v1.840.0 v1.841.0

Name: Vibe-Trading
Author: HKUDS

medium risk

HKUDS/Vibe-TradingOct 17, 2026 → Oct 18, 20261 day between releases

What's New

Adds workload identity auth, MCP server config, and gVisor compatibility.

New Features

Agent workers can authenticate with a workload identity token.
Added ALLOW_PRIVATE_MCP_SERVER_URLS to name private hosts.
Probe nsjail with a real jail and added gVisor compatibility mode.

Bug Fixes

Insert ApiAuthed into request extensions in no-auth mode.
Reject out-of-range integer args to narrow SQL types instead of wrapping.
Warn when an autoscaled worker group has no tags to count.

Upgrade Notes

Configure the new ALLOW_PRIVATE_MCP_SERVER_URLS environment variable if using private MCP servers. Ensure agent workers are configured to use the new workload identity token authentication if enabled. No configuration changes are required for existing sandboxes or AI proxy paths.

The Two Releases

v1.840.0

Oct 17, 2026· 4 days ago

Windmill release enhancing sandboxing capabilities, adding security warnings, and improving AI proxy path handling.

Full release notes

v1.841.0

Oct 18, 2026· 3 days ago

Windmill release introducing workload identity authentication, private MCP server configuration, and nsjail compatibility.

Full release notes