Mabadiliko ya Tabianchi

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

Both sites took .getContent() and dropped the total on the floor, so both were paying for the same discarded COUNT over every object in the session that just 50...

The container ran with a 1Gi limit while the image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch. Read off the live process, that is MaxHeapSi...

Spring Data derives a second statement for every Page it returns, and the chat history read asked for one it never looked at: MediaController takes page.getCont...

Outbound tcp/22 is rejected for every uid except root and sage, keyed on socket owner so future accounts are covered without re-running anything. Reapplied at b...

Adds krita and maven **************** were already present), pins Chrome, VS Code, Kate, Spectacle and Krita to the taskbar for every user, and lets dev users i...

Cilium egress is default-deny for every endpoint it selects, and toEndpoints:[{}] is scoped to the policy's OWN namespace — so SecurityService could not reach d...

The icon now appears exactly when the connection behind it will work — the SSO endpoint enforces the same rule, so the two cannot disagree. Windows and Master s...

Keeps three states apart that one toggle would collapse: never provisioned (needs a password), provisioned but locked (needs only the switch), and failed (needs...

*** is forwarded explicitly — buildForwardHeaders sets X-OTK but not the session token, and the dev-machine endpoints resolve the caller from it. The action seg...

Linux is gated on an enabled provision rather than god, and served with the member's own credentials. The connection is omitted from the token entirely when the...

Username derives from the member ACCOUNT email, not the TeamMember work email — a work address can sit on another domain and would silently produce a different ...

health() swallows transport failures and answers false so the SSO preflight can return an actionable 503 rather than a 500.

Codec is deliberately reversible — RDP auto-login needs a real password — and uses GCM so a tampered or wrong-key row fails loudly rather than decrypting to noi...

status and enabled are deliberately separate: a provisioned-but-disabled account keeps its home directory, so re-enabling restores access rather than rebuilding...

Alert expressions verified against the live Prometheus. Uses kube-state-metrics rather than kubevirt_* — the KubeVirt metrics endpoint is not scraped here, so r...

Staged under /opt/kamo-desktop-agent so install-agent.sh has a distinct source and destination. Covers netplan-by-driver, cloud-init network disable, xrdp sessi...

Python 3 stdlib only. Every mutation runs subprocess with an argv list, never a shell string; passwords go to chpasswd on stdin so they stay out of /proc.

KubeVirt generates a random MAC per VMI when macAddress is absent. The guest's netplan matched on the first-boot MAC, so every VMI recreate silently orphaned th...

16 tasks across KlusterServices, kamo-shared-library, KamoInitializerService, SecurityService and kamo-internal.

Covers the root cause of the 23-day KamoDesktop outage (netplan matching a first-boot MAC that KubeVirt regenerates on every VMI recreate), the live fix already...

SecurityService now sends ids past Number.MAX_SAFE_INTEGER as strings so they survive JSON.parse. That was being undone one line into the client: OrganizationDT...

CockroachDB unique_rowid() ids are 19 digits, past Number.MAX_SAFE_INTEGER, so an id sent as a JSON number arrives in the browser with its low digits rounded aw...

JacksonConfig registered a **************** serializing Long as String -- the standard guard for CockroachDB ids, which run past JavaScript's MAX_SAFE_INTEGER. ...

A department's contact address is derived from the assigned mailbox server-side, and `email` was dropped from the create and update requests when the mailbox po...

Declaring an ObjectMapper bean takes binding away from Spring Boot's auto-configured one, and a hand-built mapper carries Jackson's defaults rather than Boot's....

The inline sign-in messages ("Login successful! Redirecting...", "Invalid username and/or password.") used MUI's default Alert, whose pastel fill plus matching ...

The reported case is the brand green on a tint of itself: --color-primary against rgba(107,142,58,0.15) is 3.43:1. That clears the 3:1 WCAG 1.4.11 floor for gra...

Two placements, both chosen for where the claim is already being made: Footer — 60px, beside "© 2001–<year> ... established 2025". Site-wide, ...

Renders "© 2001–<year> KamoCRM. KamoCRM Inc. established 2025. All rights reserved." The range start is hard-coded next to the dynamic end year rather than livi...

Zoom and Microsoft Teams for meetings, and the ten payroll vendors — ADP Workforce Now, BambooHR, Dayforce, Gusto, Paychex Flex, Paycor, Paylocity, Rippling, UK...

"Apps & Integrations" was one tile reading 31+. It is now two, each with a figure that can be re-derived rather than estimated: Apps 64 — Forgejo pro...

The h1 stacked four effects: a fade wrapper, mouse parallax on each line, per-character 3D rotation on line one, and a blue/purple/green gradient cycling across...

The success/error screen shown briefly before redirect was the one logo in the sign-in flow still rendering untouched. It kept its own design rather than joinin...

Two ordered steps, the checks that made the second one safe, and the reason the order matters: kamo-internal had to be signing before KamoLOS started validating...

los.proxy-hmac.enabled has been falling through to its false default since this service deployed, so ProxyHmacFilter existed and never ran. X-Org-Id — the heade...

There were four copies of the same full-screen loading markup — the navigation screen, both of /validate's pre-result screens, and /logout — identical down to t...

KamoLOS trusts X-Org-Id and X-Member-Id from this proxy. ProxyHmacFilter exists to prove those headers really came from here, but it is disabled in production: ...

Same bug as LoanController.get(uid), repeated: these controllers took a loan id off the path and handed it to a repository, so GET /api/los/statements/by-loan/4...

KamoMeet is a Meet fork with no access to OrgContext, so it learns org branding from the theme config.json this service bakes. The org stores an overlay TOKEN; ...

Third overlay surface: the KamoMeet pre-meeting screen. Same shape as the other two — nullable, no backfill, no DEFAULT. The drift guard needed only its field ...

Third and last overlay surface, same vocabulary as its two siblings, plus its branch in the generic patch path. This one is different in where it ends up. The ...

§12 concluded that KamoLOS had no deployment and that gating it was therefore free, and the LOS proxy repeated the claim in a comment. Both are wrong. The servi...

3bfe883c rewrote PublicProvider.tsx and the org route wholesale — 1919 and 121 lines for what was a one-line addition to each. The content was intact; the endin...

Third and last surface, offered next to the other two — same thirteen options, its own setting, default No Overlay. Hidden unless the org can actually reach th...

An org can now choose a solid colour for the pre-meeting logo, set from kamo-internal's Branding settings and applied here. This side never sees the token voca...

Half strength let too much of the photography through the join column and the preview pane. Both are now 90% of their own colour, so the background reads as a f...