v1.812.0 v1.0.3
windmill-labs/windmillSep 15, 2026 → Sep 15, 20260 days between releases
What's New
Security release patches critical RCE/SSRF vulnerabilities and upgrades Next.js.
Breaking Changes
- Access-code tokens now have a 7-day server-side lifetime and are rate-limited.
- Render service CSP injection restricts inline scripts and network access on preview paths.
New Features
- Storage asset lifecycle management (server owns entry and releases on deletion).
Improvements
- Next.js upgraded to 16.3.3 to patch a critical remote code execution vulnerability.
- Audio provider requests validate every redirect hop to prevent DNS rebinding attacks.
Bug Fixes
- Fixed untrusted HTML execution in the render service by injecting CSP and request interception.
- Fixed access-code tokens that never expired by enforcing 7-day lifetime and rate limiting.
Upgrade Notes
Access-code tokens now expire after 7 days; regenerate them if you rely on long-lived tokens. The render service CSP changes may break inline scripts or network access in previews.
The Two Releases
v1.812.0
Sep 15, 2026· 1 month ago
This release introduces per-route CORS allowlists, AI session artifact sharing, and CLI trash management. It also adds pre-approved cloud accounts and a dedicated Windmill-chat SDK for external integrations.
Full release notesOpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
A security release patching critical vulnerabilities like RCE and SSRF, upgrading Next.js, and adding bug fixes and features since 1.0.2.
Full release notes