⚡️(devx) switch devstack to node:22-alpine

The devstack was pulling the full `node:22` image, around 1.6 GB. Switch to `node:22-alpine`, which is much smaller, to speed up the devstack bootstrap time and reduce disk usage.
⚡️(devx) use a single Redis image version in the devstack
2026-10-04 21:02:07 +00:00 · 2026-10-02 15:46:34 +02:00 · 2026-10-01 16:38:31 +02:00 · 2026-10-01 16:37:29 +02:00 · 2026-10-01 16:37:29 +02:00 · 2026-10-01 00:13:36 +02:00
64 changed files with 721 additions and 1721 deletions
@@ -0,0 +1,9 @@
 [codespell]
 # Files that are not English, or generated
 skip = ./.git,*.pdf,*.po,*.pot,*.json,*.lock,package-lock.json,
  ./LICENSES,
  ./src/summary/summary/core/locales,
  ./src/summary/summary/core/prompt.py
 # Valid words in French (connexion) or in the code (statics)
 ignore-words-list = connexion,statics
 check-filenames = true
@@ -0,0 +1,20 @@
 # Debian 13 base image (python:3.14-slim): no fixed version available yet.
 # Review regularly and remove entries once Debian ships a fix.
 # util-linux
 CVE-2026-76642
 CVE-2026-78408
 CVE-2026-78409
 CVE-2026-78410
 # acl
 CVE-2026-54369
 # ncurses
 CVE-2025-69720
 # systemd
 CVE-2026-16742
 # perl-base (fix deferred by Debian)
 CVE-2026-9538
@@ -0,0 +1,19 @@
 name: Changelog Workflow
 on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled]
 permissions:
  contents: read
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true
 jobs:
  changelog:
    uses: suitenumerique/ci/.github/workflows/_changelog.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
@@ -11,180 +11,30 @@ permissions:
  contents: read
 jobs:
-  lint-git:
+
-    runs-on: ubuntu-latest
+  lint-python:
-    if: github.event_name == 'pull_request' # Makes sense only for pull requests
+    name: lint ${{ matrix.service }}
-    permissions:
+    strategy:
-      contents: read
+      fail-fast: false
-    steps:
+      matrix:
-      - name: Checkout repository
+        include:
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+          - service: backend
            working_directory: src/backend
            pylint_targets: meet demo core
          - service: agents
            working_directory: src/agents
            pylint_targets: ""
          - service: summary
            working_directory: src/summary
            pylint_targets: ""
    uses: suitenumerique/ci/.github/workflows/_python-lint.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
    with:
-          fetch-depth: 0
+      working_directory: ${{ matrix.working_directory }}
-      - name: show
+      python_version: "3.13"
-        run: git log
+      pylint_targets: ${{ matrix.pylint_targets }}
      - name: Enforce absence of print statements in code
        if: always()
        run: |
          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude).github/workflows/**' | grep "print("
      - name: Check absence of fixup commits
        if: always()
        run: |
          ! git log | grep 'fixup!'
      - name: Install uv
        if: always()
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
      - name: Lint commit messages added to main
        if: always()
        run: uvx --no-build --from gitlint-core==0.19.1 gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
  check-changelog:
    runs-on: ubuntu-latest
    if: |
      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
      github.event_name == 'pull_request'
    permissions:
        contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 50
      - name: Check that the CHANGELOG has been modified in the current branch
        run: git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.after }} | grep 'CHANGELOG.md'
  lint-changelog:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
          if [ $max_line_length -ge 80 ]; then
            echo "ERROR: CHANGELOG has lines longer than 80 characters."
            exit 1
          fi
  build-mails:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/mail
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: "22"
      - name: Restore the mail templates
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
      - name: Install yarn
        if: steps.mail-templates.outputs.cache-hit != 'true'
        run: npm install -g --ignore-scripts yarn@1.22.22
      - name: Install node dependencies
        if: steps.mail-templates.outputs.cache-hit != 'true'
        run: yarn install --frozen-lockfile --ignore-scripts
      - name: Build mails
        if: steps.mail-templates.outputs.cache-hit != 'true'
        run: yarn build
      - name: Cache mail templates
        if: steps.mail-templates.outputs.cache-hit != 'true'
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
  lint-back:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/backend
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.13"
      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
      - name: Install the project
        run: uv sync --locked --all-extras
      - name: Check code formatting with ruff
        run: uv run --no-sync --no-build ruff format . --diff
      - name: Lint code with ruff
        run: uv run --no-sync --no-build ruff check .
      - name: Lint code with pylint
        run: uv run --no-sync --no-build pylint meet demo core
  lint-agents:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/agents
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.13"
      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
      - name: Install the project
        run: uv sync --locked --all-extras --no-build
      - name: Check code formatting with ruff
        run: uv run --no-sync --no-build ruff format . --diff
      - name: Lint code with ruff
        run: uv run --no-sync --no-build ruff check .
  lint-summary:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: src/summary
    steps:
      - name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.13"
      - name: Install uv
        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
      - name: Install the project
        run: uv sync --locked --all-extras
      - name: Check code formatting with ruff
        run: uv run --no-sync --no-build ruff format . --diff
      - name: Lint code with ruff
        run: uv run --no-sync --no-build ruff check .
  test-back:
    runs-on: ubuntu-latest
    needs: build-mails
    permissions:
      contents: read
    defaults:
@@ -244,12 +94,8 @@ jobs:
          sudo mkdir -p /data/media && \
          sudo mkdir -p /data/static
-      - name: Restore the mail templates
+      - name: Build or restore the mail templates
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: suitenumerique/ci/actions/mail-templates@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
        id: mail-templates
        with:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
      # Creates the access key and the bucket on startup
      - name: Start Garage
@@ -0,0 +1,14 @@
 name: Project quality Workflow
 on:
  pull_request:
 permissions:
  contents: read
 jobs:
  quality:
    uses: suitenumerique/ci/.github/workflows/_project-quality.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
    with:
      print_check_paths: src/backend src/summary src/agents
      codespell_ignore_words: "unsecure"
@@ -1,33 +0,0 @@
 name: Download Crowdin translations
 on:
  workflow_dispatch:
    types: [file-fully-translated]
 permissions:
  contents: write
  pull-requests: write
 jobs:
  crowdin:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Download Crowdin files
        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
        with:
          upload_sources: false
          upload_translations: false
          download_translations: true
          localization_branch_name: l10n_crowdin_translations
          create_pull_request: true
          pull_request_title: "New Crowdin translations"
          pull_request_body: "New Crowdin pull request with translations"
          pull_request_base_branch_name: "main"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
          CROWDIN_BASE_PATH: ${{ github.workspace }}
@@ -1,5 +1,5 @@
-name: Docker Hub Workflow
+name: Docker images
-run-name: Docker Hub Workflow
+run-name: Docker images
 on:
  workflow_dispatch:
@@ -15,265 +15,62 @@ on:
 permissions:
  contents: read
 env:
  DOCKER_USER: 1001:127
  DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io
  DOCKER_CONTAINER_REGISTRY_NAMESPACE: lasuite
  IS_MULTI_PLATFORM_BUILD: ${{ startsWith(github.ref, 'refs/tags/v') }}
  BUILD_PLATFORMS: ${{ startsWith(github.ref, 'refs/tags/v') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
 jobs:
-  build-and-push-backend:
+  build-and-push:
-    runs-on: ubuntu-latest
+    name: ${{ matrix.service }}
-    permissions:
+    strategy:
-      contents: read
+      fail-fast: false
-    steps:
+      matrix:
-      -
+        include:
-        name: Checkout repository
+          - service: backend
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+            image_name: lasuite/meet-backend
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
        with:
          docker-build-args: '--target backend-production -f Dockerfile'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
            context: .
            file: ./Dockerfile
            target: backend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
+          - service: frontend
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+            image_name: lasuite/meet-frontend
          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  build-and-push-frontend-generic:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      -
        name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
        with:
          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
            context: .
            file: ./src/frontend/Dockerfile
            target: frontend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
+          - service: frontend-dinum
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+            image_name: lasuite/meet-frontend-dinum
          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  build-and-push-frontend-dinum:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      -
        name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
        with:
          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
      -
        name: Build and push
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
            context: .
            file: ./docker/dinum-frontend/Dockerfile
            target: frontend-production
-          platforms: ${{ env.BUILD_PLATFORMS }}
+          - service: summary
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+            image_name: lasuite/meet-summary
          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  build-and-push-summary:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      -
        name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary'
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
        continue-on-error: true
        with:
          docker-build-args: '-f src/summary/Dockerfile --target production'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
          docker-context: './src/summary'
      -
        name: Build and push
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
            context: ./src/summary
            file: ./src/summary/Dockerfile
            target: production
-          platforms: ${{ env.BUILD_PLATFORMS }}
+          - service: agents
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+            image_name: lasuite/meet-agents
          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  build-and-push-agents:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      -
        name: Checkout repository
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      -
        name: Set up QEMU
        if: env.IS_MULTI_PLATFORM_BUILD == 'true'
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: lasuite/meet-agents
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/')
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: Run trivy scan
        uses: numerique-gouv/action-trivy-cache@d6e94cfb488f03a0b3e8b8739aad94e74d24d8da # main
        continue-on-error: true
        with:
          docker-build-args: '-f src/agents/Dockerfile --target production'
          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
          docker-context: './src/agents'
      -
        name: Build and push
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
            context: ./src/agents
            file: ./src/agents/Dockerfile
            target: production
-          platforms: ${{ env.BUILD_PLATFORMS }}
+    uses: suitenumerique/ci/.github/workflows/_docker-publish.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+    with:
-          push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
+      image_name: ${{ matrix.image_name }}
-          tags: ${{ steps.meta.outputs.tags }}
+      context: ${{ matrix.context }}
-          labels: ${{ steps.meta.outputs.labels }}
+      file: ${{ matrix.file }}
      target: ${{ matrix.target }}
      docker_user: "1001:127"
      is_multi_platform: ${{ startsWith(github.ref, 'refs/tags/v') }}
      should_push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
      trivy_scan: true
      trivy_ignore_files: ./.github/.trivyignore
    secrets:
      DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
  notify-argocd:
    permissions:
      contents: read
    needs:
-      - build-and-push-frontend-generic
+      - build-and-push
      - build-and-push-frontend-dinum
      - build-and-push-backend
      - build-and-push-summary
      - build-and-push-agents
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
+      - uses: suitenumerique/ci/actions/argocd-webhook-notification@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
        id: notify
        with:
          deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"
@@ -1,33 +1,17 @@
-name: Release Chart
+name: Release Helm chart
 run-name: Release Chart
 on:
  push:
    branches:
      - main
    paths:
      - src/helm/meet/**
 permissions:
  contents: read
 jobs:
  release:
    permissions:
      contents: write
-    runs-on: ubuntu-latest
+    uses: suitenumerique/ci/.github/workflows/_release-helm-chart.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
      - name: Cleanup
        run: rm -rf ./src/helm/extra
      - name: Install Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
      - name: Publish Helm charts
        uses: numerique-gouv/helm-gh-pages@2cf477ae49d7c70037ceb1685803f4f7bad9b981 # add-overwrite-option
        with:
          charts_dir: ./src/helm
          linting: on
          token: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,21 @@
 name: Security analysis
 on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "**"
 permissions: {}
 jobs:
  zizmor:
    permissions:
      contents: read
      actions: read
      security-events: write
    uses: suitenumerique/ci/.github/workflows/_zizmor.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
    with:
      config: .github/zizmor.yml
@@ -0,0 +1,5 @@
 rules:
  unpinned-uses:
    config:
      policies:
        "suitenumerique/*": ref-pin
@@ -10,6 +10,20 @@ and this project adheres to
 ### Added
 - 🔒(backend) throttle meeting link generation
 - 🔒️(backend) add a daily cap on room creation
 ### Fixed
 - 🐛(frontend) enforce recording-mode permissions on the checkboxes
 - 🔒️(agents) fix util-linux CVEs reported by Cyberwatch
 - 🔒️(backend) fix HIGH CVEs in Django and urllib3
 - 🔒️(agents) upgrade libpcre2-8-0 to fix CVE-2026-103111
 ## [1.33.0] - 2026-09-30
 ### Added
 - ✨(backend) purge rooms inactive for a configurable period
 - 🔨(makefile) add targets to list and download files stored in Garage
@@ -21,7 +35,6 @@ and this project adheres to
 - ♻️(agents) replace the minio client by boto3
 - 🔧(compose) replace MinIO by Garage for local development
 - 🔧(helm) point media services to Garage by default
 - 💥(backend) replace recording encoding options with a profile model
 ### Fixed
@@ -394,7 +407,7 @@ and this project adheres to
 ### Fixed
- ♿️(frontend) improve accessibilty of the Effects panel #1401
+- ♿️(frontend) improve accessibility of the Effects panel #1401
 ## [1.20.0] - 2026-06-12
@@ -37,14 +37,13 @@ RUN --mount=type=cache,target=/root/.cache/uv \
  uv sync --locked --no-dev
 # ---- mails ----
-FROM node:22 AS mail-builder
+FROM node:22-alpine AS mail-builder
 COPY ./src/mail /mail/app
 WORKDIR /mail/app
-RUN yarn install --frozen-lockfile && \
+RUN npm ci --ignore-scripts && npm run build
  yarn build
 # ---- static link collector ----
@@ -53,127 +53,6 @@ Also:
 ### Helm chart: media services default to Garage
 The `meet` chart now defaults `serviceMedia.host` and `serviceMediaFiles.host` to `garage.meet.svc.cluster.local`, and the `upstream-vhost` annotation of `ingressMedia` and `ingressMediaFiles` to `garage.meet.svc.cluster.local:9000`. If you relied on the former `minio.meet.svc.cluster.local` defaults, set these values explicitly to your S3 service before upgrading, or recordings and files stop being served under `/media`.
 ### Recording encoding settings replaced by a resolution/profile model
 The `RECORDING_ENCODING_*` settings introduced in v1.16.0 exposed raw encoder
 values (width, height, framerate, bitrate). They are replaced by two named and configurable sets of
 dimensions, a **resolution** (default: `540p`, `720p`, `1080p`) and a **profile**
 (default: `talking_heads`, `text`, `mixed`, `full`), which are resolved to the width, height,
 fps and video bitrate.
