From 70db567a78b1e1bc9e2dcc9ff2139951d778117e Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 9 Oct 2026 20:06:01 +0200
Subject: [PATCH 1/8] fix(cli): count superadmins as able to preserve ownership
 on push (#11653)

Claude-Session: https://claude.ai/code/session_011BzU9zd53JsTShCsbKzYzB

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cli/src/core/permissioned_as.ts               |  8 ++++--
 cli/test/permissioned_as_context_unit.test.ts | 27 +++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 cli/test/permissioned_as_context_unit.test.ts

diff --git a/cli/src/core/permissioned_as.ts b/cli/src/core/permissioned_as.ts
index d0301373da..87ee37a8cb 100644
--- a/cli/src/core/permissioned_as.ts
+++ b/cli/src/core/permissioned_as.ts
@@ -34,10 +34,14 @@ export async function buildPermissionedAsContext(
     return undefined;
   }
   const user = await wmill.whoami({ workspace });
+  // A superadmin acts as admin in every workspace, so the backend preserves
+  // ownership for them even when their own `usr` row there is not an admin.
   const userIsAdminOrDeployer =
-    user.is_admin || (user.groups ?? []).includes("wm_deployers");
+    user.is_admin ||
+    user.is_super_admin ||
+    (user.groups ?? []).includes("wm_deployers");
   log.debug(
-    `permissioned_as: user=${user.email}, is_admin=${user.is_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`
+    `permissioned_as: user=${user.email}, is_admin=${user.is_admin}, is_super_admin=${user.is_super_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`
   );
   return {
     userCache: new Map(),
diff --git a/cli/test/permissioned_as_context_unit.test.ts b/cli/test/permissioned_as_context_unit.test.ts
new file mode 100644
index 0000000000..33a24bf3a1
--- /dev/null
+++ b/cli/test/permissioned_as_context_unit.test.ts
@@ -0,0 +1,27 @@
+/**
+ * Regression guard: a superadmin whose `usr` row in the workspace is not an
+ * admin still preserves ownership on the backend, so the CLI must not refuse
+ * their push as if it would reassign every item to them.
+ */
+
+import { expect, test } from "bun:test";
+import { mockServices } from "./mock_services.ts";
+
+mockServices({
+  whoami: async () => ({
+    email: "super@windmill.dev",
+    username: "super",
+    is_admin: false,
+    is_super_admin: true,
+    groups: [],
+  }),
+});
+
+const { buildPermissionedAsContext } = await import(
+  "../src/core/permissioned_as.ts"
+);
+
+test("a superadmin with a non-admin membership counts as able to preserve", async () => {
+  const ctx = await buildPermissionedAsContext("w", "v1");
+  expect(ctx?.userIsAdminOrDeployer).toBe(true);
+});

From 8556a7bebe093e0bd61c33d67415fd553f0070ad Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Fri, 9 Oct 2026 14:20:22 -0400
Subject: [PATCH 2/8] fix: harden app secret validation (#11655)

Claude-Session: https://claude.ai/code/session_01Kv72vdCDggCZEjJSmNCwnX

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 backend/windmill-api/src/apps.rs | 60 ++++++++++++++++++++++++++------
 1 file changed, 49 insertions(+), 11 deletions(-)

diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index 818a284e96..54095f0dc6 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -2109,18 +2109,23 @@ async fn get_id_from_secret(
     prefix: Option<&str>,
 ) -> Result<i64> {
     let mc = build_crypt(db, w_id).await?;
-    let decrypted = mc
-        .decrypt_bytes_to_bytes(&(hex::decode(secret)?))
-        .map_err(|e| Error::internal_err(e.to_string()))?;
-    let mut bytes = str::from_utf8(&decrypted).map_err(to_anyhow)?;
-    if let Some(prefix) = prefix {
-        if !bytes.starts_with(prefix) {
-            return Err(Error::BadRequest("Invalid secret".to_string()));
-        }
-        bytes = bytes.strip_prefix(prefix).unwrap_or("");
+    id_from_secret(&mc, &secret, prefix)
+        .ok_or_else(|| Error::BadRequest("Invalid secret".to_string()))
+}
+
+/// The secret comes from the URL of unauthenticated routes, so every way it can be invalid
+/// must produce the same response: a caller must never learn why a secret was rejected.
+fn id_from_secret(
+    mc: &magic_crypt::MagicCrypt256,
+    secret: &str,
+    prefix: Option<&str>,
+) -> Option<i64> {
+    let decrypted = mc.decrypt_bytes_to_bytes(&hex::decode(secret).ok()?).ok()?;
+    let plaintext = String::from_utf8(decrypted).ok()?;
+    match prefix {
+        Some(prefix) => plaintext.strip_prefix(prefix)?.parse().ok(),
+        None => plaintext.parse().ok(),
     }
-    let id: i64 = bytes.parse().map_err(to_anyhow)?;
-    Ok(id)
 }
 
 async fn get_public_resource(
@@ -6834,6 +6839,39 @@ mod policy_tests {
     }
 }
 
+#[cfg(test)]
+mod app_secret_tests {
+    use super::{id_from_secret, BUNDLE_SECRET_PREFIX};
+    use magic_crypt::MagicCryptTrait;
+
+    #[test]
+    fn every_invalid_secret_is_rejected_alike() {
+        let mc = magic_crypt::new_magic_crypt!("workspace-key", 256);
+        let other = magic_crypt::new_magic_crypt!("another-key", 256);
+        let valid = hex::encode(mc.encrypt_str_to_bytes("42"));
+        assert_eq!(id_from_secret(&mc, &valid, None), Some(42));
+        let bundle = hex::encode(mc.encrypt_str_to_bytes(format!("{BUNDLE_SECRET_PREFIX}7")));
+        assert_eq!(
+            id_from_secret(&mc, &bundle, Some(BUNDLE_SECRET_PREFIX)),
+            Some(7)
+        );
+
+        let mut tampered = mc.encrypt_str_to_bytes("42");
+        *tampered.last_mut().unwrap() ^= 1;
+        for bad in [
+            "not hex".to_string(),
+            hex::encode(&tampered),
+            hex::encode(other.encrypt_str_to_bytes("42")),
+            hex::encode(mc.encrypt_bytes_to_bytes(&[0xff, 0xfe])),
+            hex::encode(mc.encrypt_str_to_bytes("not a number")),
+            valid.clone(),
+        ] {
+            let prefix = (bad == valid).then_some(BUNDLE_SECRET_PREFIX);
+            assert_eq!(id_from_secret(&mc, &bad, prefix), None, "{bad}");
+        }
+    }
+}
+
 #[cfg(test)]
 mod raw_app_file_key_tests {
     use super::validate_raw_app_path_keys;

From 0a19d26d5f9623b805a7a4cd2e3fc44255a6efee Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 9 Oct 2026 21:12:12 +0200
Subject: [PATCH 3/8] chore(main): release 1.830.0 (#11650)

* chore(main): release 1.830.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 .release-please-manifest.json                 |   2 +-
 CHANGELOG.md                                  |  20 +++
 backend/Cargo.lock                            | 162 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 chat-sdk/package-lock.json                    |   4 +-
 chat-sdk/package.json                         |   2 +-
 cli/src/core/constants.ts                     |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 windmill-yaml-validator/package-lock.json     |   4 +-
 windmill-yaml-validator/package.json          |   2 +-
 22 files changed, 148 insertions(+), 128 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 79d95a4d54..fdce702331 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.829.0"
+  ".": "1.830.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f664a8aa97..80939b1b47 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## [1.830.0](https://github.com/windmill-labs/windmill/compare/v1.829.0...v1.830.0) (2026-10-09)
+
+
+### Features
+
+* add a jobs:run:dependencies token scope for lock generation ([#11643](https://github.com/windmill-labs/windmill/issues/11643)) ([1dc4ed5](https://github.com/windmill-labs/windmill/commit/1dc4ed5e7fb86c9658f1f877e7b92cd9dab5e283))
+* let operators compose full-code apps when the workspace grants it ([#11229](https://github.com/windmill-labs/windmill/issues/11229)) ([02e4697](https://github.com/windmill-labs/windmill/commit/02e4697157112581e9e2a9303180077126db714b))
+* operators get AI sessions ([#11443](https://github.com/windmill-labs/windmill/issues/11443)) ([338c4e9](https://github.com/windmill-labs/windmill/commit/338c4e921dc3185d886c8b040f253285adf20efb))
+* replace the hub_sync script with an opt-in daily server sync ([#11624](https://github.com/windmill-labs/windmill/issues/11624)) ([2b55a8a](https://github.com/windmill-labs/windmill/commit/2b55a8afbc8a86c6cebe97b1cab02c313b986f22))
+* retry transient AI provider failures before output reaches readers ([#11623](https://github.com/windmill-labs/windmill/issues/11623)) ([d3ddef0](https://github.com/windmill-labs/windmill/commit/d3ddef0b7ec4705aa578c4eca24b96e9152485bd))
+* stop offering deno for new scripts, ship it only on full images ([#11648](https://github.com/windmill-labs/windmill/issues/11648)) ([cda7883](https://github.com/windmill-labs/windmill/commit/cda78830fde1b96bd3de2674e23c245b50e3c051))
+
+
+### Bug Fixes
+
+* **cli:** count superadmins as able to preserve ownership on push ([#11653](https://github.com/windmill-labs/windmill/issues/11653)) ([70db567](https://github.com/windmill-labs/windmill/commit/70db567a78b1e1bc9e2dcc9ff2139951d778117e))
+* harden app secret validation ([#11655](https://github.com/windmill-labs/windmill/issues/11655)) ([8556a7b](https://github.com/windmill-labs/windmill/commit/8556a7bebe093e0bd61c33d67415fd553f0070ad))
+* open the chat + menu without waiting on the skills and mcp fetches ([#11645](https://github.com/windmill-labs/windmill/issues/11645)) ([1fea1aa](https://github.com/windmill-labs/windmill/commit/1fea1aa6609d644e02bac8d16186f9a2dfcb63cd))
+* say Running on a chat run card only once its job exists ([#11627](https://github.com/windmill-labs/windmill/issues/11627)) ([d046187](https://github.com/windmill-labs/windmill/commit/d046187e3edd01535240c6080b483afe154ae189))
+
 ## [1.829.0](https://github.com/windmill-labs/windmill/compare/v1.828.0...v1.829.0) (2026-10-09)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 64a152c962..fe235db7d1 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -14829,7 +14829,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14918,7 +14918,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -14953,7 +14953,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14966,7 +14966,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15106,7 +15106,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15129,7 +15129,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15146,7 +15146,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15172,7 +15172,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15182,7 +15182,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15199,7 +15199,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -15221,7 +15221,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15244,7 +15244,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15260,7 +15260,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15282,7 +15282,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15304,7 +15304,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15318,7 +15318,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15354,7 +15354,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15380,7 +15380,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15408,7 +15408,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15430,7 +15430,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15450,7 +15450,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15492,7 +15492,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15521,7 +15521,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -15533,7 +15533,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -15557,7 +15557,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15571,7 +15571,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -15610,7 +15610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15625,7 +15625,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -15644,7 +15644,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "chrono",
  "futures",
@@ -15778,7 +15778,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "regex",
  "serde",
@@ -15795,7 +15795,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15822,7 +15822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15839,7 +15839,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15855,7 +15855,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15876,7 +15876,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15907,7 +15907,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -15932,7 +15932,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -15968,7 +15968,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -15986,7 +15986,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15995,7 +15995,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16007,7 +16007,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16019,7 +16019,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -16031,7 +16031,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16043,7 +16043,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16055,7 +16055,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -16066,7 +16066,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -16077,7 +16077,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -16089,7 +16089,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -16100,7 +16100,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16122,7 +16122,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16134,7 +16134,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16148,7 +16148,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -16165,7 +16165,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16178,7 +16178,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16190,7 +16190,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16208,7 +16208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -16224,7 +16224,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -16240,7 +16240,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16254,7 +16254,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16293,7 +16293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -16333,7 +16333,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -16344,7 +16344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16379,7 +16379,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16403,7 +16403,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16436,7 +16436,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-amqp"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16463,7 +16463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16496,7 +16496,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16516,7 +16516,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16550,7 +16550,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16587,7 +16587,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16610,7 +16610,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16634,7 +16634,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16658,7 +16658,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16693,7 +16693,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16721,7 +16721,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16746,7 +16746,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "bitflags 2.13.2",
@@ -16765,7 +16765,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16884,7 +16884,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "bytes",
  "futures",
@@ -17731,9 +17731,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.1.0+zstd.1.5.7"
+version = "2.1.1+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0"
+checksum = "aeec9eaf2dffbbd09201e23bd0ffcbaa33bb8e9266a10734fd7ed90a85eca078"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 4cdd6adae5..f50a858d52 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.829.0"
+version = "1.830.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -88,7 +88,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.829.0"
+version = "1.830.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 2180b0656d..c0108282ee 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6216,7 +6216,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6302,7 +6302,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6314,7 +6314,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6323,7 +6323,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6335,7 +6335,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6347,7 +6347,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6359,7 +6359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6371,7 +6371,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6383,7 +6383,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6394,7 +6394,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6405,7 +6405,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6417,7 +6417,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6428,7 +6428,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6450,7 +6450,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6462,7 +6462,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6476,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6493,7 +6493,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6506,7 +6506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6518,7 +6518,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6536,7 +6536,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6552,7 +6552,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6568,7 +6568,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6600,7 +6600,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6614,7 +6614,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.829.0"
+version = "1.830.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 2592d0bad4..8aebf20597 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.829.0"
+version = "1.830.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 6e3c6ae615..43b1f776c2 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.829.0
+  version: 1.830.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 6fbac6f559..34e4da5cf3 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.829.0";
+export const VERSION = "v1.830.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/chat-sdk/package-lock.json b/chat-sdk/package-lock.json
index 308927fefe..03a55cff86 100644
--- a/chat-sdk/package-lock.json
+++ b/chat-sdk/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-chat",
-  "version": "1.829.0",
+  "version": "1.830.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-chat",
-      "version": "1.829.0",
+      "version": "1.830.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "@ai-sdk/react": "^4.0.102",
diff --git a/chat-sdk/package.json b/chat-sdk/package.json
index c1e57bcc1c..96637c376c 100644
--- a/chat-sdk/package.json
+++ b/chat-sdk/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-chat",
   "description": "Build chat interfaces on Windmill flows deployed in chat mode, from any frontend or raw app",
-  "version": "1.829.0",
+  "version": "1.830.0",
   "author": "Ruben Fiszel",
   "license": "Apache-2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/chat-sdk#readme",
diff --git a/cli/src/core/constants.ts b/cli/src/core/constants.ts
index 837dc4cf57..21aeb07f60 100644
--- a/cli/src/core/constants.ts
+++ b/cli/src/core/constants.ts
@@ -10,4 +10,4 @@ export const WM_FORK_PREFIX = "wm-fork";
 // (e.g. utils.ts) can read it without importing main.ts and creating a circular
 // dependency (main → workspace → utils → main) that triggers a TDZ.
 // Re-exported from main.ts for backwards compatibility.
-export const VERSION = "1.829.0";
+export const VERSION = "1.830.0";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 774e9db0df..c8250f9eca 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.829.0",
+	"version": "1.830.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@windmill-labs/components",
-			"version": "1.829.0",
+			"version": "1.830.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 25924993cf..ddfc6b410b 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@windmill-labs/components",
-	"version": "1.829.0",
+	"version": "1.830.0",
 	"scripts": {
 		"dev": "vite dev",
 		"dev:ui-builder": "mv static/ui_builder static/ui_builder.dev-disabled 2>/dev/null || true ; trap 'mv static/ui_builder.dev-disabled static/ui_builder 2>/dev/null || true' EXIT ; vite dev",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 84ddb02401..4aee9bdf9f 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.829.0"
+wmill = ">=1.830.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 0e186c74bd..e3759ee6a6 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.829.0
+  version: 1.830.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index fb5186c37a..8385126639 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.829.0'
+    ModuleVersion     = '1.830.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 104455b7f9..411bc09cc8 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.829.0"
+version = "1.830.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index ff319ebeea..ffd7c2300a 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.829.0",
+  "version": "1.830.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts", "./wacError.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index b62ad56266..9adbfcec62 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.829.0",
+  "version": "1.830.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",
diff --git a/version.txt b/version.txt
index bb120b1ee4..54f09db472 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.829.0
+1.830.0
diff --git a/windmill-yaml-validator/package-lock.json b/windmill-yaml-validator/package-lock.json
index 6b3afa01f6..95c5128a13 100644
--- a/windmill-yaml-validator/package-lock.json
+++ b/windmill-yaml-validator/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.829.0",
+  "version": "1.830.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "windmill-yaml-validator",
-      "version": "1.829.0",
+      "version": "1.830.0",
       "license": "Apache 2.0",
       "dependencies": {
         "@stoplight/yaml": "^4.3.0",
diff --git a/windmill-yaml-validator/package.json b/windmill-yaml-validator/package.json
index 7e00259bbb..6f2c2d7fed 100644
--- a/windmill-yaml-validator/package.json
+++ b/windmill-yaml-validator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "windmill-yaml-validator",
-  "version": "1.829.0",
+  "version": "1.830.0",
   "description": "YAML validator for Windmill flow, schedule, and trigger files",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

From 93e81ec1899778dc4d5e79d10cb08992b0da8c18 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 9 Oct 2026 21:54:57 +0200
Subject: [PATCH 4/8] [ee] chore: upgrade native runtime to current deno crates
 and v8 150 (#11657)

* chore: upgrade the native runtime to the current deno crates and v8 150

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: keep data and blob fetches working under no_network

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: pin the simdutf v8 archive and keep telemetry on http exporters

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: force the http otlp exporter for native telemetry and pin v8

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/Cargo.lock                            | 1650 ++++++++++++-----
 backend/Cargo.toml                            |   52 +-
 backend/ee-repo-ref.txt                       |    2 +-
 backend/windmill-runtime-nativets/Cargo.toml  |   13 +-
 backend/windmill-runtime-nativets/build.rs    |  222 +--
 backend/windmill-runtime-nativets/src/lib.rs  |  269 ++-
 .../windmill-runtime-nativets/src/runtime.js  |  121 +-
 .../src/smoke_tests.rs                        |    4 +
 .../tests/no_network.rs                       |   12 +
 .../tests/otel_e2e.rs                         |   15 +-
 .../tests/otel_init.rs                        |   11 +-
 flake.nix                                     |    9 +-
 12 files changed, 1485 insertions(+), 895 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index fe235db7d1..efd46867fb 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -508,6 +508,22 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16"
 
+[[package]]
+name = "asn1-rs"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f6fd5ddaf0351dff5b8da21b2fb4ff8e08ddd02857f0bf69c47639106c0fff0"
+dependencies = [
+ "asn1-rs-derive 0.4.0",
+ "asn1-rs-impl 0.1.0",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
 [[package]]
 name = "asn1-rs"
 version = "0.6.2"
@@ -515,7 +531,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
 dependencies = [
  "asn1-rs-derive 0.5.1",
- "asn1-rs-impl",
+ "asn1-rs-impl 0.2.0",
  "displaydoc",
  "nom",
  "num-traits",
@@ -531,7 +547,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
 dependencies = [
  "asn1-rs-derive 0.6.0",
- "asn1-rs-impl",
+ "asn1-rs-impl 0.2.0",
  "displaydoc",
  "nom",
  "num-traits",
@@ -540,6 +556,18 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "asn1-rs-derive"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "726535892e8eae7e70657b4c8ea93d26b8553afb1ce617caee529ef96d7dee6c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "synstructure 0.12.6",
+]
+
 [[package]]
 name = "asn1-rs-derive"
 version = "0.5.1"
@@ -564,6 +592,17 @@ dependencies = [
  "synstructure 0.13.2",
 ]
 
+[[package]]
+name = "asn1-rs-impl"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2777730b2039ac0f95f093556e61b6d26cebed5393ca6f152717777cec3a42ed"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "asn1-rs-impl"
 version = "0.2.0"
@@ -974,11 +1013,23 @@ version = "1.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
 dependencies = [
- "aws-lc-sys",
+ "aws-lc-sys 0.45.0",
  "untrusted 0.7.1",
  "zeroize",
 ]
 
