What shipped

Llunky84

A new API endpoint was added to allow services to check whether feature flags are enabled for a specific organization without needing to duplicate that logic everywhere.

Rrobin-agent

Keystone's gRPC calls now have timeouts to prevent workers from hanging indefinitely on slow services, retries for transient failures, and the assignment cleanup moved off the blocking request path.

JJoshYG-TheKey

Added optional publish date filters to the chat search request protocol so articles can be filtered by when they were last updated.

Rrobin-agent

Included the publication status of training items in API responses so downstream services can see whether items are published or coming-soon.

Aalex-wilson-the-key

Added a missing external links data type to support KCSIE compliance features in the training assignment system.

Rrobin-agent

Automatically deleted orphaned training assignments when a user account is permanently removed from the system to prevent data inconsistencies.

Aalex-wilson-the-key

The system now supports external links as a new assignment type, allowing users to assign government documents like KCSIE files as required reading with a corresponding external link identifier.

Llunky84

User authentication now bypasses caching during password resets so that login immediately validates against the new password hash instead of stale cached credentials.

TTheTomWard

Added new API endpoints to support migrating training data between different user accounts.

Ccpotey

Ensured the local development database doesn't restore a stale deprecated validation URL when reset, preventing authentication issues during testing.

Ccpotey

Removed a stale redirect URL from the MYKEY application record that was causing login flows to hit a deprecated endpoint instead of returning users to their intended destination.

Rrobin-agent

Fixed security vulnerabilities in lodash-es and fast-xml-parser by adding dependency overrides and upgrading packages to safer versions.

Rrobin-agent

Additional vulnerable transitive dependencies in company-backend have been patched through pnpm overrides to address remaining security vulnerabilities like prototype pollution and HTTP response splitting issues.

Rrobin-agent

Seventy-one vulnerable transitive dependencies introduced by Strapi have been mitigated by pinning safe patched versions through pnpm overrides, addressing critical security issues while maintaining API compatibility.