors.New("invalid section order")
+		}
+
 		sectionContentStart := r.Len()
 		switch sectionID {
 		case wasm.SectionIDCustom:
@@ -123,9 +130,6 @@ func DecodeModule(
 		case wasm.SectionIDExport:
 			m.ExportSection, m.Exports, err = decodeExportSection(r)
 		case wasm.SectionIDStart:
-			if m.StartSection != nil {
-				return nil, errors.New("multiple start sections are invalid")
-			}
 			m.StartSection, err = decodeStartSection(r)
 		case wasm.SectionIDElement:
 			m.ElementSection, err = decodeElementSection(r, enabledFeatures)
@@ -164,6 +168,34 @@ func DecodeModule(
 	return m, nil
 }
 
+func checkSectionOrder(current, previous wasm.SectionID) (byte, bool) {
+	// https://webassembly.github.io/spec/core/binary/modules.html#binary-module
+
+	// Custom sections can show up anywhere.
+	if current == wasm.SectionIDCustom {
+		return previous, true
+	}
+
+	// DataCount was introduced in Wasm 2.0,
+	// and it's the maximum we support so far.
+	// It must come after Element and before Code.
+	if current > wasm.SectionIDDataCount {
+		return current, false
+	}
+	if current == wasm.SectionIDDataCount {
+		return current, previous <= wasm.SectionIDElement
+	}
+	if previous == wasm.SectionIDDataCount {
+		return current, current >= wasm.SectionIDCode
+	}
+
+	// Tag will be introduced in Wasm 3.0.
+	// It must come after Memory and before Global.
+
+	// Otherwise, strictly increasing order.
+	return current, current > previous
+}
+
 // memorySizer derives min, capacity and max pages from decoded wasm.
 type memorySizer func(minPages uint32, maxPages *uint32) (min uint32, capacity uint32, max uint32)
 
diff --git a/vendor/github.com/tetratelabs/wazero/internal/wasm/func_validation.go b/vendor/github.com/tetratelabs/wazero/internal/wasm/func_validation.go
index 96d061a7bc..b0e7f7cfbc 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/wasm/func_validation.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/wasm/func_validation.go
@@ -40,6 +40,11 @@ func readMemArg(pc uint64, body []byte) (align, offset uint32, read uint64, err
 		err = fmt.Errorf("read memory align: %v", err)
 		return
 	}
+	if align >= 32 {
+		// Prevent 1<<align uint32 overflow.
+		err = fmt.Errorf("invalid memory alignment")
+		return
+	}
 	read += num
 
 	offset, num, err = leb128.LoadUint32(body[pc+num:])
diff --git a/vendor/github.com/tetratelabs/wazero/internal/wasm/memory.go b/vendor/github.com/tetratelabs/wazero/internal/wasm/memory.go
index 9a1f0c6d1d..275530558c 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/wasm/memory.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/wasm/memory.go
@@ -87,8 +87,7 @@ func NewMemoryInstance(memSec *Memory, allocator experimental.MemoryAllocator, m
 		//
 		// Also, allocating Max here isn't harmful as the Go runtime uses mmap for large allocations, therefore,
 		// the memory buffer allocation here is virtual and doesn't consume physical memory until it's used.
-		// 	* https://github.com/golang/go/blob/8121604559035734c9677d5281bbdac8b1c17a1e/src/runtime/malloc.go#L1059
-		//	* https://github.com/golang/go/blob/8121604559035734c9677d5281bbdac8b1c17a1e/src/runtime/malloc.go#L1165
+		// 	* https://github.com/golang/go/blob/go1.24.0/src/runtime/malloc.go#L1059
 		buffer = make([]byte, minBytes, maxBytes)
 	} else {
 		buffer = make([]byte, minBytes, capBytes)
diff --git a/vendor/github.com/tetratelabs/wazero/internal/wasm/store.go b/vendor/github.com/tetratelabs/wazero/internal/wasm/store.go
index c7909c67c1..ee5e8678e8 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/wasm/store.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/wasm/store.go
@@ -456,7 +456,7 @@ func (m *ModuleInstance) resolveImports(ctx context.Context, module *Module) (er
 					return
 				}
 
-				if expected.Min > importedTable.Min {
+				if uint64(expected.Min) > uint64(len(importedTable.References)) {
 					err = errorMinSizeMismatch(i, expected.Min, importedTable.Min)
 					return
 				}
diff --git a/vendor/github.com/tetratelabs/wazero/sys/stat_bsd.go b/vendor/github.com/tetratelabs/wazero/sys/stat_bsd.go
index 3bf9b5d143..bd392aaea1 100644
--- a/vendor/github.com/tetratelabs/wazero/sys/stat_bsd.go
+++ b/vendor/github.com/tetratelabs/wazero/sys/stat_bsd.go
@@ -1,4 +1,4 @@
-//go:build (amd64 || arm64) && (darwin || freebsd)
+//go:build darwin || freebsd || netbsd
 
