Ruben FiszelandClaude Opus 4.8 8053266f88 fix(mcp): resolve MCP resource token via caller RLS + SSRF-guard url (#9428) ...

* fix(mcp): resolve MCP resource token via caller RLS + SSRF-guard url

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(mcp): clone user_db for oauth2 refresh and drop advisory ids from comments

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(mcp): disable redirects on MCP client to prevent SSRF bypass

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-03 09:00:43 +00:00

..

ai

fix(mcp): resolve MCP resource token via caller RLS + SSRF-guard url (#9428)

2026-06-03 09:00:43 +00:00

agent_workers.rs

feat: Data tables (#7226)

2025-12-05 23:08:58 +00:00

ai_executor.rs

fix(mcp): resolve MCP resource token via caller RLS + SSRF-guard url (#9428)

2026-06-03 09:00:43 +00:00

ansible_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

bash_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

bigquery_executor.rs

feat: support S3Object input args in native SQL scripts (#8954)

2026-04-28 20:01:06 +00:00

bun_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

common.rs

fix(nsjail): gate unix-symlink test behind cfg(unix) for Windows build (#9280)

2026-05-21 20:47:26 +00:00

config.rs

feat: replace ephemeral tokens by jwt (#3908)

2024-06-14 13:07:35 +02:00

csharp_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

dedicated_worker_oss.rs

feat: flow for loop squashing (#7107)

2025-11-25 17:25:34 +01:00

deno_executor.rs

feat: WM_TESTED_RUNNABLE env var + wildcards in test: annotation (#8926)

2026-04-24 12:52:25 +00:00

duckdb_executor.rs

fix: cgroup-aware DuckDB memory_limit + allocator memory release (#9245)

2026-05-20 14:05:16 +00:00

global_cache.rs

fix: atomic bundle cache writes to prevent parallel cold-load race (#9186)

2026-05-15 21:04:16 +00:00

go_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

graphql_executor.rs

improve graphql error reporting (#6092)

2025-07-01 15:45:04 +02:00

handle_child.rs

oom_adj nit

2026-05-21 04:29:34 +00:00

java_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

job_logger_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

job_logger.rs

use excluded where relevant

2025-10-16 09:19:44 +00:00

js_eval.rs

fix: retry js eval up to 3 times on timeout from slow DB (#7890)

2026-02-10 17:50:41 +00:00

lib.rs

feat: CLI datatable serve / psql (#9267)

2026-05-20 16:56:50 +00:00

memory_common.rs

refactor: move ai sse plumbing to windmill-ai (#9059)

2026-05-11 10:01:45 +00:00

memory_oss.rs

refactor: move ai sse plumbing to windmill-ai (#9059)

2026-05-11 10:01:45 +00:00

mssql_executor.rs

feat: support S3Object input args in native SQL scripts (#8954)

2026-04-28 20:01:06 +00:00

mysql_executor.rs

feat: support S3Object input args in native SQL scripts (#8954)

2026-04-28 20:01:06 +00:00

nu_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

oracledb_executor.rs

fix: track dollar-quoted strings in SQL block splitter (#8891)

2026-04-21 17:07:01 +00:00

otel_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

otel_tracing_proxy_oss.rs

feat: add otlp/http internal collector (#7690)

2026-01-26 19:29:09 +00:00

pg_executor.rs

feat: CLI datatable serve / psql (#9267)

2026-05-20 16:56:50 +00:00

pg_raw_output.rs

feat: CLI datatable serve / psql (#9267)

2026-05-20 16:56:50 +00:00

php_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

prepare_deps.rs

feat: debuggers for python and bun v0 (#7546)

2026-01-13 15:20:06 +00:00

pwsh_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

python_executor.rs

perf(python): add --compile-bytecode to uv pip install (#9393)

2026-06-01 15:46:33 +00:00

python_versions.rs

fix(nsjail): precompile python stdlib + raise download rlimit_as (#9429)

2026-06-03 08:47:19 +00:00

r_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

result_processor.rs

fix: don't fail flow on AlreadyCompleted after zombie restart (#9214)

2026-05-18 23:11:37 +00:00

ruby_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

rust_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

sanitized_sql_params.rs

feat: add support for contextual vars in SQL (#6791)

2025-10-10 18:52:24 +00:00

schema.rs

fix: parse Python datetime.datetime and datetime.date type annotations (#7856)

2026-02-09 15:17:26 +00:00

snowflake_executor.rs

feat(snowflake): derive public key from private key when omitted (WIN-1959) (#9251)

2026-05-20 06:48:10 +00:00

sql_s3_input.rs

feat: support S3Object input args in native SQL scripts (#8954)

2026-04-28 20:01:06 +00:00

sql_utils.rs

Nit better test and comment (#8030)

2026-02-20 12:06:05 +00:00

universal_pkg_installer.rs

fix: pair PG arg type with actual Rust binding to keep query_typed_raw safe (#8999)

2026-05-01 17:08:59 +00:00

volume_oss.rs

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

wac_executor.rs

fix: detect WAC v2 Python workflows that only use step() (no @task) (#8819)

2026-04-13 23:22:30 +00:00

worker_flow.rs

feat(flows): preserve step/subflow worker tags under a custom-tagged flow (#9375)

2026-05-30 12:10:16 +00:00

worker_lockfiles.rs

fix: prevent flow-dep job stalls under row-lock contention (#8952)

2026-04-27 16:03:57 +00:00

worker_utils.rs

refactor: convert read-hot globals to AtomicBool/I64 and ArcSwap (#8815)

2026-04-14 00:04:10 +00:00

worker.rs

fix(websocket-trigger): honor HTTPS_PROXY/HTTP_PROXY/NO_PROXY (#9324)

2026-05-26 06:17:07 +00:00