🔖(minor) bump release to 1.8.0

📝(changelog) update changelog with recent changes
Update changelog.
2026-02-20 13:44:19 +01:00 · 2026-02-20 13:17:45 +01:00 · 2026-02-20 13:17:45 +01:00 · 2026-02-20 13:17:45 +01:00 · 2026-02-20 13:17:45 +01:00 · 2026-02-20 13:17:45 +01:00
19 changed files with 82 additions and 47 deletions
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Download Crowdin files
        uses: crowdin/github-action@v2
@@ -23,7 +23,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Docker meta
        id: meta
@@ -59,7 +59,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Docker meta
        id: meta
@@ -96,7 +96,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Docker meta
        id: meta
@@ -133,7 +133,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Docker meta
        id: meta
@@ -172,7 +172,7 @@ jobs:
    steps:
      -
        name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Docker meta
        id: meta
@@ -14,7 +14,7 @@ jobs:
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: show
@@ -41,7 +41,7 @@ jobs:
      github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 50
      - name: Check that the CHANGELOG has been modified in the current branch
@@ -51,7 +51,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -67,15 +67,15 @@ jobs:
        working-directory: src/mail
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version: "18"

      - name: Restore the mail templates
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -95,7 +95,7 @@ jobs:

      - name: Cache mail templates
        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
@@ -107,9 +107,9 @@ jobs:
        working-directory: src/backend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -129,9 +129,9 @@ jobs:
        working-directory: src/agents
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -149,9 +149,9 @@ jobs:
        working-directory: src/summary
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -216,7 +216,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Create writable /data
        run: |
@@ -224,7 +224,7 @@ jobs:
          sudo mkdir -p /data/static

      - name: Restore the mail templates
-        uses: actions/cache@v4
+        uses: actions/cache@v5
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
@@ -258,7 +258,7 @@ jobs:
            mc mb meet/meet-media-storage"

      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: "pip"
@@ -281,7 +281,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install dependencies
        run: cd src/frontend/ && npm ci
@@ -299,7 +299,7 @@ jobs:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install dependencies
        run: npm ci
@@ -318,7 +318,7 @@ jobs:
        working-directory: src/sdk/library
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Install dependencies
        run: npm ci
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -8,9 +8,25 @@ and this project adheres to

 ## [Unreleased]

+## [1.8.0] - 2026-02-20
+
+### Changed
+
+- 🔒️(agents) uninstall pip from the agents image
+- 🔒️(summary) switch to Alpine base image
+- 🔒️(backend) uninstall pip in the production image 
+
+### Fixed
+
+- 🔒️(agents) upgrade OpenSSL to address CVE-2025-15467
+- 📌(agents) pin protobuf to 6.33.5 to fix CVE-2026-0994
+
+## [1.7.0] - 2026-02-19
+
 ### Added

 - ✨(frontend) expose Windows app web link #976
+- ✨(frontend) support additional shortcuts to broaden accessibility

 ### Changed

@@ -127,6 +127,9 @@ ARG MEET_STATIC_ROOT=/data/static
 RUN mkdir -p /usr/local/etc/gunicorn
 COPY docker/files/usr/local/etc/gunicorn/meet.py /usr/local/etc/gunicorn/meet.py

