v1.839.0 v1.840.0
windmill-labs/windmillOct 16, 2026 → Oct 17, 20261 day between releases
What's New
Adds no_network annotation for sandboxed jobs and fixes AI proxy path handling
New Features
- Add `no_network` annotation for sandboxed jobs
- Warn at worker startup when `WHITELIST_ENVS` forwards a secret-shaped variable
Improvements
- Mount Python script modules into the nsjail sandbox
- Run Bun and NPM installs under nsjail sandboxing
- Scope `delete_jobs` side-table deletes to the request workspace
Bug Fixes
- Keep script and flow deploys off a second pool connection
- Let `ALLOW_PRIVATE_AI_BASE_URLS` name the private hosts it allows
- Refuse dot segments in AI proxy paths
- Scope `delete_jobs` side-table deletes to the request workspace
Upgrade Notes
You can now use the `no_network` annotation to restrict network access in jobs. Review your `WHITELIST_ENVS` configuration as the worker now warns if it forwards secret-shaped variables. The `delete_jobs` operation is now scoped to the request workspace.
The Two Releases
v1.839.0
Oct 16, 2026· 5 days ago
This release focuses on improving security and isolation for project forks, consolidating Teams integration components, and enhancing S3 proxy routing. It introduces a new protection rule for isolated forks and fixes a security vulnerability regarding Teams activity verification.
Full release notesv1.840.0
Oct 17, 2026· 4 days ago
This release introduces a new `no_network` annotation for sandboxed jobs to control network access, adds a warning mechanism for `WHITELIST_ENVS` handling secrets, and fixes several bugs involving AI proxy paths, sandboxing for Python modules and package installers, and workspace scoping for job deletions.
Full release notes