The published ghcr.io/windmill-labs/windmill-cli image shipped two fixable
CRITICAL findings:
- openssl (libssl3t64, openssl-provider-legacy): stale in the oven/bun:slim
base image (CVE-2026-34182). Fixed by running apt-get upgrade so the image
picks up the patched Debian packages.
- vitest 2.1.9 (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): a dev-only
devDependency reference in esrap's cached package.json living in bun's
package download cache. The cache is unused at runtime, so it is removed
after install.
Validated by building the image and scanning with Trivy: openssl now reports
3.5.6-1~deb13u2 (fixed) and vitest is entirely absent. wmill still runs. The
only remaining CRITICALs are perl-base CVEs with no upstream fix available.
Fixes GIT-922
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(cli): add consistent get/list/new subcommands for all item types
Make the CLI consistent so every item type (script, flow, app, resource,
resource-type, variable, schedule, folder, trigger) supports get/list/new
subcommands, enabling the CLI to be used as a full API client in bash
scripts with jq piping.
- Add --json flag to all list commands for machine-readable output
- Register explicit "list" subcommand alongside default action
- Add "get <path> [--json]" subcommand to fetch single items from API
- Rename "bootstrap" to "new" for script/flow, keep "bootstrap" as alias
- Add "new" subcommand for resource, resource-type, variable, schedule,
folder, and trigger to create local template YAML files
- Update cli-commands skill documentation for wmill init
- Add integration tests for all new commands
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* feat: install wmill CLI in Docker images and use it for bash variable/resource access
- Install windmill-cli via bun in all Dockerfiles that include bun
- DockerfileCli: switch from node:slim to oven/bun:slim
- CLI: auto-configure from WM_WORKSPACE/WM_TOKEN/BASE_INTERNAL_URL env vars
as last-resort fallback when no workspace is configured
- Frontend: replace curl-based bash snippets with wmill variable/resource get
- Add backend integration tests for wmill CLI in bash scripts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ci): install windmill-cli in backend test workflow
Ensures wmill is available on PATH for bash integration tests
that use `wmill variable get` and `wmill resource get`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor(cli): replace @std/* Deno dependencies with Node.js equivalents
Replace @std/log with a lightweight custom logger (core/log.ts),
@std/path with node:path, and @std/yaml with the yaml npm package.
Also fix process hang on exit, add --node option to install_dev.sh,
and add missing hasRequiredPermissions to NpmProvider.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* all
* all
* refactor(cli): replace @ayonli/jsext and @std/encoding with lightweight alternatives
Replace @ayonli/jsext (8.4MB) with tar-stream (32kB) for tar creation,
replace @std/encoding with Node.js Buffer.toString("hex"), and fix
@windmill-labs/shared-utils to use direct npm instead of JSR mirror.
Also resolve merge conflicts in sync.ts and fix pre-existing type errors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(cli): use singleQuote YAML output and pass yamlOptions in gitsync pull
The yaml library defaults to double quotes, but the codebase (and tests)
expect single-quoted strings. Add singleQuote: true to yamlOptions and
pass yamlOptions to gitsync-settings pull writeFile calls.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* all
* all
* fix(cli): address code review feedback
- Install CLI from source in backend tests instead of npm
- Fix script bootstrap catch block to re-throw "File already exists"
- Add type-safe local variable after trigger kind validation
- Use created_by instead of policy.on_behalf_of for app get output
- Note --kind is recommended for faster trigger lookup in help text
- Document node symlink purpose in Dockerfiles
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ci): use /usr/bin for wmill wrapper to ensure it's in PATH
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(ci): install wmill to ~/.local/bin to avoid permission issues
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ci(backend): switch to Blacksmith runner and add cargo caching
- Switch from ubicloud-standard-16 to blacksmith-16vcpu-ubuntu-2404 for faster NVMe-backed builds
- Add stickydisk for cargo target directory (persistent NVMe cache across runs)
- Add cache for cargo registry and git dependencies
- Upgrade DuckDB FFI cache from actions/cache@v3 to useblacksmith/cache@v1
- Enable CARGO_INCREMENTAL=1 to benefit from persistent target cache
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix ci
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Ruben Fiszel
Ruben Fiszel