chore(main): release 1.703.3

[rubenfiszel]

🤖 I have created a release beep boop

1.703.3 (2026-05-18)

Bug Fixes

• constrain unauthenticated get_public_resource to app_theme resources (#9203) (24eedef)
• enforce folder ACL on flow run-by-version routes (#9202) (ab11c77)
• enforce jobs:run scope on job preview and inline endpoints (#9198) (664edcd)
• mcp: validate oauth dynamic client registration redirect_uris (#9197) (8bc2295)
• validate entrypoint override to prevent worker code injection (GHSA-wxjq-w5pj-jqhx) (#9204) (bd05bca)

---

This PR was generated with Release Please. See documentation.

[cloudflare-workers-and-pages]

Deploying windmill with    Cloudflare Pages

Latest commit:	5af2e37
Status:	✅  Deploy successful!
Preview URL:	https://e1813730.windmill.pages.dev
Branch Preview URL:	https://release-please--branches--ma.windmill.pages.dev

View logs

[claude]

Claude finished @rubenfiszel's task in 16s —— View job

---

Good to merge

This is an automated Release Please PR. The diff is purely mechanical:

• version.txt: 1.703.2 → 1.703.3
• CHANGELOG.md: adds the 1.703.3 section with the single bug fix (#9197 — MCP OAuth redirect_uri validation)

Both changes match the release contents and follow the established changelog format. No code changes, no review concerns.

Test coverage

CI/release-only change — no automated tests expected and none needed. The underlying fix (#9197) was reviewed and merged on its own PR.

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[github-actions]

Pi Review

Good to merge

This is an automated Release Please PR that bumps the version from 1.703.2 → 1.703.3 and adds the corresponding 1.703.3 release section to CHANGELOG.md. The diff is purely mechanical — two files, no code changes:

• version.txt: bumped to 1.703.3
• CHANGELOG.md: added release section for 1.703.3 with the one included bug fix (#9197 — MCP oauth dynamic client registration redirect_uris validation)

The changelog entry correctly references the underlying commit and issue. No concerns.

Test coverage

CI / release-only change — no automated tests expected or needed. The underlying fix (#9197) was reviewed and merged on its own PR.

[github-actions]

Codex Review

Good to merge

No issues found. Checked for bugs, security, and AGENTS.md compliance.

Test coverage

Release metadata only: CHANGELOG.md and version.txt. No automated tests are expected, and there is no in-app surface to manually verify for this PR.

[github-actions]

Pi Review

Good to merge

This is an automated Release Please PR that bumps the version from 1.703.2 → 1.703.3. The diff is purely mechanical across 17 files:

• version.txt: 1.703.2 → 1.703.3
• CHANGELOG.md: adds the 1.703.3 release section with the single bug fix entry (#9197 — MCP OAuth dynamic client registration redirect_uris validation)
• All other files: version string bumps in package manifests (Cargo.toml, Cargo.lock, package.json, package-lock.json, pyproject.toml, openapi specs, client SDK manifests, etc.)

No code changes, no new public surfaces, no bugs, no security concerns.

No issues found. Checked for bugs, security, and AGENTS.md compliance.

Test coverage

CI / release-only change — no automated tests expected or needed. The underlying fix (#9197) was reviewed and merged on its own PR. No in-app surface to exercise for this change; the version bumps are metadata only.

[github-actions]

Codex Review

Good to merge

No issues found. The diff is release metadata only: version bumps across package manifests/locks/generated API metadata plus the CHANGELOG.md entry for 1.703.3.

Test coverage

CI / release-only change. No automated tests are expected, and there is no in-app surface to manually verify for this PR.

[github-actions]

Codex Review

Good to merge

No issues found. The current PR diff is release metadata only: CHANGELOG.md adds the 1.703.3 section and version.txt bumps 1.703.2 to 1.703.3.

Test coverage

Docs/config-only release change, so no automated tests are expected. There is no in-app surface to manually verify for this PR.

[github-actions]

Pi Review

Good to merge

This is an automated Release Please PR. The diff is purely mechanical:

• version.txt: 1.703.2 → 1.703.3
• CHANGELOG.md: adds the 1.703.3 release section with three bug fixes (fix: constrain unauthenticated get_public_resource to app_theme resources #9203, fix: enforce folder ACL on flow run-by-version routes (GHSA-8mv7-hmrg-96xv) #9202, fix(mcp): validate oauth dynamic client registration redirect_uris #9197)

Both changes match the release contents and follow the established changelog format. No code changes, no public surfaces, no security concerns.

Test coverage

CI / release-only change — no automated tests expected or needed. The underlying fixes (#9203, #9202, #9197) were reviewed and merged on their own PRs. No in-app surface to manually verify for this change; the version bumps are metadata only.

[github-actions]

Pi Review

Good to merge

This is an automated Release Please PR that bumps the version from 1.703.2 → 1.703.3. The diff is purely mechanical across 17 files:

• version.txt: 1.703.2 → 1.703.3
• CHANGELOG.md: adds the 1.703.3 release section with three bug fixes (fix: constrain unauthenticated get_public_resource to app_theme resources #9203, fix: enforce folder ACL on flow run-by-version routes (GHSA-8mv7-hmrg-96xv) #9202, fix(mcp): validate oauth dynamic client registration redirect_uris #9197)
• All other files: version string bumps in package manifests (Cargo.toml, Cargo.lock, package.json, package-lock.json, pyproject.toml, openapi specs, client SDK manifests, etc.)

No code changes, no new public surfaces, no bugs, no security concerns.

Test coverage

CI / release-only change — no automated tests expected or needed. The underlying fixes (#9203, #9202, #9197) were reviewed and merged on their own PRs. No in-app surface to manually verify for this change; the version bumps are metadata only.