+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}
@@ -18,6 +18,7 @@ docker_build(
    'localhost:5001/meet-backend:latest',
    context='..',
    dockerfile='../Dockerfile',
+    build_args={'DOCKER_USER': '1001:127'},
    only=['./src/backend', './src/mail', './docker'],
    target = 'backend-production',
    live_update=[
@@ -33,6 +34,7 @@ clean_old_images('localhost:5001/meet-backend')
 docker_build(
    'localhost:5001/meet-frontend-dinum:latest',
    context='..',
+    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../docker/dinum-frontend/Dockerfile',
    only=['./src/frontend', './docker', './.dockerignore'],
    target = 'frontend-production',
@@ -57,6 +59,7 @@ clean_old_images('localhost:5001/meet-frontend-generic')
 docker_build(
    'localhost:5001/meet-summary:latest',
    context='../src/summary',
+    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../src/summary/Dockerfile',
    only=['.'],
    target = 'production',
@@ -69,8 +72,9 @@ clean_old_images('localhost:5001/meet-summary')
 docker_build(
    'localhost:5001/meet-agents:latest',
    context='../src/agents',
+    build_args={'DOCKER_USER': '1001:127'},
    dockerfile='../src/agents/Dockerfile',
-   only=['.'],
+    only=['.'],
    target = 'production',
    live_update=[
        sync('../src/agents', '/app'),
@@ -4,6 +4,8 @@ FROM python:3.13-slim AS base
 RUN apt-get update && apt-get install -y \
    libglib2.0-0 \
    libgobject-2.0-0 \
+    "openssl=3.5.4-1~deb13u2" \
+    "libssl3t64=3.5.4-1~deb13u2" \
    && rm -rf /var/lib/apt/lists/*

 FROM base AS builder
@@ -19,6 +21,9 @@ FROM base AS production

 WORKDIR /app

+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 ARG DOCKER_USER
 USER ${DOCKER_USER}

@@ -1,14 +1,15 @@

 [project]
 name = "agents"
-version = "1.6.0"
+version = "1.8.0"
 requires-python = ">=3.12"
 dependencies = [
    "livekit-agents==1.3.10",
    "livekit-plugins-deepgram==1.3.10",
    "livekit-plugins-silero==1.3.10",
    "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.1"
+    "python-dotenv==1.2.1",
+    "protobuf==6.33.5"
 ]

 [project.optional-dependencies]
@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"

 [project]
 name = "meet"
-version = "1.6.0"
+version = "1.8.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
@@ -1,12 +1,12 @@
 {
  "name": "meet",
-  "version": "1.6.0",
+  "version": "1.8.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "meet",
-      "version": "1.6.0",
+      "version": "1.8.0",
      "dependencies": {
        "@fontsource-variable/material-symbols-outlined": "5.2.34",
        "@fontsource/material-icons-outlined": "5.2.6",
@@ -1,7 +1,7 @@
 {
  "name": "meet",
  "private": true,
-  "version": "1.6.0",
+  "version": "1.8.0",
  "type": "module",
  "scripts": {
    "dev": "panda codegen && vite",
@@ -6,6 +6,7 @@ import { css } from '@/styled-system/css'
 import { useParticipants } from '@livekit/components-react'
 import { useSidePanel } from '../../../hooks/useSidePanel'
 import { ToggleButtonProps } from '@/primitives/ToggleButton'
+import { useRegisterKeyboardShortcut } from '@/features/shortcuts/useRegisterKeyboardShortcut'

 export const ParticipantsToggle = ({
  onPress,
@@ -27,6 +28,11 @@ export const ParticipantsToggle = ({

  const tooltipLabel = isParticipantsOpen ? 'open' : 'closed'

+  useRegisterKeyboardShortcut({
+    id: 'toggle-participants',
+    handler: toggleParticipants,
+  })
+
  return (
    <div
      className={css({
@@ -1,12 +1,12 @@
 {
  "name": "mail_mjml",
-  "version": "1.6.0",
+  "version": "1.8.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "mail_mjml",
-      "version": "1.6.0",
+      "version": "1.8.0",
      "license": "MIT",
      "dependencies": {
        "@html-to/text-cli": "0.5.4",
@@ -1,6 +1,6 @@
 {
  "name": "mail_mjml",
-  "version": "1.6.0",
+  "version": "1.8.0",
  "description": "An util to generate html and text django's templates from mjml templates",
  "type": "module",
  "dependencies": {
@@ -1,12 +1,12 @@
 {
  "name": "sdk",
-  "version": "1.6.0",
+  "version": "1.8.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sdk",
-      "version": "1.6.0",
+      "version": "1.8.0",
      "license": "ISC",
      "workspaces": [
        "./library",
@@ -1,6 +1,6 @@
 {
  "name": "sdk",
-  "version": "1.6.0",
+  "version": "1.8.0",
  "author": "",
  "license": "ISC",
  "description": "",
@@ -1,12 +1,9 @@
-FROM python:3.13-slim AS base
+FROM python:3.13-alpine3.23 AS base


 # Install ffmpeg for audio/video processing (format conversion, extraction, compression)
 # See summary/core/file_service.py for usage.
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends ffmpeg=7:7.1.3-* && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/*
+RUN apk add --no-cache "ffmpeg=8.0.1-r1"

 FROM base AS builder

@@ -14,13 +11,13 @@ WORKDIR /app

 COPY pyproject.toml .