+[[package]]
+name = "aws-lc-sys"
+version = "0.40.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
 [[package]]
 name = "aws-lc-sys"
 version = "0.45.0"
@@ -1349,7 +1400,7 @@ dependencies = [
  "hyper-util",
  "pin-project-lite",
  "rustls 0.21.12",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "rustls-pki-types",
  "tokio",
@@ -1492,44 +1543,17 @@ dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
- "rustc_version 0.4.1",
+ "rustc_version",
  "tracing",
 ]
 
-[[package]]
-name = "axum"
-version = "0.7.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
-dependencies = [
- "async-trait",
- "axum-core 0.4.5",
- "bytes",
- "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
- "http-body-util",
- "itoa",
- "matchit 0.7.3",
- "memchr",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "rustversion",
- "serde",
- "sync_wrapper",
- "tower 0.5.3",
- "tower-layer",
- "tower-service",
-]
-
 [[package]]
 name = "axum"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
- "axum-core 0.5.6",
+ "axum-core",
  "axum-macros",
  "bytes",
  "form_urlencoded",
@@ -1558,26 +1582,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "axum-core"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
-dependencies = [
- "async-trait",
- "bytes",
- "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
- "http-body-util",
- "mime",
- "pin-project-lite",
- "rustversion",
- "sync_wrapper",
- "tower-layer",
- "tower-service",
-]
-
 [[package]]
 name = "axum-core"
 version = "0.5.6"
@@ -1608,12 +1612,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "az"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be5eb007b7cacc6c660343e96f650fedf4b5a77512399eb952ca6642cf8d13f7"
-
 [[package]]
 name = "backon"
 version = "1.6.0"
@@ -1646,6 +1644,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
 [[package]]
 name = "base32"
 version = "0.5.1"
@@ -1723,6 +1727,26 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bindgen"
+version = "0.70.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f49d8fed880d473ea71efb9bf597651e77201bdd4893efe54c9e5d65ae04ce6f"
+dependencies = [
+ "bitflags 2.13.2",
+ "cexpr",
+ "clang-sys",
+ "itertools 0.13.0",
+ "log",
+ "prettyplease 0.2.37",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash 1.1.0",
+ "shlex 1.3.0",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "bindgen"
 version = "0.71.1"
@@ -2018,6 +2042,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "brotli"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74f7971dbd9326d58187408ab83117d8ac1bb9c17b085fdacd1cf2f598719b6b"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor 4.0.3",
+]
+
 [[package]]
 name = "brotli"
 version = "7.0.0"
@@ -2212,6 +2247,16 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "calendrical_calculations"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5abbd6eeda6885048d357edc66748eea6e0268e3dd11f326fff5bd248d779c26"
+dependencies = [
+ "core_maths",
+ "displaydoc",
+]
+
 [[package]]
 name = "candle-core"
 version = "0.9.2"
@@ -2490,8 +2535,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b77c319abfd5219629c45c34c89ba945ed3c5e49fcde9d16b6c3885f118a730"
 dependencies = [
  "const-oid 0.9.6",
- "der",
- "spki",
+ "der 0.7.10",
+ "spki 0.7.3",
  "x509-cert",
 ]
 
@@ -2562,6 +2607,18 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "const-hex"
+version = "1.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e59eef12462b0f9b0a3620219be5d639afd79fe39dff0a42c3997061f9298b4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "proptest",
+ "serde_core",
+]
+
 [[package]]
 name = "const-oid"
 version = "0.9.6"
@@ -2700,6 +2757,21 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
+[[package]]
+name = "core_maths"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77745e017f5edba1a9c1d854f6f3a52dac8a12dd5af5d2f54aecf61e43d80d30"
+dependencies = [
+ "libm",
+]
+
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -2751,6 +2823,12 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
 [[package]]
 name = "cron"
 version = "0.17.0"
@@ -2842,6 +2920,22 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "crypto-bigint"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
+dependencies = [
+ "cpubits",
+ "ctutils",
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "num-traits",
+ "rand_core 0.10.1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -2859,7 +2953,32 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
+ "getrandom 0.4.3",
  "hybrid-array",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "cssparser"
+version = "0.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dae61cf9c0abb83bd659dab65b7e4e38d8236824c85f0f804f173567bda257d2"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf 0.13.1",
+ "smallvec",
+]
+
+[[package]]
+name = "cssparser-macros"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2899,6 +3018,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
 dependencies = [
  "cmov",
+ "subtle",
 ]
 
 [[package]]
@@ -2926,8 +3046,8 @@ dependencies = [
  "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
  "digest 0.10.7",
- "fiat-crypto 0.2.9",
- "rustc_version 0.4.1",
+ "fiat-crypto",
+ "rustc_version",
  "subtle",
  "zeroize",
 ]
@@ -3801,7 +3921,7 @@ checksum = "c72e0409b3dbd60a5bf296cbc273a8e36bb3a3aab6abac389f1891e187d5ce14"
 dependencies = [
  "base64 0.22.1",
  "capacity_builder",
- "deno_error 0.7.3",
+ "deno_error",
  "deno_media_type",
  "deno_terminal",
  "dprint-swc-ext",
@@ -3835,37 +3955,29 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "deno_console"
-version = "0.209.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66c0b8a65dcb7b38c22e5969c6454b3cb0839b7dcfb7a4f0d904de871a4c4416"
-dependencies = [
- "deno_core",
-]
-
 [[package]]
 name = "deno_core"
-version = "0.352.1"
+version = "0.412.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf78f3f72ac8e09b18a588bc26a1b3c5ab853e7fb489889b2f5000654d34db5d"
+checksum = "580cb2e0d797d75ff3dfc4a8f2b14aa7470f0fa31654a09a83d4cbb42b5eb9b4"
 dependencies = [
  "anyhow",
- "az",
- "bincode",
+ "base64 0.22.1",
  "bit-set",
  "bit-vec 0.8.0",
+ "boxed_error",
  "bytes",
- "capacity_builder",
  "cooked-waker",
- "deno_core_icudata",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_ops",
  "deno_path_util",
  "deno_unsync",
+ "deno_v8",
  "futures",
  "indexmap 2.14.2",
+ "inventory",
  "libc",
+ "num-bigint",
  "parking_lot",
  "percent-encoding",
  "pin-project",
@@ -3875,28 +3987,25 @@ dependencies = [
  "smallvec",
  "sourcemap",
  "static_assertions",
+ "sys_traits",
  "thiserror 2.0.21",
  "tokio",
  "url",
- "v8",
+ "uuid",
  "wasm_dep_analyzer",
+ "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "deno_core_icudata"
-version = "0.74.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe4dccb6147bb3f3ba0c7a48e993bfeb999d2c2e47a81badee80e2b370c8d695"
-
 [[package]]
 name = "deno_crypto"
-version = "0.223.0"
+version = "0.273.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "beb2568806b930b96fb6440ff16463befa73a36de3378986644e7134c9d52e8f"
+checksum = "d9931d22328961b9a9c8d3b666a27312c1f3ddcc7ea78d8610ddfbc934ac61a0"
 dependencies = [
  "aes 0.8.3",
  "aes-gcm",
  "aes-kw",
+ "argon2",
  "aws-lc-rs",
  "base64 0.22.1",
  "cbc",
@@ -3904,12 +4013,15 @@ dependencies = [
  "ctr",
  "curve25519-dalek",
  "deno_core",
- "deno_error 0.6.1",
- "deno_web",
+ "deno_crypto_provider",
+ "deno_error",
  "ecdsa",
- "ed448-goldilocks",
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
+ "fips203",
+ "fips205",
+ "hmac 0.12.1",
  "num-traits",
+ "ocb3",
  "once_cell",
  "p256",
  "p384",
@@ -3920,21 +4032,34 @@ dependencies = [
  "serde_bytes",
  "sha1",
  "sha2 0.10.9",
- "signature",
- "spki",
+ "sha3",
+ "signature 2.2.0",
+ "spki 0.7.3",
+ "subtle",
  "thiserror 2.0.21",
+ "tiny-keccak",
  "tokio",
  "uuid",
  "x25519-dalek",
 ]
 
 [[package]]
-name = "deno_error"
-version = "0.6.1"
+name = "deno_crypto_provider"
+version = "0.53.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "612ec3fc481fea759141b0c57810889b0a4fb6fee8f10748677bfe492fd30486"
+checksum = "fafd673e5a4eefd6d65db358b00ff60488cfa1be6515406b4371935c2e2e6baa"
 dependencies = [
- "deno_error_macro 0.6.1",
+ "aws-lc-sys 0.40.0",
+ "ed448-goldilocks",
+]
+
+[[package]]
+name = "deno_error"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfafd2219b29886a71aecbb3449e462deed1b2c474dc5b12f855f0e58c478931"
+dependencies = [
+ "deno_error_macro",
  "libc",
  "serde",
  "serde_json",
@@ -3942,32 +4067,11 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "deno_error"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3007d3f1ea92ea503324ae15883aac0c2de2b8cf6fead62203ff6a67161007ab"
-dependencies = [
- "deno_error_macro 0.7.3",
- "libc",
-]
-
 [[package]]
 name = "deno_error_macro"
-version = "0.6.1"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8380a4224d5d2c3f84da4d764c4326cac62e9a1e3d4960442d29136fc07be863"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "deno_error_macro"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b565e60a9685cdf312c888665b5f8647ac692a7da7e058a5e2268a466da8eaf"
+checksum = "1c28ede88783f14cd8aae46ca89f230c226b40e4a81ab06fa52ed72af84beb2f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3976,31 +4080,30 @@ dependencies = [
 
 [[package]]
 name = "deno_features"
-version = "0.6.0"
+version = "0.56.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "487773bb24b92f3b88d1c9ef0d4d15888641a2e2ea4d4cdfd6fda12cae26317c"
+checksum = "2fef16a40daeb19acfc5345aa5bb367a36ecffef18b7ad1a594f0f01fe7c20c5"
 dependencies = [
  "deno_core",
- "serde",
- "serde_json",
 ]
 
 [[package]]
 name = "deno_fetch"
-version = "0.233.0"
+version = "0.283.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cbe158bec955790105ded69978b1245b97c65092f7bf184add344c0e78efffa"
+checksum = "20e792f76d45e20cf6f1ad46157bbe1a0a895a6f09ec4d99b0911112be8e05e3"
 dependencies = [
+ "async-compression",
  "base64 0.22.1",
  "bytes",
  "data-url",
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_fs",
+ "deno_io",
  "deno_path_util",
  "deno_permissions",
  "deno_tls",
- "dyn-clone",
  "error_reporter",
  "h2 0.4.20",
  "hickory-resolver",
@@ -4011,8 +4114,7 @@ dependencies = [
  "hyper-util",
  "ipnet",
  "percent-encoding",
- "rustls-webpki 0.102.8",
- "serde",
+ "rustls-webpki 0.103.15",
  "serde_json",
  "thiserror 2.0.21",
  "tokio",
@@ -4021,62 +4123,69 @@ dependencies = [
  "tokio-util",
  "tokio-vsock",
  "tower 0.5.3",
- "tower-http",
  "tower-service",
 ]
 
 [[package]]
 name = "deno_fs"
-version = "0.119.0"
+version = "0.169.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca83a95cea7bcdf19dac1888ef6f04aff69d251640a4d085bc6089c06b4b181"
+checksum = "a0b0ae3c55f4af9d33113ba4935828a2e9a7bfcbf4d3058533403b9ef332a966"
 dependencies = [
  "async-trait",
- "base32",
  "boxed_error",
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_io",
+ "deno_maybe_sync",
  "deno_path_util",
  "deno_permissions",
  "filetime",
  "junction",
  "libc",
- "nix 0.27.1",
+ "nix 0.30.1",
  "rand 0.8.5",
  "rayon",
+ "same-file",
  "serde",
  "thiserror 2.0.21",
- "winapi",
+ "tokio",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "deno_io"
-version = "0.119.0"
+version = "0.169.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597aac25be261a1bd545d6f47a80439c60e600c076f9847b3718a592883b2a73"
+checksum = "ba495b6c141d34e49fb2dbe7ca746d7ac068b1962470776eb341c59059b758f6"
 dependencies = [
  "async-trait",
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
+ "deno_permissions",
  "deno_subprocess_windows",
  "filetime",
- "fs3",
  "libc",
  "log",
- "nix 0.27.1",
- "once_cell",
+ "nix 0.30.1",
  "os_pipe",
  "parking_lot",
  "pin-project",
  "rand 0.8.5",
  "tokio",
  "uuid",
- "winapi",
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "deno_maybe_sync"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57e5e72b38015b5e478b8d739dfa818d563329e03a72d6ce5cfb2ecbcd7f8d41"
+dependencies = [
+ "rustc-hash 2.1.3",
+]
+
 [[package]]
 name = "deno_media_type"
 version = "0.3.3"
@@ -4103,17 +4212,21 @@ dependencies = [
 
 [[package]]
 name = "deno_net"
-version = "0.201.0"
+version = "0.251.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb88f1ea2762065d6cc0316372acc22696ab6004943aa029f80546f9faf1b491"
+checksum = "19ba02152d978f30e2eb5f8d074b343363f53cb1364b5c304b3176da916a06c0"
 dependencies = [
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_features",
  "deno_permissions",
+ "deno_signals",
  "deno_tls",
+ "deno_tunnel",
  "hickory-proto",
  "hickory-resolver",
+ "libc",
+ "log",
  "pin-project",
  "quinn",
  "rustls-tokio-stream",
@@ -4125,32 +4238,33 @@ dependencies = [
  "tokio-vsock",
  "url",
  "web-transport-proto",
+ "x509-parser 0.15.1",
 ]
 
 [[package]]
 name = "deno_ops"
-version = "0.228.1"
+version = "0.288.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bf8dbe5abf37d270bb853c5dfe45fbe3b1b6c453877cc11d7fe84e9862a6dbc"
+checksum = "977748624aad80164dbe385c8c907bc0041c2e6849f92528e362e03132c64c52"
 dependencies = [
  "indexmap 2.14.2",
- "proc-macro-rules",
  "proc-macro2",
  "quote",
  "stringcase",
  "strum",
  "strum_macros",
  "syn 2.0.119",
+ "syn-match",
  "thiserror 2.0.21",
 ]
 
 [[package]]
 name = "deno_path_util"
-version = "0.4.0"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "516f813389095889776b81cc9108ff6f336fd9409b4b12fc0138aea23d2708e1"
+checksum = "78c7e98943f0d068928906db0c7bde89de684fa32c6a8018caacc4cee2cdd72b"
 dependencies = [
- "deno_error 0.6.1",
+ "deno_error",
  "percent-encoding",
  "sys_traits",
  "thiserror 2.0.21",
@@ -4159,77 +4273,100 @@ dependencies = [
 
 [[package]]
 name = "deno_permissions"
-version = "0.68.0"
+version = "0.118.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baa14d9c3fbba59836ffbaac7f736a2f48d4a5fc209a2103d1e1b898915232a5"
+checksum = "f8e9d37215f52e29b5ad9d9065c476168ffb888cd2ad93b0ae153f22304851a0"
 dependencies = [
  "capacity_builder",
- "deno_error 0.6.1",
+ "chrono",
+ "deno_error",
  "deno_path_util",
  "deno_terminal",
  "deno_unsync",
+ "dunce",
  "fqdn",
- "ipnetwork",
+ "ipnet",
  "libc",
  "log",
- "nix 0.27.1",
+ "nix 0.30.1",
  "once_cell",
  "parking_lot",
- "percent-encoding",
  "serde",
  "serde_json",
  "sys_traits",
- "temp_deno_which",
  "thiserror 2.0.21",
+ "unicode-normalization",
  "url",
- "winapi",
+ "which 8.0.6",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "deno_signals"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "038ed4b09a6d36c81ac436c4d10076e9e01cc67faf93d701c541887f8eeddf36"
+dependencies = [
+ "libc",
+ "signal-hook",
+ "thiserror 2.0.21",
+ "tokio",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "deno_subprocess_windows"
-version = "0.4.0"
+version = "0.54.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bc6b10059f0ccb14c6e0319c5275f0407fb2f9ffe405cd555700561999ea4bf"
+checksum = "04d4f451b2f94d2847de4895d39ca5aa264b90af34e72fd79ddc1d0da05a5ea0"
 dependencies = [
- "fastrand 2.5.0",
  "futures-channel",
  "libc",
+ "rand 0.8.5",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "deno_telemetry"
-version = "0.31.0"
+version = "0.81.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "377581966bd34e85ce230f7f4b1dee7e16c6bf7f845b4690648507ce7ba105d9"
+checksum = "8831dc236ed1c66a90c8dfddab93ad44fbb28950fc476c78306b9100233ff694"
 dependencies = [
  "async-trait",
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
+ "deno_net",
+ "deno_signals",
+ "deno_terminal",
  "deno_tls",
+ "flate2",
  "http-body-util",
  "hyper 1.12.0",
  "hyper-rustls 0.27.10",
  "hyper-util",
  "log",
  "once_cell",
- "opentelemetry 0.27.1",
- "opentelemetry-http 0.27.0",
- "opentelemetry-otlp 0.27.0",
- "opentelemetry-semantic-conventions 0.27.0",
- "opentelemetry_sdk 0.27.1",
+ "opentelemetry 0.32.0",
+ "opentelemetry-http 0.32.0",
+ "opentelemetry-otlp 0.32.0",
+ "opentelemetry-proto 0.32.0",
+ "opentelemetry-semantic-conventions 0.32.1",
+ "opentelemetry_sdk 0.32.1",
  "pin-project",
+ "prost 0.14.4",
  "serde",
+ "sys_traits",
  "thiserror 2.0.21",
  "tokio",
+ "tokio-vsock",
+ "tower-service",
 ]
 
 [[package]]
 name = "deno_terminal"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23f71c27009e0141dedd315f1dfa3ebb0a6ca4acce7c080fac576ea415a465f6"
+checksum = "f3ba8041ae7319b3ca6a64c399df4112badcbbe0868b4517637647614bede4be"
 dependencies = [
  "once_cell",
  "termcolor",
@@ -4237,23 +4374,40 @@ dependencies = [
 
 [[package]]
 name = "deno_tls"
-version = "0.196.0"
+version = "0.246.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7835eb6a8d114703b0293573fbb8885bc2c81e8c35363b9e89391dd3c541fa6"
+checksum = "6229f7a00441b2acbf7fae58dd14bded0e835f212653402083430826e640f99d"
 dependencies = [
  "deno_core",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_native_certs",
- "rustls 0.23.35",
+ "log",
+ "rustls 0.23.40",
  "rustls-pemfile 2.2.0",
  "rustls-tokio-stream",
- "rustls-webpki 0.102.8",
+ "rustls-webpki 0.103.15",
  "serde",
  "thiserror 2.0.21",
  "tokio",
  "webpki-roots 0.26.11",
 ]
 
+[[package]]
+name = "deno_tunnel"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e432929e0c167f2a003b963ee406c714fcd947a87d4f9edc7b3255e87be9881d"
+dependencies = [
+ "pin-project",
+ "quinn",
+ "serde",
+ "serde_json",
+ "socket2 0.6.5",
+ "thiserror 2.0.21",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "deno_unsync"
 version = "0.4.4"
@@ -4266,42 +4420,43 @@ dependencies = [
 ]
 
 [[package]]
-name = "deno_url"
-version = "0.209.0"
+name = "deno_v8"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cccbb10fb59f29b04161055a65f7fe83364f9e8317d4d2ce3bd7979faf63a87"
+checksum = "85cdff08dedf79da6a40f97554f47d59d419ba3df8061b8b31789cd2cbe00433"
 dependencies = [
- "deno_core",
- "deno_error 0.6.1",
- "urlpattern",
+ "v8",
+ "v8x",
 ]
 
 [[package]]
 name = "deno_web"
-version = "0.240.0"
+version = "0.290.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d6b8a97cc90b6aaea20fe200cfa7e5b6953dd33ecda0af50d6d360387c33df4"
+checksum = "7510967ba4ec695959c1a518748c3b564fd9ca7a8f3eb13bd397707a3ca232da"
 dependencies = [
  "async-trait",
- "base64-simd",
+ "brotli 6.0.0",
  "bytes",
+ "cssparser",
  "deno_core",
- "deno_error 0.6.1",
- "deno_permissions",
+ "deno_error",
  "encoding_rs",
  "flate2",
  "futures",
  "serde",
  "thiserror 2.0.21",
  "tokio",
+ "unicode-normalization",
+ "urlpattern",
  "uuid",
 ]
 
