Ruben Fiszel 8053266f88 fix(mcp): resolve MCP resource token via caller RLS + SSRF-guard url (#9428) ...

* fix(mcp): resolve MCP resource token via caller RLS + SSRF-guard url

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(mcp): clone user_db for oauth2 refresh and drop advisory ids from comments

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(mcp): disable redirects on MCP client to prevent SSRF bypass

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-03 09:00:43 +00:00

..

app_custom_path_cross_workspace.sql

fix: actionable error when a custom_path is taken by an app in another workspace (#9190)

2026-05-16 08:29:53 +00:00

app_preview_auth.sql

fix: enforce auth guards on app component preview execution (#9235)

2026-05-19 17:40:55 +00:00

base.sql

feat: store hashed tokens instead of plaintext (#8217)

2026-03-17 01:15:38 +00:00

batch_rerun.sql

fix: handle singlestepflow zombies and stop filtering them from runs page (#9055)

2026-05-07 08:00:38 +00:00

bun_edge_cases.sql

feat: upgrade bun to v1.3.8 with regression tests (#7761)

2026-02-04 11:38:15 +00:00

dedicated_flows.sql

fix: dedicated worker dispatch, cross-workspace deps, UI improvements (#8689)

2026-04-03 17:50:07 +00:00

dependency_map.sql

feat: workspace dependencies (#7124)

2025-11-28 16:00:11 +00:00

djob_debouncing.sql

feat: dependency job debouncing (#6769)

2025-10-16 16:49:35 +00:00

end_user_email.sql

feat: store hashed tokens instead of plaintext (#8217)

2026-03-17 01:15:38 +00:00

folder_default_permissioned_as.sql

feat: folder default_permissioned_as rules for ownership defaults on deploy (#8801)

2026-04-12 20:14:07 +00:00

fork_deployment_requests.sql

feat: add deploy restriction rule and fork review requests (#8804)

2026-04-13 17:10:37 +00:00

hello.sql

feat: add preprocessor support for dedicated workers and bunnative scripts (#8284)

2026-03-10 18:26:02 +00:00

hub_sync_blacklist.sql

feat: workspace dependencies (#7124)

2025-11-28 16:00:11 +00:00

instance_group_auto_add.sql

test: add integration tests for instance group and workspace auto-add interaction

2026-01-26 23:46:27 +00:00

jobs_read_auth.sql

fix(backend): authorize single-job read endpoints by job/flow visibility (#9416)

2026-06-02 22:10:16 +00:00

lockfile_python.sql

feat(python): per import requirement pin (#5520)

2025-04-11 21:31:51 +00:00

mcp_token_exfil.sql

fix(mcp): resolve MCP resource token via caller RLS + SSRF-guard url (#9428)

2026-06-03 09:00:43 +00:00

multipython.sql

feat(python): inline script metadata (PEP 723) (#5712)

2025-05-24 02:13:47 +02:00

permissions_test.sql

fix: replace email with permissioned_as for triggers/schedules (#8439)

2026-03-20 16:28:38 +00:00

preserve_on_behalf_of.sql

fix: replace email with permissioned_as for triggers/schedules (#8439)

2026-03-20 16:28:38 +00:00

relative_bun.sql

feat(cache): remove persistent raw values from queue (#4866)

2024-12-16 17:10:16 +01:00

relative_deno.sql

feat(cache): remove persistent raw values from queue (#4866)

2024-12-16 17:10:16 +01:00

relative_python.sql

fix(backend): rework dependency_map handling (#6598)

2025-09-24 13:40:39 +00:00

resources_test.sql

add back mcp_tools endpoints

2026-02-08 20:50:58 +00:00

restrict_deploy_to_deployers.sql

feat: add deploy restriction rule and fork review requests (#8804)

2026-04-13 17:10:37 +00:00

result_format.sql

backend: finalize v2 migration (v2 phase 4 - final) (#5155)

2025-02-13 17:10:30 +01:00

schedule_push.sql

fix: prevent schedule pool connection exhaustion (#7821)

2026-02-05 23:25:42 +00:00

schedule.sql

feat(cache): remove persistent raw values from queue (#4866)

2024-12-16 17:10:16 +01:00

secret_backend.sql

fix: parse Python datetime.datetime and datetime.date type annotations (#7856)

2026-02-09 15:17:26 +00:00

start_all_triggers.sh

test: add end-to-end trigger integration tests and DB CRUD tests

2026-02-09 12:28:25 +00:00

start_gcp_pubsub.sh

test: add end-to-end trigger integration tests and DB CRUD tests

2026-02-09 12:28:25 +00:00

start_kafka.sh

test: add end-to-end trigger integration tests and DB CRUD tests

2026-02-09 12:28:25 +00:00

start_mqtt.sh

test: add end-to-end trigger integration tests and DB CRUD tests

2026-02-09 12:28:25 +00:00

start_nats.sh

test: add end-to-end trigger integration tests and DB CRUD tests

2026-02-09 12:28:25 +00:00

start_postgres_replication.sh

test: add end-to-end trigger integration tests and DB CRUD tests

2026-02-09 12:28:25 +00:00

start_sqs.sh

test: add end-to-end trigger integration tests and DB CRUD tests

2026-02-09 12:28:25 +00:00

start_websocket.sh

test: add end-to-end trigger integration tests and DB CRUD tests

2026-02-09 12:28:25 +00:00

variables_test.sql

add back mcp_tools endpoints

2026-02-08 20:50:58 +00:00

wac_preprocessor.sql

fix(wac): recognize @workflow main, list WAC in scripts/list, run preprocessor (#8951)

2026-04-27 13:38:49 +00:00

wmill_cli_test.sql

feat(cli): add consistent get/list/new subcommands for all item types (#8047)

2026-02-22 07:53:28 +00:00

workspace_dependencies_leafs.sql

feat: workspace dependencies (#7124)

2025-11-28 16:00:11 +00:00

workspace_dependencies.sql

feat: workspace dependencies (#7124)

2025-11-28 16:00:11 +00:00

ws_specific.sql

feat: add workspace-specific flag for resources and variables (#8836)

2026-05-07 13:35:54 +00:00