-RUN pip3 install --no-cache-dir .
+RUN pip install --no-cache-dir .

 FROM base AS development
 WORKDIR /app

 COPY . .
-RUN pip3 install --no-cache-dir -e ".[dev]" || pip3 install --no-cache-dir -e .
+RUN pip install --no-cache-dir -e ".[dev]" || pip install --no-cache-dir -e .

 CMD ["uvicorn", "summary.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]

@@ -28,6 +25,9 @@ FROM base AS production

 WORKDIR /app

+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}
@@ -1,7 +1,7 @@

 [project]
 name = "summary"
-version = "1.6.0"
+version = "1.8.0"
 dependencies = [
    "fastapi[standard]>=0.105.0",
    "uvicorn>=0.24.0",
Author	SHA1	Message	Date
lebaudantoine	9916ab7d7e	🔖(minor) bump release to 1.8.0	2026-02-20 13:44:19 +01:00
lebaudantoine	bd2ad3bb99	📝(changelog) update changelog with recent changes Update changelog.	2026-02-20 13:17:45 +01:00
lebaudantoine	f02fbc85a3	🔒️(agents) upgrade OpenSSL to address CVE-2025-15467 Upgrade OpenSSL and related dependencies to address CVE-2025-15467 in meet-agents. This vulnerability was blocking the image signature workflow, as it is classified as a critical dependency.	2026-02-20 13:17:45 +01:00
lebaudantoine	4fd4e074e0	📌(agents) pin protobuf to 6.33.5 to fix CVE-2026-0994 Protobuf is a transitive dependency. Pin it to version 6.33.5 to address CVE-2026-0994.	2026-02-20 13:17:45 +01:00
lebaudantoine	ec3d4f7462	🔒️(agents) uninstall pip from the agents image Reduce surface area and keep the runtime image minimal.	2026-02-20 13:17:45 +01:00
lebaudantoine	4507325331	🔒️(summary) switch to Alpine base image Reduce surface area and keep the runtime image minimal. Alpine 3.22 provides ffmpeg v6 as the latest version. Alpine 3.23 does not include ffmpeg v7, so upgrade directly to v8. Install pip temporarily for build steps, then remove it from the production image.	2026-02-20 13:17:45 +01:00
lebaudantoine	dac4a72838	🔒️(backend) uninstall pip in the production image Reduce surface area and keep the runtime image minimal.	2026-02-20 13:17:45 +01:00
lebaudantoine	5048005fc1	🔧(tilt) use the same user as in production to facilitate testing Use the same user as in production to facilitate local testing with the production image. Assign group 127 to the docker user to mirror CI and match production practices, even though the rationale for this group mapping is unclear.	2026-02-20 13:17:45 +01:00
lebaudantoine	002c7c0e42	🩹(tilt) fix minor indentation issue in the Tilt file No functional impact, just a formatting cleanup.	2026-02-20 13:17:45 +01:00
Stephan Meijer	e18b732776	⬆️(ci) upgrade GitHub Actions workflow steps to latest versions Update all GitHub Actions to their latest major versions for improved performance, security patches, and Node.js runtime compatibility. Signed-off-by: Stephan Meijer <me@stephanmeijer.com>	2026-02-20 11:49:14 +01:00
lebaudantoine	ce9f812a7e	🔖(minor) bump release to 1.7.0	2026-02-19 12:37:26 +01:00
lebaudantoine	b02591170f	🐛(frontend) configure missing participants shortcut Configure missing shortcut in the frontend for the participant side panel. It was accidentally omitted while merging Cyril's changes.	2026-02-19 12:12:23 +01:00