Live Change Log

The one way to change a file the document editor cannot open - a PDF above all, which is what most templates are. POST **************** takes the new file, scan...

**************** asserted that an image already inside the box comes back byte-identical to what went in. It has been failing since afee6fd in July, and the cod...

A tab icon uploaded as a transparent PNG-8 arrived in the browser tab as a black square with a ragged logo on it. Measured on the upload that exposed it: of the...

The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...

The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...

replicas 1 -> 2. This service runs no @Scheduled work and binds no exclusive NATS durable, so a second pod duplicates nothing — it is stateless request serving,...

Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...

Backs the email signature footer badges, which are downscaled to 150px tall on upload. resize-bg could not be reused. It exists to make a wallpaper cheap to sh...

Picks up kamo-shared-library d21e01ce. uploadDocument created its ImgDat with isMissing=false BEFORE sending the bytes, and its @Transactional did not roll back...

The library moved to 1.6.0 while every consumer stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors...

An operator granted "Manage Platform Sounds" on the Platform Administrators page saw the Sounds tab — the console gates on the right — opened the upload dialog,...

The document rights are enforced in DocsService as of this change, but the upload endpoints are not in DocsService — kamo-internal's app/api/imaging/upload prox...

Extends the ffmpeg wrapper the VoIP recording pipeline already had — this image installs ffmpeg with libopus for it, so putting a second ffmpeg in another image...

Chat attachments have run at 3 GiB through this same imaging pipeline for a while; documents were capped at 500MB. The difference was not a policy, it was that ...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The expiration on the Redis record IS the session; when it lapses the member is signed out. This service holds its own copy of KSessionService against that SHAR...

Hibernate's PostgreSQL dialect read @Lob String columns as OIDs via getLong(). Affects notes, contacts, calendar, OAuth tokens, IMAP passwords, email campaign b...

CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...

Fifth service holding its own copy of KSessionService, and the fifth sliding the shared *** TTL on every read. Each one alone was enough to keep a session alive...

Three builds died today on "Tag mismatch" pulling a jar — and the mirror added an hour ago did not help, because kbservice, mcpgatewayservice and ragservice hit...

Every Docker stage starts from a cold ~/.m2 and refetches the whole dependency tree, so Central sees the full weight of every concurrent service build. It answe...

Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...

Picks up kamo-shared-library 8db077c, which makes registerExistingDocument copy a reused ImgDat's objects into the target association's bucket. ConversionServic...

Picks up **************** now setting createdByMember, so deduplicated documents record who uploaded them.

convertAndGenerateThumbnails runs on a virtual thread with a detached ImgDat, so imgDatRepository.save() merged a stale orphan-removal collection and threw befo...

ImagingUploadController reads ImageAssocType.values(); without this rebuild an upload from the HR Resources tab cannot resolve ordinal 13 to its bucket.

The document vault accepted arbitrary uploads with no malware scanning anywhere on the platform, and it is multi-tenant — a file one org uploads is opened by an...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

The handler was declared backfillConversions() — it took no request at all — under the comment "No auth — internal maintenance, mirrors /backfill-thumbnails". I...

wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...

The upload/register paths indexed ImageAssocType.values() with the client's raw index, so an out-of-range value surfaced as an ArrayIndexOutOfBoundsException (5...

Adds DocPageRenderService + POST /api/conversion/render-page (page N → PNG at 150 DPI, capped 300) and /page-count. This is the read-quality companion to the 30...

With the resize semaphore in place, give the pod room for the JVM plus up to 2 concurrent ffmpeg image decodes so multi-file wallpaper uploads no longer OOMKill...

A multi-file upload fires all files at once; each ffmpeg decode allocates the full uncompressed frame, so N concurrent large images blew past the pod's memory l...

**************** scaled small images UP to fill the box (800x600 -> 1440x1080). Compute a concrete downscale factor capped at 1.0 from the probed dimensions ins...

Adversarial-review follow-ups on the ffmpeg rewrite: - probeDimensions redirects ffprobe output to a file and calls waitFor() FIRST (destroyForcibly on timeou...

ImageIO + webp-imageio could native-crash the JVM (SIGSEGV in libwebp-imageio, UpsampleBgraLinePair_SSE2) on certain WebP inputs, taking the whole ConversionSer...

The image/video/PDF thumbnail steps set thumb flags on a detached ImgDat and called save(), which merges and cascades into the orphanRemoval images collection —...

The conversion-progress publish used NatsMessageService.publish(), which asserts expectedStream=<this service's stream>. The subject **************** resolves t...

- Extract a reusable TranscriptionService (ffmpeg normalize -> whisper-asr) and a generic POST /api/conversion/transcribe endpoint, replacing the meet-specifi...

POST /api/conversion/meet/transcribe (X-Internal-Auth): normalizes an uploaded meeting recording to 16kHz mono WAV via a new additive FfmpegService helper, forw...

Canva MP4 exports (and any video upload) skip the Docs PDF path and get a single ffmpeg poster-frame thumbnail (_thumb_p0.png) instead of failing. - **********...

When an uploaded file's bytes matched an existing ImgDat, the dedup path (register-existing) reused that dat verbatim and never ran the conversion pipeline. If ...

Favicon PNG/ICO frames were produced with keepAspectRatio(false), stretching any non-square logo into a distorted square. Center-fit the logo on a transparent s...

Both the template and regular upload conversion pipelines swallowed Docs conversion failures (logged only), leaving is_converted=false with no recorded reason —...