What shipped

Rrobin-agent

The key_service_sites microservice now applies timeouts to all gRPC calls including page-rendering operations, preventing worker threads from getting stuck waiting for unresponsive backend services.

Rrobin-agent

Keystone's gRPC calls now have timeouts to prevent workers from hanging indefinitely on slow services, retries for transient failures, and the assignment cleanup moved off the blocking request path.

Rrobin-agent

The training_centre service added timeouts and automatic retries to its gRPC calls so transient service issues don't silently break course completion flows.

RRhadamanthus1

The almanac calendar management tool was restored to the training_centre codebase after it was accidentally deleted during a code cleanup.

Ssarahcthekey

Configured the key_service_sites container to run as a non-root user for improved security in production environments.

Rrobin-agent

Automatically deleted orphaned training assignments when a user account is permanently removed from the system to prevent data inconsistencies.

Rrobin-agent

Prevented accidental changes to SCOID identifiers on training pages once registrations exist, which was breaking the ability to sync completion data from ScormCloud.

Llunky84

Modified certificate downloads to reference training results through their unique IDs instead of a separate certificates table for better data consistency.

Llunky84

User authentication now bypasses caching during password resets so that login immediately validates against the new password hash instead of stale cached credentials.

Llunky84

The e-learning certificate API now exposes the record ID so clients can identify which e-learning result each certificate corresponds to.

Rrobin-agent

Training content marked as 'new' will now automatically stop appearing as new after 2 months, eliminating the need for manual updates and preventing stale content from being labeled as fresh.

Ccpotey

Ensured the local development database doesn't restore a stale deprecated validation URL when reset, preventing authentication issues during testing.

Ccpotey

Removed a stale redirect URL from the MYKEY application record that was causing login flows to hit a deprecated endpoint instead of returning users to their intended destination.

Rrobin-agent

Prevented learner course completion status from reverting to incomplete when they re-access a finished ScormCloud course, ensuring consistent data between status and completion timestamps.

Ssnyk-io-eu[bot]

Updated the PostgreSQL Docker image from version 16.11 to 16.14 to address three security vulnerabilities.

Rrobin-agent

Fixed security vulnerabilities in lodash-es and fast-xml-parser by adding dependency overrides and upgrading packages to safer versions.

Rrobin-agent

Made text and messaging updates to the website for ticket 3635 to improve user-facing copy.

Rrobin-agent

Additional vulnerable transitive dependencies in company-backend have been patched through pnpm overrides to address remaining security vulnerabilities like prototype pollution and HTTP response splitting issues.

Rrobin-agent

Seventy-one vulnerable transitive dependencies introduced by Strapi have been mitigated by pinning safe patched versions through pnpm overrides, addressing critical security issues while maintaining API compatibility.

Ccpotey

Images no longer silently disappear from articles when the Wagtail editor encounters rendering errors, preventing accidental data loss when users save pages after editing.

RRhadamanthus1

Unused application settings and the context processor module that served no active purpose have been removed as part of cleanup operations.

RRhadamanthus1

Obsolete OIDC middleware that was designed for the old user-facing Django template system has been removed since the application is now a headless backend.

RRhadamanthus1

The single-access-session middleware and related functionality have been removed because no new tokens of this type have been created in years and stakeholders confirmed it is unused.

RRhadamanthus1

The redirect middleware has been removed because its functionality is now handled by Kubernetes infrastructure-level redirect rules that are already in place.

Aalex-wilson-the-key

The training centre service now exposes an endpoint for the orca service to retrieve elearning results data, enabling service-to-service communication with proper authentication.