⬆️(dependencies) update python dependencies

Update python dependencies.

CHANGELOG.md

@@ -8,6 +8,20 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Changed
+
+- ⬆️(agents) upgrade to python 3.14 slim
+- ⬆️(dependencies) update python dependencies
+
+### Fixed
+
+- 🚀(front) fix frontend build failure
+- 🐛(makefile) fix args in make test
+- 🩹(backend) fix case-insensitive email deduplication in merge command
+- 🐛(summary) support media files with bad streams #1478
+
+## [1.22.0] - 2026-07-03
+
 ### Added
 
 - ✨(frontend) cap and paginate tiles in picture-in-picture #1383
@@ -16,12 +30,20 @@ and this project adheres to
 - 🧱(helm) run clean files command as cronjob
 - ✨(backend) add fallback to save recordings without S3/MinIO webhooks
 - 🩹(frontend) enable screen share button in PiP #1458
+- 🐛(backend) support unencoded S3 notification object keys #1455
 
 ### Changed
 
 - ✨(summary) generalized stt api call #1420
 - ♻️(env) refactor env variables handling
 - 🚸(frontend) use "Advanced" instead of "Premium" in the sidepanel
+- ♿️(frontend) make fullscreen share warning keyboard accessible #1459
+- ⬆️(summary) update docker alpine to 3.24 & ffmpeg to 8.1.2 #1471
+
+### Fixed
+
+- 🛂(backend) reject user access tokens on the API
+- 🩹(helm) fix Helm ingress rendering when passing multiple hosts
 
 ## [1.21.0] - 2026-06-15
 

Makefile

@@ -211,24 +211,25 @@ lint-pylint: ## lint back-end python sources with pylint only on changed files f
 	@$(COMPOSE_RUN_APP) pylint meet demo core
 .PHONY: lint-pylint
 
-test: ## run project tests
-	@$(MAKE) test-back-parallel
-	@$(MAKE) test-summary
+test: ## run project tests; pass extra pytest args via ARGS, e.g. `make test ARGS="-vv"`
+	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
+	$(MAKE) test-back-parallel ARGS="$${args}" && \
+	$(MAKE) test-summary ARGS="$${args}"
 .PHONY: test
 
-test-back: ## run back-end tests
-	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
-	bin/pytest $${args:-${1}}
+test-back: ## run back-end tests (pass extra pytest args via ARGS)
+	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
+	bin/pytest $${args}
 .PHONY: test-back
 
-test-back-parallel: ## run all back-end tests in parallel
-	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
-	bin/pytest -n auto $${args:-${1}}
+test-back-parallel: ## run all back-end tests in parallel (pass extra pytest args via ARGS)
+	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
+	bin/pytest -n auto $${args}
 .PHONY: test-back-parallel
 
-test-summary: ## run summary tests
-	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
-	bin/pytest-summary $${args:-${1}}
+test-summary: ## run summary tests (pass extra pytest args via ARGS)
+	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
+	bin/pytest-summary $${args}
 .PHONY: test-summary
 
 makemigrations:  ## run django makemigrations for the Meet project.

src/agents/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.13.13-slim AS base
+FROM python:3.14.6-slim AS base
 
 # Install system dependencies required by LiveKit
 RUN apt-get update && apt-get install -y \

src/agents/pyproject.toml

@@ -1,21 +1,21 @@
 
 [project]
 name = "agents"
-version = "1.21.0"
+version = "1.22.0"
 requires-python = ">=3.12"
 dependencies = [
-    "livekit-agents==1.5.13",
-    "livekit-plugins-deepgram==1.5.13",
-    "livekit-plugins-silero==1.5.13",
+    "livekit-agents==1.6.4",
+    "livekit-plugins-deepgram==1.6.4",
+    "livekit-plugins-silero==1.6.4",
     "livekit-plugins-kyutai-lasuite==0.0.6",
     "python-dotenv==1.2.2",
-    "protobuf==6.33.6",
+    "protobuf>=6.33.5",
     "minio==7.2.20"
 ]
 
 [project.optional-dependencies]
 dev = [
-    "ruff==0.15.14",
+    "ruff==0.15.19",
 ]
 