 [[package]]
 name = "deno_webidl"
-version = "0.209.0"
+version = "0.259.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a20bbfac0cf15918f7cbd0b55c366ac20ad65c825f362fa684c3104984254d3b"
+checksum = "40af42313723a8d3114c4e5b007abd1cab4400a0b68929794c556b2e792409c7"
 dependencies = [
  "deno_core",
 ]
@@ -4319,6 +4474,30 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "der"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a"
+dependencies = [
+ "const-oid 0.10.2",
+ "zeroize",
+]
+
+[[package]]
+name = "der-parser"
+version = "8.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbd676fbbab537128ef0278adb5576cf363cff6aa22a7b24effe97347cfab61e"
+dependencies = [
+ "asn1-rs 0.5.2",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
 [[package]]
 name = "der-parser"
 version = "9.0.0"
@@ -4367,6 +4546,25 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "derive-io"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58cc7f4740088458993d183a200fe56e62378736f94bf0e2dd45807407e7bb94"
+dependencies = [
+ "derive-io-macros",
+ "tokio",
+]
+
+[[package]]
+name = "derive-io-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d0a1bd7eeab72097740967d03d53db5fbaf8e3c0dd471ebdefa43ce445a20a6"
+dependencies = [
+ "proc-macro2",
+]
+
 [[package]]
 name = "derive_builder"
 version = "0.12.0"
@@ -4467,7 +4665,7 @@ checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
 dependencies = [
  "proc-macro2",
  "quote",
- "rustc_version 0.4.1",
+ "rustc_version",
  "syn 2.0.119",
 ]
 
@@ -4524,6 +4722,38 @@ dependencies = [
  "ctutils",
 ]
 
+[[package]]
+name = "diplomat"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8b37a6cea72eb6df5143d3e091d4c34cb0cf4046dd1ddcc082988886fe1f809"
+dependencies = [
+ "diplomat_core",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "diplomat-runtime"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae517853d9f82b2d144393b1c32c34c46c2e361de2b6c44a8fdfce23beb211cd"
+
+[[package]]
+name = "diplomat_core"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b18e806f9ecb92df828d080efe47984ae1193958295d4a84fb8b32c9a1aa1b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "smallvec",
+ "strck",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "dirs"
 version = "4.0.0"
@@ -4681,6 +4911,21 @@ dependencies = [
  "text_lines",
 ]
 
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
 [[package]]
 name = "duct"
 version = "0.13.7"
@@ -4727,12 +4972,12 @@ version = "0.16.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
- "der",
+ "der 0.7.10",
  "digest 0.10.7",
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
  "rfc6979",
- "signature",
- "spki",
+ "signature 2.2.0",
+ "spki 0.7.3",
 ]
 
 [[package]]
@@ -4741,8 +4986,8 @@ version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "pkcs8",
- "signature",
+ "pkcs8 0.10.2",
+ "signature 2.2.0",
 ]
 
 [[package]]
@@ -4756,21 +5001,35 @@ dependencies = [
  "rand_core 0.6.4",
  "serde",
  "sha2 0.10.9",
- "signature",
+ "signature 2.2.0",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
-name = "ed448-goldilocks"
-version = "0.8.3"
+name = "ed448"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06924531e9e90130842b012e447f85bdaf9161bc8a0f8092be8cb70b01ebe092"
+checksum = "ae112a25f86ae3598d4e8533ed1e65149cec6eb21918e7a6f4c06dddec370263"
 dependencies = [
- "fiat-crypto 0.1.20",
- "hex",
+ "pkcs8 0.11.0",
+ "signature 3.0.0",
+]
+
+[[package]]
+name = "ed448-goldilocks"
+version = "0.14.0-pre.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b805154de2e68f59874ec217ca36790dcffe500cd872c60fe509d28d0814a74d"
+dependencies = [
+ "ed448",
+ "elliptic-curve 0.14.1",
+ "hash2curve",
+ "rand_core 0.10.1",
+ "serdect 0.4.3",
+ "shake",
+ "signature 3.0.0",
  "subtle",
- "zeroize",
 ]
 
 [[package]]
@@ -4800,20 +5059,39 @@ version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "base64ct",
- "crypto-bigint",
+ "crypto-bigint 0.5.5",
  "digest 0.10.7",
- "ff",
+ "ff 0.13.1",
  "generic-array",
- "group",
+ "group 0.13.0",
  "hkdf",
  "pem-rfc7468",
- "pkcs8",
+ "pkcs8 0.10.2",
  "rand_core 0.6.4",
- "sec1",
+ "sec1 0.7.3",
  "serde_json",
- "serdect",
+ "serdect 0.2.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "elliptic-curve"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
+dependencies = [
+ "base16ct 1.0.0",
+ "crypto-bigint 0.7.5",
+ "crypto-common 0.2.2",
+ "ff 0.14.0",
+ "group 0.14.0",
+ "hybrid-array",
+ "pkcs8 0.11.0",
+ "rand_core 0.10.1",
+ "sec1 0.8.1",
  "subtle",
  "zeroize",
 ]
@@ -5012,6 +5290,18 @@ dependencies = [
  "regex-syntax 0.8.11",
 ]
 
+[[package]]
+name = "fastbloom"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef975e30683b2d965054bb0a836f8973857c4ebf6acf274fe46617cd285060d8"
+dependencies = [
+ "foldhash 0.2.0",
+ "libm",
+ "portable-atomic",
+ "siphasher 1.0.4",
+]
+
 [[package]]
 name = "fastdivide"
 version = "0.4.2"
@@ -5044,10 +5334,14 @@ dependencies = [
 ]
 
 [[package]]
-name = "fiat-crypto"
-version = "0.1.20"
+name = "ff"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e825f6987101665dea6ec934c09ec6d721de7bc1bf92248e1d5810c8cd636b77"
+checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
+dependencies = [
+ "rand_core 0.10.1",
+ "subtle",
+]
 
 [[package]]
 name = "fiat-crypto"
@@ -5071,6 +5365,30 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
+[[package]]
+name = "fips203"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8bdb6454f692ca2a2b45cd554c6828c639d7f9c968cf83a678899ec4443a280"
+dependencies = [
+ "rand_core 0.6.4",
+ "sha3",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "fips205"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f5626bf5534df4ebdbd2536465d7eaa8a9dc2cdeb7e036e0ecf291dcc80ffb6"
+dependencies = [
+ "rand_core 0.6.4",
+ "sha2 0.10.9",
+ "sha3",
+ "zeroize",
+]
+
 [[package]]
 name = "fixedbitset"
 version = "0.5.7"
@@ -5090,7 +5408,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35f6839d7b3b98adde531effaf34f0c2badc6f4735d26fe74709d8e513a96ef3"
 dependencies = [
  "bitflags 2.13.2",
- "rustc_version 0.4.1",
+ "rustc_version",
 ]
 
 [[package]]
@@ -5173,9 +5491,9 @@ dependencies = [
 
 [[package]]
 name = "fqdn"
-version = "0.3.12"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb540cf7bc4fe6df9d8f7f0c974cfd0dce8ed4e9e8884e73433b503ee78b4e7d"
+checksum = "886ac788f62d16d6b0f26b2fa762b34ef16ebfb4b624c2c15fbcadc9173c0f72"
 
 [[package]]
 name = "from_variant"
@@ -5193,17 +5511,6 @@ version = "1.20260821.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28c70238056ad1dbfdf035222a571d2e9baf5b6a4c308cfa87bc8cbe7f2f3840"
 
-[[package]]
-name = "fs3"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb17cf6ed704f72485332f6ab65257460c4f9f3083934cf402bf9f5b3b600a90"
-dependencies = [
- "libc",
- "rustc_version 0.2.3",
- "winapi",
-]
-
 [[package]]
 name = "fs4"
 version = "0.13.1"
@@ -5721,7 +6028,7 @@ version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "886aa8ec755382a1fdf4651f6e6ec01f2f3bf49f2cb0f068b9a74cafd574a715"
 dependencies = [
- "prost",
+ "prost 0.13.5",
  "prost-types",
  "tonic 0.12.3",
 ]
@@ -5783,11 +6090,22 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
- "ff",
+ "ff 0.13.1",
  "rand_core 0.6.4",
  "subtle",
 ]
 
+[[package]]
+name = "group"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
+dependencies = [
+ "ff 0.14.0",
+ "rand_core 0.10.1",
+ "subtle",
+]
+
 [[package]]
 name = "gzip-header"
 version = "1.1.0"
@@ -5850,6 +6168,16 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "hash2curve"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1eaf40612d7d854743e7189228a6d528f0f6e8502cf6a0cb831d28a218b7f3f6"
+dependencies = [
+ "digest 0.11.3",
+ "elliptic-curve 0.14.1",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -5997,11 +6325,10 @@ dependencies = [
 
 [[package]]
 name = "hickory-proto"
-version = "0.25.0-alpha.5"
+version = "0.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d00147af6310f4392a31680db52a3ed45a2e0f68eb18e8c3fe5537ecc96d9e2"
+checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
 dependencies = [
- "async-recursion",
  "async-trait",
  "cfg-if",
  "data-encoding",
@@ -6013,6 +6340,7 @@ dependencies = [
  "ipnet",
  "once_cell",
  "rand 0.9.5",
+ "ring 0.17.14",
  "serde",
  "thiserror 2.0.21",
  "tinyvec",
@@ -6023,9 +6351,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-resolver"
-version = "0.25.0-alpha.5"
+version = "0.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5762f69ebdbd4ddb2e975cd24690bf21fe6b2604039189c26acddbc427f12887"
+checksum = "dc62a9a99b0bfb44d2ab95a7208ac952d31060efc16241c87eaf36406fecf87a"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -6217,7 +6545,9 @@ version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
 dependencies = [
+ "subtle",
  "typenum",
+ "zeroize",
 ]
 
 [[package]]
@@ -6344,7 +6674,7 @@ dependencies = [
  "hyper 1.12.0",
  "hyper-util",
  "log",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "tokio",
  "tokio-rustls 0.26.6",
@@ -6461,6 +6791,28 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_calendar"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58655df2f728e46e4eee80bddebefacf52ec3e77cdb925014b47c5a5905eb55c"
+dependencies = [
+ "calendrical_calculations",
+ "displaydoc",
+ "icu_calendar_data",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_calendar_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc00caaa3fb3201ff7a18aa458e8c3ab042b9da154cfdf948bdde3936c31c36e"
+
 [[package]]
 name = "icu_collections"
 version = "2.3.0"
@@ -6733,15 +7085,6 @@ version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
-[[package]]
-name = "ipnetwork"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf466541e9d546596ee94f9f69590f89473455f88372423e0008fc1a7daf100e"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "is-macro"
 version = "0.3.8"
@@ -6808,6 +7151,12 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
+[[package]]
+name = "ixdtf"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d3667095d64c3ecffc96463a21157b04bf3e252f6e8d5750b20c02e33c194e3"
+
 [[package]]
 name = "jiff"
 version = "0.2.38"
@@ -6887,7 +7236,7 @@ checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
 dependencies = [
  "proc-macro2",
  "quote",
- "rustc_version 0.4.1",
+ "rustc_version",
  "simd_cesu8",
  "syn 2.0.119",
 ]
@@ -6995,7 +7344,7 @@ dependencies = [
  "pem",
  "serde",
  "serde_json",
- "signature",
+ "signature 2.2.0",
  "simple_asn1",
  "zeroize",
 ]
@@ -7022,6 +7371,25 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "keccak"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
+dependencies = [
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "keccak"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8f198d1db720e4940b5a493201d199d9f24f568f8f746bd13706243a2f71598"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+]
+
 [[package]]
 name = "keyed_priority_queue"
 version = "0.4.2"
@@ -7093,7 +7461,7 @@ dependencies = [
  "k8s-openapi",
  "kube-core",
  "pem",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "secrecy",
  "serde",
  "serde_json",
@@ -7582,7 +7950,7 @@ dependencies = [
  "base64 0.22.1",
  "gethostname",
  "mail-builder",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "smtp-proto",
  "tokio",
@@ -8072,6 +8440,7 @@ dependencies = [
  "cfg-if",
  "cfg_aliases",
  "libc",
+ "memoffset",
 ]
 
 [[package]]
@@ -8291,7 +8660,6 @@ checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
 dependencies = [
  "num-integer",
  "num-traits",
- "rand 0.8.5",
  "serde",
 ]
 
@@ -8490,6 +8858,18 @@ dependencies = [
  "web-time",
 ]
 
+[[package]]
+name = "ocb3"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c196e0276c471c843dd5777e7543a36a298a4be942a2a688d8111cd43390dedb"
+dependencies = [
+ "aead",
+ "cipher 0.4.4",
+ "ctr",
+ "subtle",
+]
+
 [[package]]
 name = "odpic-sys"
 version = "0.1.1"
@@ -8499,6 +8879,15 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "oid-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bedf36ffb6ba96c2eb7144ef6270557b52e54b20c0a8e1eb2ff99a6c6959bff"
+dependencies = [
+ "asn1-rs 0.5.2",
+]
+
 [[package]]
 name = "oid-registry"
 version = "0.7.1"
@@ -8528,6 +8917,10 @@ name = "once_cell"
 version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
 
 [[package]]
 name = "once_cell_polyfill"
@@ -8667,23 +9060,23 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry"
-version = "0.27.1"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab70038c28ed37b97d8ed414b6429d343a8bbf44c9f79ec854f3a643029ba6d7"
+checksum = "aaf416e4cb72756655126f7dd7bb0af49c674f4c1b9903e80c009e0c37e552e6"
 dependencies = [
  "futures-core",
  "futures-sink",
  "js-sys",
  "pin-project-lite",
- "thiserror 1.0.69",
+ "thiserror 2.0.21",
  "tracing",
 ]
 
 [[package]]
 name = "opentelemetry"
-version = "0.30.0"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aaf416e4cb72756655126f7dd7bb0af49c674f4c1b9903e80c009e0c37e552e6"
+checksum = "b0142c63252a9e054e68a4c61a5778f7b14f576274d593f8ce883d191a099682"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -8705,18 +9098,6 @@ dependencies = [
  "tracing-subscriber",
 ]
 
-[[package]]
-name = "opentelemetry-http"
-version = "0.27.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a8a7f5f6ba7c1b286c2fbca0454eaba116f63bbe69ed250b642d36fbb04d80"
-dependencies = [
- "async-trait",
- "bytes",
- "http 1.5.0",
- "opentelemetry 0.27.1",
-]
-
 [[package]]
 name = "opentelemetry-http"
 version = "0.30.0"
@@ -8731,24 +9112,15 @@ dependencies = [
 ]
 
 [[package]]
-name = "opentelemetry-otlp"
-version = "0.27.0"
+name = "opentelemetry-http"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91cf61a1868dacc576bf2b2a1c3e9ab150af7272909e80085c3173384fe11f76"
+checksum = "5683015d09e2df236ef005b17f6f196f0d5f6313c4fa43a7b6a53b52776e4331"
 dependencies = [
  "async-trait",
- "futures-core",
+ "bytes",
  "http 1.5.0",
- "opentelemetry 0.27.1",
- "opentelemetry-http 0.27.0",
- "opentelemetry-proto 0.27.0",
- "opentelemetry_sdk 0.27.1",
- "prost",
- "serde_json",
- "thiserror 1.0.69",
- "tokio",
- "tonic 0.12.3",
- "tracing",
+ "opentelemetry 0.32.0",
 ]
 
 [[package]]
@@ -8762,7 +9134,7 @@ dependencies = [
  "opentelemetry-http 0.30.0",
  "opentelemetry-proto 0.30.0",
  "opentelemetry_sdk 0.30.0",
- "prost",
+ "prost 0.13.5",
  "reqwest 0.12.28",
  "thiserror 2.0.21",
  "tokio",
@@ -8771,17 +9143,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "opentelemetry-proto"
-version = "0.27.0"
+name = "opentelemetry-otlp"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6e05acbfada5ec79023c85368af14abd0b307c015e9064d249b2a950ef459a6"
+checksum = "9966929966d17620d7c316c643ba62631826e10021409357772d5eea84f62c35"
 dependencies = [
- "hex",
- "opentelemetry 0.27.1",
- "opentelemetry_sdk 0.27.1",
- "prost",
- "serde",
- "tonic 0.12.3",
+ "http 1.5.0",
+ "opentelemetry 0.32.0",
+ "opentelemetry-http 0.32.0",
+ "opentelemetry-proto 0.32.0",
+ "opentelemetry_sdk 0.32.1",
+ "prost 0.14.4",
+ "serde_json",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -8794,16 +9168,24 @@ dependencies = [
  "hex",
  "opentelemetry 0.30.0",
  "opentelemetry_sdk 0.30.0",
- "prost",
+ "prost 0.13.5",
  "serde",
  "tonic 0.13.1",
 ]
 
 [[package]]
-name = "opentelemetry-semantic-conventions"
-version = "0.27.0"
+name = "opentelemetry-proto"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc1b6902ff63b32ef6c489e8048c5e253e2e4a803ea3ea7e783914536eb15c52"
+checksum = "56d658ba1faf63f7b9c492cfbe6e0ec365440a16132d3270c1065f7b33f1b638"
+dependencies = [
+ "base64 0.22.1",
+ "const-hex",
+ "opentelemetry 0.32.0",
+ "opentelemetry_sdk 0.32.1",
+ "prost 0.14.4",
+ "serde",
+]
 
 [[package]]
 name = "opentelemetry-semantic-conventions"
@@ -8812,25 +9194,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "83d059a296a47436748557a353c5e6c5705b9470ef6c95cfc52c21a8814ddac2"
 
 [[package]]
-name = "opentelemetry_sdk"
-version = "0.27.1"
+name = "opentelemetry-semantic-conventions"
+version = "0.32.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "231e9d6ceef9b0b2546ddf52335785ce41252bc7474ee8ba05bfad277be13ab8"
-dependencies = [
- "async-trait",
- "futures-channel",
- "futures-executor",
- "futures-util",
- "glob",
- "opentelemetry 0.27.1",
- "percent-encoding",
- "rand 0.8.5",
- "serde_json",
- "thiserror 1.0.69",
- "tokio",
- "tokio-stream",
- "tracing",
-]
+checksum = "c913ac17a6c451661ee255f4625d143e51647ae78ebd969b75e41c4442f4fe47"
 
 [[package]]
 name = "opentelemetry_sdk"
@@ -8850,6 +9217,24 @@ dependencies = [
  "tokio-stream",
 ]
 
+[[package]]
+name = "opentelemetry_sdk"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b59f80e1ac4d5ff7a2db8fb6c80badb7f0f3f858211fba08dd9aaec750894f9"
+dependencies = [
+ "futures-channel",
+ "futures-executor",
+ "futures-util",
+ "opentelemetry 0.32.0",
+ "percent-encoding",
+ "portable-atomic",
+ "rand 0.9.5",
+ "thiserror 2.0.21",
+ "tokio",
+ "tokio-stream",
+]
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -8939,7 +9324,7 @@ checksum = "3cae83056e7cb770211494a0ecf66d9fa7eba7d00977e5bb91f0e925b40b937f"
 dependencies = [
  "cbc",
  "cms",
- "der",
+ "der 0.7.10",
  "des 0.8.1",
  "hex",
  "hmac 0.12.1",
@@ -8960,7 +9345,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
 dependencies = [
  "ecdsa",
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
  "primeorder",
  "sha2 0.10.9",
 ]
@@ -8972,7 +9357,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
 dependencies = [
  "ecdsa",
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
  "primeorder",
  "sha2 0.10.9",
 ]
@@ -8983,9 +9368,9 @@ version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "ecdsa",
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
  "primeorder",
  "rand_core 0.6.4",
  "sha2 0.10.9",
@@ -9224,7 +9609,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
 dependencies = [
- "phf_macros",
+ "phf_macros 0.11.3",
  "phf_shared 0.11.3",
 ]
 
@@ -9243,6 +9628,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
+ "phf_macros 0.13.1",
  "phf_shared 0.13.1",
  "serde",
 ]
@@ -9253,7 +9639,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
 dependencies = [
- "phf_generator",
+ "phf_generator 0.11.3",
  "phf_shared 0.11.3",
 ]
 
@@ -9267,19 +9653,42 @@ dependencies = [
  "rand 0.8.5",
 ]
 