 **The following environment variables are no longer read. If they are still set in
 your deployment they are silently ignored, and your recordings will be encoded with
 the new defaults instead of your tuned values.**
 | Removed variable                        | Replaced by                                                                                                   |
 | --------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
 | `RECORDING_ENCODING_ENABLED`            | Nothing. A default encoding is now always built (see below). **Not** `RECORDING_CUSTOM_ENCODING_ENABLED`, which gates a different feature. |
 | `RECORDING_ENCODING_WIDTH`              | The `width` of the entry selected by `RECORDING_ENCODING_DEFAULT_RESOLUTION` in `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`. |
 | `RECORDING_ENCODING_HEIGHT`             | The `height` of that same entry.                                                                              |
 | `RECORDING_ENCODING_FRAMERATE`          | The `fps` of the profile selected by `RECORDING_ENCODING_DEFAULT_PROFILE` in `RECORDING_ENCODING_AVAILABLE_PROFILES`. |
 | `RECORDING_ENCODING_VIDEO_BITRATE_KBPS` | That profile's `kbps`.                                                                  |
 `RECORDING_ENCODING_AUDIO_BITRATE_KBPS` and `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S`
 keep their names and meaning. The keyframe interval now defaults to `0` (unset,
 encoder's choice) instead of `4.0`.
 #### If you never set `RECORDING_ENCODING_ENABLED=True`
 The shipped defaults (`RECORDING_ENCODING_DEFAULT_PROFILE=full`,
 `RECORDING_ENCODING_DEFAULT_RESOLUTION=720p`) match LiveKit's built-in
 `H264_720P_30` preset: 1280×720, 30 fps, 3000 kbps H.264 MAIN, 128 kbps AAC.
 Video output is therefore unchanged.
 Audio and keyframing may not be. These values are now sent explicitly as advanced
 `EncodingOptions` rather than relying on LiveKit's preset, so
 `RECORDING_ENCODING_AUDIO_BITRATE_KBPS` and `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S`
 now apply to every recording. They previously applied only when
 `RECORDING_ENCODING_ENABLED` was `True`. **If you set either of them while the
 feature was disabled, they had no effect and now do**; check them before upgrading.
 If you never set them, no action is required: 128 kbps AAC is what the preset used,
 and the keyframe interval now defaults to `0`, which leaves the field unset so the
 encoder keeps picking it as before. Set `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=4.0`
 if you want fixed 4-second keyframes (the value the setting defaulted to while it
 was gated behind `RECORDING_ENCODING_ENABLED`).
 To keep letting LiveKit pick the encoding instead, set either default to an empty
 value:
 ```
 RECORDING_ENCODING_DEFAULT_RESOLUTION=
 RECORDING_ENCODING_DEFAULT_PROFILE=
 ```
 #### If you had tuned `RECORDING_ENCODING_*` values
 Translate your old values into a default resolution and a default profile. Declare your own resolution and/or profile. Both maps are read from the
 environment as a single-line Python/JSON dict literal (parsed with
 `ast.literal_eval`, so use double-quoted keys and no trailing commas, and do not
 add outer quotes in `.env`-style files):
 ```bash
 RECORDING_ENCODING_AVAILABLE_RESOLUTIONS={"540p": {"width": 960, "height": 540}, "720p": {"width": 1280, "height": 720}, "1080p": {"width": 1920, "height": 1080}}
 RECORDING_ENCODING_AVAILABLE_PROFILES={"my_old_profile": {"fps": 15, "kbps": {"540p": 350, "720p": 600, "1080p": 1100}}}
 RECORDING_ENCODING_DEFAULT_RESOLUTION=720p
 RECORDING_ENCODING_DEFAULT_PROFILE=my_old_profile
 ```
 Both maps are validated at startup and a malformed one raises a `ValueError`:
 - every entry of `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS` must declare `width` and
  `height`, and every entry of `RECORDING_ENCODING_AVAILABLE_PROFILES` an `fps` and a
  `kbps` map;
 - every profile must define a `kbps` entry for **exactly** the keys of
  `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`; overriding one of the two maps usually
  means overriding both;
 - `RECORDING_ENCODING_DEFAULT_RESOLUTION` and `RECORDING_ENCODING_DEFAULT_PROFILE`,
  when non-empty, must be keys of their respective map.
 #### Breaking: custom worker services must accept `encoding_options`
 Only concerns deployments pointing `RECORDING_WORKER_CLASSES` at their own worker
 class. The shipped `VideoCompositeEgressService` and `AudioCompositeEgressService`
 are already updated.
 The `WorkerService` protocol's `start()` takes a third argument, and the mediator
 now always passes it as a keyword when the recording carries no per-recording encoding:
 ```python
 # before
 def start(self, room_id: str, recording_id: str) -> str: ...
 # now
 def start(
    self,
    room_id: str,
    recording_id: str,
    encoding_options: Optional[Dict[str, Any]] = None,
 ) -> str: ...
 ```
 #### Optional: per-recording encoding
 `RECORDING_CUSTOM_ENCODING_ENABLED` (default `False`) toggles whether the
 start-recording API accepts an `encoding` object
 (`{"resolution": "720p", "profile": "talking_heads"}`, `profile` optional. It
 falls back to `RECORDING_ENCODING_DEFAULT_PROFILE`) that overrides the default for
 a single recording. It does not enable or disable the
 default encoding, which is built from the two `RECORDING_ENCODING_DEFAULT_*`
 settings either way. Leaving it at `False` preserves the previous behaviour, where
 every recording uses the server-side encoding: requests carrying
 `options.encoding` are rejected with a `400` before the recording is created, so
 nothing is persisted and no egress is started.
 Before enabling it:
 - clients can only pick keys you declared; there is no way to send a raw width or bitrate
 - as of this implementation, the frontend never sends `encoding` 
 - `encoding` is accepted but ignored for `transcript` recordings, whose audio-only
  egress has no video encoding to configure.
 See [docs/features/recording.md](docs/features/recording.md#tuning-recording-encoding)
 for the full setting reference, the shipped profile table and the tuning caveats.
 ## v1.30.0
@@ -55,12 +55,12 @@ function _docker_compose() {
 function _dc_run() {
    _set_user
-    user_args="--user=$USER_ID"
+    user_args=()
-    if [ -z $USER_ID ]; then
+    if [ -n "$USER_ID" ]; then
-        user_args=""
+        user_args=("--user=$USER_ID")
    fi
-    _docker_compose run --rm $user_args "$@"
+    _docker_compose run --rm "${user_args[@]}" "$@"
 }
 # _dc_exec: wrap docker compose exec command
@@ -74,12 +74,12 @@ function _dc_exec() {
    echo "🐳(compose) exec command: '\$@'"
-    user_args="--user=$USER_ID"
+    user_args=()
-    if [ -z $USER_ID ]; then
+    if [ -n "$USER_ID" ]; then
-        user_args=""
+        user_args=("--user=$USER_ID")
    fi
-    _docker_compose exec $user_args "$@"
+    _docker_compose exec "${user_args[@]}" "$@"
 }
 # _django_manage: wrap django's manage.py command with docker compose
@@ -40,7 +40,7 @@ if [ -n "$CUSTOM_LOGO_URL" ]; then
    [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1
    mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
+    echo "[custom-logo] INFO: Custom logo downloaded successfully"
 fi
 mv src/backend/* ./
@@ -7,7 +7,7 @@ gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
 bin/run &
 # if the current shell is killed, also terminate all its children     
-trap "pkill SIGTERM -P $$" SIGTERM
+trap 'pkill -TERM -P $$' SIGTERM
 # wait for a single child to finish,
 wait -n
@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 set -o errexit
 CURRENT_DIR=$(pwd)
 NAMESPACE=${1:-meet}
 SECRET_NAME=${2:-bitwarden-cli-meet}
 TEMP_SECRET_FILE=$(mktemp)
@@ -30,10 +29,10 @@ check_secret_exists() {
 # Collect user input securely
 get_user_input() {
    echo "Please provide the following information:"
-    read -p "Enter your Vaultwarden email login: " LOGIN
+    read -r -p "Enter your Vaultwarden email login: " LOGIN
-    read -s -p "Enter your Vaultwarden password: " PASSWORD
+    read -r -s -p "Enter your Vaultwarden password: " PASSWORD
    echo
-    read -p "Enter your Vaultwarden server url: " URL
+    read -r -p "Enter your Vaultwarden server url: " URL
 }
 # Create and apply the secret
@@ -77,7 +76,7 @@ main() {
        exit 0
    fi
-    echo -e ${TEMP_SECRET_FILE}
+    echo -e "${TEMP_SECRET_FILE}"
    get_user_input
    echo -e "\nCreating Vaultwarden secret…"
@@ -3,7 +3,7 @@
 mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
 PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"
-cat <<'EOF' >$PRE_COMMIT_FILE
+cat <<'EOF' >"$PRE_COMMIT_FILE"
 #!/bin/bash
 # directories containing potential secrets
@@ -27,4 +27,4 @@ for d in $DIRS; do
 done
 EOF
-chmod +x $PRE_COMMIT_FILE
+chmod +x "$PRE_COMMIT_FILE"
@@ -68,7 +68,7 @@ fi
 # Ask user for release version number
 echo ""
-read -p "Enter release version number (e.g., 1.2.3): " VERSION
+read -r -p "Enter release version number (e.g., 1.2.3): " VERSION
 # Validate version format (basic semver check)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
 git submodule update --init --recursive
 # shellcheck disable=SC2016
 git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'
@@ -8,6 +8,6 @@ environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=
 for env in $environments; do
 	echo "################### $env lint ###################"
-	helmfile -e $env -f src/helm/helmfile.yaml lint || exit 1
+	helmfile -e "$env" -f src/helm/helmfile.yaml lint || exit 1
 	echo -e "\n"
 done
@@ -172,7 +172,7 @@ services:
    working_dir: /app
  node:
-    image: node:22
+    image: node:22-alpine
    user: "${DOCKER_USER:-1000}"
    environment:
      HOME: /tmp
@@ -271,7 +271,7 @@ services:
      - /app/.venv
  redis-summary:
-    image: redis
+    image: redis:5
    ports:
      - "6379:6379"
@@ -1,7 +1,7 @@
 # Bureautix proxy overrides
 #
 # Builds submitted through the Docker API of the Podman service get none of
-# the proxy variables in their RUN steps. We need to pass the http_proxy explicitely
+# the proxy variables in their RUN steps. We need to pass the http_proxy explicitly
 # otherwise all connections fail during the build.
 x-proxy-vars: &proxy-vars
@@ -93,13 +93,13 @@ sequenceDiagram
 | **RECORDING_WORKER_CLASSES**            | Dict        | `{ "screen_recording": "core.recording.worker.services.VideoCompositeEgressService", "transcript": "core.recording.worker.services.AudioCompositeEgressService" }` | Maps recording types to their worker service classes.                                                                                                                                                                                                                                              |
 | **RECORDING_EXPIRATION_DAYS**           | Integer     | `None`                                                                                                                                                             | Number of days before recordings expire. Should match bucket lifecycle policy. Set to `None` for no expiration.                                                                                                                                                                                    |
 | **RECORDING_MAX_DURATION**              | Integer     | `None`                                                                                                                                                             | Maximum duration of a recording in milliseconds. Must be synced with the LiveKit Egress configuration. Set to None for unlimited duration. When the maximum duration is reached, the recording is automatically stopped and saved, and the user is prompted in the frontend with an alert message. |
-| **RECORDING_CUSTOM_ENCODING_ENABLED**          | Boolean     | `False`                                                                                                                                                            | Whether the start-recording API accepts a per-recording `encoding` object (resolution/profile) that overrides the default. When `False`, the API rejects per-recording `encoding`; when `True`, clients may pick from the available resolutions/profiles. The default encoding below is applied regardless of this flag. See [Tuning recording encoding](#tuning-recording-encoding).                                                          |
+| **RECORDING_ENCODING_ENABLED**          | Boolean     | `False`                                                                                                                                                            | When `False`, LiveKit Egress uses its built-in `H264_720P_30` preset. When `True`, the `RECORDING_ENCODING_*` values below are sent to LiveKit as advanced `EncodingOptions`. See [Tuning recording encoding](#tuning-recording-encoding).                                                          |
-| **RECORDING_ENCODING_AVAILABLE_RESOLUTIONS** | Dict      | `{"540p": {"width": 960, "height": 540}, "720p": {"width": 1280, "height": 720}, "1080p": {"width": 1920, "height": 1080}}`                                        | Maps a resolution name to its `{"width", "height"}` in pixels. Both the default encoding and the per-recording start-recording API pick from these keys.                                                                                                                                          |
+| **RECORDING_ENCODING_WIDTH**            | Integer     | `1280`                                                                                                                                                             | Recording video width in pixels. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                         |
-| **RECORDING_ENCODING_AVAILABLE_PROFILES** | Dict      | `{"full": {"fps": 30, "kbps": {…}}, …}`               | Maps a profile name to `{"fps", "kbps": {resolution: video_bitrate_kbps}}`. Every profile must define a bitrate for each available resolution (validated at startup).                                                                                                                              |
+| **RECORDING_ENCODING_HEIGHT**           | Integer     | `720`                                                                                                                                                              | Recording video height in pixels. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                        |
-| **RECORDING_ENCODING_DEFAULT_RESOLUTION** | String    | `"720p"`                                                                                                                                                          | Resolution used by the default encoding. When set, must be a key of `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`. Leave unset (together with, or instead of, the default profile) to disable the custom default encoding and fall back to LiveKit's built-in preset (a startup warning is emitted).                                                                                                                                                                  |
+| **RECORDING_ENCODING_FRAMERATE**        | Integer     | `30`                                                                                                                                                               | Recording video framerate (fps). Directly impacts egress worker CPU (roughly linear). Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                    |
-| **RECORDING_ENCODING_DEFAULT_PROFILE**  | String    | `"full"`                                                                                                                                                          | Profile used by the default encoding. When set, must be a key of `RECORDING_ENCODING_AVAILABLE_PROFILES`. Leave unset (together with, or instead of, the default resolution) to disable the custom default encoding and fall back to LiveKit's built-in preset (a startup warning is emitted).                                                                                                                                                                        |
+| **RECORDING_ENCODING_VIDEO_BITRATE_KBPS** | Integer   | `3000`                                                                                                                                                             | H.264 MAIN video bitrate in kbps. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                        |
-| **RECORDING_ENCODING_AUDIO_BITRATE_KBPS** | Integer   | `128`                                                                                                                                                              | AAC audio bitrate in kbps used in the default encoding.                                                                                                                                                                                                               |
+| **RECORDING_ENCODING_AUDIO_BITRATE_KBPS** | Integer   | `128`                                                                                                                                                              | AAC audio bitrate in kbps. Only applied when `RECORDING_ENCODING_ENABLED` is `True`.                                                                                                                                                                                                               |
-| **RECORDING_ENCODING_KEY_FRAME_INTERVAL_S** | Float   | `0.0`                                                                                                                                                              | Keyframe interval in seconds. Drives seek granularity in the recorded MP4 (a player can only seek to keyframe boundaries). Larger values give the encoder slightly more bits for non-keyframe content at a fixed bitrate. `0` leaves the field unset, letting the encoder pick; `4.0` is a standard VOD value. |
+| **RECORDING_ENCODING_KEY_FRAME_INTERVAL_S** | Float   | `4.0`                                                                                                                                                              | Keyframe interval in seconds. Drives seek granularity in the recorded MP4 (a player can only seek to keyframe boundaries). Larger values give the encoder slightly more bits for non-keyframe content at a fixed bitrate. `4.0` is a standard VOD value. Only applied when `RECORDING_ENCODING_ENABLED` is `True`. |
 > [!NOTE]
@@ -130,59 +130,52 @@ This allows you to verify which recordings are in progress, troubleshoot egress
 ## Tuning recording encoding
-Every video recording is encoded from a default resolved from `RECORDING_ENCODING_DEFAULT_PROFILE` + `RECORDING_ENCODING_DEFAULT_RESOLUTION` and passed to LiveKit as advanced `EncodingOptions`. The shipped defaults (`full` profile) match LiveKit's built-in `H264_720P_30` preset. For a one-hour meeting that produces a file of roughly **1.4 GB**, which is often heavier than necessary for talking-head content and screen sharing; lowering the default profile/resolution shrinks it. If either default is left unset, no custom default encoding is built: a warning is logged at startup and LiveKit's built-in preset is used instead.
