diff --git a/go.mod b/go.mod
index 1dff4fe44..8fd42c171 100644
--- a/go.mod
+++ b/go.mod
@@ -61,7 +61,7 @@ require (
 	github.com/tdewolff/minify/v2 v2.21.3
 	github.com/technologize/otel-go-contrib v1.1.1
 	github.com/temoto/robotstxt v1.1.2
-	github.com/tetratelabs/wazero v1.8.2
+	github.com/tetratelabs/wazero v1.9.0
 	github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80
 	github.com/ulule/limiter/v3 v3.11.2
 	github.com/uptrace/bun v1.2.9
diff --git a/go.sum b/go.sum
index d1713cceb..c83ba4136 100644
--- a/go.sum
+++ b/go.sum
@@ -542,8 +542,8 @@ github.com/technologize/otel-go-contrib v1.1.1 h1:wZH9aSPNWZWIkEh3vfaKfMb15AJ80j
 github.com/technologize/otel-go-contrib v1.1.1/go.mod h1:dCN/wj2WyUO8aFZFdIN+6tfJHImjTML/8r2YVYAy3So=
 github.com/temoto/robotstxt v1.1.2 h1:W2pOjSJ6SWvldyEuiFXNxz3xZ8aiWX5LbfDiOFd7Fxg=
 github.com/temoto/robotstxt v1.1.2/go.mod h1:+1AmkuG3IYkh1kv0d2qEB9Le88ehNO0zwOr3ujewlOo=
-github.com/tetratelabs/wazero v1.8.2 h1:yIgLR/b2bN31bjxwXHD8a3d+BogigR952csSDdLYEv4=
-github.com/tetratelabs/wazero v1.8.2/go.mod h1:yAI0XTsMBhREkM/YDAK/zNou3GoiAce1P6+rp/wQhjs=
+github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I=
+github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM=
 github.com/tidwall/btree v0.0.0-20191029221954-400434d76274 h1:G6Z6HvJuPjG6XfNGi/feOATzeJrfgTNJY+rGrHbA04E=
 github.com/tidwall/btree v0.0.0-20191029221954-400434d76274/go.mod h1:huei1BkDWJ3/sLXmO+bsCNELL+Bp2Kks9OLyQFkzvA8=
 github.com/tidwall/buntdb v1.1.2 h1:noCrqQXL9EKMtcdwJcmuVKSEjqu1ua99RHHgbLTEHRo=
diff --git a/vendor/github.com/tetratelabs/wazero/.gitignore b/vendor/github.com/tetratelabs/wazero/.gitignore
index 6a14146d4..e9dd94b3e 100644
--- a/vendor/github.com/tetratelabs/wazero/.gitignore
+++ b/vendor/github.com/tetratelabs/wazero/.gitignore
@@ -36,6 +36,7 @@ package-lock.json
 .vagrant
 
 zig-cache/
+.zig-cache/
 zig-out/
 
 .DS_Store
diff --git a/vendor/github.com/tetratelabs/wazero/Makefile b/vendor/github.com/tetratelabs/wazero/Makefile
index 17e264e01..b33fdd4ed 100644
--- a/vendor/github.com/tetratelabs/wazero/Makefile
+++ b/vendor/github.com/tetratelabs/wazero/Makefile
@@ -1,7 +1,7 @@
 
 gofumpt       := mvdan.cc/gofumpt@v0.6.0
 gosimports    := github.com/rinchsan/gosimports/cmd/gosimports@v0.3.8
-golangci_lint := github.com/golangci/golangci-lint/cmd/golangci-lint@v1.60.0
+golangci_lint := github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.5
 asmfmt        := github.com/klauspost/asmfmt/cmd/asmfmt@v1.3.2
 # sync this with netlify.toml!
 hugo          := github.com/gohugoio/hugo@v0.115.2
@@ -36,14 +36,24 @@ build.examples.as:
 build.examples.zig: examples/allocation/zig/testdata/greet.wasm imports/wasi_snapshot_preview1/example/testdata/zig/cat.wasm imports/wasi_snapshot_preview1/testdata/zig/wasi.wasm
 	@cd internal/testing/dwarftestdata/testdata/zig; zig build; mv zig-out/*/main.wasm ./ # Need DWARF custom sections.
 