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand 2.5.0",
+ "phf_shared 0.13.1",
+]
+
 [[package]]
 name = "phf_macros"
 version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
 dependencies = [
- "phf_generator",
+ "phf_generator 0.11.3",
  "phf_shared 0.11.3",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "phf_shared"
 version = "0.11.3"
@@ -9380,9 +9789,9 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
 dependencies = [
- "der",
- "pkcs8",
- "spki",
+ "der 0.7.10",
+ "pkcs8 0.10.2",
+ "spki 0.7.3",
 ]
 
 [[package]]
@@ -9393,9 +9802,9 @@ checksum = "695b3df3d3cc1015f12d70235e35b6b79befc5fa7a9b95b951eab1dd07c9efc2"
 dependencies = [
  "cms",
  "const-oid 0.9.6",
- "der",
+ "der 0.7.10",
  "digest 0.10.7",
- "spki",
+ "spki 0.7.3",
  "x509-cert",
  "zeroize",
 ]
@@ -9408,11 +9817,11 @@ checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6"
 dependencies = [
  "aes 0.8.3",
  "cbc",
- "der",
+ "der 0.7.10",
  "pbkdf2",
  "scrypt",
  "sha2 0.10.9",
- "spki",
+ "spki 0.7.3",
 ]
 
 [[package]]
@@ -9421,8 +9830,18 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der",
- "spki",
+ "der 0.7.10",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
+dependencies = [
+ "der 0.8.2",
+ "spki 0.8.1",
 ]
 
 [[package]]
@@ -9608,7 +10027,7 @@ version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
 dependencies = [
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
 ]
 
 [[package]]
@@ -9643,29 +10062,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "proc-macro-rules"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07c277e4e643ef00c1233393c673f655e3672cf7eb3ba08a00bdd0ea59139b5f"
-dependencies = [
- "proc-macro-rules-macros",
- "proc-macro2",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "proc-macro-rules-macros"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "207fffb0fe655d1d47f6af98cc2793405e85929bdbc420d685554ff07be27ac7"
-dependencies = [
- "once_cell",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "proc-macro-utils"
 version = "0.10.0"
@@ -9739,6 +10135,21 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "proptest"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+dependencies = [
+ "bitflags 2.13.2",
+ "num-traits",
+ "rand 0.9.5",
+ "rand_chacha 0.9.0",
+ "rand_xorshift",
+ "regex-syntax 0.8.11",
+ "unarray",
+]
+
 [[package]]
 name = "prost"
 version = "0.13.5"
@@ -9746,7 +10157,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
 dependencies = [
  "bytes",
- "prost-derive",
+ "prost-derive 0.13.5",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
+dependencies = [
+ "bytes",
+ "prost-derive 0.14.4",
 ]
 
 [[package]]
@@ -9762,13 +10183,26 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "prost-derive"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
+dependencies = [
+ "anyhow",
+ "itertools 0.14.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "prost-types"
 version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
 dependencies = [
- "prost",
+ "prost 0.13.5",
 ]
 
 [[package]]
@@ -9886,7 +10320,7 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash 2.1.3",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "socket2 0.6.5",
  "thiserror 2.0.21",
  "tokio",
@@ -9902,13 +10336,14 @@ checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "aws-lc-rs",
  "bytes",
+ "fastbloom",
  "getrandom 0.4.3",
  "lru-slab",
  "rand 0.10.3",
  "rand_pcg",
  "ring 0.17.14",
  "rustc-hash 2.1.3",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.21",
@@ -10094,6 +10529,15 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "rand_xorshift"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+dependencies = [
+ "rand_core 0.9.5",
+]
+
 [[package]]
 name = "raw-cpuid"
 version = "11.6.0"
@@ -10373,7 +10817,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "rustls-pki-types",
  "serde",
@@ -10420,7 +10864,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "rustls-platform-verifier",
  "serde",
@@ -10476,6 +10920,16 @@ dependencies = [
  "wasmtimer",
 ]
 
+[[package]]
+name = "resb"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22d392791f3c6802a1905a509e9d1a6039cbbcb5e9e00e5a6d3661f7c874f390"
+dependencies = [
+ "potential_utf",
+ "serde_core",
+]
+
 [[package]]
 name = "resolv-conf"
 version = "0.7.6"
@@ -10666,10 +11120,10 @@ dependencies = [
  "num-integer",
  "num-traits",
  "pkcs1",
- "pkcs8",
+ "pkcs8 0.10.2",
  "rand_core 0.6.4",
- "signature",
- "spki",
+ "signature 2.2.0",
+ "spki 0.7.3",
  "subtle",
  "zeroize",
 ]
@@ -10765,22 +11219,13 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
-[[package]]
-name = "rustc_version"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "138e3e0acb6c9fb258b19b67cb8abd63c00679d2851805ea151465464fe9030a"
-dependencies = [
- "semver 0.9.0",
-]
-
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
 dependencies = [
- "semver 1.0.28",
+ "semver",
 ]
 
 [[package]]
@@ -10860,9 +11305,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.35"
+version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -10881,7 +11326,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70cc376c6ba1823ae229bacf8ad93c136d93524eab0e4e5e0e4f96b9c4e5b212"
 dependencies = [
  "log",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.7.3",
  "rustls-pki-types",
  "rustls-webpki 0.103.15",
@@ -10963,7 +11408,7 @@ dependencies = [
  "jni",
  "log",
  "once_cell",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.15",
@@ -10981,12 +11426,13 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
 
 [[package]]
 name = "rustls-tokio-stream"
-version = "0.5.0"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faa7dc7c991d9164e55bbf1558029eb5b84d32cc4d61a7df5b8641b2deedc4b3"
+checksum = "0560d12c0d8c672f849197de91b9ee61f5bf9aa024c97aaeeb112ec2f6c347fd"
 dependencies = [
+ "derive-io",
  "futures",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "socket2 0.5.10",
  "tokio",
 ]
@@ -11288,11 +11734,25 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct",
- "der",
+ "base16ct 0.2.0",
+ "der 0.7.10",
  "generic-array",
- "pkcs8",
- "serdect",
+ "pkcs8 0.10.2",
+ "serdect 0.2.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "sec1"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
+dependencies = [
+ "base16ct 1.0.0",
+ "ctutils",
+ "der 0.8.2",
+ "hybrid-array",
  "subtle",
  "zeroize",
 ]
@@ -11342,27 +11802,12 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "semver"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d7eb9ef2c18661902cc47e535f9bc51b78acd254da71d375c2f6720d9a40403"
-dependencies = [
- "semver-parser",
-]
-
 [[package]]
 name = "semver"
 version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
-[[package]]
-name = "semver-parser"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
-
 [[package]]
 name = "seq-macro"
 version = "0.3.6"
@@ -11541,16 +11986,16 @@ dependencies = [
 
 [[package]]
 name = "serde_v8"
-version = "0.261.1"
+version = "0.321.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3495190857461e87a2716141043218aad5281f219f54a03b7ebbe605b3b931df"
+checksum = "fd3b6f6140192f569b88997e2ea7afeef6aa38b64374e84784ea1d1ea35679d3"
 dependencies = [
- "deno_error 0.6.1",
+ "deno_error",
+ "deno_v8",
  "num-bigint",
  "serde",
  "smallvec",
  "thiserror 2.0.21",
- "v8",
 ]
 
 [[package]]
@@ -11620,7 +12065,17 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
+ "serde",
+]
+
+[[package]]
+name = "serdect"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
+dependencies = [
+ "base16ct 1.0.0",
  "serde",
 ]
 
@@ -11695,6 +12150,27 @@ dependencies = [
  "digest 0.11.3",
 ]
 
+[[package]]
+name = "sha3"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+dependencies = [
+ "digest 0.10.7",
+ "keccak 0.1.6",
+]
+
+[[package]]
+name = "shake"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a"
+dependencies = [
+ "digest 0.11.3",
+ "keccak 0.2.2",
+ "sponge-cursor",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -11735,6 +12211,16 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
+[[package]]
+name = "signal-hook"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
@@ -11751,9 +12237,9 @@ version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1e303f8205714074f6068773f0e29527e0453937fe837c9717d066635b65f31"
 dependencies = [
- "pkcs8",
+ "pkcs8 0.10.2",
  "rand_core 0.6.4",
- "signature",
+ "signature 2.2.0",
  "zeroize",
 ]
 
@@ -11767,6 +12253,16 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "signature"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
+dependencies = [
+ "digest 0.11.3",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.10"
@@ -11779,7 +12275,7 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
 dependencies = [
- "rustc_version 0.4.1",
+ "rustc_version",
  "simdutf8",
 ]
 
@@ -11947,7 +12443,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der",
+ "der 0.7.10",
+]
+
+[[package]]
+name = "spki"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
+dependencies = [
+ "base64ct",
+ "der 0.8.2",
 ]
 
 [[package]]
@@ -11962,6 +12468,12 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "sponge-cursor"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
+
 [[package]]
 name = "sql-builder"
 version = "3.1.1"
@@ -12041,7 +12553,7 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -12238,6 +12750,15 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
+[[package]]
+name = "strck"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42316e70da376f3d113a68d138a60d8a9883c604fe97942721ec2068dab13a9f"
+dependencies = [
+ "unicode-ident",
+]
+
 [[package]]
 name = "string_enum"
 version = "1.0.2"
@@ -12751,6 +13272,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn-match"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54b8f0a9004d6aafa6a588602a1119e6cdaacec9921aa1605383e6e7d6258fd6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "sync_wrapper"
 version = "1.0.2"
@@ -12760,6 +13292,18 @@ dependencies = [
  "futures-core",
 ]
 
+[[package]]
+name = "synstructure"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "unicode-xid",
+]
+
 [[package]]
 name = "synstructure"
 version = "0.13.2"
@@ -12793,11 +13337,14 @@ dependencies = [
 
 [[package]]
 name = "sys_traits"
-version = "0.1.16"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc4707edf3196e8037ee45018d1bb1bfb233b0e4fc440fa3d3f25bc69bfdaf26"
+checksum = "c7a35f11f9773f11930a7d1e6276766f1577400ee2530b7f0cf3844c2dcbf12b"
 dependencies = [
+ "junction",
+ "libc",
  "sys_traits_macros",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -13052,15 +13599,6 @@ dependencies = [
  "rustls-pemfile 2.2.0",
 ]
 
-[[package]]
-name = "temp_deno_which"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "366c5ccd670145885feb6efd6bbf2478ed236c4c3839046fcc8e2a1a84c51091"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -13074,6 +13612,40 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "temporal_capi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f48eb9ca4ca22caaa48d1e7a534ad3fd598a23d1a71945e8ad5ac0be501fa5f2"
+dependencies = [
+ "diplomat",
+ "diplomat-runtime",
+ "icu_calendar",
+ "icu_locale_core",
+ "num-traits",
+ "temporal_rs",
+ "timezone_provider",
+ "writeable",
+ "zoneinfo64",
+]
+
+[[package]]
+name = "temporal_rs"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a978fef907a27736827d336c0bfaab14fb8a7509dd6dc2b43c44e51d59aca5b"
+dependencies = [
+ "calendrical_calculations",
+ "core_maths",
+ "icu_calendar",
+ "icu_locale_core",
+ "ixdtf",
+ "num-traits",
+ "timezone_provider",
+ "tinystr",
+ "writeable",
+]
+
 [[package]]
 name = "termcolor"
 version = "1.4.1"
@@ -13274,6 +13846,18 @@ dependencies = [
  "time-core",
 ]
 
+[[package]]
+name = "timezone_provider"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89ec4f4eebb4817fde02a411aedc7ac5f66c89c68c49e5d4b17a8139f077af52"
+dependencies = [
+ "tinystr",
+ "zerotrie",
+ "zerovec",
+ "zoneinfo64",
+]
+
 [[package]]
 name = "tiny-keccak"
 version = "2.0.2"
@@ -13350,9 +13934,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.46.1"
+version = "1.47.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc3a2344dafbe23a245241fe8b09735b521110d30fcefbbd5feb1797ca35d17"
+checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
 dependencies = [
  "backtrace",
  "bytes",
@@ -13363,10 +13947,10 @@ dependencies = [
  "pin-project-lite",
  "signal-hook-registry",
  "slab",
- "socket2 0.5.10",
+ "socket2 0.6.5",
  "tokio-macros",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -13490,7 +14074,7 @@ version = "0.26.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
 dependencies = [
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "tokio",
 ]
 
@@ -13669,13 +14253,10 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
 dependencies = [
- "async-stream",
  "async-trait",
- "axum 0.7.9",
  "base64 0.22.1",
  "bytes",
  "flate2",
- "h2 0.4.20",
  "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
@@ -13684,9 +14265,8 @@ dependencies = [
  "hyper-util",
  "percent-encoding",
  "pin-project",
- "prost",
+ "prost 0.13.5",
  "rustls-pemfile 2.2.0",
- "socket2 0.5.10",
  "tokio",
  "tokio-rustls 0.26.6",
  "tokio-stream",
@@ -13704,7 +14284,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e581ba15a835f4d9ea06c55ab1bd4dce26fc53752c69a04aac00703bfb49ba9"
 dependencies = [
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "bytes",
  "flate2",
@@ -13717,7 +14297,7 @@ dependencies = [
  "hyper-util",
  "percent-encoding",
  "pin-project",
- "prost",
+ "prost 0.13.5",
  "rustls-native-certs 0.8.4",
  "socket2 0.5.10",
  "tokio",
@@ -13775,7 +14355,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "151b5a3e3c45df17466454bb74e9ecedecc955269bdedbf4d150dfa393b55a36"
 dependencies = [
- "axum-core 0.5.6",
+ "axum-core",
  "cookie",
  "futures-util",
  "http 1.5.0",
@@ -14129,6 +14709,12 @@ dependencies = [
  "web-time",
 ]
 
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
 [[package]]
 name = "unic-char-property"
 version = "0.9.0"
@@ -14344,7 +14930,7 @@ dependencies = [
  "log",
  "native-tls",
  "once_cell",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -14374,13 +14960,13 @@ checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
 [[package]]
 name = "urlpattern"
-version = "0.3.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70acd30e3aa1450bc2eece896ce2ad0d178e9c079493819301573dae3c37ba6d"
+checksum = "0f805818f843b548bacc19609eb3619dd2850e54746f5cada37927393c2ef4ec"
 dependencies = [
+ "icu_properties",
  "regex",
  "serde",
- "unic-ucd-ident",
  "url",
 ]
 
@@ -14428,20 +15014,36 @@ dependencies = [
 
 [[package]]
 name = "v8"
-version = "137.3.0"
+version = "150.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33995a1fee055ff743281cde33a41f0d618ee0bdbe8bdf6859e11864499c2595"
+checksum = "42a978ff11f15b24e5c05a7123cf2b68f41e763546699781a924ef4e2cf43a49"
 dependencies = [
- "bindgen 0.71.1",
+ "bindgen 0.72.1",
  "bitflags 2.13.2",
  "fslock",
  "gzip-header",
  "home",
  "miniz_oxide 0.8.9",
  "paste",
+ "temporal_capi",
  "which 6.0.3",
 ]
 
+[[package]]
+name = "v8x"
+version = "149.4.0-rc.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3701ffb3692a24808503d17f758b0a3f688d2c451779247982566b5941033e63"
+dependencies = [
+ "bindgen 0.70.1",
+ "bitflags 2.13.2",
+ "cc",
+ "paste",
+ "temporal_capi",
+ "temporal_rs",
+ "timezone_provider",
+]
+
 [[package]]
 name = "valuable"
 version = "0.1.1"
@@ -14661,11 +15263,11 @@ dependencies = [
 
 [[package]]
 name = "wasm_dep_analyzer"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51cf5f08b357e64cd7642ab4bbeb11aecab9e15520692129624fb9908b8df2c"
+checksum = "a10e6b67c951a84de7029487e0e0a496860dae49f6699edd279d5ff35b8fbf54"
 dependencies = [
- "deno_error 0.6.1",
+ "deno_error",
  "thiserror 2.0.21",
 ]
 
@@ -14766,6 +15368,12 @@ dependencies = [
  "winsafe",
 ]
 
