Ruben Fiszel 751c999e26 fix: read every colon split in a builder app's triggerable keys ...

`execute_component` looks up `format!("{component}:{path}")` and `component` is an
unrestricted string, so every colon in a triggerable key is a possible split, not
just the first. Validation stripped only up to the first one, so `x:y:script/hub/1/foo`
parsed as neither a script nor a flow key and was skipped entirely, while a request
with `component = "x:y"` matched it exactly. A builder could deploy a clean
Publisher app and run hub code, or any unreadable runnable, on a worker.

Now every suffix that parses as a runnable is validated, rather than guessing which
one a request will use.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-17 16:49:46 +00:00

..

agent-worker-e2e.md

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

app-mode-ai-chat-review.md

docs: remove stale planning notes (#9342)

2026-05-27 07:19:51 +00:00

clone_repo_and_upload_to_instance_storage.bun.ts

[ee] fix: GitRepoViewer reliable load for large repos (#8991)

2026-04-30 13:28:50 +00:00

dbt-runtime.md

feat(dbt): reach any dbt adapter through a dbt_profile resource, and constrain the warehouse picker (#10525)

2026-08-05 00:34:26 +02:00

docker-security.md

security(docker): apt-get upgrade base OS in all runtime base stages (#10114)

2026-07-15 01:50:50 +02:00

docker-v2-runtime.md

fix: return result.json and stdout results from sandboxed containers (#10460)

2026-08-03 12:35:12 +02:00

duckdb-isolation.md

feat: bound how much disk a single duckdb job can spill (#10645)

2026-08-12 01:55:45 +02:00

ducklake-materialization.md

feat(pipelines): wm_partition macro for grain-agnostic partition filters (#9950)

2026-07-06 10:26:53 +02:00

enterprise.md

feat(pipeline): write-audit-publish for materialization data tests (#9911)

2026-07-04 17:19:49 +02:00

feature-telemetry.md

feat(telemetry): extend feature-usage tracking beyond AI features (#10681)

2026-08-14 18:50:38 +02:00

fork-triggers.md

fix(forks): keep trigger/schedule operational state owned by the parent - WIN-2019 (#9476)

2026-06-08 16:18:12 +00:00

frontend-import-cycles.md

chore: re-land vite 8.2.0 with the chunk cycle that broke it (#10472)

2026-08-03 18:09:06 +02:00

git-repo-viewer-hub-script.md

[ee] fix: GitRepoViewer reliable load for large repos (#8991)

2026-04-30 13:28:50 +00:00

git-sync-github-app-permissions.md

feat: automatic git-to-windmill sync (polling, webhooks, in-app PRs + checks) (#9552)

2026-07-16 15:55:44 +02:00

git-sync-pull-design.md

feat: automatic git-to-windmill sync (polling, webhooks, in-app PRs + checks) (#9552)

2026-07-16 15:55:44 +02:00

npm-proxy-storage.md

feat(npm-proxy): keep package files on disk and in the object store (#10638)

2026-08-11 16:40:53 +00:00

operator-builder-rights.md

fix: read every colon split in a builder app's triggerable keys

2026-08-17 16:49:46 +00:00

pipeline-env-isolation.md

feat(pipelines): fork data environments for ducklake materialization (dev data) (#9915)

2026-07-05 09:58:06 +02:00

pipeline-local-dev.md

fix(parsers): keep s3 asset path suffix verbatim to preserve storage distinction (#10241)

2026-07-21 16:25:06 +00:00

pipeline-metrics-layer.md

feat(pipelines): catalog declared measures and dimensions (#10190)

2026-07-21 07:34:44 +02:00

pipelines-vs-dbt.md

fix(pipelines): dedup guard for keyed merge + deploy-time SCD2 validation (#9936)

2026-07-05 22:24:41 +02:00

reusable-ai-agents.md

feat: version resource values with history, diff and restore (#10596)

2026-08-10 21:32:18 +02:00

validation.md

fix(agents): let the scratch-dir hooks own their permission prompt (#10702)

2026-08-14 14:30:52 +02:00

wac-sdk-e2e.md

test(wac): pin the failure record with one corpus both SDKs read (#10385)

2026-07-28 16:54:40 +02:00