 package sys
 
@@ -13,16 +13,16 @@ func statFromFileInfo(info fs.FileInfo) Stat_t {
 	if d, ok := info.Sys().(*syscall.Stat_t); ok {
 		st := Stat_t{}
 		st.Dev = uint64(d.Dev)
-		st.Ino = d.Ino
+		st.Ino = Inode(d.Ino)
 		st.Mode = info.Mode()
 		st.Nlink = uint64(d.Nlink)
-		st.Size = d.Size
+		st.Size = int64(d.Size)
 		atime := d.Atimespec
-		st.Atim = atime.Sec*1e9 + atime.Nsec
+		st.Atim = EpochNanos(atime.Sec)*1e9 + EpochNanos(atime.Nsec)
 		mtime := d.Mtimespec
-		st.Mtim = mtime.Sec*1e9 + mtime.Nsec
+		st.Mtim = EpochNanos(mtime.Sec)*1e9 + EpochNanos(mtime.Nsec)
 		ctime := d.Ctimespec
-		st.Ctim = ctime.Sec*1e9 + ctime.Nsec
+		st.Ctim = EpochNanos(ctime.Sec)*1e9 + EpochNanos(ctime.Nsec)
 		return st
 	}
 	return defaultStatFromFileInfo(info)
diff --git a/vendor/github.com/tetratelabs/wazero/sys/stat_linux.go b/vendor/github.com/tetratelabs/wazero/sys/stat_linux.go
deleted file mode 100644
index dded363470..0000000000
--- a/vendor/github.com/tetratelabs/wazero/sys/stat_linux.go
+++ /dev/null
@@ -1,32 +0,0 @@
-//go:build (amd64 || arm64 || ppc64le || riscv64 || s390x) && linux
-
-// Note: This expression is not the same as compiler support, even if it looks
-// similar. Platform functions here are used in interpreter mode as well.
-
-package sys
-
-import (
-	"io/fs"
-	"syscall"
-)
-
-const sysParseable = true
-
-func statFromFileInfo(info fs.FileInfo) Stat_t {
-	if d, ok := info.Sys().(*syscall.Stat_t); ok {
-		st := Stat_t{}
-		st.Dev = uint64(d.Dev)
-		st.Ino = uint64(d.Ino)
-		st.Mode = info.Mode()
-		st.Nlink = uint64(d.Nlink)
-		st.Size = d.Size
-		atime := d.Atim
-		st.Atim = atime.Sec*1e9 + atime.Nsec
-		mtime := d.Mtim
-		st.Mtim = mtime.Sec*1e9 + mtime.Nsec
-		ctime := d.Ctim
-		st.Ctim = ctime.Sec*1e9 + ctime.Nsec
-		return st
-	}
-	return defaultStatFromFileInfo(info)
-}
diff --git a/vendor/github.com/tetratelabs/wazero/sys/stat_posix.go b/vendor/github.com/tetratelabs/wazero/sys/stat_posix.go
new file mode 100644
index 0000000000..0e0f47e5ab
--- /dev/null
+++ b/vendor/github.com/tetratelabs/wazero/sys/stat_posix.go
@@ -0,0 +1,29 @@
+//go:build linux || openbsd || dragonfly || solaris
+
+package sys
+
+import (
+	"io/fs"
+	"syscall"
+)
+
+const sysParseable = true
+
+func statFromFileInfo(info fs.FileInfo) Stat_t {
+	if d, ok := info.Sys().(*syscall.Stat_t); ok {
+		st := Stat_t{}
+		st.Dev = uint64(d.Dev)
+		st.Ino = Inode(d.Ino)
+		st.Mode = info.Mode()
+		st.Nlink = uint64(d.Nlink)
+		st.Size = int64(d.Size)
+		atime := d.Atim
+		st.Atim = EpochNanos(atime.Sec)*1e9 + EpochNanos(atime.Nsec)
+		mtime := d.Mtim
+		st.Mtim = EpochNanos(mtime.Sec)*1e9 + EpochNanos(mtime.Nsec)
+		ctime := d.Ctim
+		st.Ctim = EpochNanos(ctime.Sec)*1e9 + EpochNanos(ctime.Nsec)
+		return st
+	}
+	return defaultStatFromFileInfo(info)
+}
diff --git a/vendor/github.com/tetratelabs/wazero/sys/stat_unsupported.go b/vendor/github.com/tetratelabs/wazero/sys/stat_unsupported.go
index cc800b2e3d..6fb9b80961 100644
--- a/vendor/github.com/tetratelabs/wazero/sys/stat_unsupported.go
+++ b/vendor/github.com/tetratelabs/wazero/sys/stat_unsupported.go
@@ -1,4 +1,4 @@
-//go:build (!((amd64 || arm64 || ppc64le || riscv64 || s390x) && linux) && !((amd64 || arm64) && (darwin || freebsd)) && !((amd64 || arm64) && windows)) || js
+//go:build !(linux || darwin || freebsd || netbsd || openbsd || dragonfly || solaris || windows)
 
 package sys
 
diff --git a/vendor/github.com/tetratelabs/wazero/sys/stat_windows.go b/vendor/github.com/tetratelabs/wazero/sys/stat_windows.go
index 1a7070f48a..91450ffdf5 100644
--- a/vendor/github.com/tetratelabs/wazero/sys/stat_windows.go
+++ b/vendor/github.com/tetratelabs/wazero/sys/stat_windows.go
@@ -1,5 +1,3 @@
-//go:build (amd64 || arm64) && windows
-
 package sys
 
 import (
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 500c855f1f..b489583c97 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1326,8 +1326,8 @@ github.com/stretchr/testify/assert
 github.com/stretchr/testify/assert/yaml
 github.com/stretchr/testify/require
 github.com/stretchr/testify/suite
-# github.com/tetratelabs/wazero v1.10.1
-## explicit; go 1.23.0
+# github.com/tetratelabs/wazero v1.11.0
+## explicit; go 1.24.0
 github.com/tetratelabs/wazero
 github.com/tetratelabs/wazero/api
 github.com/tetratelabs/wazero/experimental