Stop an indexed source turning the tab icon into a black box
A tab icon uploaded as a transparent PNG-8 arrived in the browser tab as a black square with a ragged logo on it. Measured on the upload that exposed it: of the...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Gate platform uploads on MANAGE_PLATFORM_SOUNDS, not org ownership
An operator granted "Manage Platform Sounds" on the Platform Administrators page saw the Sounds tab — the console gates on the right — opened the upload dialog,...
Uploading a file takes CREATE_DOCUMENTS, like every other way of making one
The document rights are enforced in DocsService as of this change, but the upload endpoints are not in DocsService — kamo-internal's app/api/imaging/upload prox...
Raise the document upload ceiling from 500MB to 3 GiB
Chat attachments have run at 3 GiB through this same imaging pipeline for a while; documents were capped at 500MB. The difference was not a policy, it was that ...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop renewing the shared *** TTL for idle users
Fifth service holding its own copy of KSessionService, and the fifth sliding the shared *** TTL on every read. Each one alone was enough to keep a session alive...
Use targeted conversion updates instead of saving a detached ImgDat
convertAndGenerateThumbnails runs on a virtual thread with a detached ImgDat, so imgDatRepository.save() merged a stale orphan-removal collection and threw befo...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Require a session on POST /backfill-conversions
The handler was declared backfillConversions() — it took no request at all — under the comment "No auth — internal maintenance, mirrors /backfill-thumbnails". I...
Stop pinning the expired wildcard-kamocrm-com secret
wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...
A bad assocType index is a 400, not a 500
The upload/register paths indexed ImageAssocType.values() with the client's raw index, so an out-of-range value surfaced as an ArrayIndexOutOfBoundsException (5...
Bound concurrent ffmpeg to prevent OOM under upload bursts
A multi-file upload fires all files at once; each ffmpeg decode allocates the full uncompressed frame, so N concurrent large images blew past the pod's memory l...
Downscale-only (never upscale small images)
**************** scaled small images UP to fill the box (800x600 -> 1440x1080). Compute a concrete downscale factor capped at 1.0 from the probed dimensions ins...
Harden ffmpeg resize (probe safety, dim caps, bomb guard)
Adversarial-review follow-ups on the ffmpeg rewrite: - probeDimensions redirects ffprobe output to a file and calls waitFor() FIRST (destroyForcibly on timeou...
Resize backgrounds via ffmpeg subprocess (crash-isolated)
ImageIO + webp-imageio could native-crash the JVM (SIGSEGV in libwebp-imageio, UpsampleBgraLinePair_SSE2) on certain WebP inputs, taking the whole ConversionSer...
Persist thumb flags via targeted update, not detached save
The image/video/PDF thumbnail steps set thumb flags on a detached ImgDat and called save(), which merges and cascades into the orphanRemoval images collection —...
Stop uploads hanging on 'Converting...' — route NATS progress + direct image thumbnails
The conversion-progress publish used NatsMessageService.publish(), which asserts expectedStream=<this service's stream>. The subject **************** resolves t...
Convert deduplicated documents so e-sign edit is enabled
When an uploaded file's bytes matched an existing ImgDat, the dedup path (register-existing) reused that dat verbatim and never ran the conversion pipeline. If ...
Use cluster MinIO service DNS; drop deprecated WireGuard/CGNAT IPs and retired k2m1/k0m1
Persist conversion_error instead of failing silently
Both the template and regular upload conversion pipelines swallowed Docs conversion failures (logged only), leaving is_converted=false with no recorded reason —...
Enable JPA repos for commerce + email + dao.repositories packages
ConversionService new pod CrashLoopBackOff with the same error DaemonService hit earlier: Parameter 0 of constructor in **************** required a bean of ...
Add @JsonIgnoreProperties to UploadTemplateRequest to prevent hash null on unknown fields
The frontend sends accessLevel, description, folderId, docTypeId in the metadata JSON. Jackson was failing to parse the entire metadata object when encountering...
Expand component scan and add full datasource/JPA/Redis/MinIO config
ConversionServiceApplication was only scanning com.kamo.ConversionService, missing all shared library beans (ImageService, MinIOStorageService, MemberRepository...
Add kamo-shared-library build stage to resolve missing dependency
The Dockerfile was trying to fetch kamo-shared-library from Maven Central, which doesn't exist there. Mirror the SecurityService pattern: clone the shared libra...
Handle image files (JPG, PNG, TIFF, etc.) directly via PDFBox instead of Docs
Docs can't convert images to PDF. Added ImageToPdfService that embeds images into a PDF page using PDFBox. Docs is only used for office document formats (DOC, D...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.