+[[package]]
+name = "which"
+version = "8.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bae2f2b2b816647a1cab1acc91f5bd20812d53cb344382635ec2181940c8034f"
+
 [[package]]
 name = "whoami"
 version = "1.6.1"
@@ -14836,7 +15444,7 @@ dependencies = [
  "aws-config",
  "aws-credential-types",
  "aws-sdk-sqs",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "constant_time_eq 0.3.1",
@@ -14856,7 +15464,7 @@ dependencies = [
  "rdkafka",
  "reqwest 0.13.5",
  "rumqttc",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "serde",
  "serde_derive",
  "serde_json",
@@ -14955,7 +15563,7 @@ dependencies = [
 name = "windmill-alerting"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "serde",
  "serde_json",
@@ -14977,7 +15585,7 @@ dependencies = [
  "async_zip",
  "aws-sdk-config",
  "aws-sigv4",
- "axum 0.8.9",
+ "axum",
  "base32",
  "base64 0.22.1",
  "bytes",
@@ -15019,7 +15627,7 @@ dependencies = [
  "reqwest 0.13.5",
  "rsa",
  "rust-embed",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "samael",
  "serde",
  "serde_json",
@@ -15108,7 +15716,7 @@ dependencies = [
 name = "windmill-api-agent-workers"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "http 1.5.0",
  "hyper 1.12.0",
@@ -15131,7 +15739,7 @@ dependencies = [
 name = "windmill-api-assets"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "serde",
  "serde_json",
@@ -15149,7 +15757,7 @@ name = "windmill-api-auth"
 version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "chrono",
  "http 1.5.0",
  "itertools 0.14.0",
@@ -15184,7 +15792,7 @@ dependencies = [
 name = "windmill-api-configs"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "itertools 0.14.0",
  "serde",
@@ -15201,7 +15809,7 @@ dependencies = [
 name = "windmill-api-debug"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "ed25519-dalek",
@@ -15224,7 +15832,7 @@ name = "windmill-api-embeddings"
 version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "candle-core",
  "candle-nn",
  "candle-transformers",
@@ -15246,7 +15854,7 @@ dependencies = [
 name = "windmill-api-flow-conversations"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "serde",
  "sql-builder",
@@ -15262,7 +15870,7 @@ dependencies = [
 name = "windmill-api-flows"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "hyper 1.12.0",
  "serde",
@@ -15284,7 +15892,7 @@ dependencies = [
 name = "windmill-api-groups"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "globset",
  "lazy_static",
@@ -15306,7 +15914,7 @@ dependencies = [
 name = "windmill-api-inputs"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "serde",
  "serde_json",
@@ -15325,7 +15933,7 @@ dependencies = [
  "aws-config",
  "aws-credential-types",
  "aws-sdk-sqs",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "futures",
  "hex",
@@ -15357,7 +15965,7 @@ name = "windmill-api-jobs"
 version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "http 1.5.0",
@@ -15382,7 +15990,7 @@ dependencies = [
 name = "windmill-api-npm-proxy"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "flate2",
  "futures",
@@ -15390,7 +15998,7 @@ dependencies = [
  "lazy_static",
  "quick_cache",
  "reqwest 0.13.5",
- "semver 1.0.28",
+ "semver",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -15411,7 +16019,7 @@ name = "windmill-api-openapi"
 version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "http 1.5.0",
  "indexmap 2.14.2",
  "itertools 0.14.0",
@@ -15432,7 +16040,7 @@ dependencies = [
 name = "windmill-api-schedule"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "chrono-tz",
  "serde",
@@ -15453,7 +16061,7 @@ name = "windmill-api-scripts"
 version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "chrono",
  "futures",
  "http 1.5.0",
@@ -15495,7 +16103,7 @@ name = "windmill-api-settings"
 version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -15536,7 +16144,7 @@ name = "windmill-api-users"
 version = "1.830.0"
 dependencies = [
  "argon2",
- "axum 0.8.9",
+ "axum",
  "chrono",
  "http 1.5.0",
  "hyper 1.12.0",
@@ -15559,7 +16167,7 @@ dependencies = [
 name = "windmill-api-workers"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "serde",
  "serde_json",
@@ -15573,7 +16181,7 @@ dependencies = [
 name = "windmill-api-workspaces"
 version = "1.830.0"
 dependencies = [
- "axum 0.8.9",
+ "axum",
  "chrono",
  "constant_time_eq 0.3.1",
  "futures",
@@ -15628,7 +16236,7 @@ name = "windmill-autoscaling"
 version = "1.830.0"
 dependencies = [
  "anyhow",
- "axum 0.8.9",
+ "axum",
  "k8s-openapi",
  "kube",
  "serde",
@@ -15658,7 +16266,7 @@ dependencies = [
  "aws-sdk-secretsmanager",
  "aws-sdk-sts",
  "aws-smithy-types-convert",
- "axum 0.8.9",
+ "axum",
  "backon",
  "base64 0.22.1",
  "bitflags 2.13.2",
@@ -15712,18 +16320,18 @@ dependencies = [
  "reqwest-middleware",
  "reqwest-retry",
  "rsa",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "ryu-js",
  "schemars 0.8.22",
- "semver 1.0.28",
+ "semver",
  "serde",
  "serde_json",
  "serde_yml",
  "sha1",
  "sha2 0.10.9",
  "size",
- "spki",
+ "spki 0.7.3",
  "sqlx",
  "strum",
  "strum_macros",
@@ -15880,7 +16488,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "backon",
  "base64 0.22.1",
  "chrono",
@@ -15912,7 +16520,7 @@ dependencies = [
  "anyhow",
  "arc-swap",
  "async-oauth2",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "hex",
@@ -15941,7 +16549,7 @@ dependencies = [
  "aws-credential-types",
  "aws-sdk-sts",
  "aws-smithy-types-convert",
- "axum 0.8.9",
+ "axum",
  "bytes",
  "chrono",
  "datafusion",
@@ -16258,7 +16866,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-recursion",
- "axum 0.8.9",
+ "axum",
  "backon",
  "chrono",
  "chrono-tz",
@@ -16298,18 +16906,14 @@ dependencies = [
  "anyhow",
  "const_format",
  "deno_ast",
- "deno_console",
  "deno_core",
  "deno_crypto",
- "deno_error 0.6.1",
+ "deno_error",
  "deno_fetch",
- "deno_fs",
- "deno_io",
  "deno_net",
  "deno_permissions",
  "deno_telemetry",
  "deno_tls",
- "deno_url",
  "deno_web",
  "deno_webidl",
  "futures",
@@ -16318,13 +16922,15 @@ dependencies = [
  "rcgen",
  "regex",
  "reqwest 0.13.5",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "serde",
  "serde_json",
  "sqlx",
+ "sys_traits",
  "tokio",
  "tracing",
  "uuid",
+ "v8",
  "winapi",
  "windmill-common",
  "windmill-parser-ts",
@@ -16348,7 +16954,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-recursion",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "dashmap",
@@ -16383,7 +16989,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "chrono",
  "futures",
  "serde",
@@ -16407,7 +17013,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "chrono",
  "http 1.5.0",
  "hyper 1.12.0",
@@ -16440,7 +17046,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "futures",
  "itertools 0.14.0",
@@ -16467,7 +17073,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -16500,7 +17106,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "lazy_static",
  "regex",
@@ -16520,7 +17126,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -16554,7 +17160,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "chrono",
  "constant_time_eq 0.3.1",
@@ -16591,7 +17197,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "itertools 0.14.0",
  "rdkafka",
@@ -16614,7 +17220,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "bytes",
  "itertools 0.14.0",
@@ -16639,7 +17245,7 @@ dependencies = [
  "anyhow",
  "async-nats",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "itertools 0.14.0",
  "nkeys",
@@ -16662,7 +17268,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "byteorder",
  "bytes",
  "chrono",
@@ -16702,7 +17308,7 @@ dependencies = [
  "aws-sdk-sqs",
  "aws-sdk-sts",
  "aws-smithy-types",
- "axum 0.8.9",
+ "axum",
  "backon",
  "chrono",
  "itertools 0.14.0",
@@ -16725,7 +17331,7 @@ version = "1.830.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "base64 0.22.1",
  "futures",
  "http 1.5.0",
@@ -16772,7 +17378,7 @@ dependencies = [
  "async-recursion",
  "async-stream",
  "async-trait",
- "axum 0.8.9",
+ "axum",
  "backon",
  "base64 0.22.1",
  "bit-vec 0.6.3",
@@ -16817,7 +17423,7 @@ dependencies = [
  "postgres-protocol",
  "process-wrap",
  "prometheus",
- "prost",
+ "prost 0.13.5",
  "quick_cache",
  "rand 0.9.5",
  "rcgen",
@@ -16826,7 +17432,7 @@ dependencies = [
  "reqwest-middleware",
  "rsa",
  "rust_decimal",
- "rustls 0.23.35",
+ "rustls 0.23.40",
  "rustls-native-certs 0.8.4",
  "rustls-pemfile 2.2.0",
  "serde",
@@ -17480,8 +18086,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
 dependencies = [
  "const-oid 0.9.6",
- "der",
- "spki",
+ "der 0.7.10",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "x509-parser"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7069fba5b66b9193bd2c5d3d4ff12b839118f6bcbef5328efafafb5395cf63da"
+dependencies = [
+ "asn1-rs 0.5.2",
+ "data-encoding",
+ "der-parser 8.2.0",
+ "lazy_static",
+ "nom",
+ "oid-registry 0.6.1",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
 ]
 
 [[package]]
@@ -17711,6 +18334,19 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
+[[package]]
+name = "zoneinfo64"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed6eb2607e906160c457fd573e9297e65029669906b9ac8fb1b5cd5e055f0705"
+dependencies = [
+ "calendrical_calculations",
+ "icu_locale_core",
+ "potential_utf",
+ "resb",
+ "serde",
+]
+
 [[package]]
 name = "zstd"
 version = "0.13.3"
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index f50a858d52..e91ad01795 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -451,7 +451,7 @@ headers = "^0"
 hyper = { version = "^1", features = ["full"] }
 hyper-tls = "^0.6"
 hyper-util = { version = "^0.1", features = ["client-legacy", "http1", "tokio"] }
-tokio = { version = "=1.46.1", features = ["full", "tracing", "time"] }
+tokio = { version = "=1.47.1", features = ["full", "tracing", "time"] }
 tokio-stream = { version = "0.1.17" }
 tower = "^0"
 tower-http = { version = "^0.6", features = ["trace", "cors", "catch-panic"] }
@@ -519,33 +519,29 @@ aws-sdk-rds = "^1"
 async-trait = "0.1.88"
 
 
-v8 = "=137.1.0"  # Exact version NOTE: Do not forget to update version and hash in flake.nix
-# deno_* pin set: deno v2.4.0 base, with deno_ast force-overridden to =0.51.0.
-# Rationale: deno_ast 0.51.0 is the first version pulling swc_common =14.0.4,
-# the first swc_common patch that dropped `pub use serde::__private as serde;`
-# (the line that capped our workspace serde pin at =1.0.220). v2.4.0's other
-# pins keep deno_tls at 0.196.0 which uses permissive `rustls ^0.23.11`,
-# compatible with aws-sdk-bedrockruntime's `^0.23.31` requirement. deno_tls
-# 0.198+ tightened that to exact `=0.23.28`, which would have made any
-# meaningful deno bump resolver-impossible against aws-sdk.
-deno_fetch = "0.233.0"
-deno_tls = "0.196.0"
-deno_console = "0.209.0"
-deno_url = "0.209.0"
-deno_webidl = "0.209.0"
-deno_web = "0.240.0"
-# Sibling release of the pinned deno_core 0.352 / deno_web 0.240 stack
-# (its deps are deno_core ^0.352, deno_web ^0.240, deno_error =0.6.1). A newer
-# deno_crypto would force bumping the whole deno stack.
-deno_crypto = "0.223.0"
-deno_io = "0.119.0"
-deno_fs = "0.119.0"
-deno_net = "0.201.0"
-deno_core = "0.352.0"
+# deno_* pin set: the crates deno published together on 2026-09-16 (deno_core
+# 0.412).
+# V8 is pinned exactly because flake.nix fetches the prebuilt archive of that
+# version: update its version and hash there with any bump. No default features,
+# so the pin leaves the feature set deno_core picks untouched.
+v8 = { version = "=150.4.0", default-features = false }
+# These release as a matched set: each pins its siblings, deno_error exactly,
+# and deno_tls pins rustls exactly (=0.23.40, the workspace `rustls` pin below
+# must equal it). A bump moves all of them at once.
+# deno_ast is independent of that set and stays at 0.51.0: a newer one pulls
+# swc_common 17, which would force bumping every swc_* pin the parsers use.
+deno_fetch = "0.283.0"
+deno_tls = "0.246.0"
+deno_webidl = "0.259.0"
+deno_web = "0.290.0"
+deno_crypto = "0.273.0"
+deno_net = "0.251.0"
+deno_core = "0.412.0"
 deno_ast = { version = "=0.51.0", features = ["transpiling"] }
-deno_permissions = "0.68.0"
-deno_telemetry = "0.31.0"
-deno_error = "=0.6.1"
+deno_permissions = "0.118.0"
+deno_telemetry = "0.81.0"
+deno_error = "=0.7.1"
+sys_traits = { version = "0.1.28", features = ["real", "libc", "winapi"] }
 rustls-pemfile = "2.2.0"
 
 # only used with special deno_core_mac feature to prevent ffi issue on macos, requires libffi to be installed
@@ -682,7 +678,7 @@ aws-sdk-sqs = "^1.89.0"
 aws-sdk-sts = "^1.91.0"
 aws-sdk-sso = "=1.77.0"
 aws-sdk-ssooidc = "=1.78.0"
-rustls = "=0.23.35"
+rustls = "=0.23.40"
 async-once-cell = "0.5.4"
 size = "0.5.0"
 
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 15e23c383d..b2d35dc125 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-5d7726c4979070ee8db4fb9e8014152872a641ba
+599eae0034b34c5e0d3d42df37cf18bbe01f9b49
diff --git a/backend/windmill-runtime-nativets/Cargo.toml b/backend/windmill-runtime-nativets/Cargo.toml
index d0b4e97f19..22da97ab1d 100644
--- a/backend/windmill-runtime-nativets/Cargo.toml
+++ b/backend/windmill-runtime-nativets/Cargo.toml
@@ -22,16 +22,15 @@ deno_webidl.workspace = true
 deno_web.workspace = true
 deno_crypto.workspace = true
 deno_net.workspace = true
-deno_console.workspace = true
-deno_url.workspace = true
 deno_core.workspace = true
 deno_ast.workspace = true
 deno_tls.workspace = true
 deno_permissions.workspace = true
-deno_io.workspace = true
-deno_fs.workspace = true
 deno_telemetry.workspace = true
 deno_error.workspace = true
+sys_traits.workspace = true
+# Not used directly: depending on it is what makes the workspace pin bind.
+v8.workspace = true
 winapi.workspace = true
 
 itertools.workspace = true
@@ -58,14 +57,8 @@ deno_webidl.workspace = true
 deno_web.workspace = true
 deno_crypto.workspace = true
 deno_net.workspace = true
-deno_console.workspace = true
-deno_url.workspace = true
 deno_core.workspace = true
 deno_ast.workspace = true
-deno_tls.workspace = true
-deno_permissions.workspace = true
-deno_io.workspace = true
-deno_fs.workspace = true
 deno_telemetry.workspace = true
 deno_error.workspace = true
 winapi.workspace = true
diff --git a/backend/windmill-runtime-nativets/build.rs b/backend/windmill-runtime-nativets/build.rs
index 29a6dbf81b..fab6cbb1ed 100644
--- a/backend/windmill-runtime-nativets/build.rs
+++ b/backend/windmill-runtime-nativets/build.rs
@@ -1,107 +1,11 @@
 use deno_ast::{MediaType, ParseParams};
-use deno_core::{ModuleCodeString, ModuleName, SourceMapData};
+use deno_core::{Extension, ModuleCodeString, ModuleName, SourceMapData};
 use deno_error::JsErrorBox;
-use deno_fetch::FetchPermissions;
-use deno_net::NetPermissions;
-use deno_web::{BlobStore, TimersPermission};
-use std::borrow::Cow;
+use std::collections::HashSet;
 use std::env;
+use std::fmt::Write as _;
 use std::io::Write;
 use std::path::{Path, PathBuf};
-use std::sync::Arc;
-
-pub struct PermissionsContainer;
-
-impl FetchPermissions for PermissionsContainer {
-    #[inline(always)]
-    fn check_net_url(
-        &mut self,
-        _url: &deno_core::url::Url,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-
-    #[inline(always)]
-    fn check_read<'a>(
-        &mut self,
-        _path: Cow<'a, Path>,
-        _api_name: &str,
-        _get_path: &'a dyn deno_fs::GetPath,
-    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
-        unreachable!("snapshotting")
-    }
-
-    #[inline(always)]
-    fn check_write<'a>(
-        &mut self,
-        _path: Cow<'a, Path>,
-        _api_name: &str,
-        _get_path: &'a dyn deno_fs::GetPath,
-    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
-        unreachable!("snapshotting")
-    }
-
-    #[inline(always)]
-    fn check_net_vsock(
-        &mut self,
-        _cid: u32,
-        _port: u32,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-}
-
-impl TimersPermission for PermissionsContainer {
-    #[inline(always)]
-    fn allow_hrtime(&mut self) -> bool {
-        true
-    }
-}
-
-impl NetPermissions for PermissionsContainer {
-    fn check_read(
-        &mut self,
-        _p: &str,
-        _api_name: &str,
-    ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-
-    fn check_write(
-        &mut self,
-        _p: &str,
-        _api_name: &str,
-    ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-
-    fn check_net<T: AsRef<str>>(
-        &mut self,
-        _host: &(T, Option<u16>),
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-
-    fn check_write_path<'a>(
-        &mut self,
-        _p: Cow<'a, Path>,
-        _api_name: &str,
-    ) -> Result<Cow<'a, Path>, deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-
-    fn check_vsock(
-        &mut self,
-        _cid: u32,
-        _port: u32,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        unreachable!("snapshotting")
-    }
-}
 
 deno_core::extension!(
     fetch,
@@ -109,38 +13,29 @@ deno_core::extension!(
     esm = ["src/runtime.js"],
 );
 
-// `extension_transpiler` callback for `deno_core::snapshot::create_snapshot`.
+// `extension_transpiler` callback for `deno_core::snapshot::create_snapshot`,
+// also applied to the residual lazy sources below.
 //
-// Specialized to our snapshot's inputs. Of the eight deno_* extensions
-// we register via `init()`, seven ship pre-built `.js` files
-// in their `esm` lists (webidl/url/console/web/crypto/fetch/net) — only
-// `deno_telemetry`'s `extension!` macro lists `.ts` files
-// (`telemetry.ts`, `util.ts`), so the TypeScript branch is needed
-// solely for that crate. Our local `fetch` extension contributes
-// `src/runtime.js` (pure JS). No `node:` imports happen at snapshot
-// build time, no `.mjs`, no user-supplied modules. So:
+// Specialized to our inputs: the deno_* extensions ship `.js`, except
+// `deno_telemetry` whose lazy scripts are `.ts`. Our local `fetch` extension
+// contributes `src/runtime.js`. No `node:` imports, no `.mjs`, no
+// user-supplied modules. So:
 //   - `.js` → pass through.
 //   - `.ts` → transpile via deno_ast (deno_telemetry only).
 //   - anything else → build bug (deno shipping an unexpected file type
 //     or us mislabelling one), panic loudly rather than emit a broken
 //     snapshot.
 //
-// No source maps: the snapshot is a binary blob the runtime loads — source
-// maps would never be consumed.
+// No source maps: nothing consumes them.
 //
-// The signature still returns `Result<_, JsErrorBox>` because that's what
-// `extension_transpiler` expects, but we never construct one — parse and
-// transpile failures are build-time bugs in deno's own .ts internals (or
-// in our runtime.js, if we ever change its extension), so they panic.
+// The signature returns `Result<_, JsErrorBox>` because that's what
+// `extension_transpiler` expects, but we never construct one: parse and
+// transpile failures are build-time bugs, so they panic.
 //
-// This replaces a call to `deno_runtime::transpile::maybe_transpile_source`
-// from `deno_runtime 0.198.0`. The original is more general (handles
-// `node:` modules, `.mjs`, emits source maps in debug builds, plumbs
-// errors via `JsErrorBox`); none of that surface is reachable in our
-// build. Dropping the `deno_runtime` dep eliminates a
-// `deno_cache → rusqlite → libsqlite3-sys 0.35` transitive chain that
-// collides with sqlx-sqlite's `libsqlite3-sys 0.30` (cargo's
-// `links = "sqlite3"` rule).
+// `deno_runtime::transpile::maybe_transpile_source` is the general version;
+// depending on `deno_runtime` would pull a
+// `deno_cache → rusqlite → libsqlite3-sys` chain that collides with
+// sqlx-sqlite's `libsqlite3-sys` (cargo's `links = "sqlite3"` rule).
 fn maybe_transpile_source(
     name: ModuleName,
     source: ModuleCodeString,
@@ -154,7 +49,7 @@ fn maybe_transpile_source(
 
     let parsed = deno_ast::parse_module(ParseParams {
         specifier: deno_core::url::Url::parse(&name).unwrap(),
-        text: source.into(),
+        text: source.as_str().into(),
         media_type,
         capture_tokens: false,
         scope_analysis: false,
@@ -169,7 +64,13 @@ fn maybe_transpile_source(
                 ..Default::default()
             },
             &deno_ast::TranspileModuleOptions::default(),
-            &deno_ast::EmitOptions::default(),
+            // The default appends an inline source map comment, which is a
+            // syntax error where deno_core evaluates a lazy script as an
+            // expression.
+            &deno_ast::EmitOptions {
+                source_map: deno_ast::SourceMapOption::None,
+                ..Default::default()
+            },
         )
         .unwrap_or_else(|e| panic!("snapshot transpile: emit failed for {name}: {e}"))
         .into_source();
@@ -177,27 +78,66 @@ fn maybe_transpile_source(
     Ok((transpiled.text.into(), None))
 }
 
+/// One `(specifier, source)` table of the extension scripts the snapshot did
+/// not evaluate. The snapshot only carries scripts that ran while it was built,
+/// so a script first loaded in a live isolate has to come from here.
+///
+/// deno_core binary-searches the table and reads each source as ASCII without
+/// checking, so it must be sorted by specifier, free of duplicates, and ASCII.
+fn residual_table(
+    name: &str,
+    files: impl Iterator<Item = deno_core::ExtensionFileSource>,
+    consumed: &HashSet<String>,
+) -> String {
+    let mut files: Vec<_> = files.filter(|f| !consumed.contains(f.specifier)).collect();
+    files.sort_by_key(|f| f.specifier);
+    files.dedup_by_key(|f| f.specifier);
+
+    let mut out = format!("pub static {name}: &[(&str, &str)] = &[\n");
+    for file in files {
+        let source = file
+            .load()
+            .unwrap_or_else(|e| panic!("could not load {}: {e}", file.specifier));
+        let (code, _) =
+            maybe_transpile_source(ModuleName::from_static(file.specifier), source).unwrap();
+        assert!(
+            code.as_str().is_ascii(),
+            "{} is not ASCII after transpiling",
+            file.specifier
+        );
+        writeln!(out, "    ({:?}, {:?}),", file.specifier, code.as_str()).unwrap();
+    }
+    out.push_str("];\n");
+    out
+}
+
 fn main() {
     println!("cargo:rustc-env=TARGET={}", env::var("TARGET").unwrap());
     println!("cargo:rustc-env=PROFILE={}", env::var("PROFILE").unwrap());
 
-    let exts = vec![
-        deno_telemetry::deno_telemetry::init(),
-        deno_webidl::deno_webidl::init(),
-        deno_url::deno_url::init(),
-        deno_console::deno_console::init(),
-        deno_web::deno_web::init::<PermissionsContainer>(Arc::new(BlobStore::default()), None),
-        deno_crypto::deno_crypto::init(None),
-        deno_fetch::deno_fetch::init::<PermissionsContainer>(Default::default()),
-        deno_net::deno_net::init::<PermissionsContainer>(None, None),
+    // Same list and order as `create_nativets_runtime`, which supplies their
+    // state through `lazy_init_extensions`.
+    let exts: Vec<Extension> = vec![
+        deno_telemetry::deno_telemetry::lazy_init(),
+        deno_webidl::deno_webidl::lazy_init(),
+        deno_web::deno_web::lazy_init(),
+        deno_crypto::deno_crypto::lazy_init(),
+        deno_fetch::deno_fetch::lazy_init(),
+        deno_net::deno_net::lazy_init(),
         fetch::init(),
     ];
 
