starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-12 08:02:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: start aead secret writes one release after read support

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Alexander Petric
2026-10-11 20:50:05 +00:00
co-authored by Claude Opus 5.5
parent b5f7527b7d
commit 1fa1a4f246
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-common/src/min_version.rs
+5 -6
View File
@@ -23,12 +23,11 @@ pub const MIN_VERSION_SUPPORTS_BUN_LOCKFILE_V2: VC = vc(1, 794, 0, "Bun v2 lockf
// them, so a restriction set while one is live is silently ignored on the jobs it runs. Must
// name the release this ships in.
pub const MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES: VC = vc(1, 822, 0, "Restricted job tokens");
// The release that reads AES-256-GCM workspace ciphertext. A worker that predates it reads
// secrets from the database with the CBC cipher alone and fails every job using a value
// written in the new format. Must name the release this ships in. Only worker versions are
// seen here, not servers; once met, the background pass rewrites every secret variable, so
// going back below this release leaves them unreadable.
pub const MIN_VERSION_SUPPORTS_AEAD_SECRETS: VC = vc(1, 831, 0, "AES-GCM secret encryption");
// Gates writing AES-256-GCM workspace ciphertext and the background pass that rewrites the
// stored secret variables. Reading it ships one release earlier (1.831), so a rollback to
// that release still reads every secret; below it, secrets written after the switch stay
// unreadable until rolled forward. Only worker versions are seen here, not servers.
pub const MIN_VERSION_SUPPORTS_AEAD_SECRETS: VC = vc(1, 832, 0, "AES-GCM secret encryption");
pub const MIN_VERSION_SUPPORTS_NODE_DEBOUNCING: VC = vc(1, 658, 0, "Flow node debouncing");
pub const MIN_VERSION_SUPPORTS_TOKEN_HASH: VC = vc(1, 659, 0, "Token hash storage");
pub const MIN_VERSION_SUPPORTS_SYNC_JOBS_DEBOUNCING: VC = vc(1, 602, 0, "Sync jobs debouncing");