What shipped

Llunky84

A new API endpoint was added to allow services to check whether feature flags are enabled for a specific organization without needing to duplicate that logic everywhere.

Rrobin-agent

The key_service_sites microservice now applies timeouts to all gRPC calls including page-rendering operations, preventing worker threads from getting stuck waiting for unresponsive backend services.

Rrobin-agent

The training_centre service added timeouts and automatic retries to its gRPC calls so transient service issues don't silently break course completion flows.

RRhadamanthus1

The almanac calendar management tool was restored to the training_centre codebase after it was accidentally deleted during a code cleanup.

JJoshYG-TheKey

Added optional publish date filters to the chat search request protocol so articles can be filtered by when they were last updated.

Rrobin-agent

Included the publication status of training items in API responses so downstream services can see whether items are published or coming-soon.

Aalex-wilson-the-key

Added a missing external links data type to support KCSIE compliance features in the training assignment system.

Ssarahcthekey

Configured the key_service_sites container to run as a non-root user for improved security in production environments.

Rrobin-agent

Prevented accidental changes to SCOID identifiers on training pages once registrations exist, which was breaking the ability to sync completion data from ScormCloud.

Llunky84

Modified certificate downloads to reference training results through their unique IDs instead of a separate certificates table for better data consistency.

Aalex-wilson-the-key

The system now supports external links as a new assignment type, allowing users to assign government documents like KCSIE files as required reading with a corresponding external link identifier.

Llunky84

The e-learning certificate API now exposes the record ID so clients can identify which e-learning result each certificate corresponds to.

Rrobin-agent

Training content marked as 'new' will now automatically stop appearing as new after 2 months, eliminating the need for manual updates and preventing stale content from being labeled as fresh.

TTheTomWard

Added new API endpoints to support migrating training data between different user accounts.

Rrobin-agent

Prevented learner course completion status from reverting to incomplete when they re-access a finished ScormCloud course, ensuring consistent data between status and completion timestamps.

Ssnyk-io-eu[bot]

Updated the PostgreSQL Docker image from version 16.11 to 16.14 to address three security vulnerabilities.

Rrobin-agent

Fixed security vulnerabilities in lodash-es and fast-xml-parser by adding dependency overrides and upgrading packages to safer versions.

Rrobin-agent

Made text and messaging updates to the website for ticket 3635 to improve user-facing copy.

Rrobin-agent

Additional vulnerable transitive dependencies in company-backend have been patched through pnpm overrides to address remaining security vulnerabilities like prototype pollution and HTTP response splitting issues.

Rrobin-agent

Seventy-one vulnerable transitive dependencies introduced by Strapi have been mitigated by pinning safe patched versions through pnpm overrides, addressing critical security issues while maintaining API compatibility.

Ccpotey

Images no longer silently disappear from articles when the Wagtail editor encounters rendering errors, preventing accidental data loss when users save pages after editing.

RRhadamanthus1

Unused application settings and the context processor module that served no active purpose have been removed as part of cleanup operations.

RRhadamanthus1

Obsolete OIDC middleware that was designed for the old user-facing Django template system has been removed since the application is now a headless backend.

RRhadamanthus1

The single-access-session middleware and related functionality have been removed because no new tokens of this type have been created in years and stakeholders confirmed it is unused.

RRhadamanthus1

The redirect middleware has been removed because its functionality is now handled by Kubernetes infrastructure-level redirect rules that are already in place.

Aalex-wilson-the-key

The training centre service now exposes an endpoint for the orca service to retrieve elearning results data, enabling service-to-service communication with proper authentication.