* fix: truncate strings on char boundaries to avoid panics on multibyte input
* fix: add borrowed truncate_chars helper and pin ee ref for audit fix
* docs: clarify truncate_with_ellipsis length contract
* chore: update ee-repo-ref to bbfb0de0dc9fa06130a231eb10c64f60238d1bbd
This commit updates the EE repository reference after PR #690 was merged in windmill-ee-private.
Previous ee-repo-ref: de15aeff12daf457711f5b981de691418484535c
New ee-repo-ref: bbfb0de0dc9fa06130a231eb10c64f60238d1bbd
Automated by sync-ee-ref workflow.
---------
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Previously each API replica generated a random Ed25519 signing key at
startup (unless DEBUG_SIGNING_KEY_SEED was set). In multi-replica
deployments this caused "Invalid JWT signature" rejections in the
multiplayer server: the browser could sign a token on pod A while
`windmill-extra` had cached the JWKS public key from pod B.
Derive the seed deterministically from the DB-backed JWT_SECRET using
SHA-256 with a domain-separation tag so all pods agree without
coordination. Re-derive on JWT_SECRET rotation. The
DEBUG_SIGNING_KEY_SEED env var is still honored as an override.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ruben Fiszel