Ruben FiszelandClaude Opus 5.5 c25bb1ed90 feat: add //no_network annotation for native scripts (#11445) ...

* feat: add //no_network annotation to deny all network access in native scripts

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: close no_network bypasses (quic dns, header parsing, token, non-native)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix: refuse //no_network on deno regardless of //native, derive disabled ops from deno_net

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* refactor: scope //no_network to native scripts only, drop bun/deno refusal

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-01 10:47:28 +02:00

..

ai

feat: dispatch ai agent tools through the worker queue (#11227)

2026-09-29 22:30:50 +02:00

agent_workers.rs

feat: put a data table's connection under Postgres roles (#11020)

2026-09-18 13:56:41 +02:00

ai_executor.rs

feat: dispatch ai agent tools through the worker queue (#11227)

2026-09-29 22:30:50 +02:00

ansible_executor.rs

feat: ingest dbt column lineage and real column schemas from the engine's parquet index (#10977)

2026-09-08 09:58:38 +02:00

bash_executor.rs

fix(bash): normalize CRLF line endings before running scripts (#10131)

2026-07-15 12:46:26 +02:00

bigquery_executor.rs

fix: heartbeat job ping during s3object materialization in SQL executors (#10152)

2026-07-16 15:48:11 +02:00

bun_executor.rs

feat: add //no_network annotation for native scripts (#11445)

2026-10-01 10:47:28 +02:00

common.rs

fix: dispatch workflow-as-code tasks from a deployed flow's inline step (#11146)

2026-09-16 09:58:29 +02:00

config.rs

feat: replace ephemeral tokens by jwt (#3908)

2024-06-14 13:07:35 +02:00

csharp_executor.rs

fix: key build artifact caches on a runnable's inline modules (#10819)

2026-08-28 16:40:22 +02:00

dbt_column_index.rs

feat: make snowflake_oauth work as a dbt warehouse on every engine (#11095)

2026-09-12 00:00:17 +02:00

dbt_engine.rs

feat(dbt): reach any dbt adapter through a dbt_profile resource, and constrain the warehouse picker (#10525)

2026-08-05 00:34:26 +02:00

dbt_executor.rs

feat: make snowflake_oauth work as a dbt warehouse on every engine (#11095)

2026-09-12 00:00:17 +02:00

dbt_profiles.rs

feat: make snowflake_oauth work as a dbt warehouse on every engine (#11095)

2026-09-12 00:00:17 +02:00

dbt_state.rs

feat: durable dbt state per environment, and --defer onto it (#10975)

2026-09-08 08:32:30 +02:00

dedicated_worker_oss.rs

feat: flow for loop squashing (#7107)

2025-11-25 17:25:34 +01:00

deno_executor.rs

fix(security): drop --allow-run from Deno sandbox (GHSA-gj6h-vw66-mr8f) (#10039)

2026-07-10 13:33:22 +00:00

docker_v2.rs

fix: return result.json and stdout results from sandboxed containers (#10460)

2026-08-03 12:35:12 +02:00

duckdb_executor.rs

test: fix CLI and Windows cargo test failures on 1.820.0 (#11429)

2026-09-29 22:36:32 +02:00

global_cache.rs

fix(worker): bound cache transfers and import fetches in bun jobs (#11138)

2026-09-15 13:02:44 +02:00

go_executor.rs

fix: key build artifact caches on a runnable's inline modules (#10819)

2026-08-28 16:40:22 +02:00

graphql_executor.rs

improve graphql error reporting (#6092)

2025-07-01 15:45:04 +02:00

handle_child.rs

perf: skip job-start pings and checkpoint read for short non-WAC jobs (#11356)

2026-09-25 18:39:08 +02:00

java_executor.rs

fix: key build artifact caches on a runnable's inline modules (#10819)

2026-08-28 16:40:22 +02:00

job_logger_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

job_logger.rs

fix: return result.json and stdout results from sandboxed containers (#10460)

2026-08-03 12:35:12 +02:00

js_eval.rs

fix: retry js eval up to 3 times on timeout from slow DB (#7890)

2026-02-10 17:50:41 +00:00

lib.rs

feat: ingest dbt column lineage and real column schemas from the engine's parquet index (#10977)

