[KiaraGrouwstra]

Changelog: https://github.com/windmill-labs/windmill/blob/v1.839.0/CHANGELOG.md

Releases before 1.783.0 have CVE-2026-29059, an unauthenticated path traversal in /api/w/{workspace}/jobs_u/get_log_file/{filename}. This update gets the fix.

Changes to the recipe:

• Regenerate the patches for the new source.
• Remove rust_executor.patch. Upstream now has a default value when HOME is not set.
• Remove the loki feature, because upstream removed it.
• Use the simdutf archive of librusty_v8, because the deno crates enable the simdutf feature of v8. update-librusty.sh gets this archive.
• Remove the mold linker flag of upstream, because mold is not in the build environment.
• Set auditable = false, because cargo-auditable gives the features of windmill to all workspace members, and windmill-mcp refuses oauth2.
• Set OPENSSL_NO_VENDOR. The ssl-vendored feature of rdkafka enables the vendored feature of openssl-sys, so without this setting the binary contains its own copy of OpenSSL (3.6.3 in this release). With this setting, the binary links to the openssl of nixpkgs.
• Use response files in the cc and ld wrappers, because the link of the windmill binary has too many arguments for one exec.

The binary still contains its own copies of curl (8.22.0, from curl-sys with curl-static) and librdkafka (2.12.1, from rdkafka-sys with cmake-build), as in 1.601.1.

Tests: windmill version gives v1.839.0. nixosTests.windmill (passthru.tests) passes on x86_64-linux. I did not build on aarch64-linux and I did not run nixpkgs-review.

Patch and description drafted up by Claude, and reviewed by me.

Things done

• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.
• Follows the automation/AI policy.
• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • aarch64-darwin
• Tested, as applicable:
  • Basic functionality of all binary files, usually in ./result/bin/.
  • Ran nixpkgs-review on this PR. See nixpkgs-review usage.
  • Package tests at passthru.tests.
  • NixOS tests in nixos/tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.

Assisted-by: Claude:claude-opus-5-5

https://claude.ai/code/session_017suXJrdCohj4k1zNZaRkEg

[happysalada]

The diff looks good, would be nice if you can run a nixpkgs-review, otherwise will do so when j get time.

[KiaraGrouwstra]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 575365
Commit: 02b0a9c7c1b57064e4beab0f629eab7d79bbc84b

---

x86_64-linux

✅ 1 package built:

• windmill