Ruben FiszelandClaude Opus 4.7 e73770c247 fix: derive debug signing key deterministically from JWT_SECRET (#8917) ...

Previously each API replica generated a random Ed25519 signing key at
startup (unless DEBUG_SIGNING_KEY_SEED was set). In multi-replica
deployments this caused "Invalid JWT signature" rejections in the
multiplayer server: the browser could sign a token on pod A while
`windmill-extra` had cached the JWKS public key from pod B.

Derive the seed deterministically from the DB-backed JWT_SECRET using
SHA-256 with a domain-separation tag so all pods agree without
coordination. Re-derive on JWT_SECRET rotation. The
DEBUG_SIGNING_KEY_SEED env var is still honored as an override.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-22 20:05:08 +00:00

..

mcp

refactor: convert read-hot globals to AtomicBool/I64 and ArcSwap (#8815)

2026-04-14 00:04:10 +00:00

native_triggers

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

triggers

feat: add GitHub as a native trigger service (#8856)

2026-04-17 17:01:55 +00:00

ai.rs

refactor: create windmill-ai crate (part 1 — types, traits, base modules) (#8530)

2026-04-22 11:20:27 +00:00

approvals.rs

feat: show groups and notes in flow status viewer (#8535)

2026-03-26 08:18:01 +00:00

apps_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

apps.rs

refactor: convert read-hot globals to AtomicBool/I64 and ArcSwap (#8815)

2026-04-14 00:04:10 +00:00

args.rs

feat: accept any content type on webhooks/http triggers with fallback (#8743)

2026-04-07 12:14:24 +00:00

audit.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

auth.rs

feat: make WM_END_USER_EMAIL display users from different workspaces (#8208)

2026-03-04 11:50:59 +00:00

azure_proxy_oss.rs

feat: DuckDB support write to Azure (#7618)

2026-01-20 12:52:58 +00:00

bedrock.rs

refactor: create windmill-ai crate (part 1 — types, traits, base modules) (#8530)

2026-04-22 11:20:27 +00:00

capture.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

concurrency_groups.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

db_health.rs

fix: split DB health endpoint and add slow query controls (#8725)

2026-04-05 14:00:44 +00:00

db.rs

fix: skip down migrations in potentially_stale checksum comparison (#8271)

2026-03-08 16:18:22 +00:00

drafts.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

ee_oss.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

embeddings.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

favorite.rs

feat: favorite datatable and ducklake tables + asset page nits (#7795)

2026-02-04 18:48:51 +00:00

flows.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

folder_history.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00

folders.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00

git_sync_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

google.rs

refactor: create windmill-ai crate (part 1 — types, traits, base modules) (#8530)

2026-04-22 11:20:27 +00:00

granular_acls.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00

group_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

groups.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00

health.rs

feat: add DB health diagnostic dashboard for superadmins (#8574)

2026-03-28 09:32:10 +00:00

indexer_oss.rs

feat: move index management out of /srch/, add storage size reporting (#8169)

2026-03-03 16:46:10 +00:00

inkeep_oss.rs

feat(mcp): add documentation endpoint (#7331)

2025-12-10 17:28:56 +00:00

integration.rs

refactor: convert read-hot globals to AtomicBool/I64 and ArcSwap (#8815)

2026-04-14 00:04:10 +00:00

internal_db.rs

fix: Move database manager SQL queries to backend (#8306)

2026-03-24 09:45:37 +00:00

job_helpers_oss.rs

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

job_metrics.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

jobs_export.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

jobs.rs

feat: async dep endpoints and queue-position logs in cli (#8895)

2026-04-21 15:06:46 +00:00

lib.rs

fix: derive debug signing key deterministically from JWT_SECRET (#8917)

2026-04-22 20:05:08 +00:00

live_migrations.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

mcp_oauth_oss.rs

feat(aiagent): handle oauth for mcp tools (#7564)

2026-01-14 12:06:40 +00:00

mcp_tools.rs

reorg mcp_tools

2026-02-11 06:44:10 +00:00

oauth2_oss.rs

refactor: convert read-hot globals to AtomicBool/I64 and ArcSwap (#8815)

2026-04-14 00:04:10 +00:00

offboarding.rs

fix: update on_behalf_of_email in app policy on offboarding (#8858)

2026-04-17 12:11:12 +00:00

oidc_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

path_autocomplete.rs

feat: add path name autocomplete with ghost text and folder cycling (#8731)

2026-04-06 03:44:21 +00:00

public_app_layer.rs

feat(aiagent): handle oauth for mcp tools (#7564)

2026-01-14 12:06:40 +00:00

public_app_rate_limit.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

raw_apps.rs

feat: add optional labels to scripts, flows, apps, schedules, triggers (#8609)

2026-04-03 17:39:32 +00:00

resources.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

s3_log_batching.rs

fix: debounce S3 proxy logs (#8694)

2026-04-03 13:46:09 +00:00

s3_proxy_oss.rs

fix s3 proxy dev build (#6535)

2025-09-04 22:05:22 +00:00

saml_oss.rs

SSRF protection for SAML and MCP OAuth endpoints (#8473)

2026-03-22 17:18:22 +00:00

scim_oss.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

scripts.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

secret_backend_ext.rs

fix: zero-downtime coordinated restarts for OTEL and other setting changes (#8768)

2026-04-08 20:35:27 +00:00

service_logs.rs

fix: add path traversal check in service_logs get_log_file endpoint (#8605)

2026-03-30 08:18:08 +00:00

slack_approvals.rs

fix: add HMAC signature verification to Slack interactive callback endpoint (#8611)

2026-04-02 20:55:23 +00:00

smtp_server_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

static_assets.rs

fix static assets loading for apps raw

2025-12-25 16:29:49 +00:00

stripe_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

teams_approvals_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

teams_cache_oss.rs

fix: teams api improvements (#6643)

2025-09-19 17:43:16 +00:00

teams_oss.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

token.rs

fix: add flow conversation token scope (#8903)

2026-04-22 13:42:22 +00:00

tracing_init.rs

fix: enrich OTEL log records with per-request LogContext (#8812)

2026-04-13 21:50:50 +00:00

trash.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

users_oss.rs

handle OSS onboarding error gracefully (#8459)

2026-03-20 12:37:05 +00:00

users.rs

feat: add disable_password_login global setting (#8873)

2026-04-17 18:12:30 +00:00

utils.rs

refactor: extract 12 leaf crates from windmill-api (#7899)

2026-02-11 10:31:03 +00:00

variables.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

volumes_oss.rs

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

webhook_util.rs

refactor: extract windmill-dep-map crate for parallel api/worker compilation (#7846)

2026-02-08 00:39:56 +00:00

workspace_dependencies.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

workspaces_export.rs

fix: omit default_permissioned_as from tarball export when empty

2026-04-22 19:31:37 +00:00

workspaces.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00