-    // Build the file path to the snapshot.
+    let lazy_js: Vec<_> = exts
+        .iter()
+        .flat_map(|e| e.lazy_loaded_js_files.iter().cloned())
+        .collect();
+    let lazy_esm: Vec<_> = exts
+        .iter()
+        .flat_map(|e| e.lazy_loaded_esm_files.iter().cloned())
+        .collect();
+
     let o = PathBuf::from(env::var_os("OUT_DIR").unwrap());
-    let snapshot_path = o.join("FETCH_SNAPSHOT.bin");
 
-    // Create the snapshot.
     let output = deno_core::snapshot::create_snapshot(
         deno_core::snapshot::CreateSnapshotOptions {
             cargo_manifest_dir: env!("CARGO_MANIFEST_DIR"),
@@ -213,9 +153,17 @@ fn main() {
     )
     .unwrap();
 
-    let mut file = std::fs::File::create(snapshot_path).unwrap();
+    let mut file = std::fs::File::create(o.join("FETCH_SNAPSHOT.bin")).unwrap();
     file.write_all(&output.output).unwrap();
 
+    let consumed: HashSet<String> = output.consumed_lazy_specifiers.into_iter().collect();
+    let residual = format!(
+        "{}{}",
+        residual_table("RESIDUAL_LAZY_JS", lazy_js.into_iter(), &consumed),
+        residual_table("RESIDUAL_LAZY_ESM", lazy_esm.into_iter(), &consumed),
+    );
+    std::fs::write(o.join("residual_lazy_sources.rs"), residual).unwrap();
+
     for path in output.files_loaded_during_snapshot {
         println!("cargo:rerun-if-changed={}", path.display());
     }
diff --git a/backend/windmill-runtime-nativets/src/lib.rs b/backend/windmill-runtime-nativets/src/lib.rs
index 75aacbcc64..750cdaa609 100644
--- a/backend/windmill-runtime-nativets/src/lib.rs
+++ b/backend/windmill-runtime-nativets/src/lib.rs
@@ -22,9 +22,7 @@ mod smoke_tests;
 mod cert_tests;
 
 use std::{
-    borrow::Cow,
     cell::RefCell,
-    path::PathBuf,
     rc::Rc,
     sync::{Arc, LazyLock, Mutex},
 };
@@ -32,17 +30,55 @@ use std::{
 // Re-export deno_telemetry for use by windmill-worker's otel proxy
 pub use deno_telemetry;
 
+/// The real environment and filesystem, except that the OTLP protocol always
+/// reads as HTTP.
+///
+/// The caller points `OTEL_EXPORTER_OTLP_ENDPOINT` at its own HTTP collector
+/// only while [`init_telemetry`] runs, and the instance's own exporter shares
+/// `OTEL_EXPORTER_OTLP_PROTOCOL`. Honouring `grpc` there would build an exporter
+/// that reads the endpoint again on every export, and `console` one that never
+/// reads it, so either would send job telemetry past that collector.
+struct HttpOtlpSys;
+
+impl sys_traits::BaseEnvVar for HttpOtlpSys {
+    fn base_env_var_os(&self, key: &std::ffi::OsStr) -> Option<std::ffi::OsString> {
+        if key == "OTEL_EXPORTER_OTLP_PROTOCOL" {
+            return Some("http/protobuf".into());
+        }
+        sys_traits::impls::RealSys.base_env_var_os(key)
+    }
+}
+
+impl sys_traits::BaseFsRead for HttpOtlpSys {
+    fn base_fs_read(
+        &self,
+        path: &std::path::Path,
+    ) -> std::io::Result<std::borrow::Cow<'static, [u8]>> {
+        sys_traits::impls::RealSys.base_fs_read(path)
+    }
+}
+
+/// `deno_telemetry::init` for the isolates of this process.
+pub fn init_telemetry(
+    rt_config: deno_telemetry::OtelRuntimeConfig,
+    config: deno_telemetry::OtelConfig,
+) -> anyhow::Result<()> {
+    deno_telemetry::init(&HttpOtlpSys, rt_config, config)
+}
+
 use deno_ast::ParseParams;
 use deno_core::{
+    error::CoreErrorKind,
     op2, serde_v8, url,
     v8::{self, IsolateHandle},
     Extension, JsRuntime, OpState, PollEventLoopOptions, RuntimeOptions,
 };
 use deno_error::JsErrorBox;
-use deno_fetch::FetchPermissions;
-use deno_net::NetPermissions;
+use deno_permissions::{
+    Permissions, PermissionsContainer, PermissionsOptions, RuntimePermissionDescriptorParser,
+};
 use deno_tls::{rustls::pki_types::CertificateDer, rustls::RootCertStore, RootCertStoreProvider};
-use deno_web::{BlobStore, TimersPermission};
+use deno_web::{BlobStore, InMemoryBroadcastChannel};
 use itertools::Itertools;
 use lazy_static::lazy_static;
 use regex::Regex;
@@ -57,156 +93,55 @@ use windmill_common::worker::{write_file, Connection, WINDMILL_DIR};
 
 // ── Snapshot-matched extensions ──────────────────────────────────────
 //
-// `deno_core` 0.352 validates that the snapshot's extension list is a
-// *prefix* of the runtime's extension list (snapshot does not need an
-// exact match — runtime is allowed to add extensions at the tail, but
-// must not reorder or omit any that the snapshot baked in).
+// The snapshot (build.rs) is built from the deno_* extensions in their
+// `lazy_init()` form followed by this local `fetch` ext. deno_core requires the
+// runtime's extension list to start with that same list in that same order; it
+// may append more, which is how the windmill `ext` carrying our own ops gets in.
 //
-// Our snapshot (in build.rs) is the same eight deno_* extensions ending
-// with this local `fetch` ext. The runtime adds one extra entry at the
-// end — the windmill `ext` carrying our own ops — which is fine because
-// it's after the snapshot prefix.
-//
-// This local `fetch` extension declaration must be present in both
-// build.rs and lib.rs so the type passes through the `init()` macro.
-// The ESM is already in the snapshot, so this `init()` call at runtime
-// is a no-op for esm — the registration just records the ext.
+// This declaration must exist in both build.rs and lib.rs. The ESM is already
+// in the snapshot, so `init()` at runtime only records the extension.
 deno_core::extension!(
     fetch,
     esm_entry_point = "ext:fetch/src/runtime.js",
     esm = ["src/runtime.js"],
 );
 
-// ── Permission container ─────────────────────────────────────────────
+include!(concat!(env!("OUT_DIR"), "/residual_lazy_sources.rs"));
 
-/// `no_network` is what `//no_network` promises: no outbound traffic of any kind,
-/// the Windmill API included (the client module reaches it through `fetch`).
-/// Enforced here and by disabling the deno_net ops, never in JS: user code can
-/// call `Deno.core.ops.*` directly and skip any JS-level guard.
-pub struct PermissionsContainer {
-    pub no_network: bool,
-}
-
-const NO_NETWORK_ANNOTATION: &str = "no_network";
+// ── Permissions ──────────────────────────────────────────────────────
 
 /// Every op deno_net registers, see `create_nativets_runtime`. Read from the
 /// extension itself so an upgrade that adds an op cannot leave it enabled.
 static NO_NETWORK_DISABLED_OPS: LazyLock<std::collections::HashSet<&'static str>> =
     LazyLock::new(|| {
-        deno_net::deno_net::init::<PermissionsContainer>(None, None)
+        deno_net::deno_net::lazy_init()
             .ops
             .iter()
             .map(|op| op.name)
             .collect()
     });
 
-impl PermissionsContainer {
-    fn deny_net(&self, target: &str) -> Result<(), deno_permissions::PermissionCheckError> {
-        if self.no_network {
-            Err(deno_permissions::PermissionDeniedError::Fatal {
-                access: format!(
-                    "net access to {target} (the script is annotated //{NO_NETWORK_ANNOTATION})"
-                ),
-            }
-            .into())
-        } else {
-            Ok(())
-        }
-    }
-}
-
-impl FetchPermissions for PermissionsContainer {
-    #[inline(always)]
-    fn check_net_url(
-        &mut self,
-        url: &deno_core::url::Url,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("\"{}\"", url.host_str().unwrap_or_default()))
-    }
-
-    #[inline(always)]
-    fn check_read<'a>(
-        &mut self,
-        path: Cow<'a, std::path::Path>,
-        _api_name: &str,
-        _get_path: &'a dyn deno_fs::GetPath,
-    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
-        Ok(deno_fs::CheckedPath::Unresolved(path))
-    }
-
-    #[inline(always)]
-    fn check_write<'a>(
-        &mut self,
-        path: Cow<'a, std::path::Path>,
-        _api_name: &str,
-        _get_path: &'a dyn deno_fs::GetPath,
-    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
-        Ok(deno_fs::CheckedPath::Unresolved(path))
-    }
-
-    #[inline(always)]
-    fn check_net_vsock(
-        &mut self,
-        cid: u32,
-        port: u32,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("vsock {cid}:{port}"))
-    }
-}
-
-impl TimersPermission for PermissionsContainer {
-    #[inline(always)]
-    fn allow_hrtime(&mut self) -> bool {
-        true
-    }
-}
-
-impl NetPermissions for PermissionsContainer {
-    fn check_read(
-        &mut self,
-        p: &str,
-        _api_name: &str,
-    ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("unix socket \"{p}\""))?;
-        Ok(PathBuf::from(p))
-    }
-
-    fn check_write(
-        &mut self,
-        p: &str,
-        _api_name: &str,
-    ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("unix socket \"{p}\""))?;
-        Ok(PathBuf::from(p))
-    }
-
-    fn check_net<T: AsRef<str>>(
-        &mut self,
-        host: &(T, Option<u16>),
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("\"{}\"", host.0.as_ref()))
-    }
-
-    fn check_write_path<'a>(
-        &mut self,
-        p: Cow<'a, std::path::Path>,
-        _api_name: &str,
-    ) -> Result<Cow<'a, std::path::Path>, deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("unix socket \"{}\"", p.display()))?;
-        Ok(p)
-    }
-
-    fn check_vsock(
-        &mut self,
-        cid: u32,
-        port: u32,
-        _api_name: &str,
-    ) -> Result<(), deno_permissions::PermissionCheckError> {
-        self.deny_net(&format!("vsock {cid}:{port}"))
-    }
+/// What an isolate may do: reach the network, unless `no_network`, and nothing
+/// else (no filesystem, environment, subprocess or FFI). Nothing prompts.
+///
+/// `no_network` is what `//no_network` promises: no outbound traffic of any
+/// kind, the Windmill API included (the client module reaches it through
+/// `fetch`). Enforced here and by disabling the deno_net ops, never in JS: user
+/// code can call `Deno.core.ops.*` directly and skip any JS-level guard.
+fn isolate_permissions(no_network: bool) -> anyhow::Result<PermissionsContainer> {
+    let parser = Arc::new(RuntimePermissionDescriptorParser::new(
+        sys_traits::impls::RealSys,
+    ));
+    // An empty list means "all hosts", for a grant and for a denial alike.
+    let options = PermissionsOptions {
+        allow_net: (!no_network).then(Vec::new),
+        deny_net: no_network.then(Vec::new),
+        prompt: false,
+        ..Default::default()
+    };
+    let permissions = Permissions::from_options(parser.as_ref(), &options)
+        .map_err(|e| anyhow::anyhow!("invalid isolate permissions: {e}"))?;
+    Ok(PermissionsContainer::new(parser, permissions))
 }
 
 // ── Types ────────────────────────────────────────────────────────────
@@ -228,7 +163,7 @@ pub struct NativeAnnotation {
     /// script; `None` leaves the default in force.
     pub fetch_response_timeout_secs: Option<u64>,
     /// `//no_network`: the isolate may open no connection at all, see
-    /// [`PermissionsContainer`].
+    /// [`isolate_permissions`].
     pub no_network: bool,
 }
 
@@ -413,13 +348,10 @@ pub fn setup_deno_runtime() -> anyhow::Result<()> {
         // deno_fetch requires a TLS provider; install ring as default (idempotent).
         let _ = rustls::crypto::ring::default_provider().install_default();
 
-        let unrecognized_v8_flags = deno_core::v8_set_flags(vec![
-            "--stack-size=1024".to_string(),
-            "--no-harmony-import-assertions".to_string(),
-        ])
-        .into_iter()
-        .skip(1)
-        .collect::<Vec<_>>();
+        let unrecognized_v8_flags = deno_core::v8_set_flags(vec!["--stack-size=1024".to_string()])
+            .into_iter()
+            .skip(1)
+            .collect::<Vec<_>>();
 
         if !unrecognized_v8_flags.is_empty() {
             init_err = Some(format!(
@@ -435,7 +367,7 @@ pub fn setup_deno_runtime() -> anyhow::Result<()> {
         // SIGSEGV in WasmCodePointerTable::AllocateUninitializedEntry() on x86_64 Linux.
         // See: https://github.com/denoland/deno_core/issues/952
         let platform = deno_core::v8::new_unprotected_default_platform(0, false).make_shared();
-        deno_core::JsRuntime::init_platform(Some(platform), false);
+        deno_core::JsRuntime::init_platform(Some(platform));
     });
 
     if let Some(msg) = init_err {
@@ -666,17 +598,15 @@ pub(crate) fn create_nativets_runtime(
         ..Default::default()
     };
 
+    // Same list and order as the snapshot (build.rs); their state follows in
+    // `lazy_init_extensions` below, which must match it too.
     let exts: Vec<Extension> = vec![
-        deno_telemetry::deno_telemetry::init(),
-        deno_webidl::deno_webidl::init(),
-        deno_url::deno_url::init(),
-        deno_console::deno_console::init(),
-        deno_web::deno_web::init::<PermissionsContainer>(Arc::new(BlobStore::default()), None),
-        // Registered after deno_web to keep the snapshot (build.rs) a prefix of
-        // the runtime extension list; deno_crypto declares deps = [deno_webidl, deno_web].
-        deno_crypto::deno_crypto::init(None),
-        deno_fetch::deno_fetch::init::<PermissionsContainer>(fetch_options),
-        deno_net::deno_net::init::<PermissionsContainer>(None, None),
+        deno_telemetry::deno_telemetry::lazy_init(),
+        deno_webidl::deno_webidl::lazy_init(),
+        deno_web::deno_web::lazy_init(),
+        deno_crypto::deno_crypto::lazy_init(),
+        deno_fetch::deno_fetch::lazy_init(),
+        deno_net::deno_net::lazy_init(),
         fetch::init(),
         ext,
     ];
@@ -688,6 +618,8 @@ pub(crate) fn create_nativets_runtime(
             deno_core::v8::CreateParams::default().heap_limits(0, 1024 * 1024 * 128),
         ),
         startup_snapshot: Some(RUNTIME_SNAPSHOT),
+        residual_lazy_js_sources: RESIDUAL_LAZY_JS,
+        residual_lazy_esm_sources: RESIDUAL_LAZY_ESM,
         module_loader: Some(Rc::new(deno_core::FsModuleLoader)),
         extension_transpiler: None,
         ..Default::default()
@@ -714,12 +646,28 @@ pub(crate) fn create_nativets_runtime(
         y * 2
     });
 
+    js_runtime
+        .lazy_init_extensions(vec![
+            deno_telemetry::deno_telemetry::args(),
+            deno_webidl::deno_webidl::args(),
+            deno_web::deno_web::args(
+                Arc::new(BlobStore::default()),
+                None,
+                false,
+                InMemoryBroadcastChannel::default(),
+            ),
+            deno_crypto::deno_crypto::args(None),
+            deno_fetch::deno_fetch::args(fetch_options),
+            deno_net::deno_net::args(None, None),
+        ])
+        .map_err(windmill_common::error::to_anyhow)?;
+
     let (log_sender, log_receiver) = mpsc::unbounded_channel::<String>();
 
     {
         let op_state = js_runtime.op_state();
         let mut op_state = op_state.borrow_mut();
-        op_state.put(PermissionsContainer { no_network });
+        op_state.put(isolate_permissions(no_network)?);
         op_state.put(MainArgs { args: initial_args });
         op_state.put(LogString { s: log_sender });
     }
@@ -731,7 +679,7 @@ pub(crate) fn create_nativets_runtime(
         .execute_script(
             "<wm_init>",
             format!(
-                "globalThis.__wmInitPerIsolate({{ fetchResponseTimeoutMs: {fetch_response_timeout_ms} }})"
+                "globalThis.__wmInitPerIsolate({{ fetchResponseTimeoutMs: {fetch_response_timeout_ms}, noNetwork: {no_network} }})"
             ),
         )
         .map_err(windmill_common::error::to_anyhow)?;
@@ -777,7 +725,7 @@ pub(crate) fn extract_global_string(
     js_runtime: &mut JsRuntime,
     global: v8::Global<v8::Value>,
 ) -> Result<Box<RawValue>, String> {
-    let scope = &mut js_runtime.handle_scope();
+    deno_core::scope!(scope, js_runtime);
     let local = v8::Local::new(scope, global);
     match serde_v8::from_v8::<Option<String>>(scope, local) {
         Ok(s) => Ok(unsafe_raw(s.unwrap_or_else(|| "null".to_string()))),
@@ -1169,7 +1117,10 @@ import("file:///eval.ts").then((module) => module.{main_fn}(...args))
         Ok(global) => {
             extract_global_string(js_runtime, global).map_err(|e| ExecuteError::Script(e))
         }
-        Err(deno_core::error::CoreError::Js(e)) => {
+        Err(e) if matches!(e.as_kind(), CoreErrorKind::Js(_)) => {
+            let CoreErrorKind::Js(e) = e.into_kind() else {
+                unreachable!("matched as a JS error above")
+            };
             let source = e.frames.first().and_then(|f| {
                 f.file_name
                     .as_ref()
diff --git a/backend/windmill-runtime-nativets/src/runtime.js b/backend/windmill-runtime-nativets/src/runtime.js
index 88e10f765a..86d20dd022 100644
--- a/backend/windmill-runtime-nativets/src/runtime.js
+++ b/backend/windmill-runtime-nativets/src/runtime.js
@@ -1,39 +1,42 @@
-import * as abortSignal from "ext:deno_web/03_abort_signal.js";
-import * as domException from "ext:deno_web/01_dom_exception.js";
-import * as base64 from "ext:deno_web/05_base64.js";
-import * as console from "ext:deno_console/01_console.js";
-import * as encoding from "ext:deno_web/08_text_encoding.js";
-import * as event from "ext:deno_web/02_event.js";
-import * as fetch from "ext:deno_fetch/26_fetch.js";
-import * as file from "ext:deno_web/09_file.js";
-import * as fileReader from "ext:deno_web/10_filereader.js";
-import * as formData from "ext:deno_fetch/21_formdata.js";
-import * as headers from "ext:deno_fetch/20_headers.js";
-import * as streams from "ext:deno_web/06_streams.js";
-import * as timers from "ext:deno_web/02_timers.js";
-import * as url from "ext:deno_url/00_url.js";
-import * as net from "ext:deno_net/01_net.js";
-import * as tls from "ext:deno_net/02_tls.js";
-import * as urlPattern from "ext:deno_url/01_urlpattern.js";
-import * as webidl from "ext:deno_webidl/00_webidl.js";
-import * as crypto from "ext:deno_crypto/00_crypto.js";
-import * as response from "ext:deno_fetch/23_response.js";
-import * as request from "ext:deno_fetch/23_request.js";
-import "ext:deno_web/02_structured_clone.js";
-import * as globalInterfaces from "ext:deno_web/04_global_interfaces.js";
-// Namespace imports (not side-effect-only) so their constructors are reachable
-// for the globalThis wiring below. The module bodies still execute on
-// evaluation, so their side effects apply.
-import * as messagePort from "ext:deno_web/13_message_port.js";
-import * as compression from "ext:deno_web/14_compression.js";
-import * as performance from "ext:deno_web/15_performance.js";
-import "ext:deno_web/16_image_data.js";
-import "ext:deno_fetch/27_eventsource.js";
+import { core, internals } from "ext:core/mod.js";
+
+// deno_crypto brands CryptoKeys with this symbol and reads it from `internals`
+// when it evaluates; in Deno a deno_node module sets it, which is not loaded here.
+internals.kKeyObject ??= Symbol("kKeyObject");
+
+// Every script loaded here runs at snapshot-build time and is baked into the
+// snapshot. One that is first loaded at run time comes from the residual table
+// build.rs emits instead.
+const abortSignal = core.loadExtScript("ext:deno_web/03_abort_signal.js");
+const domException = core.loadExtScript("ext:deno_web/01_dom_exception.js");
+const base64 = core.loadExtScript("ext:deno_web/05_base64.js");
+const console = core.loadExtScript("ext:deno_web/01_console.js");
+const encoding = core.loadExtScript("ext:deno_web/08_text_encoding.js");
+const event = core.loadExtScript("ext:deno_web/02_event.js");
+const fetch = core.loadExtScript("ext:deno_fetch/26_fetch.js");
+const file = core.loadExtScript("ext:deno_web/09_file.js");
+const fileReader = core.loadExtScript("ext:deno_web/10_filereader.js");
+const formData = core.loadExtScript("ext:deno_fetch/21_formdata.js");
+const headers = core.loadExtScript("ext:deno_fetch/20_headers.js");
+const streams = core.loadExtScript("ext:deno_web/06_streams.js");
+const timers = core.loadExtScript("ext:deno_web/02_timers.js");
+const url = core.loadExtScript("ext:deno_web/00_url.js");
+const urlPattern = core.loadExtScript("ext:deno_web/01_urlpattern.js");
+const webidl = core.loadExtScript("ext:deno_webidl/00_webidl.js");
+const crypto = core.loadExtScript("ext:deno_crypto/00_crypto.js");
+const response = core.loadExtScript("ext:deno_fetch/23_response.js");
+const request = core.loadExtScript("ext:deno_fetch/23_request.js");
+const globalInterfaces = core.loadExtScript(
+  "ext:deno_web/04_global_interfaces.js",
+);
+const messagePort = core.loadExtScript("ext:deno_web/13_message_port.js");
+const compression = core.loadExtScript("ext:deno_web/14_compression.js");
+const performance = core.loadExtScript("ext:deno_web/15_performance.js");
 