-tinygo_sources := examples/basic/testdata/add.go examples/allocation/tinygo/testdata/greet.go examples/cli/testdata/cli.go imports/wasi_snapshot_preview1/example/testdata/tinygo/cat.go imports/wasi_snapshot_preview1/testdata/tinygo/wasi.go cmd/wazero/testdata/cat/cat.go
-.PHONY: build.examples.tinygo
-build.examples.tinygo: $(tinygo_sources)
+tinygo_reactor_sources_reactor := examples/basic/testdata/add.go examples/allocation/tinygo/testdata/greet.go
+.PHONY: build.examples.tinygo_reactor
+build.examples.tinygo_reactor: $(tinygo_sources_reactor)
 	@for f in $^; do \
-	    tinygo build -o $$(echo $$f | sed -e 's/\.go/\.wasm/') -scheduler=none --no-debug --target=wasi $$f; \
+	    tinygo build -o $$(echo $$f | sed -e 's/\.go/\.wasm/') -scheduler=none --no-debug --target=wasip1 -buildmode=c-shared $$f; \
+	done
+
+tinygo_sources_clis := examples/cli/testdata/cli.go imports/wasi_snapshot_preview1/example/testdata/tinygo/cat.go imports/wasi_snapshot_preview1/testdata/tinygo/wasi.go cmd/wazero/testdata/cat/cat.go
+.PHONY: build.examples.tinygo_clis
+build.examples.tinygo_clis: $(tinygo_sources_clis)
+	@for f in $^; do \
+	    tinygo build -o $$(echo $$f | sed -e 's/\.go/\.wasm/') -scheduler=none --no-debug --target=wasip1 $$f; \
 	done
 	@mv cmd/wazero/testdata/cat/cat.wasm cmd/wazero/testdata/cat/cat-tinygo.wasm
 
+.PHONY: build.examples.tinygo
+build.examples.tinygo: build.examples.tinygo_reactor build.examples.tinygo_clis
+
 # We use zig to build C as it is easy to install and embeds a copy of zig-cc.
 # Note: Don't use "-Oz" as that breaks our wasi sock example.
 c_sources := imports/wasi_snapshot_preview1/example/testdata/zig-cc/cat.c imports/wasi_snapshot_preview1/testdata/zig-cc/wasi.c internal/testing/dwarftestdata/testdata/zig-cc/main.c
@@ -80,21 +90,21 @@ build.examples.emscripten: $(emscripten_sources)
 	done
 
 %/greet.wasm : cargo_target := wasm32-unknown-unknown
-%/cat.wasm : cargo_target := wasm32-wasi
-%/wasi.wasm : cargo_target := wasm32-wasi
+%/cat.wasm : cargo_target := wasm32-wasip1
+%/wasi.wasm : cargo_target := wasm32-wasip1
 
 .PHONY: build.examples.rust
 build.examples.rust: examples/allocation/rust/testdata/greet.wasm imports/wasi_snapshot_preview1/example/testdata/cargo-wasi/cat.wasm imports/wasi_snapshot_preview1/testdata/cargo-wasi/wasi.wasm internal/testing/dwarftestdata/testdata/rust/main.wasm.xz
 
 # Normally, we build release because it is smaller. Testing dwarf requires the debug build.
 internal/testing/dwarftestdata/testdata/rust/main.wasm.xz:
-	cd $(@D) && cargo wasi build
-	mv $(@D)/target/wasm32-wasi/debug/main.wasm $(@D)
+	cd $(@D) && cargo build --target wasm32-wasip1
+	mv $(@D)/target/wasm32-wasip1/debug/main.wasm $(@D)
 	cd $(@D) && xz -k -f ./main.wasm # Rust's DWARF section is huge, so compress it.
 
-# Builds rust using cargo normally, or cargo-wasi.
+# Builds rust using cargo normally
 %.wasm: %.rs
-	@(cd $(@D); cargo $(if $(findstring wasi,$(cargo_target)),wasi build,build --target $(cargo_target)) --release)
+	@(cd $(@D); cargo build --target $(cargo_target) --release)
 	@mv $(@D)/target/$(cargo_target)/release/$(@F) $(@D)
 
 spectest_base_dir := internal/integration_test/spectest
diff --git a/vendor/github.com/tetratelabs/wazero/config.go b/vendor/github.com/tetratelabs/wazero/config.go
index ea7b84f44..9fa2bada8 100644
--- a/vendor/github.com/tetratelabs/wazero/config.go
+++ b/vendor/github.com/tetratelabs/wazero/config.go
@@ -12,8 +12,6 @@ import (
 
