From ccb1a3614db62b158d2df9d0af55071d55804b46 Mon Sep 17 00:00:00 2001 From: Alexander Petric Date: Sun, 11 Oct 2026 19:01:18 +0000 Subject: [PATCH] docs: note the aead gate covers workers only and is one-way Co-Authored-By: Claude Opus 5.5 (1M context) --- backend/windmill-common/src/min_version.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/windmill-common/src/min_version.rs b/backend/windmill-common/src/min_version.rs index 61f8d62117..f255bf5cae 100644 --- a/backend/windmill-common/src/min_version.rs +++ b/backend/windmill-common/src/min_version.rs @@ -25,7 +25,9 @@ pub const MIN_VERSION_SUPPORTS_BUN_LOCKFILE_V2: VC = vc(1, 794, 0, "Bun v2 lockf pub const MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES: VC = vc(1, 822, 0, "Restricted job tokens"); // The release that reads AES-256-GCM workspace ciphertext. A worker that predates it reads // secrets from the database with the CBC cipher alone and fails every job using a value -// written in the new format. Must name the release this ships in. +// written in the new format. Must name the release this ships in. Only worker versions are +// seen here, not servers; once met, the background pass rewrites every secret variable, so +// going back below this release leaves them unreadable. pub const MIN_VERSION_SUPPORTS_AEAD_SECRETS: VC = vc(1, 831, 0, "AES-GCM secret encryption"); pub const MIN_VERSION_SUPPORTS_NODE_DEBOUNCING: VC = vc(1, 658, 0, "Flow node debouncing"); pub const MIN_VERSION_SUPPORTS_TOKEN_HASH: VC = vc(1, 659, 0, "Token hash storage");