From 1fa1a4f2468b0d69965e2bedd60aebc1856864af Mon Sep 17 00:00:00 2001 From: Alexander Petric Date: Sun, 11 Oct 2026 20:50:05 +0000 Subject: [PATCH] fix: start aead secret writes one release after read support Co-Authored-By: Claude Opus 5.5 (1M context) --- backend/windmill-common/src/min_version.rs | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/backend/windmill-common/src/min_version.rs b/backend/windmill-common/src/min_version.rs index f255bf5cae..05b664b23d 100644 --- a/backend/windmill-common/src/min_version.rs +++ b/backend/windmill-common/src/min_version.rs @@ -23,12 +23,11 @@ pub const MIN_VERSION_SUPPORTS_BUN_LOCKFILE_V2: VC = vc(1, 794, 0, "Bun v2 lockf // them, so a restriction set while one is live is silently ignored on the jobs it runs. Must // name the release this ships in. pub const MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES: VC = vc(1, 822, 0, "Restricted job tokens"); -// The release that reads AES-256-GCM workspace ciphertext. A worker that predates it reads -// secrets from the database with the CBC cipher alone and fails every job using a value -// written in the new format. Must name the release this ships in. Only worker versions are -// seen here, not servers; once met, the background pass rewrites every secret variable, so -// going back below this release leaves them unreadable. -pub const MIN_VERSION_SUPPORTS_AEAD_SECRETS: VC = vc(1, 831, 0, "AES-GCM secret encryption"); +// Gates writing AES-256-GCM workspace ciphertext and the background pass that rewrites the +// stored secret variables. Reading it ships one release earlier (1.831), so a rollback to +// that release still reads every secret; below it, secrets written after the switch stay +// unreadable until rolled forward. Only worker versions are seen here, not servers. +pub const MIN_VERSION_SUPPORTS_AEAD_SECRETS: VC = vc(1, 832, 0, "AES-GCM secret encryption"); pub const MIN_VERSION_SUPPORTS_NODE_DEBOUNCING: VC = vc(1, 658, 0, "Flow node debouncing"); pub const MIN_VERSION_SUPPORTS_TOKEN_HASH: VC = vc(1, 659, 0, "Token hash storage"); pub const MIN_VERSION_SUPPORTS_SYNC_JOBS_DEBOUNCING: VC = vc(1, 602, 0, "Sync jobs debouncing");