 	"github.com/tetratelabs/wazero/api"
 	experimentalsys "github.com/tetratelabs/wazero/experimental/sys"
-	"github.com/tetratelabs/wazero/internal/engine/interpreter"
-	"github.com/tetratelabs/wazero/internal/engine/wazevo"
 	"github.com/tetratelabs/wazero/internal/filecache"
 	"github.com/tetratelabs/wazero/internal/internalapi"
 	"github.com/tetratelabs/wazero/internal/platform"
@@ -175,7 +173,9 @@ type RuntimeConfig interface {
 // NewRuntimeConfig returns a RuntimeConfig using the compiler if it is supported in this environment,
 // or the interpreter otherwise.
 func NewRuntimeConfig() RuntimeConfig {
-	return newRuntimeConfig()
+	ret := engineLessConfig.clone()
+	ret.engineKind = engineKindAuto
+	return ret
 }
 
 type newEngine func(context.Context, api.CoreFeatures, filecache.Cache) wasm.Engine
@@ -203,7 +203,8 @@ var engineLessConfig = &runtimeConfig{
 type engineKind int
 
 const (
-	engineKindCompiler engineKind = iota
+	engineKindAuto engineKind = iota - 1
+	engineKindCompiler
 	engineKindInterpreter
 	engineKindCount
 )
@@ -234,7 +235,6 @@ const (
 func NewRuntimeConfigCompiler() RuntimeConfig {
 	ret := engineLessConfig.clone()
 	ret.engineKind = engineKindCompiler
-	ret.newEngine = wazevo.NewEngine
 	return ret
 }
 
@@ -242,7 +242,6 @@ func NewRuntimeConfigCompiler() RuntimeConfig {
 func NewRuntimeConfigInterpreter() RuntimeConfig {
 	ret := engineLessConfig.clone()
 	ret.engineKind = engineKindInterpreter
-	ret.newEngine = interpreter.NewEngine
 	return ret
 }
 
diff --git a/vendor/github.com/tetratelabs/wazero/config_supported.go b/vendor/github.com/tetratelabs/wazero/config_supported.go
deleted file mode 100644
index 214c2bb8c..000000000
--- a/vendor/github.com/tetratelabs/wazero/config_supported.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// Note: The build constraints here are about the compiler, which is more
-// narrow than the architectures supported by the assembler.
-//
-// Constraints here must match platform.CompilerSupported.
-//
-// Meanwhile, users who know their runtime.GOOS can operate with the compiler
-// may choose to use NewRuntimeConfigCompiler explicitly.
-//go:build (amd64 || arm64) && (linux || darwin || freebsd || netbsd || dragonfly || solaris || windows)
-
-package wazero
-
-import "github.com/tetratelabs/wazero/internal/platform"
-
-func newRuntimeConfig() RuntimeConfig {
-	if platform.CompilerSupported() {
-		return NewRuntimeConfigCompiler()
-	}
-	return NewRuntimeConfigInterpreter()
-}
diff --git a/vendor/github.com/tetratelabs/wazero/config_unsupported.go b/vendor/github.com/tetratelabs/wazero/config_unsupported.go
deleted file mode 100644
index be56a4bc2..000000000
--- a/vendor/github.com/tetratelabs/wazero/config_unsupported.go
+++ /dev/null
@@ -1,8 +0,0 @@
-// This is the opposite constraint of config_supported.go
-//go:build !(amd64 || arm64) || !(linux || darwin || freebsd || netbsd || dragonfly || solaris || windows)
-
-package wazero
-
-func newRuntimeConfig() RuntimeConfig {
-	return NewRuntimeConfigInterpreter()
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine.go b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine.go
index 7c27c92af..fd0d69ca9 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/engine/wazevo/backend/isa/amd64/machine.go
@@ -1918,6 +1918,9 @@ func (m *machine) lowerCall(si *ssa.Instruction) {
 		for i := regalloc.RealReg(0); i < 16; i++ {
 			m.insert(m.allocateInstr().asDefineUninitializedReg(regInfo.RealRegToVReg[xmm0+i]))
 		}
+		// Since Go 1.24 it may also use DX, which is not reserved for the function call's 3 args.
+		// https://github.com/golang/go/blob/go1.24.0/src/runtime/memmove_amd64.s#L123
+		m.insert(m.allocateInstr().asDefineUninitializedReg(regInfo.RealRegToVReg[rdx]))
 	}
 
 	if isDirectCall {
@@ -1933,6 +1936,7 @@ func (m *machine) lowerCall(si *ssa.Instruction) {
 		for i := regalloc.RealReg(0); i < 16; i++ {
 			m.insert(m.allocateInstr().asNopUseReg(regInfo.RealRegToVReg[xmm0+i]))
 		}
+		m.insert(m.allocateInstr().asNopUseReg(regInfo.RealRegToVReg[rdx]))
 	}
 
 	var index int
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/platform.go b/vendor/github.com/tetratelabs/wazero/internal/platform/platform.go
index b9af094c1..532cc7b8c 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/platform.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/platform/platform.go
@@ -6,18 +6,28 @@ package platform
 
 import (
 	"runtime"
-)
 