+By default, LiveKit Egress records with the built-in `H264_720P_30` preset: 1280×720 at 30 fps, 3000 kbps H.264 MAIN video and 128 kbps AAC audio. For a one-hour meeting this produces a file of roughly **1.4 GB**, which is often heavier than necessary for talking-head content and screen sharing.
-Encoding is chosen from two maps: `RECORDING_ENCODING_AVAILABLE_RESOLUTIONS` (`resolution → {"width", "height"}`) and `RECORDING_ENCODING_AVAILABLE_PROFILES` (`profile → {"fps", "kbps": {resolution: video_bitrate_kbps}}`):
+The `RECORDING_ENCODING_*` settings let operators override this preset without modifying the source. Values are passed straight through LiveKit's `EncodingOptions.advanced` to the GStreamer pipeline (`x264enc` for video, `faac` for audio), so there are no hidden conversions — what you set is what the encoder receives.
 - **Default**: `RECORDING_ENCODING_DEFAULT_PROFILE` + `RECORDING_ENCODING_DEFAULT_RESOLUTION` set the encoding used by every recording that doesn't override it. Leave either unset to fall back to LiveKit's built-in preset (a startup warning is emitted).
 - **Per recording (opt-in)**: set `RECORDING_CUSTOM_ENCODING_ENABLED=True` to let clients override the default per recording. The start-recording API then accepts an `encoding` object selecting a `resolution` (required) and `profile` (optional): a resolution-only request keeps `RECORDING_ENCODING_DEFAULT_PROFILE` for fps and bitrate, so clients can only pick from pre-defined values. When `RECORDING_CUSTOM_ENCODING_ENABLED=False`, the API rejects any per-recording `encoding` and the default is used.
 The resolved values are passed straight through LiveKit's `EncodingOptions.advanced` to the GStreamer pipeline (`x264enc` for video, `faac` for audio), so there are no hidden conversions — what the profile/resolution resolve to is what the encoder receives.
 ### How values map to GStreamer
-| Resolved value                            | GStreamer element | Property                           |
+| Setting                               | GStreamer element | Property                           |
-| ----------------------------------------- | ----------------- | ---------------------------------- |
+| ------------------------------------- | ----------------- | ---------------------------------- |
-| resolution `width` / `height`             | capsfilter        | `video/x-raw,width=W,height=H`     |
+| `RECORDING_ENCODING_WIDTH/HEIGHT`     | capsfilter        | `video/x-raw,width=W,height=H`     |
-| profile `fps`                             | capsfilter        | `framerate=F/1`                    |
+| `RECORDING_ENCODING_FRAMERATE`        | capsfilter        | `framerate=F/1`                    |
-| profile `kbps[resolution]`                | `x264enc`         | `bitrate=kbps` (kilobits)          |
+| `RECORDING_ENCODING_VIDEO_BITRATE_KBPS` | `x264enc`       | `bitrate=kbps` (kilobits)          |
 | `RECORDING_ENCODING_KEY_FRAME_INTERVAL_S` | `x264enc`     | `key-int-max = interval × fps`     |
 | `RECORDING_ENCODING_AUDIO_BITRATE_KBPS` | `faac`          | `bitrate = kbps × 1000` (bits)     |
 The H.264 profile is fixed to MAIN and the x264 `speed-preset` to `veryfast` by LiveKit (real-time constraint) — lowering the framerate is therefore the main lever to save CPU, while lowering the bitrate is the main lever to shrink the output file.
-### Built-in profiles
+### Reference profiles
-The default `RECORDING_ENCODING_AVAILABLE_PROFILES` ship four profiles. Framerate is fixed per profile; video bitrate (kbps) scales with resolution so quality stays consistent across sizes. File size scales roughly with `framerate × bitrate`, and so does egress CPU cost.
+Rough 30-minute file-size estimates assume video + audio bitrate multiplied by duration. Actual sizes vary with content (static talking heads compress better than heavy screen motion). Egress CPU figures are indicative, measured on a single Ryzen laptop core saturated by the default preset (= 100 %); scaling is roughly linear with `framerate × bitrate` but the absolute numbers depend on the host hardware.
-| Profile         | FPS | 540p (kbps) | 720p (kbps) | 1080p (kbps) | Suitable for                                       |
+| Profile                | Resolution | FPS | Video (kbps) | Audio (kbps) | Keyframe (s) | ~ size / 30 min | Egress CPU (vs. default) | Suitable for                                        |
-| --------------- | --- | ----------- | ----------- | ------------ | -------------------------------------------------- |
+| ---------------------- | ---------- | --- | ------------ | ------------ | ------------ | --------------- | ------------------------ | --------------------------------------------------- |
-| `talking_heads` | 15  | 400         | 700         | 1200         | Talking-head dominant meetings + occasional slides |
+| Default (preset)       | 1280×720   | 30  | 3000         | 128          | 4            | **~690 MB**     | 100 %                    | Unchanged LiveKit behaviour                         |
-| `text`          | 15  | 600         | 1000        | 1800         | Frequent dense screen sharing (decks, IDE, docs)   |
+| Balanced               | 1280×720   | 20  | 1000         | 96           | 4            | ~240 MB         | ~67 %                    | Mixed content, moderate motion                      |
-| `mixed`         | 20  | 900         | 1500        | 2500         | Mixed content, moderate motion                     |
+| **Low CPU / small file** | 1280×720 | 15  | 600          | 64           | 4            | **~150 MB**     | ~50 %                    | Talking-head dominant meetings + occasional slides ★ |
-| `full`          | 30  | 2000        | 3000        | 4500         | Highest fidelity; closest to the LiveKit default preset    |
+| Slide-heavy            | 1280×720   | 15  | 900          | 64           | 4            | ~210 MB         | ~55 %                    | Frequent dense screen sharing (decks, IDE, docs)    |
 | Minimum CPU            | 960×540    | 15  | 500          | 64           | 4            | ~125 MB         | ~30 %                    | Voice-first meetings, readable text not required    |
 | Audio-heavy fallback   | 1280×720   | 10  | 400          | 96           | 4            | ~110 MB         | ~35 %                    | Long webinars, low motion                           |
-To pick a profile per recording (requires `RECORDING_CUSTOM_ENCODING_ENABLED=True`), the client sends it in the start-recording request:
+★ Recommended starting point for typical LaSuite Meet usage.
-```json
+Environment variables for the **Low CPU / small file** profile:
 {
  "mode": "screen_recording",
  "options": {"encoding": {"resolution": "720p", "profile": "talking_heads"}}
 }
 ```
 To change the default encoding applied to every recording:
 ```bash
-RECORDING_ENCODING_DEFAULT_RESOLUTION=720p
+RECORDING_ENCODING_ENABLED=True
-RECORDING_ENCODING_DEFAULT_PROFILE=talking_heads
+RECORDING_ENCODING_WIDTH=1280
 RECORDING_ENCODING_HEIGHT=720
 RECORDING_ENCODING_FRAMERATE=15
 RECORDING_ENCODING_VIDEO_BITRATE_KBPS=600
 RECORDING_ENCODING_AUDIO_BITRATE_KBPS=64
 RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=4.0
 ```
 ### Caveats
- **Screen-share readability — think bits/frame, not bitrate**: at 720p, text legibility starts to break down below ~40 kbits/frame (= `bitrate ÷ framerate`). The `talking_heads` profile (700 kbps × 15 fps) sits just above that threshold, comfortable for talking heads with occasional slide sharing. The same bitrate at 30 fps would only deliver ~23 kbits/frame and visibly blur dense slides — which is why **lowering framerate is a more screen-share-friendly lever than lowering bitrate**. For deck-heavy or IDE-share meetings, prefer the **`text`** profile (1000 kbps × 15 fps ≈ 67 kbits/frame).
+- **Screen-share readability — think bits/frame, not bitrate**: at 720p, text legibility starts to break down below ~40 kbits/frame (= `bitrate ÷ framerate`). The recommended preset (600 kbps × 15 fps) sits at exactly that threshold, comfortable for talking heads with occasional slide sharing. The same 600 kbps at 30 fps would only deliver 20 kbits/frame and visibly blur dense slides — which is why **lowering framerate is a more screen-share-friendly lever than lowering bitrate**. For deck-heavy or IDE-share meetings, prefer the **Slide-heavy** profile (900 kbps × 15 fps ≈ 60 kbits/frame).
 - **Motion handling**: the `veryfast` x264 preset is set by LiveKit and cannot be overridden here. Low-bitrate settings will therefore show more artefacts on fast motion than an offline re-encode with a slower preset would. This is the other reason FPS reduction is the safer tuning lever for meeting recordings.
 - **Audio**: AAC at 64 kbps stereo is transparent for voice but starts to compress music noticeably. Keep 128 kbps if you expect music playback in meetings.
 - **Codec choice**: H.264 MAIN is hardcoded on purpose. Switching to HEVC or VP9 would increase egress CPU cost 2×–5×, defeating the goal of this tuning.
@@ -312,7 +312,7 @@ frontend:
 These are the environmental options available on meet backend.
 | Option                                          | Description                                                                                                                                                  | default                                                                                                                                                      |
-|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                        |
 | DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                           |
 | DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                              |
@@ -333,6 +333,8 @@ These are the environmental options available on meet backend.
 | DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                        |
 | REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                         |
 | SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                             |
 | ROOM_CREATION_THROTTLE_RATES                    | Room creation throttle rate per authenticated user | 50/minute                                                                                               | 50/minute                                                                                                                                                    |
 | ROOM_CREATION_DAILY_THROTTLE_RATES              | Daily room creation cap per authenticated user                                                                                                               | 1000/day                                                                                                                                                     |
 | REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                   |
 | CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                   |
 | SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                        |
@@ -70,33 +70,18 @@ SUMMARY_SERVICE_API_TOKEN=password
 SUMMARY_SERVICE_WEBHOOK_API_TOKEN=webhook-password
 RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording
 # Recording encoding (LiveKit Egress advanced options).
-# Every video recording is encoded with parameters (height, width, fps, kbps) derived
+# When RECORDING_ENCODING_ENABLED is False (default), LiveKit uses its built-in
-# from the pair (profile, resolution) and passed to LiveKit as advanced EncodingOptions.
+# H264_720P_30 preset (1280x720, 30fps, 3000 kbps). Enable and tune to reduce
-# Choose the available resolutions and profiles that default settings and users can 
+# file size and CPU load on the egress worker.
-# pick from. They must be defined as a single-line dict literal (parsed with 
+# RECORDING_ENCODING_ENABLED=False
-# ast.literal_eval: double-quoted keys, no trailing comma, no outer quotes). 
+# RECORDING_ENCODING_WIDTH=1280
-# Every profile must define a kbps entry for exactly the keys of
+# RECORDING_ENCODING_HEIGHT=720
-# RECORDING_ENCODING_AVAILABLE_RESOLUTIONS (validated at startup).
