Upgrade wazero to v1.12.0 and harden WASM compilation cache shutdown

[Copilot]

This updates the gateway’s in-process WASM runtime from wazero v1.11.0 to v1.12.0 and re-verifies the trap-detection assumption called out in the guard code. It also closes a small lifecycle gap in the shared compilation cache by clearing the global reference before close.

• Dependency update

  • Bumps github.com/tetratelabs/wazero from v1.11.0 to v1.12.0
  • Refreshes module checksums in go.sum

• Compilation cache shutdown safety

  • Updates CloseGlobalCompilationCache to set globalCompilationCache = nil while holding the mutex, before closing the cache
  • Prevents a stale global reference from remaining reachable across repeated or unusual shutdown paths

• Trap handling verification

  • Updates the version-specific comment in wasm_parse.go to reflect verification against wazero v1.12.0
  • Adds a regression test that triggers a real WASM trap and asserts the emitted error still contains the wasm error: prefix used by isWasmTrap

• Lifecycle regression coverage

  • Adds focused tests for global cache close behavior:
    • shared cache is nilled on close
    • repeated close is effectively idempotent
    • nil state is preserved even when cache close returns an error

func CloseGlobalCompilationCache(ctx context.Context) error {
	globalCompilationCacheMu.Lock()
	cache := globalCompilationCache
	globalCompilationCache = nil
	globalCompilationCacheMu.Unlock()

	if cache == nil {
		return nil
	}
	return cache.Close(ctx)
}

[Copilot]

Pull request overview

This PR upgrades the in-process WASM runtime dependency (wazero) to v1.12.0 and tightens the lifecycle behavior of the shared WASM compilation cache by clearing the global reference before closing. It also adds regression tests to ensure the trap-detection heuristic ("wasm error:" prefix) and cache shutdown behavior remain stable across the upgrade.

Changes:

• Bump github.com/tetratelabs/wazero from v1.11.0 → v1.12.0 (and refresh go.sum).
• Harden CloseGlobalCompilationCache by setting globalCompilationCache = nil under lock before closing.
• Add targeted tests for (a) real wazero trap prefix behavior and (b) global cache close idempotence / nil-on-error semantics; update version-verified comment.

Show a summary per file

File	Description
internal/guard/wasm.go	Clears the global compilation cache reference under mutex prior to closing it.
internal/guard/wasm_test.go	Adds trap-prefix regression coverage and new shutdown/idempotence tests for the global compilation cache.
internal/guard/wasm_parse.go	Updates the version-verified comment for the "wasm error:" trap fallback to v1.12.0.
go.mod	Updates wazero dependency version to v1.12.0.
go.sum	Updates module checksums for the wazero version bump.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/5 changed files
• Comments generated: 1

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Updated in commit 6ae9005. I aligned the CloseGlobalCompilationCache doc comment with current behavior: repeated calls are now documented as no-ops after the global cache is cleared, while retaining the warning that concurrent use and closing while guards are active are unsafe.