 [tool.uv]

src/backend/core/analytics/__init__.py

@@ -0,0 +1,59 @@
+"""
+Pluggable analytics.
+
+Usage anywhere in the codebase:
+
+    from core import analytics
+
+    analytics.capture(request.user, "room_created", {"room_id": str(room.pk)})
+
+The concrete backend is resolved lazily from Django settings, so swapping
+PostHog for anything else is a configuration change, not a code change.
+"""
+
+from functools import lru_cache
+from typing import Any
+
+from django.conf import settings
+from django.utils.module_loading import import_string
+
+from .base import AnalyticsBackend, NoOpAnalytics
+from .events import AnalyticsEvent
+
+__all__ = [
+    "get_analytics",
+    "identify",
+    "capture",
+    "AnalyticsBackend",
+    "AnalyticsEvent",
+]
+
+
+@lru_cache(maxsize=1)
+def get_analytics() -> AnalyticsBackend:
+    """Instantiate the configured backend once per process."""
+    dotted_path = getattr(settings, "ANALYTICS_BACKEND", None)
+    options = getattr(settings, "ANALYTICS_BACKEND_SETTINGS", {}) or {}
+
+    if not dotted_path:
+        return NoOpAnalytics()
+
+    backend_class = import_string(dotted_path)
+    return backend_class(**options)
+
+
+# Convenience module-level shortcuts
+
+analytics_instance = get_analytics()
+
+
+def identify(user, properties: dict[str, Any] | None = None) -> None:
+    """Associate traits with an identified user."""
+    analytics_instance.identify(user, properties)
+
+
+def capture(
+    user, event: AnalyticsEvent, properties: dict[str, Any] | None = None
+) -> None:
+    """Record an event performed by an identified user."""
+    analytics_instance.capture(user, event, properties)

src/backend/core/analytics/base.py

@@ -0,0 +1,50 @@
+"""Analytics backend protocol and default no-op implementation."""
+
+from typing import Any, Protocol
+
+from ..models import User
+from .events import AnalyticsEvent
+
+
+class AnalyticsBackend(Protocol):
+    """
+    Interface every analytics backend must implement.
+
+    Backends are instantiated once (singleton) with the kwargs declared in
+    settings.ANALYTICS_BACKEND_SETTINGS, e.g.:
+
+        ANALYTICS_BACKEND = "core.analytics.posthog.PostHogAnalytics"
+        ANALYTICS_BACKEND_SETTINGS = {"api_key": "...", "host": "..."}
+    """
+
+    def __init__(self, **kwargs: Any) -> None: ...
+
+    def identify(self, user: User, properties: dict[str, Any] | None = None) -> None:
+        """Associate traits (email, name, ...) with an identified user."""
+
+    def capture(
+        self,
+        user: User,
+        event: AnalyticsEvent,
+        properties: dict[str, Any] | None = None,
+    ) -> None:
+        """Record an event performed by an identified user."""
+
+    def shutdown(self) -> None:
+        """Flush pending events. Called on process exit."""
+
+
+class NoOpAnalytics:
+    """Default backend: silently discards everything."""
+
+    def __init__(self, **kwargs: Any) -> None:
+        """No-op: accepts and ignores any backend settings kwargs."""
+
+    def identify(self, user: User, properties=None) -> None:
+        """No-op: discards identify calls."""
+
+    def capture(self, user, event, properties=None) -> None:
+        """No-op: discards captured events."""
+
+    def shutdown(self) -> None:
+        """No-op: nothing to flush."""

src/backend/core/analytics/events.py

@@ -0,0 +1,10 @@
+"""Catalog of all analytics events emitted by the backend."""
+
+from enum import StrEnum
+
+
+class AnalyticsEvent(StrEnum):
+    """All trackable events. Values are the wire names sent to the provider."""
+
+    # Rooms
+    ROOM_CREATED = "room_created"