+# RECORDING_ENCODING_FRAMERATE=30
-# RECORDING_ENCODING_AVAILABLE_RESOLUTIONS={"540p": {"width": 960, "height": 540}, "720p": {"width": 1280, "height": 720}, "1080p": {"width": 1920, "height": 1080}}
+# RECORDING_ENCODING_VIDEO_BITRATE_KBPS=3000
 # RECORDING_ENCODING_AVAILABLE_PROFILES={"talking_heads": {"fps": 15, "kbps": {"540p": 400, "720p": 700, "1080p": 1200}}, "text": {"fps": 15, "kbps": {"540p": 600, "720p": 1000, "1080p": 1800}}, "mixed": {"fps": 20, "kbps": {"540p": 900, "720p": 1500, "1080p": 2500}}, "full": {"fps": 30, "kbps": {"540p": 2000, "720p": 3000, "1080p": 4500}}}
 # Choose the default named resolution and profile to use by default. These values must
 # be keys of RECORDING_ENCODING_AVAILABLE_RESOLUTIONS and RECORDING_ENCODING_AVAILABLE_PROFILES.
 # RECORDING_ENCODING_DEFAULT_RESOLUTION=720p
 # RECORDING_ENCODING_DEFAULT_PROFILE=full
 # Default encoding values independant of resolution/profile
 # RECORDING_ENCODING_AUDIO_BITRATE_KBPS=128
 # RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=4.0
 # Set to True to let the start-recording API override that default per recording
 # with an `encoding` object, e.g. {"resolution": "720p", "profile": "talking_heads"}.
 # RECORDING_CUSTOM_ENCODING_ENABLED=False
 # Telephony
 ROOM_TELEPHONY_ENABLED=True
@@ -1,5 +1,5 @@
 {
-  "extends": ["github>numerique-gouv/renovate-configuration"],
+  "extends": ["github>suitenumerique/ci//renovate/default"],
  "dependencyDashboard": true,
  "labels": ["dependencies", "noChangeLog"],
  "packageRules": [
@@ -21,7 +21,7 @@ const { initI18n, translateUI } = require("../common/i18n");
        document.querySelector("#close-msg").style.display = "block";
      })
      .catch((e) => {
-        console.error(`Error occured: ${e}`);
+        console.error(`Error occurred: ${e}`);
      })
      .finally(() => {
        // NOTE: doesn't work with the desktop client — the browser considers
@@ -1,10 +1,11 @@
-FROM python:3.14.6-slim AS base
+FROM python:3.14.7-slim AS base
 # Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
 RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
    && apt-get update && apt-get install -y --no-install-recommends  \
    libglib2.0-0 \
    libgobject-2.0-0 \
    libpcre2-8-0 \
    libssl3t64 \
    && rm -rf /var/lib/apt/lists/*
@@ -1,7 +1,7 @@
 [project]
 name = "agents"
-version = "1.32.1"
+version = "1.33.0"
 requires-python = ">=3.12"
 dependencies = [
    "livekit-agents==1.7.0",
@@ -9,7 +9,7 @@ resolution-markers = [
 [[package]]
 name = "agents"
-version = "1.32.1"
+version = "1.33.0"
 source = { virtual = "." }
 dependencies = [
    { name = "boto3" },
@@ -13,12 +13,7 @@ from django.core.exceptions import SuspiciousOperation
 from django.utils.translation import gettext_lazy as _
 from django_pydantic_field.rest_framework import SchemaField
-from pydantic import (
+from pydantic import BaseModel, Field, field_serializer
    BaseModel,
    Field,
    field_serializer,
    field_validator,
 )
 from pydantic import ValidationError as PydanticValidationError
 from rest_framework import serializers
 from rest_framework.exceptions import PermissionDenied
@@ -249,49 +244,6 @@ class BaseValidationOnlySerializer(serializers.Serializer):
        raise NotImplementedError(f"{self.__class__.__name__} is validation-only")
 class EncodingConfig(BaseModel):
    """Configuration options for recording encoding.
    The allowed `resolution` and `profile` values are derived at validation time
    from ``settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS`` and
    ``settings.RECORDING_ENCODING_AVAILABLE_PROFILES``, so adding a resolution or profile
    to those maps is enough to make it accepted here.
    Attributes:
        resolution: Target video resolution.
        profile: Encoding profile to fps and kbps. When `None`,
        `settings.RECORDING_ENCODING_DEFAULT_PROFILE` applies.
    """
    resolution: str
    profile: str | None = None
    model_config = {"extra": "forbid"}
    @field_validator("resolution")
    @classmethod
    def _validate_resolution(cls, value):
        """Reject resolutions absent from RECORDING_ENCODING_AVAILABLE_RESOLUTIONS."""
        allowed = set(settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS)
        if value not in allowed:
            raise ValueError(
                f"Invalid resolution '{value}'. Choose from {sorted(allowed)}."
            )
        return value
    @field_validator("profile")
    @classmethod
    def _validate_profile(cls, value):
        """Reject profiles absent from RECORDING_ENCODING_AVAILABLE_PROFILES."""
        if value is None:
            return None
        allowed = set(settings.RECORDING_ENCODING_AVAILABLE_PROFILES)
        if value not in allowed:
            raise ValueError(
                f"Invalid profile '{value}'. Choose from {sorted(allowed)}."
            )
        return value
 class RecordingOptions(BaseModel):
    """Configuration options for recording.
@@ -312,7 +264,7 @@ class RecordingOptions(BaseModel):
    transcribe: bool | None = None
    collect_metadata: bool | None = None
    original_mode: Literal["screen_recording", "transcript"] | None = None
-    encoding: EncodingConfig | None = None
+
    model_config = {"extra": "forbid"}
@@ -335,22 +287,6 @@ class StartRecordingSerializer(BaseValidationOnlySerializer):
        help_text="Recording options",
    )
    def validate_options(self, value: RecordingOptions):
        """Validate that custom encoding is enabled if encoding options are passed."""
        if (
            value is not None
            and value.encoding is not None
            and not settings.RECORDING_CUSTOM_ENCODING_ENABLED
        ):
            # Per-recording encoding selection is gated by
            # RECORDING_CUSTOM_ENCODING_ENABLED. When disabled, recordings use
            # encoding defined by RECORDING_ENCODING_DEFAULT_RESOLUTION
            # and RECORDING_ENCODING_DEFAULT_PROFILE.
            raise serializers.ValidationError(
                "Per-recording encoding selection is disabled."
            )
        return value
 class RequestEntrySerializer(BaseValidationOnlySerializer):
    """Validate request entry data."""
@@ -20,6 +20,33 @@ class MonitoredUserRateThrottle(MonitoredThrottleMixin, UserRateThrottle):
    """Throttle for the monitored scoped rate throttle."""
 class RoomCreationUserRateThrottle(MonitoredUserRateThrottle):
    """Throttle room creation per authenticated user.
    Can be declared at the viewset level: every action other than "create"
    is left unthrottled, so the same class can be reused on any viewset
    exposing a room creation endpoint.
    """
    scope = "room_creation"
    def get_cache_key(self, request, view):
        """Throttle only room creations."""
        if getattr(view, "action", None) != "create":
            return None
        return super().get_cache_key(request, view)
 class RoomCreationDailyUserRateThrottle(RoomCreationUserRateThrottle):
    """Cap room creation per authenticated user over a day.
    Complements the short-term RoomCreationUserRateThrottle, which absorbs
    bursts but lets a user steadily create rooms over hours or days.
    """
    scope = "room_creation_daily"
 class RequestEntryAuthenticatedUserRateThrottle(MonitoredUserRateThrottle):
    """Throttle authenticated user requesting room entry"""
@@ -55,7 +55,6 @@ from core.recording.worker.exceptions import (
    RecordingStopError,
 )
 from core.recording.worker.factories import (
    build_encoding_options,
    get_worker_service,
 )
 from core.recording.worker.mediator import (
@@ -181,6 +180,10 @@ class RoomViewSet(
    permission_classes = [permissions.RoomPermissions]
    queryset = models.Room.objects.all()
    serializer_class = serializers.RoomSerializer
    throttle_classes = [
        throttling.RoomCreationUserRateThrottle,
        throttling.RoomCreationDailyUserRateThrottle,
    ]
    def get_object(self):
        """Allow getting a room by its slug."""
@@ -324,20 +327,12 @@ class RoomViewSet(
        options = serializer.validated_data.get("options")
        room = self.get_object()
        options_data = options.model_dump(exclude_none=True) if options else {}
        if options is not None and options.encoding is not None:
            # Persist the resolved encoding (concrete width/height/framerate/
            # bitrate) alongside the requested resolution/profile for traceability.
            options_data["encoding"]["resolved"] = build_encoding_options(
                options.encoding.resolution, options.encoding.profile
            )
        try:
            with transaction.atomic():
                recording = models.Recording.objects.create(
                    room=room,
                    mode=mode,
-                    options=options_data,
+                    options=options.model_dump(exclude_none=True) if options else {},
                )
                models.RecordingAccess.objects.create(
                    user=self.request.user,
@@ -22,46 +22,6 @@ _RECORDING_AUDIO_CODEC = livekit_api.AudioCodec.AAC
 _RECORDING_AUDIO_FREQUENCY_HZ = 48000
 def build_encoding_options(resolution, profile=None):
    """Assemble the LiveKit ``EncodingOptions`` kwargs for a resolution/profile.
    Single source of truth shared by the default encoding
    (``WorkerServiceConfig.from_settings``) and the per-recording encoding
    persisted by the start-recording API, so both paths always produce the
    same shape.
    The profile-independent fields (audio bitrate, keyframe interval and the
    pinned codec / frequency constants) are always included.
    An omitted profile falls back to RECORDING_ENCODING_DEFAULT_PROFILE.
    Framerate and bitrate are left to LiveKit only when the operator
    declared no default profile at all.
    """
    profile = profile or settings.RECORDING_ENCODING_DEFAULT_PROFILE
    options: Dict[str, Any] = {
        "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
        "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
        "video_codec": _RECORDING_VIDEO_CODEC,
        "audio_codec": _RECORDING_AUDIO_CODEC,
        "audio_frequency": _RECORDING_AUDIO_FREQUENCY_HZ,
    }
    if resolution:
        resolution_config = settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS[
            resolution
        ]
        options["width"] = resolution_config["width"]
        options["height"] = resolution_config["height"]
    if resolution and profile:
        profile_config = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[profile]
        options["framerate"] = profile_config["fps"]
        options["video_bitrate"] = profile_config["kbps"][resolution]
    return options
@dataclass(frozen=True)
 class WorkerServiceConfig:
    """Declare Worker Service common configurations"""
@@ -78,16 +38,22 @@ class WorkerServiceConfig:
        logger.debug("Loading WorkerServiceConfig from settings.")
        # The default encoding is resolved from the default profile/resolution and
        # applied to every recording that carries no per-recording encoding.
        # When either default is missing, we leave this as None so LiveKit falls
        # back to its built-in preset.
        resolution = settings.RECORDING_ENCODING_DEFAULT_RESOLUTION
        profile = settings.RECORDING_ENCODING_DEFAULT_PROFILE
        encoding_options: Optional[Dict[str, Any]] = None
-        if resolution and profile:
+        if settings.RECORDING_ENCODING_ENABLED:
-            encoding_options = build_encoding_options(resolution, profile)
+            # Single source of truth for the EncodingOptions kwargs:
            # operator-tunable values live in Django settings, codec / frequency
            # are pinned constants. The services layer only unpacks this dict.
            encoding_options = {
                "width": settings.RECORDING_ENCODING_WIDTH,
                "height": settings.RECORDING_ENCODING_HEIGHT,
                "framerate": settings.RECORDING_ENCODING_FRAMERATE,
                "video_bitrate": settings.RECORDING_ENCODING_VIDEO_BITRATE_KBPS,
                "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
                "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
                "video_codec": _RECORDING_VIDEO_CODEC,
                "audio_codec": _RECORDING_AUDIO_CODEC,
                "audio_frequency": _RECORDING_AUDIO_FREQUENCY_HZ,
            }
        return cls(
            output_folder=settings.RECORDING_OUTPUT_FOLDER,
@@ -112,12 +78,7 @@ class WorkerService(Protocol):
    def __init__(self, config: WorkerServiceConfig):
        """Initialize the service with the given configuration."""
-    def start(
+    def start(self, room_id: str, recording_id: str) -> str:
        self,
        room_id: str,
        recording_id: str,
        encoding_options: Optional[Dict[str, Any]] = None,
    ) -> str:
        """Start a recording for a specified room."""
    def stop(self, worker_id: str) -> str:
@@ -51,11 +51,8 @@ class WorkerServiceMediator:
            raise RecordingStartError()
        room_name = str(recording.room.id)
        encoding_options = (recording.options.get("encoding") or {}).get("resolved")
        try:
-            worker_id = self._worker_service.start(
+            worker_id = self._worker_service.start(room_name, recording.id)
                room_name, recording.id, encoding_options=encoding_options
            )
        except (WorkerRequestError, WorkerConnectionError, WorkerResponseError) as e:
            logger.exception(
                "Failed to start recording for room %s: %s", recording.room.slug, e
@@ -9,7 +9,7 @@ from livekit import api as livekit_api
 from ... import utils
 from ..enums import FileExtension
-from .exceptions import WorkerConnectionError, WorkerRequestError, WorkerResponseError
+from .exceptions import WorkerConnectionError, WorkerResponseError
 from .factories import WorkerServiceConfig
 logger = logging.getLogger(__name__)
@@ -24,7 +24,7 @@ class BaseEgressService:
    def _get_filepath(self, filename: str, extension: str) -> str:
        """Construct the file path for a given filename and extension.
-        Unsecure method, doesn't handle paths robustly and securely.
+        Insecure method, doesn't handle paths robustly and securely.
        """
        return f"{self._config.output_folder}/{filename}.{extension}"
@@ -108,33 +108,28 @@ class BaseEgressService:
        self._log_egress_error(response, "failed to stop")
        return "FAILED_TO_STOP"
-    def start(self, room_name, recording_id, encoding_options=None):
+    def start(self, room_name, recording_id):
        """Start the egress process for a recording (not implemented in the base class).
        Each derived class must implement this method, providing the necessary parameters for
        its specific egress type (e.g. audio_only, streaming output).
        """
        raise NotImplementedError("Subclass must implement this method.")
-    def _resolve_encoding_options(self, encoding_options):
+    def _build_encoding_options(self):
-        """Build a LiveKit EncodingOptions from a resolved kwargs dict, or None.
+        """Build a LiveKit EncodingOptions from the service config, or None.
        ``encoding_options`` is the per-recording dict persisted by the API in
        ``recording.options["encoding"]["resolved"]``; it falls back to the
        default encoding carried by the service config.
        When None is returned, the caller should omit the `advanced` field so
        LiveKit Egress falls back to its built-in preset (H264_720P_30).
        The full EncodingOptions kwargs (operator-tunable values + pinned
        codec / frequency constants) are assembled in `WorkerServiceConfig`,
        so this method is a thin protobuf adapter.