-// archRequirementsVerified is set by platform-specific init to true if the platform is supported
-var archRequirementsVerified bool
+	"github.com/tetratelabs/wazero/api"
+	"github.com/tetratelabs/wazero/experimental"
+)
 
 // CompilerSupported includes constraints here and also the assembler.
 func CompilerSupported() bool {
+	return CompilerSupports(api.CoreFeaturesV2)
+}
+
+func CompilerSupports(features api.CoreFeatures) bool {
 	switch runtime.GOOS {
 	case "linux", "darwin", "freebsd", "netbsd", "dragonfly", "windows":
-		return archRequirementsVerified
+		if runtime.GOARCH == "arm64" {
+			if features.IsEnabled(experimental.CoreFeaturesThreads) {
+				return CpuFeatures.Has(CpuFeatureArm64Atomic)
+			}
+			return true
+		}
+		fallthrough
 	case "solaris", "illumos":
-		return runtime.GOARCH == "amd64" && archRequirementsVerified
+		return runtime.GOARCH == "amd64" && CpuFeatures.Has(CpuFeatureAmd64SSE4_1)
 	default:
 		return false
 	}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/platform_amd64.go b/vendor/github.com/tetratelabs/wazero/internal/platform/platform_amd64.go
deleted file mode 100644
index 59aaf5eae..000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/platform_amd64.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package platform
-
-// init verifies that the current CPU supports the required AMD64 instructions
-func init() {
-	// Ensure SSE4.1 is supported.
-	archRequirementsVerified = CpuFeatures.Has(CpuFeatureAmd64SSE4_1)
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/platform/platform_arm64.go b/vendor/github.com/tetratelabs/wazero/internal/platform/platform_arm64.go
deleted file mode 100644
index a8df707c7..000000000
--- a/vendor/github.com/tetratelabs/wazero/internal/platform/platform_arm64.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package platform
-
-// init verifies that the current CPU supports the required ARM64 features
-func init() {
-	// Ensure atomic instructions are supported.
-	archRequirementsVerified = CpuFeatures.Has(CpuFeatureArm64Atomic)
-}
diff --git a/vendor/github.com/tetratelabs/wazero/internal/sysfs/osfile.go b/vendor/github.com/tetratelabs/wazero/internal/sysfs/osfile.go
index a9b01eb6a..32d6ebb37 100644
--- a/vendor/github.com/tetratelabs/wazero/internal/sysfs/osfile.go
+++ b/vendor/github.com/tetratelabs/wazero/internal/sysfs/osfile.go
@@ -4,7 +4,6 @@ import (
 	"io"
 	"io/fs"
 	"os"
-	"runtime"
 
 	experimentalsys "github.com/tetratelabs/wazero/experimental/sys"
 	"github.com/tetratelabs/wazero/internal/fsapi"
@@ -12,11 +11,17 @@ import (
 )
 
 func newOsFile(path string, flag experimentalsys.Oflag, perm fs.FileMode, f *os.File) fsapi.File {
-	// Windows cannot read files written to a directory after it was opened.
-	// This was noticed in #1087 in zig tests. Use a flag instead of a
-	// different type.
-	reopenDir := runtime.GOOS == "windows"
-	return &osFile{path: path, flag: flag, perm: perm, reopenDir: reopenDir, file: f, fd: f.Fd()}
+	// On POSIX, if a file is removed from or added to the directory after the
+	// most recent call to opendir() or rewinddir(), whether a subsequent call
+	// to readdir() returns an entry for that file is unspecified.
+	//
+	// And Windows cannot read files added to a directory after it was opened.
+	// This was noticed in #1087 in zig tests.
+	//
+	// So there is no guarantee that files added after opendir() will be visible
+	// in readdir(). Since we want those files to be visible, we need to
+	// reopendir() to get the new state of the directory before readdir().
+	return &osFile{path: path, flag: flag, perm: perm, reopenDir: true, file: f, fd: f.Fd()}
 }
 
 // osFile is a file opened with this package, and uses os.File or syscalls to
@@ -270,6 +275,9 @@ func (f *osFile) Pwrite(buf []byte, off int64) (n int, errno experimentalsys.Err
 