 // deno_fetch applies no deadline, so a peer that accepts a request and then
 // never answers leaves `await fetch(...)` pending until the job timeout, which
 // self-hosted defaults to 7 days.
-const ORIGINAL_FETCH = fetch.fetch;
+const DENO_FETCH = fetch.fetch;
 
 // deno_web's timers reject any `this` other than undefined/globalThis, so
 // `timers.setTimeout(...)` passes the module namespace and throws "Illegal
@@ -50,6 +53,14 @@ const abortControllerAbort = Function.prototype.call.bind(
 );
 const ReflectApply = Reflect.apply;
 
+// Forwards the original argument count, like every caller below relies on. The
+// extra promise hop under `no_network` costs the same-tick settling of an
+// aborted fetch, which only matters where a request could have been made.
+function ORIGINAL_FETCH() {
+  const p = ReflectApply(DENO_FETCH, undefined, arguments);
+  return noNetwork ? promiseThen(p, undefined, rewordNoNetworkDenial) : p;
+}
+
 // Installed per isolate by __wmInitPerIsolate; 0 disables. Only a backstop
 // for the impossible case of fetch running before that init.
 let fetchResponseTimeoutMs = 900_000;
@@ -74,6 +85,21 @@ function fetchResponseTimeoutError(requestUrl, timeoutMs) {
   );
 }
 
+// Set per isolate for a `//no_network` script. The denial itself is the
+// isolate's permissions (Rust); this only replaces deno's "run again with the
+// --allow-net flag" hint, which names a flag a script author cannot pass.
+let noNetwork = false;
+
+function rewordNoNetworkDenial(e) {
+  if (e?.name === "NotCapable" && typeof e.message === "string") {
+    e.message = e.message.replace(
+      ", run again with the --allow-net flag",
+      ": the script is annotated //no_network",
+    );
+  }
+  throw e;
+}
+
 globalThis.atob = base64.atob;
 globalThis.btoa = base64.btoa;
 // Not `async`, for the same reason deno_fetch's own outer fetch isn't: WPT
@@ -152,7 +178,22 @@ globalThis.console = new console.Console((msg, level) =>
 );
 globalThis.AbortController = abortSignal.AbortController;
 globalThis.AbortSignal = abortSignal.AbortSignal;
-globalThis.crypto = crypto.crypto;
+// A getter, not a value: `crypto.crypto` mints a cppgc object, and the cppgc
+// heap is not attached while this module runs at snapshot-build time.
+Object.defineProperty(globalThis, "crypto", {
+  configurable: true,
+  enumerable: true,
+  get: () => crypto.crypto,
+  // Assignment has to keep working, as it does on a plain property.
+  set(value) {
+    Object.defineProperty(globalThis, "crypto", {
+      configurable: true,
+      enumerable: true,
+      writable: true,
+      value,
+    });
+  },
+});
 globalThis.Crypto = crypto.Crypto;
 globalThis.CryptoKey = crypto.CryptoKey;
 globalThis.SubtleCrypto = crypto.SubtleCrypto;
@@ -233,6 +274,7 @@ globalThis.__wmInitPerIsolate = (config) => {
   if (config != null && typeof config.fetchResponseTimeoutMs === "number") {
     fetchResponseTimeoutMs = config.fetchResponseTimeoutMs;
   }
+  noNetwork = config?.noNetwork === true;
 
   // setTimeOrigin() seeds performance.timeOrigin from the isolate's wall clock;
   // without it timeOrigin is undefined and `timeOrigin + performance.now()` is NaN.
@@ -256,13 +298,14 @@ globalThis.__wmInitPerIsolate = (config) => {
 };
 
 // Expose bootstrapOtel globally so it can be called from Rust after runtime creation.
-// We use dynamic import so deno_telemetry isn't loaded during snapshot creation.
+// Loaded on first call so deno_telemetry isn't evaluated during snapshot creation.
 // Config: [tracingEnabled, metricsEnabled, consoleConfig, deterministic]
 // consoleConfig: 0=ignore, 1=capture, 2=replace
 globalThis.__bootstrapOtel = () => {
-  import("ext:deno_telemetry/telemetry.ts").then(({ bootstrap, enterSpan }) => {
-    bootstrap([1, 0, 1, 0]);
-    // Expose enterSpan for setting parent trace context
-    globalThis.__enterSpan = enterSpan;
-  });
+  const { bootstrap, enterSpan } = core.loadExtScript(
+    "ext:deno_telemetry/telemetry.ts",
+  );
+  bootstrap([1, 0, 1, 0]);
+  // Expose enterSpan for setting parent trace context
+  globalThis.__enterSpan = enterSpan;
 };
diff --git a/backend/windmill-runtime-nativets/src/smoke_tests.rs b/backend/windmill-runtime-nativets/src/smoke_tests.rs
index f3da460227..1373a8abd4 100644
--- a/backend/windmill-runtime-nativets/src/smoke_tests.rs
+++ b/backend/windmill-runtime-nativets/src/smoke_tests.rs
@@ -451,6 +451,10 @@ export async function main(): Promise<{ uuid: string; nonzero: boolean; sha256:
         .map((b) => b.toString(16).padStart(2, "0"))
         .join("");
 
+    // `crypto` is installed as an accessor; polyfill-style assignment must
+    // still work rather than throw for want of a setter.
+    (globalThis as any).crypto = globalThis.crypto;
+
     return { uuid, nonzero, sha256 };
 }
 "#;
diff --git a/backend/windmill-runtime-nativets/tests/no_network.rs b/backend/windmill-runtime-nativets/tests/no_network.rs
index 876207fc26..dc7086f22e 100644
--- a/backend/windmill-runtime-nativets/tests/no_network.rs
+++ b/backend/windmill-runtime-nativets/tests/no_network.rs
@@ -55,6 +55,9 @@ async function attempt(f) {{
 export async function main() {{
   return {{
     fetch: await attempt(() => fetch("http://127.0.0.1:{port}/").then((r) => r.text())),
+    data_url: await attempt(() => fetch("data:text/plain,ok").then((r) => r.text())),
+    blob_url: await attempt(() => fetch(URL.createObjectURL(new Blob(["ok"]))).then((r) => r.text())),
+    raw_fetch: await attempt(() => Deno.core.ops.op_fetch("GET", "http://127.0.0.1:{port}/", [], null, false, null, null)),
     tcp: await attempt(() => Deno.core.ops.op_net_connect_tcp({{ hostname: "127.0.0.1", port: {port} }}, null, null)),
     unix: await attempt(() => Deno.core.ops.op_net_connect_unix("/var/run/docker.sock")),
     quic: await attempt(() => Deno.core.ops.op_quic_endpoint_create({{ hostname: "localhost", port: 0 }}, true)),
@@ -76,6 +79,15 @@ async fn no_network_denies_fetch_and_raw_socket_ops() {
         fetch.contains("no_network"),
         "fetch was not denied: {fetch}"
     );
+    // Neither opens a connection, so neither is network access.
+    assert_eq!(out["data_url"], "allowed", "{out}");
+    assert_eq!(out["blob_url"], "allowed", "{out}");
+    // The global `fetch` only words the refusal; the op under it is what refuses.
+    let raw_fetch = out["raw_fetch"].as_str().unwrap();
+    assert!(
+        raw_fetch.contains("Requires net access"),
+        "the fetch op was not denied: {raw_fetch}"
+    );
     for key in ["tcp", "unix", "quic"] {
         let msg = out[key].as_str().unwrap();
         assert!(
diff --git a/backend/windmill-runtime-nativets/tests/otel_e2e.rs b/backend/windmill-runtime-nativets/tests/otel_e2e.rs
index 22fd18de90..d1853c461d 100644
--- a/backend/windmill-runtime-nativets/tests/otel_e2e.rs
+++ b/backend/windmill-runtime-nativets/tests/otel_e2e.rs
@@ -71,7 +71,7 @@ async fn spawn_capturing_http(captured: Arc<Mutex<Vec<Vec<u8>>>>) -> u16 {
 /// drifts away from `tracing_enabled + Capture`, this test breaks
 /// before the customer-facing panic does.
 fn init_with_ee_otel_config() {
-    deno_telemetry::init(
+    windmill_runtime_nativets::init_telemetry(
         deno_telemetry::OtelRuntimeConfig {
             runtime_name: "windmill-nativets".into(),
             runtime_version: "0".into(),
@@ -157,13 +157,12 @@ export async function main(): Promise<number> {{
         "fetch target should have been hit exactly once"
     );
 
-    // 4. Force the BatchSpanProcessor to flush so the exporter posts
-    //    to our mock collector synchronously (default flush interval
-    //    is ~5s; tests can't wait that long).
-    deno_telemetry::flush();
-    // Exporter is async over the OTel runtime; give it a beat to
-    // actually send the HTTP request.
-    tokio::time::sleep(Duration::from_millis(500)).await;
+    // 4. The BatchSpanProcessor exports on its own schedule (about 5s by
+    //    default) and deno_telemetry exposes no flush, so wait for it.
+    let deadline = tokio::time::Instant::now() + Duration::from_secs(20);
+    while otlp_hits.lock().await.is_empty() && tokio::time::Instant::now() < deadline {
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
 
     let otlp_captured = otlp_hits.lock().await;
     assert!(
diff --git a/backend/windmill-runtime-nativets/tests/otel_init.rs b/backend/windmill-runtime-nativets/tests/otel_init.rs
index fdf1ac944d..80ef8683aa 100644
--- a/backend/windmill-runtime-nativets/tests/otel_init.rs
+++ b/backend/windmill-runtime-nativets/tests/otel_init.rs
@@ -46,7 +46,7 @@ async fn ee_otel_init_config_populates_otel_globals() {
     // Step 1: reproduce the footgun. `OtelConfig::default()` has
     // tracing/metrics off and `console = Ignore`, which trips the
     // 0.31 early-return — Ok(()) but OnceCell stays empty.
-    deno_telemetry::init(
+    windmill_runtime_nativets::init_telemetry(
         deno_telemetry::OtelRuntimeConfig {
             runtime_name: "windmill-nativets-test".into(),
             runtime_version: "0".into(),
@@ -63,10 +63,17 @@ async fn ee_otel_init_config_populates_otel_globals() {
          tracing_enabled/console fields."
     );
 
+    // The instance's own exporter shares this variable and may be set to gRPC,
+    // or to anything else. Native telemetry must not read it: a value
+    // deno_telemetry rejects outright shows it is never consulted.
+    // SAFETY: the only test in this binary, so nothing reads the environment
+    // concurrently.
+    unsafe { std::env::set_var("OTEL_EXPORTER_OTLP_PROTOCOL", "not-a-protocol") };
+
     // Step 2: re-call init with the exact config shape that the EE
     // `load_internal_otel_exporter` ships — this is what production
     // hits, so the test exercises the actual prod call path.
-    deno_telemetry::init(
+    windmill_runtime_nativets::init_telemetry(
         deno_telemetry::OtelRuntimeConfig {
             runtime_name: "windmill-nativets".into(),
             runtime_version: "0".into(),
diff --git a/flake.nix b/flake.nix
index f005644e3d..2a1d2699c8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -78,15 +78,16 @@
         ];
 
         # ---------------------------------------------------------------
-        # Prebuilt V8 binary (must match version in Cargo.toml)
+        # Prebuilt V8 binary (must match the `v8` pin in backend/Cargo.toml).
+        # The simdutf variant: deno_core enables that feature of the v8 crate.
         # ---------------------------------------------------------------
 
         rustyV8Archive = let
-          version = "137.1.0";
+          version = "150.4.0";
           target = stdenv.hostPlatform.rust.rustcTarget;
           sha256 = {
             x86_64-linux =
-              "sha256-Tiscfy2bzYGR3s0T+SC1IB3xWvTVpVcSEdjq3MCRoRw=";
+              "sha256-9IdiyhDR8fxgWkQcWuQw7Izh6egPFNePvELLh4wwtHY=";
             aarch64-linux = lib.fakeHash;
             x86_64-darwin = lib.fakeHash;
             aarch64-darwin = lib.fakeHash;
@@ -94,7 +95,7 @@
         in pkgs.fetchurl {
           name = "librusty_v8-${version}";
           url =
-            "https://github.com/denoland/rusty_v8/releases/download/v${version}/librusty_v8_release_${target}.a.gz";
+            "https://github.com/denoland/rusty_v8/releases/download/v${version}/librusty_v8_simdutf_release_${target}.a.gz";
           inherit sha256;
         };
 

From dedd77587f3234f3e480388b00340394794ac5bb Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 10 Oct 2026 12:40:00 +0200
Subject: [PATCH 5/8] fix: keep preserve_step_tags on saved branch and loop
 flow nodes (#11660)

* fix: keep preserve_step_tags on saved branch and loop flow nodes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* style: format reduce_flow call

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/tests/worker.rs                       | 95 +++++++++++++++++++
 .../windmill-worker/src/worker_lockfiles.rs   |  9 ++
 2 files changed, 104 insertions(+)

diff --git a/backend/tests/worker.rs b/backend/tests/worker.rs
index eebb14e07e..751752eb00 100644
--- a/backend/tests/worker.rs
+++ b/backend/tests/worker.rs
@@ -5000,6 +5000,101 @@ async fn test_flow_lock_all(db: Pool<Postgres>) -> anyhow::Result<()> {
     Ok(())
 }
 
+/// A deployed flow runs a multi-step loop body as the flow node its deploy stored, which
+/// carries its own copy of the flow's `preserve_step_tags`. A preview never loads that node.
+#[sqlx::test(fixtures("base"))]
+async fn test_saved_flow_preserves_nested_step_tags(db: Pool<Postgres>) -> anyhow::Result<()> {
+    use futures::StreamExt;
+
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let client = reqwest::Client::new();
+    let flow = json!({
+        "path": "g/all/saved_step_tags", "summary": "", "description": "", "tag": "python3",
+        "schema": { "type": "object", "properties": {}, "required": [] },
+        "value": {
+            "preserve_step_tags": true,
+            "modules": [{
+                "id": "loop",
+                "value": {
+                    "type": "forloopflow", "skip_failures": false,
+                    "iterator": { "type": "static", "value": [2, 3] },
+                    "modules": [{
+                        "id": "own_tag",
+                        "value": {
+                            "type": "rawscript", "language": "bun", "lock": "", "tag": "bun",
+                            "content": "export function main(n: number) { return n * n; }",
+                            "input_transforms": {
+                                "n": { "type": "javascript", "expr": "flow_input.iter.value" }
+                            }
+                        }
+                    }, {
+                        "id": "untagged",
+                        "value": {
+                            "type": "rawscript", "language": "bun", "lock": "",
+                            "content": "export function main(n: number) { return n + 1; }",
+                            "input_transforms": {
+                                "n": { "type": "javascript", "expr": "results.own_tag" }
+                            }
+                        }
+                    }]
+                }
+            }]
+        }
+    });
+    let mut completed = listen_for_completed_jobs(&db).await;
+    client
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/flows/create"
+        ))
+        .bearer_auth("SECRET_TOKEN")
+        .json(&flow)
+        .send()
+        .await?
+        .error_for_status()?;
+    let deployment = in_test_worker(&db, completed.next(), port).await.unwrap();
+    let deployed = completed_job(deployment, &db).await;
+    assert!(deployed.success, "{:?}", deployed.result);
+
+    let job_id = client
+        .post(format!(
+            "http://localhost:{port}/api/w/test-workspace/jobs/run/f/g/all/saved_step_tags"
+        ))
+        .bearer_auth("SECRET_TOKEN")
+        .json(&json!({}))
+        .send()
+        .await?
+        .error_for_status()?
+        .text()
+        .await?
+        .parse::<Uuid>()?;
+    in_test_worker(&db, completed.find(&job_id), port).await;
+    let job = completed_job(job_id, &db).await;
+    assert!(job.success, "{:?}", job.result);
+    let tags = sqlx::query_as::<_, (String, String)>(
+        "WITH RECURSIVE descendants AS (
+            SELECT id FROM v2_job WHERE id = $1
+            UNION ALL
+            SELECT child.id FROM v2_job child JOIN descendants ON child.parent_job = descendants.id
+        )
+        SELECT DISTINCT flow_step_id, tag FROM v2_job
+        WHERE id IN (SELECT id FROM descendants) AND flow_step_id IN ('own_tag', 'untagged')
+        ORDER BY flow_step_id, tag",
+    )
+    .bind(job_id)
+    .fetch_all(&db)
+    .await?;
+    assert_eq!(
+        tags,
+        vec![
+            ("own_tag".to_owned(), "bun".to_owned()),
+            ("untagged".to_owned(), "python3".to_owned())
+        ]
+    );
+    Ok(())
+}
+
 #[cfg(feature = "deno_core")]
 #[sqlx::test(fixtures("base"))]
 
diff --git a/backend/windmill-worker/src/worker_lockfiles.rs b/backend/windmill-worker/src/worker_lockfiles.rs
index b608601991..6189d39b8d 100644
--- a/backend/windmill-worker/src/worker_lockfiles.rs
+++ b/backend/windmill-worker/src/worker_lockfiles.rs
@@ -1244,6 +1244,7 @@ pub async fn handle_flow_dependency_job(
                 &job.workspace_id,
                 flow.failure_module.as_ref(),
                 flow.same_worker,
+                flow.preserve_step_tags,
             )
             .await?;
 
@@ -2134,6 +2135,7 @@ async fn insert_flow_modules<'c>(
     workspace_id: &str,
     failure_module: Option<&Box<FlowModule>>,
     same_worker: bool,
+    preserve_step_tags: bool,
     modules: &mut Vec<FlowModule>,
     modules_node: &mut Option<FlowNodeId>,
 ) -> Result<sqlx::Transaction<'c, sqlx::Postgres>> {
@@ -2144,6 +2146,7 @@ async fn insert_flow_modules<'c>(
         workspace_id,
         failure_module,
         same_worker,
+        preserve_step_tags,
     ))
     .await?;
     if modules.is_empty() || crate::worker_flow::is_simple_modules(modules, failure_module) {
@@ -2160,6 +2163,7 @@ async fn insert_flow_modules<'c>(
             modules: std::mem::take(modules),
             failure_module: failure_module.cloned(),
             same_worker,
+            preserve_step_tags,
             ..Default::default()
         }))),
         None,
@@ -2176,6 +2180,7 @@ async fn reduce_flow<'c>(
     workspace_id: &str,
     failure_module: Option<&Box<FlowModule>>,
     same_worker: bool,
+    preserve_step_tags: bool,
 ) -> Result<sqlx::Transaction<'c, sqlx::Postgres>> {
     use FlowModuleValue::*;
     for module in &mut *modules {
@@ -2234,6 +2239,7 @@ async fn reduce_flow<'c>(
                     workspace_id,
                     failure_module,
                     same_worker,
+                    preserve_step_tags,
                     modules,
                     modules_node,
                 )
@@ -2247,6 +2253,7 @@ async fn reduce_flow<'c>(
                         workspace_id,
                         failure_module,
                         same_worker,
+                        preserve_step_tags,
                         &mut branch.modules,
                         &mut branch.modules_node,
                     )
@@ -2258,6 +2265,7 @@ async fn reduce_flow<'c>(
                     workspace_id,
                     failure_module,
                     same_worker,
+                    preserve_step_tags,
                     default,
                     default_node,
                 )
@@ -2271,6 +2279,7 @@ async fn reduce_flow<'c>(
                         workspace_id,
                         failure_module,
                         same_worker,
+                        preserve_step_tags,
                         &mut branch.modules,
                         &mut branch.modules_node,
                     )