        """
-        encoding_options = encoding_options or self._config.encoding_options
+        opts = self._config.encoding_options
-        if not encoding_options:
+        if not opts:
            return None
-        try:
+        return livekit_api.EncodingOptions(**opts)
            return livekit_api.EncodingOptions(**encoding_options)
        except (TypeError, ValueError) as e:
            # Protobuf raises TypeError on a wrongly typed value (e.g. a float
            # framerate) and ValueError on an unknown field or an out-of-range int.
            raise WorkerRequestError(f"Invalid encoding options: {e}") from e
 class VideoCompositeEgressService(BaseEgressService):
@@ -142,7 +137,7 @@ class VideoCompositeEgressService(BaseEgressService):
    hrid = "video-recording-composite-livekit-egress"
-    def start(self, room_name, recording_id, encoding_options=None):
+    def start(self, room_name, recording_id):
        """Start the video composite egress process for a recording."""
        # Save room's recording as a mp4 video file.
@@ -163,7 +158,7 @@ class VideoCompositeEgressService(BaseEgressService):
            "layout": "speaker-light",
        }
-        advanced = self._resolve_encoding_options(encoding_options)
+        advanced = self._build_encoding_options()
        if advanced is not None:
            request_kwargs["advanced"] = advanced
@@ -182,13 +177,8 @@ class AudioCompositeEgressService(BaseEgressService):
    hrid = "audio-recording-composite-livekit-egress"
-    def start(self, room_name, recording_id, encoding_options=None):
+    def start(self, room_name, recording_id):
-        """Start the audio composite egress process for a recording.
+        """Start the audio composite egress process for a recording."""
        ``encoding_options`` is accepted for signature compatibility with the
        WorkerService protocol but ignored: audio-only egress has no
        encoding to configure.
        """
        # Save room's recording as an ogg audio file.
        file_type = livekit_api.EncodedFileType.OGG
@@ -27,7 +27,7 @@ def test_api_files_list_anonymous_not_allowed():
 def test_api_files_list_authentificated_user_allowed():
    """
-    Authentificated users should be allowed to list files
+    Authenticated users should be allowed to list files
    """
    user = factories.UserFactory()
    client = APIClient()
@@ -1,184 +0,0 @@
 """Tests for the per-recording encoding resolution in BaseEgressService."""
 # pylint: disable=protected-access,redefined-outer-name,unused-argument,no-member
 from unittest.mock import Mock
 from django.conf import settings
 from django.test import override_settings
 import pytest
 from livekit import api as livekit_api
 from pydantic import ValidationError as PydanticValidationError
 from core.api.serializers import EncodingConfig
 from core.recording.worker.exceptions import WorkerRequestError
 from core.recording.worker.factories import build_encoding_options
 from core.recording.worker.services import VideoCompositeEgressService
 def make_config():
    """Build a minimal WorkerServiceConfig-like mock for service instantiation."""
    config = Mock()
    config.bucket_args = {
        "endpoint": "https://s3.test.com",
        "access_key": "test_key",
        "secret": "test_secret",
        "region": "test-region",
        "bucket": "test-bucket",
        "force_path_style": True,
    }
    config.encoding_options = None
    return config
@pytest.fixture
 def service():
    """Return a VideoCompositeEgressService with mocked handle_request."""
    svc = VideoCompositeEgressService(make_config())
    svc._handle_request = Mock()
    return svc
 # --- build_encoding_options ---
 def test_build_options_without_profile_uses_default_profile():
    """A resolution-only config should fall back to the default profile.
    Left unset, framerate and video_bitrate take LiveKit's own EncodingOptions
    defaults. The profile-independent fields (audio bitrate, keyframe interval,
    codec/frequency pins) are always present, matching the default encoding.
    """
    default_profile = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[
        settings.RECORDING_ENCODING_DEFAULT_PROFILE
    ]
    resolved = build_encoding_options("540p")
    assert resolved == {
        "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
        "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
        "video_codec": livekit_api.VideoCodec.H264_MAIN,
        "audio_codec": livekit_api.AudioCodec.AAC,
        "audio_frequency": 48000,
        "width": 960,
        "height": 540,
        "framerate": default_profile["fps"],
        "video_bitrate": default_profile["kbps"]["540p"],
    }
@override_settings(RECORDING_ENCODING_DEFAULT_PROFILE="")
 def test_build_options_omits_profile_fields_without_default_profile():
    """With no default profile declared, framerate/bitrate are left to LiveKit."""
    resolved = build_encoding_options("720p", None)
    assert resolved == {
        "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
        "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
        "video_codec": livekit_api.VideoCodec.H264_MAIN,
        "audio_codec": livekit_api.AudioCodec.AAC,
        "audio_frequency": 48000,
        "width": 1280,
        "height": 720,
    }
    assert "framerate" not in resolved
    assert "video_bitrate" not in resolved
 def test_encoding_config_requires_resolution():
    """A profile-only or empty encoding config should be rejected at validation."""
    with pytest.raises(PydanticValidationError):
        EncodingConfig(profile="mixed")
    with pytest.raises(PydanticValidationError):
        EncodingConfig()
 # --- _resolve_encoding_options ---
@pytest.mark.parametrize("encoding_options", [None, {}])
 def test_resolve_options_returns_none_when_empty(service, encoding_options):
    """Resolver should return None when the resolved dict is empty or missing."""
    assert service._resolve_encoding_options(encoding_options) is None
@pytest.mark.parametrize(
    "encoding_options",
    [
        {"framerate": 29.97},
        {"width": "1280"},
        {"unknown_field": 1},
    ],
 )
 def test_resolve_options_invalid_raises_worker_request_error(service, encoding_options):
    """Malformed encoding options should surface as a WorkerRequestError."""
    with pytest.raises(WorkerRequestError):
        service._resolve_encoding_options(encoding_options)
@pytest.mark.parametrize(
    "resolution",
    list(settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS),
 )
@pytest.mark.parametrize(
    "profile",
    list(settings.RECORDING_ENCODING_AVAILABLE_PROFILES),
 )
 def test_resolve_profile_resolution_combinations(service, profile, resolution):
    """Every (profile, resolution) pair should resolve to the values from settings."""
    resolution_config = settings.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS[resolution]
    expected_width = resolution_config["width"]
    expected_height = resolution_config["height"]
    profile_config = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[profile]
    expected_fps = profile_config["fps"]
    expected_bitrate = profile_config["kbps"][resolution]
    resolved = build_encoding_options(resolution, profile)
    result = service._resolve_encoding_options(resolved)
    assert result.width == expected_width
    assert result.height == expected_height
    assert result.framerate == expected_fps
    assert result.video_bitrate == expected_bitrate
    # Profile-independent fields match the default encoding, never dropped.
    assert result.audio_bitrate == settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS
    assert result.video_codec == livekit_api.VideoCodec.H264_MAIN
    assert result.audio_codec == livekit_api.AudioCodec.AAC
    assert result.audio_frequency == 48000
 def test_resolve_options_none_profile_uses_default_profile(service):
    """A missing profile should resolve to the default profile's fps/bitrate."""
    default_profile = settings.RECORDING_ENCODING_AVAILABLE_PROFILES[
        settings.RECORDING_ENCODING_DEFAULT_PROFILE
    ]
    resolved = build_encoding_options("720p", None)
    result = service._resolve_encoding_options(resolved)
    assert result.width == 1280
    assert result.height == 720
    assert result.framerate == default_profile["fps"]
    assert result.video_bitrate == default_profile["kbps"]["720p"]
    assert result.audio_bitrate == settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS
    assert result.video_codec == livekit_api.VideoCodec.H264_MAIN
@override_settings(RECORDING_ENCODING_DEFAULT_PROFILE="")
 def test_resolve_options_passes_zero_when_no_default_profile(service):
    """With no default profile, fps/bitrate reach LiveKit unset (protobuf 0).
    The pinned codec / audio fields are still applied.
    """
    resolved = build_encoding_options("720p", None)
    result = service._resolve_encoding_options(resolved)
    assert result.width == 1280
    assert result.height == 720
    assert result.framerate == 0
    assert result.video_bitrate == 0
    assert result.audio_bitrate == settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS
    assert result.video_codec == livekit_api.VideoCodec.H264_MAIN
    assert result.audio_codec == livekit_api.AudioCodec.AAC
@@ -40,16 +40,6 @@ def test_settings():
        "AWS_S3_SECRET_ACCESS_KEY": "test_secret",
        "AWS_S3_REGION_NAME": "test-region",
        "AWS_STORAGE_BUCKET_NAME": "test-bucket",
        "RECORDING_ENCODING_AVAILABLE_RESOLUTIONS": {
            "720p": {"width": 1280, "height": 720}
        },
        "RECORDING_ENCODING_AVAILABLE_PROFILES": {
            "full": {"fps": 30, "kbps": {"720p": 3000}}
        },
        "RECORDING_ENCODING_DEFAULT_RESOLUTION": "720p",
        "RECORDING_ENCODING_DEFAULT_PROFILE": "full",
        "RECORDING_ENCODING_AUDIO_BITRATE_KBPS": 128,
        "RECORDING_ENCODING_KEY_FRAME_INTERVAL_S": 4.0,
    }
    # Use override_settings to properly patch Django settings
@@ -76,18 +66,8 @@ def test_config_initialization(default_config):
        "bucket": "test-bucket",
        "force_path_style": True,
    }
-    # The default encoding is always resolved from the default profile/resolution.
+    # Encoding override is opt-in; disabled by default.
-    assert default_config.encoding_options == {
+    assert default_config.encoding_options is None
        "width": 1280,
        "height": 720,
        "framerate": 30,
        "video_bitrate": 3000,
        "audio_bitrate": 128,
        "key_frame_interval": 4.0,
        "video_codec": livekit_api_codec.VideoCodec.H264_MAIN,
        "audio_codec": livekit_api_codec.AudioCodec.AAC,
        "audio_frequency": 48000,
    }
 def test_config_immutability(default_config):
@@ -96,7 +76,6 @@ def test_config_immutability(default_config):
        default_config.output_folder = "new/path"
@pytest.mark.parametrize("custom_encoding_enabled", [True, False])
@override_settings(
    RECORDING_OUTPUT_FOLDER="/test/output",
    LIVEKIT_CONFIGURATION={"server": "test.example.com"},
@@ -105,23 +84,21 @@ def test_config_immutability(default_config):
    AWS_S3_SECRET_ACCESS_KEY="test_secret",
    AWS_S3_REGION_NAME="test-region",
    AWS_STORAGE_BUCKET_NAME="test-bucket",
-    RECORDING_ENCODING_AVAILABLE_RESOLUTIONS={"720p": {"width": 1280, "height": 720}},
+    RECORDING_ENCODING_ENABLED=True,
-    RECORDING_ENCODING_AVAILABLE_PROFILES={"low": {"fps": 15, "kbps": {"720p": 600}}},
+    RECORDING_ENCODING_WIDTH=1280,
-    RECORDING_ENCODING_DEFAULT_RESOLUTION="720p",
+    RECORDING_ENCODING_HEIGHT=720,
-    RECORDING_ENCODING_DEFAULT_PROFILE="low",
+    RECORDING_ENCODING_FRAMERATE=15,
    RECORDING_ENCODING_VIDEO_BITRATE_KBPS=600,
    RECORDING_ENCODING_AUDIO_BITRATE_KBPS=64,
    RECORDING_ENCODING_KEY_FRAME_INTERVAL_S=10.0,
 )
-def test_config_encoding_options_default(custom_encoding_enabled):
+def test_config_encoding_options_enabled():
-    """The default encoding is always resolved from the default profile/resolution.
+    """When RECORDING_ENCODING_ENABLED is True, encoding options are populated.
-    The default fallback resolves the default profile/resolution and mixes those
+    The dict mixes operator-tunable values from settings with pinned codec /
-    operator-tunable values with pinned codec / frequency constants. This works
+    frequency constants, so the services layer can simply unpack it.
    regardless of RECORDING_CUSTOM_ENCODING_ENABLED, which only gates the
    per-recording API, so both toggle states produce the same default.
    """
    with override_settings(RECORDING_CUSTOM_ENCODING_ENABLED=custom_encoding_enabled):
    WorkerServiceConfig.from_settings.cache_clear()
    config = WorkerServiceConfig.from_settings()
@@ -138,27 +115,6 @@ def test_config_encoding_options_default(custom_encoding_enabled):
    }
@pytest.mark.parametrize(
    ("default_resolution", "default_profile"),
    [("", "full"), ("720p", ""), ("", "")],
 )
 def test_config_encoding_options_none_when_default_missing(
    test_settings, default_resolution, default_profile
 ):
    """A missing default resolution/profile leaves encoding_options None.
    The service then omits the `advanced` field so LiveKit uses its built-in preset.
    """
    with override_settings(
        RECORDING_ENCODING_DEFAULT_RESOLUTION=default_resolution,
        RECORDING_ENCODING_DEFAULT_PROFILE=default_profile,
    ):
        WorkerServiceConfig.from_settings.cache_clear()
        config = WorkerServiceConfig.from_settings()
    assert config.encoding_options is None
@override_settings(
    RECORDING_OUTPUT_FOLDER="/test/output",
    LIVEKIT_CONFIGURATION={"server": "test.example.com"},
@@ -50,7 +50,7 @@ def test_start_recording_success(mock_update_metadata, mediator, mock_worker_ser
    # Verify worker service call
    expected_room_name = str(mock_recording.room.id)
    mock_worker_service.start.assert_called_once_with(
-        expected_room_name, mock_recording.id, encoding_options=None
+        expected_room_name, mock_recording.id
    )
    # Verify recording updates
@@ -64,38 +64,6 @@ def test_start_recording_success(mock_update_metadata, mediator, mock_worker_ser
    )
@mock.patch("core.services.room_management.RoomManagement.update_metadata")
 def test_start_recording_passes_resolved_encoding(
    mock_update_metadata, mediator, mock_worker_service
 ):
    """The resolved encoding persisted in recording.options reaches the worker."""
    mock_worker_service.start.return_value = "test-worker-123"
    resolved = {
        "key_frame_interval": 4.0,
        "width": 1280,
        "height": 720,
        "framerate": 15,
        "video_bitrate": 700,
    }
    mock_recording = RecordingFactory(
        status=RecordingStatusChoices.INITIATED,
        worker_id=None,
        options={
            "encoding": {
                "resolution": "720p",
                "profile": "talking_heads",
                "resolved": resolved,
            }
        },
    )
    mediator.start(mock_recording)
    mock_worker_service.start.assert_called_once_with(
        str(mock_recording.room.id), mock_recording.id, encoding_options=resolved
    )
@pytest.mark.parametrize(
    "error_class", [WorkerRequestError, WorkerConnectionError, WorkerResponseError]
 )
@@ -9,6 +9,10 @@ from django.core.cache import cache
 import pytest
 from rest_framework.test import APIClient
 from ...api.throttling import (
    RoomCreationDailyUserRateThrottle,
    RoomCreationUserRateThrottle,
 )
 from ...factories import RoomFactory, UserFactory
 from ...models import Room, RoomAccessLevel
@@ -312,3 +316,145 @@ def test_api_rooms_create_authenticated_blank_user_default_access_level():
    assert response.status_code == 201
    room = Room.objects.get()
    assert room.access_level == settings.RESOURCE_DEFAULT_ACCESS_LEVEL
@pytest.fixture
 def room_creation_throttle(monkeypatch):
    """Lower the room creation rate for the duration of a test."""
    monkeypatch.setitem(
        settings.REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"], "room_creation", "2/minute"
    )
 def test_api_rooms_create_throttled(room_creation_throttle):
    """Excess requests are rejected and create no room."""