2026-09-08 09:58:38 +02:00

memory_common.rs

feat(ai-agent): add compaction memory that summarizes older context (#10928)

2026-09-29 19:01:53 +02:00

memory_oss.rs

feat(ai-agent): add compaction memory that summarizes older context (#10928)

2026-09-29 19:01:53 +02:00

mssql_executor.rs

fix: log the db auth mode used and hint at the ms_entraid sentinel (#10508)

2026-08-04 13:16:24 +00:00

mysql_executor.rs

fix: heartbeat job ping during s3object materialization in SQL executors (#10152)

2026-07-16 15:48:11 +02:00

nu_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

oracledb_executor.rs

fix: track dollar-quoted strings in SQL block splitter (#8891)

2026-04-21 17:07:01 +00:00

otel_oss.rs

feat(otel): connect jobs to the inbound distributed trace (#9456)

2026-06-05 16:50:07 +00:00

otel_tracing_proxy_oss.rs

feat: add otlp/http internal collector (#7690)

2026-01-26 19:29:09 +00:00

pg_executor.rs

feat: put a data table's connection under Postgres roles (#11020)

2026-09-18 13:56:41 +02:00

pg_raw_output.rs

fix: bound postgres result collection so an oversized result cannot OOM the worker (#10644)

2026-08-12 09:11:56 +02:00

php_executor.rs

fix: offload php signature parsing from async workers (#11027)

2026-09-08 15:20:02 +02:00

prepare_deps.rs

feat(debugger): install debug session deps from the instance registry settings (#10550)

2026-08-05 20:16:38 +00:00

pwsh_executor.rs

fix(security): sanitize dependency names & connection strings against command/SQL injection (#9590)

2026-06-15 19:06:00 +02:00

python_executor.rs

fix: await async def main in python scripts (#11437)

2026-09-30 13:02:30 +02:00

python_versions.rs

perf: cache resolved python interpreter path across worker restarts (#10701)

2026-08-14 14:58:35 +02:00

r_executor.rs

fix: pass Windows system env vars to R renv install subprocess (#10313)

2026-07-24 18:33:42 +02:00

result_processor.rs

feat: allow git sync auto-pull, promotion and PRs on Pro licenses (#11173)

2026-09-16 17:28:40 +02:00

ruby_executor.rs

feat(nsjail): optional disk-backed /tmp via instance setting (#9272)

2026-05-21 15:34:49 +00:00

rust_executor.rs

fix: key build artifact caches on a runnable's inline modules (#10819)

2026-08-28 16:40:22 +02:00

sanitized_sql_params.rs

feat: add support for contextual vars in SQL (#6791)

2025-10-10 18:52:24 +00:00

schema.rs

fix: parse Python datetime.datetime and datetime.date type annotations (#7856)

2026-02-09 15:17:26 +00:00

snowflake_executor.rs

feat: make bigquery and snowflake script languages available in CE (#10324)

2026-07-25 12:07:28 +02:00

sql_s3_input.rs

fix: heartbeat job ping during s3object materialization in SQL executors (#10152)

2026-07-16 15:48:11 +02:00

sql_utils.rs

Nit better test and comment (#8030)

2026-02-20 12:06:05 +00:00

ssh_executor_oss.rs

feat(worker): #ssh directive to run a bash script on a remote SSH host (#9479)

2026-06-10 15:14:37 +00:00

universal_pkg_installer.rs

feat: let a worker group override the dependency cache object store (#11019)

2026-09-08 14:10:51 +02:00

volume_oss.rs

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

wac_executor.rs

perf: skip job-start pings and checkpoint read for short non-WAC jobs (#11356)

2026-09-25 18:39:08 +02:00

worker_flow.rs

feat: dispatch ai agent tools through the worker queue (#11227)

2026-09-29 22:30:50 +02:00

worker_lockfiles.rs

feat: restart perpetual runs on the version a deploy makes runnable (#11200)

2026-09-29 18:03:43 +02:00

worker_utils.rs

fix: report a worker's last job when it ran under one poll interval (#11399)

2026-09-29 14:27:23 +02:00

worker.rs

feat: add //no_network annotation for native scripts (#11445)

2026-10-01 10:47:28 +02:00