chore(main): release 1.659.0

[rubenfiszel]

🤖 I have created a release beep boop

1.659.0 (2026-03-17)

Features

• add end_user_email claim to OIDC ID tokens (#8401) (de5b13b)
• add ws_base_url instance setting for WebSocket URL override (#8405) (372023e)
• DB-backed instance events webhook with superadmin UI (#8402) (7d9fb57)
• instance groups instance-level role support (#8404) (18b3528)
• script module mode with CLI sync, preview, and WAC UI improvements (#8380) (31d6660)
• store hashed tokens instead of plaintext (#8217) (f2be625)
• workspace-specific registry overrides (#8406) (73fe45b)

Bug Fixes

• improve OOM killer observability for debugging pod-level kills (#8398) (fd41cd1)

---

This PR was generated with Release Please. See documentation.

[cloudflare-workers-and-pages]

Deploying windmill with    Cloudflare Pages

Latest commit:	878596b
Status:	✅  Deploy successful!
Preview URL:	https://a27bb4c7.windmill.pages.dev
Branch Preview URL:	https://release-please--branches--ma.windmill.pages.dev

View logs

[claude]

Claude finished @rubenfiszel's task in 47s —— View job

---

Review: chore(main): release 1.658.0

• Gather context
• Review changes
• Post feedback

Findings

This is an automated release-please PR that updates CHANGELOG.md for v1.658.0. The diff adds 21 lines (the populated Features + Bug Fixes sections) above an already-existing empty v1.658.0 header from a prior release-please commit (#8382).

Issue: Duplicate v1.658.0 section — The resulting CHANGELOG.md now contains two ## [1.658.0] headers (lines 3 and 24) with nearly identical content. This happened because a previous release-please run (#8382 / commit 9554876) already created the v1.658.0 header with partial entries, and this new commit added a full copy on top. This is cosmetic and doesn't break anything, but it's a bit messy. Release-please should deduplicate on merge, but it's worth verifying.

Everything else looks correct:

• All 4 feature entries and 7 bug fix entries match the merged PRs listed in the compare range (v1.657.2...v1.658.0)
• Commit SHAs and PR numbers are properly linked
• No code changes — changelog only

How to verify

This is a changelog-only release PR. No app behavior changes to test. You can verify by checking the CHANGELOG.md on the branch and confirming the v1.658.0 entries match the features/fixes listed in the PR description. Note the duplicate section header mentioned above.

---