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(2):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
    assert response.status_code == 429
    assert 0 < int(response["Retry-After"]) <= 60
    assert Room.objects.count() == 2
 def test_api_rooms_create_throttle_per_user(room_creation_throttle):
    """Users sharing an IP have independent creation limits."""
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(2):
        response = client.post("/api/v1.0/rooms/", {"name": f"First user room {index}"})
        assert response.status_code == 201
    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
    assert response.status_code == 429
    client.force_login(UserFactory())
    response = client.post("/api/v1.0/rooms/", {"name": "Second user room"})
    assert response.status_code == 201
 def test_api_rooms_create_throttle_does_not_limit_other_actions(room_creation_throttle):
    """Exhausting creation capacity leaves listing and updating available."""
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(2):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
    room_id = response.json()["id"]
    assert client.post("/api/v1.0/rooms/", {"name": "Blocked room"}).status_code == 429
    assert client.get("/api/v1.0/rooms/").status_code == 200
    assert (
        client.patch(
            f"/api/v1.0/rooms/{room_id}/", {"name": "Renamed room"}
        ).status_code
        == 200
    )
@pytest.fixture
 def daily_room_creation_throttle(monkeypatch):
    """Use a tiny daily cap, a loose burst limit and a controllable clock.
    Rates are patched with monkeypatch.setitem so they are restored after the
    test. Returns a one-item list holding the current fake timestamp.
    """
    rates = RoomCreationDailyUserRateThrottle.THROTTLE_RATES
    monkeypatch.setitem(rates, "room_creation", "100/minute")
    monkeypatch.setitem(rates, "room_creation_daily", "3/day")
    now = [1_000_000.0]
    monkeypatch.setattr(RoomCreationUserRateThrottle, "timer", lambda self: now[0])
    return now
 def test_api_rooms_create_daily_throttled(daily_room_creation_throttle):
    """The daily cap still applies once the short-term window has elapsed."""
    now = daily_room_creation_throttle
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(3):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
        now[0] += 120  # Spread creations beyond the short-term window.
    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
    assert response.status_code == 429
    assert int(response["Retry-After"]) > 60
    assert Room.objects.count() == 3
 def test_api_rooms_create_daily_throttle_resets(daily_room_creation_throttle):
    """Room creation is allowed again once a day has passed."""
    now = daily_room_creation_throttle
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(3):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
    response = client.post("/api/v1.0/rooms/", {"name": "Blocked room"})
    assert response.status_code == 429
    now[0] += 24 * 60 * 60 + 1
    response = client.post("/api/v1.0/rooms/", {"name": "Next day room"})
    assert response.status_code == 201
 def test_api_rooms_create_daily_throttle_per_user(daily_room_creation_throttle):
    """Each user has its own daily cap."""
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(3):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
    assert client.post("/api/v1.0/rooms/", {"name": "Blocked"}).status_code == 429
    client.force_login(UserFactory())
    response = client.post("/api/v1.0/rooms/", {"name": "Other user room"})
    assert response.status_code == 201
 def test_api_rooms_create_daily_throttle_does_not_limit_other_actions(
    daily_room_creation_throttle,
 ):
    """Reaching the daily cap leaves listing and updating available."""
    client = APIClient()
    client.force_login(UserFactory())
    for index in range(3):
        response = client.post("/api/v1.0/rooms/", {"name": f"Room {index}"})
        assert response.status_code == 201
    room_id = response.json()["id"]
    assert client.post("/api/v1.0/rooms/", {"name": "Blocked"}).status_code == 429
    assert client.get("/api/v1.0/rooms/").status_code == 200
    response = client.patch(f"/api/v1.0/rooms/{room_id}/", {"name": "Renamed"})
    assert response.status_code == 200
@@ -458,7 +458,7 @@ def test_mute_participant_livekit_token_presence_check_twirp_error_forbidden(
    room = RoomFactory()
    mock_livekit_client.room.get_participant.side_effect = TwirpError(
-        msg="an error occured", code="not_found", status=500
+        msg="an error occurred", code="not_found", status=500
    )
    user = AnonymousUser()
@@ -2,12 +2,11 @@
 Test rooms API endpoints in the Meet core app: start recording.
 """
-# pylint: disable=redefined-outer-name,unused-argument,no-member
+# pylint: disable=redefined-outer-name,unused-argument
 from unittest import mock
 import pytest
 from livekit import api as livekit_api
 from rest_framework.test import APIClient
 from ...factories import RoomFactory, UserFactory
@@ -471,224 +470,6 @@ def test_start_recording_options_unknown_field_rejected(settings):
    assert response.status_code == 400
 def test_start_recording_options_encoding_valid(
    settings, mock_worker_service_factory, mock_worker_manager
 ):
    """Should accept a valid encoding configuration."""
    settings.RECORDING_ENABLE = True
    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
    room = RoomFactory()
    user = UserFactory()
    room.accesses.create(user=user, role="owner")
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-recording/",
        {
            "mode": "screen_recording",
            "options": {"encoding": {"resolution": "720p", "profile": "talking_heads"}},
        },
        format="json",
    )
    assert response.status_code == 201
 def test_start_recording_options_encoding_rejected_when_custom_encoding_disabled(
    settings, mock_worker_service_factory, mock_worker_manager
 ):
    """Per-recording encoding is rejected when RECORDING_CUSTOM_ENCODING_ENABLED is off."""
    settings.RECORDING_ENABLE = True
    settings.RECORDING_CUSTOM_ENCODING_ENABLED = False
    room = RoomFactory()
    user = UserFactory()
    room.accesses.create(user=user, role="owner")
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-recording/",
        {
            "mode": "screen_recording",
            "options": {"encoding": {"resolution": "720p", "profile": "talking_heads"}},
        },
        format="json",
    )
    assert response.status_code == 400
    assert not Recording.objects.filter(room=room).exists()
 def test_start_recording_persists_resolved_encoding(
    settings, mock_worker_service_factory, mock_worker_manager
 ):
    """The resolved encoding should be persisted in recording.options alongside
    the requested resolution/profile for traceability."""
    settings.RECORDING_ENABLE = True
    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
    room = RoomFactory()
    user = UserFactory()
    room.accesses.create(user=user, role="owner")
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-recording/",
        {
            "mode": "screen_recording",
            "options": {"encoding": {"resolution": "720p", "profile": "talking_heads"}},
        },
        format="json",
    )
    assert response.status_code == 201
    recording = Recording.objects.get(room=room)
    assert recording.options["encoding"] == {
        "resolution": "720p",
        "profile": "talking_heads",
        "resolved": {
            "audio_bitrate": settings.RECORDING_ENCODING_AUDIO_BITRATE_KBPS,
            "key_frame_interval": settings.RECORDING_ENCODING_KEY_FRAME_INTERVAL_S,
            "video_codec": livekit_api.VideoCodec.H264_MAIN,
            "audio_codec": livekit_api.AudioCodec.AAC,
            "audio_frequency": 48000,
            "width": 1280,
            "height": 720,
            "framerate": 15,
            "video_bitrate": 700,
        },
    }
 def test_start_recording_resolution_only_uses_default_profile(
    settings, mock_worker_service_factory, mock_worker_manager
 ):
    """An encoding without a profile should resolve the default profile."""
    settings.RECORDING_ENABLE = True
    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
    settings.RECORDING_ENCODING_DEFAULT_PROFILE = "talking_heads"
    room = RoomFactory()
    user = UserFactory()
    room.accesses.create(user=user, role="owner")
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-recording/",
        {"mode": "screen_recording", "options": {"encoding": {"resolution": "540p"}}},
        format="json",
    )
    assert response.status_code == 201
    recording = Recording.objects.get(room=room)
    resolved = recording.options["encoding"]["resolved"]
    assert resolved["width"] == 960
    assert resolved["height"] == 540
    assert resolved["framerate"] == 15
    assert resolved["video_bitrate"] == 400
    # The requested payload is persisted as sent: no profile was asked for.
    assert "profile" not in recording.options["encoding"]
 def test_start_recording_forwards_resolved_encoding_to_worker(
    settings, mock_worker_service, mock_worker_service_factory
 ):
    """The resolved encoding should passed on to the worker."""
    settings.RECORDING_ENABLE = True
    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
    room = RoomFactory()
    user = UserFactory()
    room.accesses.create(user=user, role="owner")
    client = APIClient()
    client.force_login(user)
    mock_worker_service.start.return_value = "egress-123"
    with mock.patch("core.services.room_management.RoomManagement.update_metadata"):
        response = client.post(
            f"/api/v1.0/rooms/{room.id}/start-recording/",
            {
                "mode": "screen_recording",
                "options": {
                    "encoding": {"resolution": "720p", "profile": "talking_heads"}
                },
            },
            format="json",
        )
    assert response.status_code == 201
    recording = Recording.objects.get(room=room)
    mock_worker_service.start.assert_called_once_with(
        str(room.id),
        recording.id,
        encoding_options=recording.options["encoding"]["resolved"],
    )
 def test_start_recording_options_encoding_invalid_resolution(settings):
    """Should reject invalid encoding resolution values."""
    settings.RECORDING_ENABLE = True
    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
    room = RoomFactory()
    user = UserFactory()
    room.accesses.create(user=user, role="owner")
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-recording/",
        {"mode": "screen_recording", "options": {"encoding": {"resolution": "4K"}}},
        format="json",
    )
    assert response.status_code == 400
 def test_start_recording_options_encoding_unknown_key_rejected(settings):
    """Should reject unknown keys in encoding configuration."""
    settings.RECORDING_ENABLE = True
    settings.RECORDING_CUSTOM_ENCODING_ENABLED = True
    room = RoomFactory()
    user = UserFactory()
    room.accesses.create(user=user, role="owner")
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-recording/",
        {
            "mode": "screen_recording",
            "options": {"encoding": {"bitrate": 9000}},
        },
        format="json",
    )
    assert response.status_code == 400
 def test_start_recording_options_without_encoding_unchanged(
    settings, mock_worker_service_factory, mock_worker_manager
 ):
    """Requests without encoding should keep existing options behavior."""
    settings.RECORDING_ENABLE = True
    room = RoomFactory()
    user = UserFactory()
    room.accesses.create(user=user, role="owner")
    client = APIClient()
    client.force_login(user)
    response = client.post(
        f"/api/v1.0/rooms/{room.id}/start-recording/",
        {"mode": "screen_recording", "options": {"language": "fr"}},
        format="json",
    )
    assert response.status_code == 201
    recording = Recording.objects.get(room=room)
    assert recording.options == {"language": "fr"}
@pytest.mark.parametrize("value", ["foo", 12])
 def test_start_recording_options_invalid_transcribe_type(settings, value):
    """Should reject non-boolean transcribe values."""
@@ -1,5 +1,5 @@
 """
-Test SIP mamagement service.
+Test SIP management service.
 """
 # pylint: disable=W0212
@@ -23,8 +23,6 @@ import dj_database_url
 import sentry_sdk
 from configurations import Configuration, values
 from lasuite.configuration.values import SecretFileValue
 from pydantic import BaseModel, PositiveInt, TypeAdapter
 from pydantic import ValidationError as PydanticValidationError
 from sentry_sdk.integrations.django import DjangoIntegration
 from sentry_sdk.integrations.logging import ignore_logger
@@ -67,27 +65,6 @@ class VideoCodecValue(values.Value):
        return codec
 class ResolutionSpec(BaseModel):
    """An value of RECORDING_ENCODING_AVAILABLE_RESOLUTIONS."""
    width: PositiveInt
    height: PositiveInt
 class ProfileSpec(BaseModel):
    """An value of RECORDING_ENCODING_AVAILABLE_PROFILES.
    `kbps` maps each resolution key to its video bitrate.
    """
    fps: PositiveInt
    kbps: dict[str, PositiveInt]
 RESOLUTION_MAP_ADAPTER = TypeAdapter(dict[str, ResolutionSpec])
 PROFILE_MAP_ADAPTER = TypeAdapter(dict[str, ProfileSpec])
 class Base(Configuration):
    """
    This is the base configuration every configuration (aka environment) should inherit from. It
@@ -384,6 +361,16 @@ class Base(Configuration):
        "DEFAULT_VERSIONING_CLASS": "rest_framework.versioning.URLPathVersioning",
        "DEFAULT_SCHEMA_CLASS": "drf_spectacular.openapi.AutoSchema",
        "DEFAULT_THROTTLE_RATES": {
            "room_creation": values.Value(
                default="50/minute",
                environ_name="ROOM_CREATION_THROTTLE_RATES",
                environ_prefix=None,
            ),
            "room_creation_daily": values.Value(
                default="1000/day",
                environ_name="ROOM_CREATION_DAILY_THROTTLE_RATES",
                environ_prefix=None,
            ),
            "request_entry": values.Value(
                default="150/minute",
                environ_name="REQUEST_ENTRY_THROTTLE_RATES",
@@ -798,81 +785,35 @@ class Base(Configuration):
    # These settings affect screen recordings handled by VideoCompositeEgressService;
    # they are silently ignored by AudioCompositeEgressService (audio-only transcript
    # recordings), whose request never carries advanced EncodingOptions.
-    #
+    # When disabled, LiveKit falls back to its built-in H264_720P_30 preset
-    # A default encoding is applied to every recording: it is resolved from the default
+    # (1280x720, 30 fps, 3000 kbps H.264 MAIN video, 128 kbps AAC audio).