From 74c9b0cb2eebc16dd5e23f23be89b127bcbe6ec2 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 10 Oct 2026 12:45:20 +0200
Subject: [PATCH 6/8] feat: add python 3.14 and 3.15 to the supported instance
 versions (#11654)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../windmill-parser-py-imports/src/lib.rs       | 11 ++++++++---
 backend/src/main.rs                             |  5 ++++-
 backend/windmill-common/src/worker.rs           | 17 +++++++++++++++--
 backend/windmill-worker/src/worker.rs           |  2 ++
 cli/src/utils/script_common.ts                  |  4 +++-
 frontend/src/lib/components/instanceSettings.ts |  8 +++++++-
 6 files changed, 39 insertions(+), 8 deletions(-)

diff --git a/backend/parsers/windmill-parser-py-imports/src/lib.rs b/backend/parsers/windmill-parser-py-imports/src/lib.rs
index de7f51bc79..72597da385 100644
--- a/backend/parsers/windmill-parser-py-imports/src/lib.rs
+++ b/backend/parsers/windmill-parser-py-imports/src/lib.rs
@@ -351,13 +351,16 @@ async fn parse_python_imports_inner(
     temp_script_refs: &Option<HashMap<String, String>>,
 ) -> error::Result<HashMap<String, NImportResolved>> {
     tracing::debug!("Parsing python imports for path: {}", path);
-    let PythonAnnotations { py310, py311, py312, py313, .. } = PythonAnnotations::parse(&code);
+    let PythonAnnotations { py310, py311, py312, py313, py314, py315, .. } =
+        PythonAnnotations::parse(&code);
     tracing::debug!(
-        "Found python annotations - py310: {}, py311: {}, py312: {}, py313: {}",
+        "Found python annotations - py310: {}, py311: {}, py312: {}, py313: {}, py314: {}, py315: {}",
         py310,
         py311,
         py312,
-        py313
+        py313,
+        py314,
+        py315
     );
 
     let mut push_version_specifiers = |perform, unparsed: String| -> error::Result<()> {
@@ -373,6 +376,8 @@ async fn parse_python_imports_inner(
     push_version_specifiers(py311, "==3.11.*".to_owned())?;
     push_version_specifiers(py312, "==3.12.*".to_owned())?;
     push_version_specifiers(py313, "==3.13.*".to_owned())?;
+    push_version_specifiers(py314, "==3.14.*".to_owned())?;
+    push_version_specifiers(py315, "==3.15.*".to_owned())?;
 
     for x in code.lines() {
         if x.starts_with("# py:") || x.starts_with("#py:") {
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 66ddce60e2..b8fdd9353f 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -123,7 +123,8 @@ use windmill_worker::{
     BUN_BUNDLE_CACHE_DIR, BUN_CACHE_DIR, CSHARP_CACHE_DIR, DENO_CACHE_DIR, DENO_CACHE_DIR_DEPS,
     DENO_CACHE_DIR_NPM, GO_BIN_CACHE_DIR, GO_CACHE_DIR, JAVA_CACHE_DIR, NU_CACHE_DIR,
     POWERSHELL_CACHE_DIR, PY310_CACHE_DIR, PY311_CACHE_DIR, PY312_CACHE_DIR, PY313_CACHE_DIR,
-    RUBY_CACHE_DIR, RUST_CACHE_DIR, R_CACHE_DIR, TAR_JAVA_CACHE_DIR, UV_CACHE_DIR,
+    PY314_CACHE_DIR, PY315_CACHE_DIR, RUBY_CACHE_DIR, RUST_CACHE_DIR, R_CACHE_DIR,
+    TAR_JAVA_CACHE_DIR, UV_CACHE_DIR,
 };
 
 use crate::monitor::{
@@ -2179,6 +2180,8 @@ pub async fn run_workers(
         &*PY311_CACHE_DIR,
         &*PY312_CACHE_DIR,
         &*PY313_CACHE_DIR,
+        &*PY314_CACHE_DIR,
+        &*PY315_CACHE_DIR,
         &*BUN_BUNDLE_CACHE_DIR,
         &*GO_CACHE_DIR,
         &*GO_BIN_CACHE_DIR,
diff --git a/backend/windmill-common/src/worker.rs b/backend/windmill-common/src/worker.rs
index 9bc788d9f3..58223c5d4a 100644
--- a/backend/windmill-common/src/worker.rs
+++ b/backend/windmill-common/src/worker.rs
@@ -1201,6 +1201,8 @@ pub struct PythonAnnotations {
     pub py311: bool,
     pub py312: bool,
     pub py313: bool,
+    pub py314: bool,
+    pub py315: bool,
     pub sandbox: bool,
 }
 
@@ -2892,6 +2894,8 @@ pub enum PyVAlias {
     #[default]
     Py312,
     Py313,
+    Py314,
+    Py315,
 }
 
 impl Into<pep440_rs::Version> for PyVAlias {
@@ -2909,13 +2913,20 @@ impl Into<u32> for PyVAlias {
 impl PyVAlias {
     pub fn all<T: From<PyVAlias>>() -> Vec<T> {
         use PyVAlias::*;
-        vec![Py310.into(), Py311.into(), Py312.into(), Py313.into()]
+        vec![
+            Py310.into(),
+            Py311.into(),
+            Py312.into(),
+            Py313.into(),
+            Py314.into(),
+            Py315.into(),
+        ]
     }
     // Get MAJOR part of alias. (semver: MAJOR.MINOR.PATCH)
     fn major(&self) -> u32 {
         use PyVAlias::*;
         match self {
-            Py310 | Py311 | Py312 | Py313 => 3,
+            Py310 | Py311 | Py312 | Py313 | Py314 | Py315 => 3,
             // Py400 | Py401 => 4
         }
     }
@@ -2930,6 +2941,8 @@ impl PyVAlias {
             "311" => Some(Py311),
             "312" => Some(Py312),
             "313" => Some(Py313),
+            "314" => Some(Py314),
+            "315" => Some(Py315),
             _ => None,
         }
     }
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 5ae626f27e..7c3c3971fa 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -215,6 +215,8 @@ lazy_static::lazy_static! {
     pub static ref PY311_CACHE_DIR: String = format!("{}python_3_11", *ROOT_CACHE_DIR);
     pub static ref PY312_CACHE_DIR: String = format!("{}python_3_12", *ROOT_CACHE_DIR);
     pub static ref PY313_CACHE_DIR: String = format!("{}python_3_13", *ROOT_CACHE_DIR);
+    pub static ref PY314_CACHE_DIR: String = format!("{}python_3_14", *ROOT_CACHE_DIR);
+    pub static ref PY315_CACHE_DIR: String = format!("{}python_3_15", *ROOT_CACHE_DIR);
 
     pub static ref TAR_JAVA_CACHE_DIR: String = format!("{}tar/java", *ROOT_CACHE_DIR);
 
diff --git a/cli/src/utils/script_common.ts b/cli/src/utils/script_common.ts
index 611268c27c..e3deabb6a7 100644
--- a/cli/src/utils/script_common.ts
+++ b/cli/src/utils/script_common.ts
@@ -189,6 +189,8 @@ const LANG_ANNOTATIONS: Partial<Record<ScriptLanguage, string[]>> = {
     "py311",
     "py312",
     "py313",
+    "py314",
+    "py315",
     "sandbox",
   ],
   bun: ["npm", "nodejs", "native", "nobundling", "sandbox"],
@@ -208,7 +210,7 @@ const LANG_ANNOTATIONS: Partial<Record<ScriptLanguage, string[]>> = {
  *
  * `# py: <specifier>` is the exception the macro does not cover: the python
  * import parser reads it directly (`windmill-parser-py-imports`, alongside the
- * `py310`..`py313` flags) to pick the interpreter, which changes what resolves.
+ * `py310`..`py315` flags) to pick the interpreter, which changes what resolves.
  */
 export function hasLockAffectingAnnotation(
   scriptContent: string,
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index 867570e1a1..83fba2b8ac 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -840,7 +840,7 @@ export const settings: Record<string, Setting[]> = {
 			// 1. Change placeholder in instanceSettings.ts
 			// 2. Change LATEST_STABLE_PY in dockerfile
 			// 3. Change #[default] annotation for PyVersion in backend
-			placeholder: '3.10,3.11,3.12,3.13',
+			placeholder: '3.10,3.11,3.12,3.13,3.14,3.15',
 			select_items: [
 				{
 					label: 'Latest Stable',
@@ -858,6 +858,12 @@ export const settings: Record<string, Setting[]> = {
 				},
 				{
 					label: '3.13'
+				},
+				{
+					label: '3.14'
+				},
+				{
+					label: '3.15'
 				}
 			],
 			storage: 'setting'

From 0250a90849fc01589e8544b91c680277570a68b6 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 10 Oct 2026 12:50:56 +0200
Subject: [PATCH 7/8] chore: bump tokio to 1.53 lts (#11663)

* chore: bump tokio to 1.51 lts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: move tokio pin to 1.53 lts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/AGENTS.md  |  2 +-
 backend/Cargo.lock | 73 +++++-----------------------------------------
 backend/Cargo.toml |  2 +-
 3 files changed, 9 insertions(+), 68 deletions(-)

diff --git a/backend/AGENTS.md b/backend/AGENTS.md
index 750e0594e1..fbacb857ee 100644
--- a/backend/AGENTS.md
+++ b/backend/AGENTS.md
@@ -214,7 +214,7 @@ Whole classes of defect compile and unit-test clean:
 - **Stack overflow from a large buffer in an async block.** An array declared across an
   `.await` is baked into the future's state; once that future is boxed a few layers deep
   by the job poller, two 16 KB arrays abort the worker *process* (`thread
-  'tokio-runtime-worker' has overflowed its stack`). Heap-allocate read buffers
+  'tokio-rt-worker' has overflowed its stack`). Heap-allocate read buffers
   (`vec![0u8; N]`, not `[0u8; N]`).
 - Deadlocks from draining only one of a child's pipes, missed cancellation or timeout
   propagation, and anything depending on the real engine's output format.
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index efd46867fb..ce517a7487 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2,15 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "addr2line"
-version = "0.25.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
-dependencies = [
- "gimli",
-]
-
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -247,7 +238,7 @@ version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73cd58deff2140a0a8eae87e417bd01db68a33e148aa93d1e8cd837e55e312b6"
 dependencies = [
- "object 0.39.1",
+ "object",
 ]
 
 [[package]]
@@ -1623,21 +1614,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "backtrace"
-version = "0.3.76"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide 0.8.9",
- "object 0.37.3",
- "rustc-demangle",
- "windows-link 0.2.1",
-]
-
 [[package]]
 name = "base16ct"
 version = "0.2.0"
@@ -5921,12 +5897,6 @@ dependencies = [
  "polyval",
 ]
 
-[[package]]
-name = "gimli"
-version = "0.32.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
-
 [[package]]
 name = "git-version"
 version = "0.3.9"
@@ -7055,17 +7025,6 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "io-uring"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed3bd0ecfbb87805f538bb7b32e5239ca0763890c623e349860ecba69469f2bb"
-dependencies = [
- "bitflags 2.13.2",
- "cfg-if",
- "libc",
-]
-
 [[package]]
 name = "ipconfig"
 version = "0.3.4"
@@ -8803,15 +8762,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "object"
-version = "0.37.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "object"
 version = "0.39.1"
@@ -11201,12 +11151,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "rustc-demangle"
-version = "0.1.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b74b56ffa8bb2830709a538c2cbcae9aa062db0d2a42563bfb09bdaae44020eb"
-
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -13934,23 +13878,20 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.47.1"
+version = "1.53.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
+checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
 dependencies = [
- "backtrace",
  "bytes",
- "io-uring",
  "libc",
  "mio",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "slab",
  "socket2 0.6.5",
  "tokio-macros",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -13979,13 +13920,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index e91ad01795..306a3ae9f6 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -451,7 +451,7 @@ headers = "^0"
 hyper = { version = "^1", features = ["full"] }
 hyper-tls = "^0.6"
 hyper-util = { version = "^0.1", features = ["client-legacy", "http1", "tokio"] }
-tokio = { version = "=1.47.1", features = ["full", "tracing", "time"] }
+tokio = { version = "=1.53.2", features = ["full", "tracing", "time"] }
 tokio-stream = { version = "0.1.17" }
 tower = "^0"
 tower-http = { version = "^0.6", features = ["trace", "cors", "catch-panic"] }

From ed7a859e8c4799bed086baf707b817a68f93d2a4 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 10 Oct 2026 13:06:58 +0200
Subject: [PATCH 8/8] chore: bump uv to 0.13.0 (#11665)

* chore: bump uv to 0.13.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: pin the python ansible is installed on in the full images

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/DockerfileBackendTests             | 2 +-
 .github/workflows/backend-test-windows.yml | 2 +-
 .github/workflows/backend-test.yml         | 2 +-
 Dockerfile                                 | 2 +-
 docker/DockerfileFull                      | 4 +++-
 docker/DockerfileFullEe                    | 4 +++-
 docker/DockerfileSlim                      | 2 +-
 docker/DockerfileSlimEe                    | 2 +-
 8 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/DockerfileBackendTests b/.github/DockerfileBackendTests
index 87a65214ab..2ce47ea714 100644
--- a/.github/DockerfileBackendTests
+++ b/.github/DockerfileBackendTests
@@ -28,7 +28,7 @@ ENV PATH="${PATH}:/usr/local/go/bin"
 ENV GO_PATH=/usr/local/go/bin/go
 
 # UV
-RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.11.24/uv-installer.sh | sh && mv /usr/local/cargo/bin/uv /usr/local/bin/uv
+RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.13.0/uv-installer.sh | sh && mv /usr/local/cargo/bin/uv /usr/local/bin/uv
 
 ENV TZ=Etc/UTC
 
diff --git a/.github/workflows/backend-test-windows.yml b/.github/workflows/backend-test-windows.yml
index 73fe57ca6a..3468449753 100644
--- a/.github/workflows/backend-test-windows.yml
+++ b/.github/workflows/backend-test-windows.yml
@@ -81,7 +81,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@v7
         with:
-          version: "0.11.24"
+          version: "0.13.0"
 
       - uses: shivammathur/setup-php@v2
         with:
diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml
index a9a2c573d6..cdfda7e0d4 100644
--- a/.github/workflows/backend-test.yml
+++ b/.github/workflows/backend-test.yml
@@ -64,7 +64,7 @@ jobs:
           node-version: "24"
       - uses: astral-sh/setup-uv@v7
         with:
-          version: "0.11.24"
+          version: "0.13.0"
       - uses: shivammathur/setup-php@v2
         with:
           php-version: "8.3"
diff --git a/Dockerfile b/Dockerfile
index fb4583bf1d..faaa49dd8d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -242,7 +242,7 @@ ENV PATH="${PATH}:/usr/local/go/bin"
 ENV GO_PATH=/usr/local/go/bin/go
 
 # Install UV
-RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.11.24/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
+RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.13.0/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
 
 # Preinstall python runtimes to temp build location (will copy with world-writable perms later)
 # --compile-bytecode precompiles the stdlib to .pyc so jobs don't recompile it on every run
diff --git a/docker/DockerfileFull b/docker/DockerfileFull
index 3528ead3aa..c3a82c8312 100644
--- a/docker/DockerfileFull
+++ b/docker/DockerfileFull
@@ -15,7 +15,9 @@ RUN RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo /usr/local/cargo/b
 # ansible there leaves its venv interpreter as a dangling symlink at runtime, so every
 # ansible-* executable fails with ENOENT ("ansible-galaxy not found"). Pin the tool's
 # interpreter to a persistent image path so the install stays self-contained.
-RUN UV_PYTHON_INSTALL_DIR=/usr/local/uv/py uv tool install ansible && [ -d "$(uv tool dir)/ansible/bin/" ] && find "$(uv tool dir)/ansible/bin/" -mindepth 1 -maxdepth 1 -type f -executable -regextype posix-extended -regex '^((.+/)?)[^.]+' -print0 | xargs -0 ln -sf -t "$UV_TOOL_BIN_DIR/" || true
+# The version is explicit because uv otherwise downloads its newest stable Python, which
+# ansible-core may not support yet: the install succeeds and every executable fails on import.
+RUN UV_PYTHON_INSTALL_DIR=/usr/local/uv/py uv tool install --python 3.14 ansible && [ -d "$(uv tool dir)/ansible/bin/" ] && find "$(uv tool dir)/ansible/bin/" -mindepth 1 -maxdepth 1 -type f -executable -regextype posix-extended -regex '^((.+/)?)[^.]+' -print0 | xargs -0 ln -sf -t "$UV_TOOL_BIN_DIR/" || true
 
 # C#
 RUN wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh \
diff --git a/docker/DockerfileFullEe b/docker/DockerfileFullEe
index 1dd1a1eb6d..bb83195f62 100644
--- a/docker/DockerfileFullEe
+++ b/docker/DockerfileFullEe
@@ -35,7 +35,9 @@ RUN RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo /usr/local/cargo/b
 # ansible there leaves its venv interpreter as a dangling symlink at runtime, so every
 # ansible-* executable fails with ENOENT ("ansible-galaxy not found"). Pin the tool's
 # interpreter to a persistent image path so the install stays self-contained.
-RUN UV_PYTHON_INSTALL_DIR=/usr/local/uv/py uv tool install ansible && [ -d "$(uv tool dir)/ansible/bin/" ] && find "$(uv tool dir)/ansible/bin/" -mindepth 1 -maxdepth 1 -type f -executable -regextype posix-extended -regex '^((.+/)?)[^.]+' -print0 | xargs -0 ln -sf -t "$UV_TOOL_BIN_DIR/" || true
+# The version is explicit because uv otherwise downloads its newest stable Python, which
+# ansible-core may not support yet: the install succeeds and every executable fails on import.
+RUN UV_PYTHON_INSTALL_DIR=/usr/local/uv/py uv tool install --python 3.14 ansible && [ -d "$(uv tool dir)/ansible/bin/" ] && find "$(uv tool dir)/ansible/bin/" -mindepth 1 -maxdepth 1 -type f -executable -regextype posix-extended -regex '^((.+/)?)[^.]+' -print0 | xargs -0 ln -sf -t "$UV_TOOL_BIN_DIR/" || true
 # dotnet SDK
 RUN wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh \
     && chmod +x dotnet-install.sh \
diff --git a/docker/DockerfileSlim b/docker/DockerfileSlim
index 45986bbd5f..a37ced0eca 100644
--- a/docker/DockerfileSlim
+++ b/docker/DockerfileSlim
@@ -58,7 +58,7 @@ RUN curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmo
 ENV TZ=Etc/UTC
 
 # Install UV
-RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.11.24/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
+RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.13.0/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
 
 # Preinstall python runtime to temp location (will copy with world-writable perms later)
 # --compile-bytecode precompiles the stdlib to .pyc so jobs don't recompile it on every run
diff --git a/docker/DockerfileSlimEe b/docker/DockerfileSlimEe
index 5ac24f5c1d..687b1506ce 100644
--- a/docker/DockerfileSlimEe
+++ b/docker/DockerfileSlimEe
@@ -58,7 +58,7 @@ RUN curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmo
 ENV TZ=Etc/UTC
 
 # Install UV
-RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.11.24/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
+RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.13.0/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
 
 # Preinstall python runtime to temp location (will copy with world-writable perms later)
 # --compile-bytecode precompiles the stdlib to .pyc so jobs don't recompile it on every run