diff --git a/CHANGELOG.md b/CHANGELOG.md
index 620fe48b59..649435e322 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.603.3](https://github.com/windmill-labs/windmill/compare/v1.603.2...v1.603.3) (2026-01-11)
+
+
+### Bug Fixes
+
+* various input tightening ([7a9ef14](https://github.com/windmill-labs/windmill/commit/7a9ef140b512d8d4af21f90fad79619ce33cb3fd))
+
 ## [1.603.2](https://github.com/windmill-labs/windmill/compare/v1.603.1...v1.603.2) (2026-01-09)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index dd34923545..7723150cb7 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2842,9 +2842,9 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.9.0"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
+checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
 
 [[package]]
 name = "data-url"
@@ -15189,7 +15189,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15252,7 +15252,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15374,7 +15374,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15384,7 +15384,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15398,7 +15398,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "axum",
@@ -15417,7 +15417,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15511,7 +15511,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "regex",
  "serde",
@@ -15526,7 +15526,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15550,7 +15550,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15566,7 +15566,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "reqwest 0.12.28",
@@ -15579,7 +15579,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "async-oauth2",
@@ -15603,7 +15603,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15612,7 +15612,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15624,7 +15624,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15636,7 +15636,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15648,7 +15648,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15660,7 +15660,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15672,7 +15672,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15683,7 +15683,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15694,7 +15694,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15707,7 +15707,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15731,7 +15731,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15745,7 +15745,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15762,7 +15762,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15776,7 +15776,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15795,7 +15795,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "serde",
@@ -15806,7 +15806,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15843,7 +15843,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15853,7 +15853,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.603.2"
+version = "1.603.3"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 58997a62c1..6af0659979 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.603.2"
+version = "1.603.3"
 authors.workspace = true
 edition.workspace = true
 
@@ -35,7 +35,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.603.2"
+version = "1.603.3"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index a08eab7afb..6399c7b979 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.603.2
+  version: 1.603.3
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index b39f93b0a9..36da8d0017 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.603.2";
+export const VERSION = "v1.603.3";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 21d7f65f78..ac00a14cbb 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -70,7 +70,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.603.2";
+export const VERSION = "1.603.3";
 
 // Re-exported from constants.ts to maintain backwards compatibility
 export { WM_FORK_PREFIX } from "./core/constants.ts";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 64242f8ce7..84eed52f45 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.603.2",
+	"version": "1.603.3",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.603.2",
+			"version": "1.603.3",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 3408920dfc..e46bdbcea9 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.603.2",
+	"version": "1.603.3",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 1facc047a4..12563c5b5f 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.603.2"
-wmill_pg = ">=1.603.2"
+wmill = ">=1.603.3"
+wmill_pg = ">=1.603.3"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index cec48583f4..b671d4cf97 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.603.2
+  version: 1.603.3
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 0081201d4c..5290ad260c 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.603.2'
+    ModuleVersion     = '1.603.3'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index d15d8f7faa..8030ad3fd8 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.603.2"
+version = "1.603.3"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index 5ac3222b0d..8b33f64342 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.603.2"
+version = "1.603.3"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index b169699c50..e213d168e6 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.603.2",
+  "version": "1.603.3",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 7a8ad93dea..00d93e0bfa 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.603.2",
+  "version": "1.603.3",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index c42b7aa951..206df3af1a 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.603.2
+1.603.3