-    # profile and resolution below and passed to LiveKit as EncodingOptions (advanced),
+    # When enabled, the values below are passed to LiveKit as EncodingOptions
-    # replacing LiveKit's built-in H264_720P_30 preset. Lowering framerate and bitrate
+    # (advanced) and replace the preset. Lowering framerate and bitrate reduces
-    # reduces output file size and CPU load on the egress worker. If either
+    # output file size and CPU load on the egress worker.
-    # RECORDING_ENCODING_DEFAULT_RESOLUTION or RECORDING_ENCODING_DEFAULT_PROFILE is
+    RECORDING_ENCODING_ENABLED = values.BooleanValue(
-    # unset, no default encoding is built (a startup warning is emitted) and LiveKit's
+        False, environ_name="RECORDING_ENCODING_ENABLED", environ_prefix=None
    # built-in preset is used instead.
    #
    # RECORDING_CUSTOM_ENCODING_ENABLED gates whether the start-recording API lets a
    # client override that default per recording (via an `encoding` object selecting a
    # resolution/profile). When False, the API rejects per-recording `encoding` and
    # every recording uses the default; when True, clients may pick from the
    # available resolutions/profiles below.
    RECORDING_CUSTOM_ENCODING_ENABLED = values.BooleanValue(
        False, environ_name="RECORDING_CUSTOM_ENCODING_ENABLED", environ_prefix=None
    )
-
+    RECORDING_ENCODING_WIDTH = values.PositiveIntegerValue(
-    # Map resolution string -> {"width", "height"} in pixels.
+        1280, environ_name="RECORDING_ENCODING_WIDTH", environ_prefix=None
-    RECORDING_ENCODING_AVAILABLE_RESOLUTIONS = values.DictValue(
+    )
-        {
+    RECORDING_ENCODING_HEIGHT = values.PositiveIntegerValue(
-            "540p": {"width": 960, "height": 540},
+        720, environ_name="RECORDING_ENCODING_HEIGHT", environ_prefix=None
-            "720p": {"width": 1280, "height": 720},
+    )
-            "1080p": {"width": 1920, "height": 1080},
+    RECORDING_ENCODING_FRAMERATE = values.PositiveIntegerValue(
-        },
+        30, environ_name="RECORDING_ENCODING_FRAMERATE", environ_prefix=None
-        environ_name="RECORDING_ENCODING_AVAILABLE_RESOLUTIONS",
+    )
    RECORDING_ENCODING_VIDEO_BITRATE_KBPS = values.PositiveIntegerValue(
        3000,
        environ_name="RECORDING_ENCODING_VIDEO_BITRATE_KBPS",
        environ_prefix=None,
    )
    # Map profile string -> {"fps", "kbps": {resolution: video_bitrate_kbps}}.
    # Bitrate scales with resolution so quality stays consistent across sizes.
    RECORDING_ENCODING_AVAILABLE_PROFILES = values.DictValue(
        {
            "talking_heads": {
                "fps": 15,
                "kbps": {"540p": 400, "720p": 700, "1080p": 1200},
            },
            "text": {
                "fps": 15,
                "kbps": {"540p": 600, "720p": 1000, "1080p": 1800},
            },
            "mixed": {
                "fps": 20,
                "kbps": {"540p": 900, "720p": 1500, "1080p": 2500},
            },
            "full": {
                "fps": 30,
                "kbps": {"540p": 2000, "720p": 3000, "1080p": 4500},
            },
        },
        environ_name="RECORDING_ENCODING_AVAILABLE_PROFILES",
        environ_prefix=None,
    )
    # Defaults used when no profile/resolution is specified per recording.
    # Must be keys of the two dicts above (validated at startup).
    RECORDING_ENCODING_DEFAULT_PROFILE = values.Value(
        "full",
        environ_name="RECORDING_ENCODING_DEFAULT_PROFILE",
        environ_prefix=None,
    )
    RECORDING_ENCODING_DEFAULT_RESOLUTION = values.Value(
        "720p",
        environ_name="RECORDING_ENCODING_DEFAULT_RESOLUTION",
        environ_prefix=None,
    )
    # Settings independent of profile/resolution.
    RECORDING_ENCODING_AUDIO_BITRATE_KBPS = values.PositiveIntegerValue(
        128,
        environ_name="RECORDING_ENCODING_AUDIO_BITRATE_KBPS",
        environ_prefix=None,
    )
    RECORDING_ENCODING_KEY_FRAME_INTERVAL_S = values.FloatValue(
-        0.0,
+        4.0,
        environ_name="RECORDING_ENCODING_KEY_FRAME_INTERVAL_S",
        environ_prefix=None,
    )
@@ -880,7 +821,6 @@ class Base(Configuration):
    SUMMARY_SERVICE_VERSION = values.PositiveIntegerValue(
        1, environ_name="SUMMARY_SERVICE_VERSION", environ_prefix=None
    )
    SUMMARY_SERVICE_ENDPOINT = values.Value(
        None, environ_name="SUMMARY_SERVICE_ENDPOINT", environ_prefix=None
    )
@@ -1295,86 +1235,6 @@ class Base(Configuration):
            },
        }
    @classmethod
    def _check_recording_encoding_maps(cls):
        """Ensure the per-recording encoding maps are well-formed and consistent.
        Each entry of RECORDING_ENCODING_AVAILABLE_RESOLUTIONS must declare a width and
        a height, each entry of RECORDING_ENCODING_AVAILABLE_PROFILES an fps and a kbps
        map, and every profile must define a bitrate for each declared resolution.
        The default profile / resolution feed the default encoding. When either is
        missing, no custom default encoding can be built: a warning is emitted and
        recordings fall back to LiveKit's built-in preset. When both are set, they
        must reference keys that actually exist in the maps above.
        """
        resolutions = set(cls.RECORDING_ENCODING_AVAILABLE_RESOLUTIONS)
        profiles = set(cls.RECORDING_ENCODING_AVAILABLE_PROFILES)
        for name, adapter in (
            ("RECORDING_ENCODING_AVAILABLE_RESOLUTIONS", RESOLUTION_MAP_ADAPTER),
            ("RECORDING_ENCODING_AVAILABLE_PROFILES", PROFILE_MAP_ADAPTER),
        ):
            try:
                adapter.validate_python(getattr(cls, name), strict=True)
            except PydanticValidationError as exc:
                raise ValueError(f"{name} is malformed: {exc}") from exc
        for (
            profile,
            profile_config,
        ) in cls.RECORDING_ENCODING_AVAILABLE_PROFILES.items():  # pylint: disable=no-member
            profile_resolutions = set(profile_config["kbps"])
            if profile_resolutions != resolutions:
                raise ValueError(
                    f"Profile '{profile}' in RECORDING_ENCODING_AVAILABLE_PROFILES must "
                    "define a bitrate for exactly the resolutions in "
                    "RECORDING_ENCODING_AVAILABLE_RESOLUTIONS, mismatch on: "
                    f"{resolutions ^ profile_resolutions}"
                )
        # Check that default resolutions and profiles are actually defined
        if (
            cls.RECORDING_ENCODING_DEFAULT_RESOLUTION
            and cls.RECORDING_ENCODING_DEFAULT_RESOLUTION not in resolutions
        ):
            raise ValueError(
                "RECORDING_ENCODING_DEFAULT_RESOLUTION "
                f"'{cls.RECORDING_ENCODING_DEFAULT_RESOLUTION}' is not a key of "
                f"RECORDING_ENCODING_AVAILABLE_RESOLUTIONS ({sorted(resolutions)})."
            )
        if (
            cls.RECORDING_ENCODING_DEFAULT_PROFILE
            and cls.RECORDING_ENCODING_DEFAULT_PROFILE not in profiles
        ):
            raise ValueError(
                "RECORDING_ENCODING_DEFAULT_PROFILE "
                f"'{cls.RECORDING_ENCODING_DEFAULT_PROFILE}' is not a key of "
                f"RECORDING_ENCODING_AVAILABLE_PROFILES ({sorted(profiles)})."
            )
        missing = [
            name
            for name, value in (
                (
                    "RECORDING_ENCODING_DEFAULT_RESOLUTION",
                    cls.RECORDING_ENCODING_DEFAULT_RESOLUTION,
                ),
                (
                    "RECORDING_ENCODING_DEFAULT_PROFILE",
                    cls.RECORDING_ENCODING_DEFAULT_PROFILE,
                ),
            )
            if not value
        ]
        if missing:
            warnings.warn(
                f"{' and '.join(missing)} not set; recordings will use LiveKit's "
                "built-in encoding preset instead of a custom default encoding.",
                UserWarning,
                stacklevel=2,
            )
    @classmethod
    def post_setup(cls):
        """Post setup configuration.
@@ -1388,8 +1248,6 @@ class Base(Configuration):
                "FILE_UPLOAD_TMP_PATH cannot be the same as FILE_UPLOAD_PATH"
            )
        cls._check_recording_encoding_maps()
        if (
            cls.SUMMARY_SERVICE_VERSION == 1
            and cls.SUMMARY_SERVICE_ENDPOINT is not None
@@ -7,7 +7,7 @@ build-backend = "uv_build"
 [project]
 name = "meet"
-version = "1.32.1"
+version = "1.33.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
    "Development Status :: 5 - Production/Stable",
@@ -40,7 +40,7 @@ dependencies = [
    "django-storages[s3]==1.14.6",
    "django-timezone-field>=5.1",
    "django-pydantic-field==0.5.4",
-    "django==5.2.16",
+    "django==5.2.17",
    "djangorestframework==3.18.0",
    "drf_spectacular==0.30.0",
    "dockerflow==2026.3.4",
@@ -62,7 +62,7 @@ dependencies = [
    "mozilla-django-oidc==5.0.2",
    "livekit-api==1.2.0",
    "aiohttp==3.14.3",
-    "urllib3==2.7.0",
+    "urllib3==2.8.0",
    "phonenumbers==9.0.37",
    "cryptography==50.0.1", # CVE-2026-69247
 ]
@@ -700,16 +700,16 @@ wheels = [
 [[package]]
 name = "django"
-version = "5.2.16"
+version = "5.2.17"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "asgiref" },
    { name = "sqlparse" },
    { name = "tzdata", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a9/26/889449d521ae508b26de715954faecd8bcf3f740affb81b2d146a83b42a5/django-5.2.16.tar.gz", hash = "sha256:59ea02020c3136fce14bef0bbece21a10a4febef5eed1c51c22ae468efa22200", size = 10890894, upload-time = "2026-07-07T13:52:17.005Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d5/d8/43e9d000519adceb189620b6869ff88031e046df91c2e9da72f8f6918399/django-5.2.17.tar.gz", hash = "sha256:9d4d93be539a18ab80d058eb515900e10951e04c537c5a6b394fc49528d3251f", size = 10889740, upload-time = "2026-08-04T15:04:03.173Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4e/13/1e5e3e4c15dcecb04281b3cb2a46a4670e1cef131068e202f6040df19224/django-5.2.16-py3-none-any.whl", hash = "sha256:04f354bf9d807a86ad1a8392fe3808d362358a8eafc322848e0e43e59b24371d", size = 8311943, upload-time = "2026-07-07T13:52:11.223Z" },
+    { url = "https://files.pythonhosted.org/packages/df/f8/ce120525ca78f12b07daf65786679c5d0b54a75285a8958d3ae55e39da35/django-5.2.17-py3-none-any.whl", hash = "sha256:f04fb3b36ee119e1af4fa1d397d5fd6cf12700f49321e84d4f4c642c5b1973db", size = 8315563, upload-time = "2026-08-04T15:03:59.1Z" },
 ]
 [[package]]
@@ -1297,7 +1297,7 @@ wheels = [
 [[package]]
 name = "meet"
-version = "1.32.1"
+version = "1.33.0"
 source = { editable = "." }
 dependencies = [
    { name = "aiohttp" },
@@ -1372,7 +1372,7 @@ requires-dist = [
    { name = "celery", extras = ["redis"], specifier = "==5.6.3" },
    { name = "cryptography", specifier = "==50.0.1" },
    { name = "dj-database-url", specifier = "==3.1.2" },
-    { name = "django", specifier = "==5.2.16" },
+    { name = "django", specifier = "==5.2.17" },
    { name = "django-configurations", specifier = "==2.5.1" },
    { name = "django-cors-headers", specifier = "==4.9.0" },
    { name = "django-countries", specifier = "==9.0.0" },
@@ -1404,7 +1404,7 @@ requires-dist = [
    { name = "redis", specifier = "==5.2.1" },
    { name = "requests", specifier = "==2.34.2" },
    { name = "sentry-sdk", specifier = "==2.68.1" },
-    { name = "urllib3", specifier = "==2.7.0" },
+    { name = "urllib3", specifier = "==2.8.0" },
    { name = "whitenoise", specifier = "==6.12.0" },
 ]
@@ -2529,11 +2529,11 @@ wheels = [
 [[package]]
 name = "urllib3"
-version = "2.7.0"
+version = "2.8.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+    { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" },
 ]
 [[package]]
@@ -1,12 +1,12 @@
 {
  "name": "meet",
-  "version": "1.32.1",
+  "version": "1.33.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "meet",
-      "version": "1.32.1",
+      "version": "1.33.0",
      "dependencies": {
        "@fontsource-variable/atkinson-hyperlegible-next": "5.3.0",
        "@fontsource-variable/lexend": "5.3.0",
@@ -1,7 +1,7 @@
 {
  "name": "meet",
  "private": true,
-  "version": "1.32.1",
+  "version": "1.33.0",
  "type": "module",
  "scripts": {
    "dev": "panda codegen && vite",
@@ -121,7 +121,7 @@ const config: Config = {
    },
    tokens: defineTokens({
      /* we take a few things from the panda preset but for now we clear out some stuff.
-       * This way we'll only add the things we need step by step and prevent using lots of differents things.
+       * This way we'll only add the things we need step by step and prevent using lots of different things.
