openstack/mistral — 2026-11-14

Security hardening across the action library and API. The bulk of the week went into tightening Mistral's standard actions and REST surface. std.ssh private keys are now confined with an egress policy, std.ssh_proxied host arguments are guarded against command injection, std.http scrubs credentials and response bodies from its logs, std.email is hardened against executor pinning and port scans, std.javascript gets execution-time and memory limits, and std.sleep/std.echo waits are capped. Jinja expressions now run in an immutable sandbox, expression resources are bounded by default, and sub-workflow depth is limited. On the API, access control is enforced on event trigger update/delete, code source and dynamic action deletion, and workbook/environment deletion; internal workflow parameters are rejected from users; Keycloak tokens are verified before their claims are trusted; and event trigger events are validated and escaped.

Engine and policy correctness. Before-start policies now apply to join tasks — including each pass of a join inside a loop — failed downstream tasks are rerun rather than replaced, tasks failed by the timeout policy are not retried, RunExistingTask commands are restored from the backlog, stale with-items indexes are ignored when the item list shrinks, and timed-out action threads are abandoned (and bounded) in the executor. A new option runs workflow executions under a trust, and named locks are released on engine errors.

DSL and query surface. Unknown top-level workflow keys are rejected, schema validation errors are shortened, JSON field filters match only on the given keys, and filters on non-stored fields return 400.

Tooling. Ruff formatting and configuration were applied repo-wide alongside a large dead-code removal (~225k lines) and pre-commit enablement, courtesy of arnaudmorin, who authored all but one of the week's 49 merges.