[github-actions]

Codex Review

Good to merge

No issues found. Checked for bugs, security concerns, and AGENTS.md compliance.

Test coverage

Release metadata/config-only change, so no automated tests are expected. No manual in-app verification is needed because the diff only bumps versions and updates the changelog.

[github-actions]

Pi Review

Good to merge

This is an automated Release Please PR. The diff is purely mechanical:

• version.txt: 1.703.2 → 1.703.3
• CHANGELOG.md: adds the 1.703.3 release section with four bug fixes (fix: constrain unauthenticated get_public_resource to app_theme resources #9203, fix: enforce folder ACL on flow run-by-version routes (GHSA-8mv7-hmrg-96xv) #9202, fix: enforce jobs:run scope on job preview and inline endpoints #9198, fix(mcp): validate oauth dynamic client registration redirect_uris #9197)

Both changes match the release contents and follow the established changelog format. No code changes, no new public surfaces, no security concerns.

Test coverage

CI / release-only change — no automated tests expected or needed. The underlying fixes (#9203, #9202, #9198, #9197) were reviewed and merged on their own PRs. No in-app surface to manually verify for this change; the version bumps are metadata only.

[github-actions]

Codex Review

Good to merge

No findings.

Test coverage

CI / docs / config-only: no automated tests expected for this release update. There is no in-app surface to exercise manually before merge.

[github-actions]

Pi Review

Good to merge

This is an automated Release Please PR. The diff is purely mechanical:

• version.txt: 1.703.2 → 1.703.3
• CHANGELOG.md: adds the 1.703.3 release section with four bug fixes (fix: constrain unauthenticated get_public_resource to app_theme resources #9203, fix: enforce folder ACL on flow run-by-version routes (GHSA-8mv7-hmrg-96xv) #9202, fix: enforce jobs:run scope on job preview and inline endpoints #9198, fix(mcp): validate oauth dynamic client registration redirect_uris #9197)
• All other files: version string bumps in package manifests (Cargo.toml, Cargo.lock, package.json, package-lock.json, pyproject.toml, openapi specs, client SDK manifests, etc.)

No code changes, no new public surfaces, no security concerns.

Test coverage

CI / release-only change — no automated tests expected or needed. The underlying fixes (#9203, #9202, #9198, #9197) were reviewed and merged on their own PRs. No in-app surface to manually verify for this change; the version bumps are metadata only.

[github-actions]

Codex Review

Good to merge

No issues found. The diff is release metadata only: version bumps from 1.703.2 to 1.703.3 across manifests/generated API metadata plus the CHANGELOG.md entry for the release.

Test coverage

CI / release-only change, so no automated tests are expected. There is no in-app surface to manually verify for this PR.

[github-actions]

Now let me run the diff to see what changed:

Pi Review

Good to merge

This is an automated Release Please PR. The diff is purely mechanical:

• version.txt: 1.703.2 → 1.703.3
• CHANGELOG.md: adds the 1.703.3 release section with five bug fixes (fix: constrain unauthenticated get_public_resource to app_theme resources #9203, fix: enforce folder ACL on flow run-by-version routes (GHSA-8mv7-hmrg-96xv) #9202, fix: enforce jobs:run scope on job preview and inline endpoints #9198, fix(mcp): validate oauth dynamic client registration redirect_uris #9197, fix: validate entrypoint override to prevent worker code injection (GHSA-wxjq-w5pj-jqhx) #9204 — including a security fix GHSA-wxjq-w5pj-jqhx for worker entrypoint validation)

Both changes match the release contents and follow the established changelog format. No code changes, no new public surfaces, no security concerns from this diff itself.

Test coverage

CI / release-only change — no automated tests expected or needed. The underlying fixes (#9203, #9202, #9198, #9197, #9204) were reviewed and merged on their own PRs. No in-app surface to manually verify for this change; the version bumps are metadata only.

[github-actions]

Codex Review

Good to merge.

No issues found. Checked for bugs, security, and AGENTS.md compliance. The diff only updates release metadata in CHANGELOG.md and version.txt.

Test coverage

No automated tests expected for changelog/version-only release metadata. No in-app manual verification is needed; the relevant manual check is confirming the release tooling consumes version 1.703.3 and the generated changelog entry.

[github-actions]

Pi Review

Good to merge

This is an automated Release Please PR that bumps the version from 1.703.2 → 1.703.3. The diff is purely mechanical across 17 files:

• version.txt: 1.703.2 → 1.703.3
• CHANGELOG.md: adds the 1.703.3 release section with five bug fixes (fix: constrain unauthenticated get_public_resource to app_theme resources #9203, fix: enforce folder ACL on flow run-by-version routes (GHSA-8mv7-hmrg-96xv) #9202, fix: enforce jobs:run scope on job preview and inline endpoints #9198, fix(mcp): validate oauth dynamic client registration redirect_uris #9197, fix: validate entrypoint override to prevent worker code injection (GHSA-wxjq-w5pj-jqhx) #9204 — including a security fix GHSA-wxjq-w5pj-jqhx for worker entrypoint validation)
• All other files: version string bumps in package manifests (Cargo.toml, Cargo.lock, package.json, package-lock.json, pyproject.toml, Pipfile, openapi specs, client SDK manifests, etc.)

No code changes, no new public surfaces, no bugs, no security concerns from this diff itself. The changelog entries match the referenced commits.

Test coverage

CI / release-only change — no automated tests expected or needed. The underlying fixes (#9203, #9202, #9198, #9197, #9204) were reviewed and merged on their own PRs. No in-app surface to manually verify for this change; the version bumps are metadata only.

[rubenfiszel]

🤖 Release is at https://github.com/windmill-labs/windmill/releases/tag/v1.703.3 🌻