       */
      ...pandaPreset.theme.tokens,
      colors: defineTokens.colors({
@@ -45,6 +45,10 @@ export const ScreenRecordingSidePanel = () => {
    FeatureFlags.ScreenRecording
  )
  const hasTranscriptAccess = useHasRecordingAccess(
    RecordingMode.Transcript,
    FeatureFlags.Transcript
  )
  const { notifyParticipants } = useNotifyParticipants()
  const { selectedLanguageKey, isLanguageSetToAuto } =
    useTranscriptionLanguage()
@@ -88,7 +92,7 @@ export const ScreenRecordingSidePanel = () => {
          ...(!isLanguageSetToAuto && {
            language: selectedLanguageKey,
          }),
-          ...(includeTranscript && { transcribe: true }),
+          ...(includeTranscript && hasTranscriptAccess && { transcribe: true }),
        }
        await startRecording({
@@ -182,9 +186,9 @@ export const ScreenRecordingSidePanel = () => {
        <RowWrapper iconName="mail" position="last">
          <Text variant="sm">{t('details.receiver')}</Text>
        </RowWrapper>
-
+        {hasTranscriptAccess && (
          <>
            <div className={css({ height: '15px' })} />
            <div
              className={css({
                width: '100%',
@@ -200,6 +204,8 @@ export const ScreenRecordingSidePanel = () => {
                <Text variant="sm">{t('details.transcription')}</Text>
              </Checkbox>
            </div>
          </>
        )}
      </VStack>
      <ControlsButton
        i18nKeyPrefix={keyPrefix}
@@ -53,6 +53,10 @@ export const TranscriptSidePanel = () => {
    FeatureFlags.Transcript
  )
  const hasScreenRecordingAccess = useHasRecordingAccess(
    RecordingMode.ScreenRecording,
    FeatureFlags.ScreenRecording
  )
  const hasFeatureWithoutAdminRights = useHasFeatureWithoutAdminRights(
    RecordingMode.Transcript,
    FeatureFlags.Transcript
@@ -97,7 +101,9 @@ export const TranscriptSidePanel = () => {
          room.localParticipant
        )
      } else {
-        const recordingMode = includeScreenRecording
+        const withScreenRecording =
          includeScreenRecording && hasScreenRecordingAccess
        const recordingMode = withScreenRecording
          ? RecordingMode.ScreenRecording
          : RecordingMode.Transcript
@@ -105,7 +111,7 @@ export const TranscriptSidePanel = () => {
          ...(!isLanguageSetToAuto && {
            language: selectedLanguageKey,
          }),
-          ...(includeScreenRecording && {
+          ...(withScreenRecording && {
            transcribe: true,
            original_mode: RecordingMode.Transcript,
          }),
@@ -122,7 +128,7 @@ export const TranscriptSidePanel = () => {
          type: NotificationType.TranscriptionStarted,
        })
        captureEvent('transcript-started', {
-          includeScreenRecording: includeScreenRecording,
+          includeScreenRecording: withScreenRecording,
          language: selectedLanguageKey,
        })
      }
@@ -234,6 +240,8 @@ export const TranscriptSidePanel = () => {
            </Button>
          </Text>
        </RowWrapper>
        {hasScreenRecordingAccess && (
          <>
            <div className={css({ height: '15px' })} />
            <div
              className={css({
@@ -250,6 +258,8 @@ export const TranscriptSidePanel = () => {
                <Text variant="sm">{t('details.recording')}</Text>
              </Checkbox>
            </div>
          </>
        )}
      </VStack>
      <ControlsButton
        i18nKeyPrefix={keyPrefix}
@@ -158,7 +158,7 @@ export const Conference = ({
           *
           * Issue: On Firefox behind proxy configurations, WebSocket signaling fails to establish.
           * Symptom: Client receives HTTP 200 instead of expected 101 (Switching Protocols).
-           * Root Cause: Certificate/security issue where the initial request is considered unsecure.
+           * Root Cause: Certificate/security issue where the initial request is considered insecure.
           *
           * Solution: Pre-establish a WebSocket connection to the signaling server, which fails.
           * This "primes" the connection, allowing subsequent WebSocket establishments to work correctly.
@@ -1,10 +1,9 @@
 #!/usr/bin/env bash
-docker image ls | grep readme-generator-for-helm
+if ! docker image ls | grep readme-generator-for-helm; then
 if [ "$?" -ne "0" ]; then
 	git clone https://github.com/bitnami/readme-generator-for-helm.git /tmp/readme-generator-for-helm
-	cd /tmp/readme-generator-for-helm
+	cd /tmp/readme-generator-for-helm || exit 1
 	docker build -t readme-generator-for-helm:latest .
-	cd $(dirname -- "${BASH_SOURCE[0]}")
+	cd "$(dirname -- "${BASH_SOURCE[0]}")" || exit 1
 fi
 docker run --rm -it -v .:/source -w /source readme-generator-for-helm:latest readme-generator -v values.yaml -r README.md
@@ -51,7 +51,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 {{/*
-transform dictionnary of environment variables
+transform dictionary of environment variables
 Usage : {{ include "meet.env.transformDict" .Values.envVars }}
 Example:
@@ -1,5 +1,5 @@
-#!/usr/bin/env bash
+#!/bin/sh
-set -eo pipefail
+set -e
 # Run html-to-text to convert all html files to text files
 DIR_MAILS="../backend/core/templates/mail/"
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/sh
 # Run mjml command to convert all mjml templates to html files
 DIR_MAILS="../backend/core/templates/mail/html/"
@@ -1,12 +1,12 @@
 {
  "name": "mail_mjml",
-  "version": "1.32.1",
+  "version": "1.33.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "mail_mjml",
-      "version": "1.32.1",
+      "version": "1.33.0",
      "license": "MIT",
      "dependencies": {
        "@html-to/text-cli": "0.6.1",
@@ -1,6 +1,6 @@
 {
  "name": "mail_mjml",
-  "version": "1.32.1",
+  "version": "1.33.0",
  "description": "An util to generate html and text django's templates from mjml templates",
  "type": "module",
  "dependencies": {
@@ -9,8 +9,8 @@
  },
  "private": true,
  "scripts": {
-    "build-mjml-to-html": "bash ./bin/mjml-to-html",
+    "build-mjml-to-html": "sh ./bin/mjml-to-html",
-    "build-html-to-plain-text": "bash ./bin/html-to-plain-text",
+    "build-html-to-plain-text": "sh ./bin/html-to-plain-text",
    "build": "npm run build-mjml-to-html && npm run build-html-to-plain-text"
  },
  "volta": {
@@ -1,12 +1,12 @@
 {
  "name": "sdk",
-  "version": "1.32.1",
+  "version": "1.33.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sdk",
-      "version": "1.32.1",
+      "version": "1.33.0",
      "license": "ISC",
      "workspaces": [
        "./library",
@@ -1,6 +1,6 @@
 {
  "name": "sdk",
-  "version": "1.32.1",
+  "version": "1.33.0",
  "author": "",
  "license": "ISC",
  "description": "",
@@ -1,7 +1,7 @@
 [project]
 name = "summary"
-version = "1.32.1"
+version = "1.33.0"
 requires-python = ">=3.13"
 dependencies = [
    "fastapi[standard]>=0.105.0",
@@ -1484,7 +1484,7 @@ wheels = [
 [[package]]
 name = "summary"
-version = "1.32.1"
+version = "1.33.0"
 source = { editable = "." }
 dependencies = [
    { name = "boto3" },
Author	SHA1	Message	Date
lebaudantoine	c7b05a4487	⚡️(devx) switch devstack to node:22-alpine The devstack was pulling the full `node:22` image, around 1.6 GB. Switch to `node:22-alpine`, which is much smaller, to speed up the devstack bootstrap time and reduce disk usage.	2026-10-02 15:46:34 +02:00
lebaudantoine	971a7295ca	⚡️(devx) use a single Redis image version in the devstack The devstack was pulling two different versions of the Redis image. Align everything on a single version to save a few MB of network bandwidth when bootstrapping the stack. Late-night minor optimization.	2026-10-01 16:38:31 +02:00
lebaudantoine	bd0329d162	🔒️(agents) upgrade libpcre2-8-0 to fix CVE-2026-103111 The python:3.14.7-slim base image ships libpcre2-8-0 10.46-1~deb13u2, which is affected by CVE-2026-103111 (HIGH): an out-of-bounds write triggered by a crafted regular expression. Explicitly install libpcre2-8-0 in the base stage so apt pulls the patched 10.46-1~deb13u3 from trixie-security. All stages (builder, development, production) inherit the fix. This line can be dropped once an upstream python slim image ships the patched package.	2026-10-01 16:37:29 +02:00
lebaudantoine	cedaa32ab7	🔒️(backend) fix HIGH CVEs in Django and urllib3 Address the following HIGH severity CVEs reported by Trivy on the backend image: * Django 5.2.16 → 5.2.17 - CVE-2026-15307 — remote code execution via GeoDjango spatial lookups. * urllib3 2.7.0 → 2.8.0 - CVE-2026-97687 — traffic interception via HTTPS proxy TLS configuration override. - CVE-2026-97689 — denial of service via unbounded memory allocation in the chunk parser.	2026-10-01 16:37:29 +02:00
lebaudantoine	22adccb353	👷(ci) ignore unfixed Debian CVEs in trivy scans The trivy scan fails on HIGH vulnerabilities found in the Debian 13 base images (util-linux, acl, ncurses, systemd and perl-base). None of them has a fixed version available yet, so there is nothing we can upgrade to clear them. List these CVEs in a shared .github/.trivyignore and pass it to every image scan, so the scan stays blocking for any new HIGH or CRITICAL vulnerability. Remove the entries once Debian ships a fix.	2026-10-01 00:13:36 +02:00
lebaudantoine	3ab651d6c7	👷(ci) pin the shared CI repo to v0.0.1 Instead of referencing the shared CI repo on `main`, pin it to the initial tagged version `v0.0.1`, so the CI behavior is stable and does not silently change when the shared repo is updated.	2026-10-01 00:13:36 +02:00
lebaudantoine	919af928aa	🚨(ci) fix the shellcheck job Get the shellcheck CI job to pass again by addressing the issues it flagged across our shell scripts. Note: I am not 100% sure of every fix applied here. Reviewers should feel free to challenge specific changes and suggest better ones where relevant.	2026-10-01 00:13:36 +02:00
lebaudantoine	3ed38f1c48	🚨(ci) fix the spellcheck job Get the spellcheck CI job to pass again by: * Fixing the actual spelling issues it caught in the project. * Excluding generated files from the scan, since they are not written by us. * Excluding translation files, whose content is not necessarily in English and would trigger false positives.	2026-10-01 00:13:36 +02:00
lebaudantoine	f172c5795e	👷(ci) add Menshen scan for GitHub Actions vulnerabilities Wire Menshen into the CI to scan the GitHub Actions we use and flag vulnerable ones, following the same approach as other projects that recently adopted it. Note: I am not fully sure about the current setup. Reviewers should feel free to adjust the configuration or the integration point as they see fit.	2026-10-01 00:13:36 +02:00
lebaudantoine	262b168414	🔥(ci) drop unused Crowdin workflows The Crowdin workflows were not used by the project and had turned into dead CI code. Remove them to reduce noise and keep the CI configuration limited to what is actually running.	2026-10-01 00:13:36 +02:00
lebaudantoine	6c371c8cb3	👷(ci) migrate CI to the shared workflows repository First iteration of a migration toward a centralized repository containing our shared CI logic. Goals: * Manage GitHub Actions version upgrades in one place. * Make it easier to audit what actually runs in CI from a security perspective. * Avoid duplicating CI logic across projects and having each repository slowly diverge over time. * Centralize as many of our custom GitHub Actions as possible, including some that still live in the old `numerique-gouv` organization. * Centralize the Renovate configuration alongside the workflows. Inspired by the Accounts project, which recently simplified and reorganized its CI setup. This PR starts moving meet's CI to the shared repository so we can validate the approach on a real project. For now, reusable workflows are pinned to `main`; once we agree on the structure and content of the central repository, they should be pinned to a specific commit SHA instead.	2026-10-01 00:13:36 +02:00
lebaudantoine	1a8906c0a1	🔒️(agents) fix util-linux CVEs reported by Cyberwatch Address the following CVEs in util-linux, reported by Cyberwatch on the agents image. The python:3.14.6-slim tag is no longer rebuilt and still ships util-linux 2.41-5. Bump the base image to python:3.14.7-slim, which ships the patched 2.41.5-0+deb13u1 (DSA-6442-1), to cover them all: * CVE-2026-53612 (7.0) — TOCTOU in mount post-mount ownership/mode changes. * CVE-2026-53613 (7.0) — TOCTOU in mount via ancestor directory swap. * CVE-2026-53614 (7.0) — SUID mount(8) nosuid/noexec bypass via `LIBMOUNT_FORCE_MOUNT2`. * CVE-2026-13595 (5.3) — flaw in the libblkid library. * CVE-2026-27456 (4.7) — TOCTOU in SUID mount(8) when setting up loop devices.	2026-09-30 16:21:22 +02:00
lebaudantoine	99ba8e330e	🐛(frontend) enforce recording-mode permissions on the checkboxes Permissions on the recording panel checkboxes were not properly enforced. A user with only partial access to some recording modes could still tick a mode's checkbox and, for example, launch a transcription from the recording panel even though they were not authorized to. Gate each checkbox on the user's actual permissions so that only authorized modes can be started from the panel.	2026-09-30 15:15:19 +02:00
lebaudantoine	059e5f1ec4	🔒️(backend) add a daily cap on room creation The per-minute room creation throttle absorbs bursts but does not stop a compromised account from steadily creating rooms over hours or days. Add RoomCreationDailyUserRateThrottle, a per-user throttle with its own "room_creation_daily" scope, applied to room creation only alongside the existing short-term throttle. It defaults to 1000 rooms per day and is configurable via ROOM_CREATION_DAILY_THROTTLE_RATES. Tests use a controllable clock and patch rates with monkeypatch so they are restored after each test.	2026-09-30 14:57:10 +02:00
Lebaud Antoine	39ab9359e4	🔒️(backend) throttle meeting link generation Add throttling on the endpoint used to generate meeting links, so a compromised authenticated account cannot silently generate thousands of links without hitting any suspicious errors or alerts. The limits are set high enough not to affect legitimate usage, while capping the damage a leaked account can do.	2026-09-30 14:57:10 +02:00
lebaudantoine	d0a0d60ece	🔖(minor) bump release to 1.33.0	2026-09-30 13:03:41 +02:00