 // Truncate implements the same method as documented on sys.File
 func (f *osFile) Truncate(size int64) (errno experimentalsys.Errno) {
+	if size < 0 {
+		return experimentalsys.EINVAL
+	}
 	if errno = experimentalsys.UnwrapOSError(f.file.Truncate(size)); errno != 0 {
 		// Defer validation overhead until we've already had an error.
 		errno = fileError(f, f.closed, errno)
diff --git a/vendor/github.com/tetratelabs/wazero/runtime.go b/vendor/github.com/tetratelabs/wazero/runtime.go
index 34742289e..7072f3f68 100644
--- a/vendor/github.com/tetratelabs/wazero/runtime.go
+++ b/vendor/github.com/tetratelabs/wazero/runtime.go
@@ -7,7 +7,10 @@ import (
 
 	"github.com/tetratelabs/wazero/api"
 	experimentalapi "github.com/tetratelabs/wazero/experimental"
+	"github.com/tetratelabs/wazero/internal/engine/interpreter"
+	"github.com/tetratelabs/wazero/internal/engine/wazevo"
 	"github.com/tetratelabs/wazero/internal/expctxkeys"
+	"github.com/tetratelabs/wazero/internal/platform"
 	internalsock "github.com/tetratelabs/wazero/internal/sock"
 	internalsys "github.com/tetratelabs/wazero/internal/sys"
 	"github.com/tetratelabs/wazero/internal/wasm"
@@ -148,15 +151,31 @@ func NewRuntime(ctx context.Context) Runtime {
 // NewRuntimeWithConfig returns a runtime with the given configuration.
 func NewRuntimeWithConfig(ctx context.Context, rConfig RuntimeConfig) Runtime {
 	config := rConfig.(*runtimeConfig)
+	configKind := config.engineKind
+	configEngine := config.newEngine
+	if configKind == engineKindAuto {
+		if platform.CompilerSupports(config.enabledFeatures) {
+			configKind = engineKindCompiler
+		} else {
+			configKind = engineKindInterpreter
+		}
+	}
+	if configEngine == nil {
+		if configKind == engineKindCompiler {
+			configEngine = wazevo.NewEngine
+		} else {
+			configEngine = interpreter.NewEngine
+		}
+	}
 	var engine wasm.Engine
 	var cacheImpl *cache
 	if c := config.cache; c != nil {
 		// If the Cache is configured, we share the engine.
 		cacheImpl = c.(*cache)
-		engine = cacheImpl.initEngine(config.engineKind, config.newEngine, ctx, config.enabledFeatures)
+		engine = cacheImpl.initEngine(configKind, configEngine, ctx, config.enabledFeatures)
 	} else {
 		// Otherwise, we create a new engine.
-		engine = config.newEngine(ctx, config.enabledFeatures, nil)
+		engine = configEngine(ctx, config.enabledFeatures, nil)
 	}
 	store := wasm.NewStore(config.enabledFeatures, engine)
 	return &runtime{
@@ -306,7 +325,7 @@ func (r *runtime) InstantiateModule(
 
 	var sysCtx *internalsys.Context
 	if sysCtx, err = config.toSysContext(); err != nil {
-		return
+		return nil, err
 	}
 
 	name := config.name
@@ -321,7 +340,7 @@ func (r *runtime) InstantiateModule(
 		if code.closeWithModule {
 			_ = code.Close(ctx) // don't overwrite the error
 		}
-		return
+		return nil, err
 	}
 
 	if closeNotifier, ok := ctx.Value(expctxkeys.CloseNotifierKey{}).(experimentalapi.CloseNotifier); ok {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 8c52d8949..af48298b4 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -466,8 +466,6 @@ github.com/microcosm-cc/bluemonday/css
 # github.com/miekg/dns v1.1.63
 ## explicit; go 1.19
 github.com/miekg/dns
-# github.com/minio/crc64nvme v1.0.0
-## explicit; go 1.22
 # github.com/minio/md5-simd v1.1.2
 ## explicit; go 1.14
 github.com/minio/md5-simd
@@ -839,8 +837,8 @@ github.com/technologize/otel-go-contrib/otelginmetrics
 # github.com/temoto/robotstxt v1.1.2
 ## explicit; go 1.11
 github.com/temoto/robotstxt
-# github.com/tetratelabs/wazero v1.8.2
-## explicit; go 1.21
+# github.com/tetratelabs/wazero v1.9.0
+## explicit; go 1.22.0
 github.com/tetratelabs/wazero
 github.com/tetratelabs/wazero/api
 github.com/tetratelabs/wazero/experimental