src/backend/core/analytics/posthog.py

@@ -0,0 +1,74 @@
+"""PostHog implementation of the analytics backend protocol."""
+
+import logging
+from typing import Any
+
+from posthog import Posthog
+
+from ..models import User
+from .events import AnalyticsEvent
+
+logger = logging.getLogger(__name__)
+
+
+class PostHogAnalytics:
+    """Send events to PostHog, keyed on the user's primary key (UUID)."""
+
+    def __init__(
+        self,
+        *,
+        api_key: str,
+        host: str = "https://eu.i.posthog.com",
+        **kwargs: Any,
+    ) -> None:
+
+        # The SDK batches and sends in a background thread by default,
+        # so calls below never block the request/response cycle.
+        self._client = Posthog(
+            project_api_key=api_key,
+            host=host,
+            **kwargs,
+        )
+
+    @staticmethod
+    def _distinct_id(user: User) -> str | None:
+        """Return the PostHog distinct_id for a user, or None if anonymous."""
+        if user is None or not getattr(user, "is_authenticated", False):
+            return None
+        return str(user.pk)
+
+    def identify(self, user: User, properties: dict[str, Any] | None = None) -> None:
+        """Associate traits (email, name, ...) with an identified user."""
+        distinct_id = self._distinct_id(user)
+        if distinct_id is None:
+            return
+        try:
+            self._client.set(
+                distinct_id=distinct_id,
+                properties=properties or {},
+            )
+        except Exception:  # pylint: disable=broad-exception-caught
+            logger.exception("PostHog identify failed")
+
+    def capture(
+        self,
+        user: User,
+        event: AnalyticsEvent,
+        properties: dict[str, Any] | None = None,
+    ) -> None:
+        """Record an event performed by an identified user."""
+        distinct_id = self._distinct_id(user)
+        if distinct_id is None:
+            return
+        try:
+            self._client.capture(
+                distinct_id=distinct_id,
+                event=str(event),
+                properties=properties or {},
+            )
+        except Exception:  # pylint: disable=broad-exception-caught
+            logger.exception("PostHog capture failed for event %s", event)
+
+    def shutdown(self) -> None:
+        """Flush pending events. Called on process exit."""
+        self._client.shutdown()

src/backend/core/api/viewsets.py

@@ -35,7 +35,7 @@ from rest_framework import (
 )
 from rest_framework.settings import api_settings
 
-from core import enums, models, utils
+from core import analytics, enums, models, utils
 from core.api.filters import ListFileFilter
 from core.enums import MEDIA_STORAGE_URL_PATTERN
 from core.recording.enums import FileExtension
@@ -308,6 +308,16 @@ class RoomViewSet(
         if callback_id := self.request.data.get("callback_id"):
             RoomCreation().persist_callback_state(callback_id, room)
 
+        analytics.capture(
+            self.request.user,
+            analytics.AnalyticsEvent.ROOM_CREATED,
+            {
+                "room_id": str(room.pk),
+                "access_level": room.access_level,
+                "from_callback": bool(self.request.data.get("callback_id")),
+            },
+        )
+
     def perform_update(self, serializer):
         """Persist the room update, then sync metadata to LiveKit."""
 

src/backend/core/authentication/backends.py

@@ -9,6 +9,7 @@ from django.utils.translation import gettext_lazy as _
 from lasuite.oidc_login.backends import (
     OIDCAuthenticationBackend as LaSuiteOIDCAuthenticationBackend,
 )
+from rest_framework.authentication import SessionAuthentication
 
 from core.models import User
 from core.services.marketing import (
@@ -96,3 +97,17 @@ class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
                         "Multiple user accounts share a common email."
                     ) from e
         return None
+
+
+class SessionAuthenticationWith401(SessionAuthentication):
+    """
+    Identical to DRF's SessionAuthentication, but returns a WWW-Authenticate
+    header so unauthenticated requests get a 401 instead of a 403.
+
+    The scheme is deliberately NOT 'Basic' — that would trigger the browser's
+    native login popup. 'Session' is ignored by the browser's auth UI but is
+    still truthy, so DRF keeps the status at 401.
+    """
+
+    def authenticate_header(self, request):
+        return "Session"

src/backend/core/external_api/viewsets.py

@@ -19,7 +19,7 @@ from rest_framework import (
     status as drf_status,
 )
 
-from core import api, models
+from core import analytics, api, models
 from core.api.feature_flag import FeatureFlag
 from core.services.jwt_token import JwtTokenService
 
@@ -194,10 +194,26 @@ class RoomViewSet(
             role=models.RoleChoices.OWNER,
         )
 
+        auth_method = type(self.request.successful_authenticator).__name__
+        client_id = (self.request.auth or {}).get("client_id", "unknown")
+
         # Log for auditing
         logger.info(
-            "Room created via application: room_id=%s, user_id=%s, client_id=%s",
+            "Room created via application: room_id=%s, user_id=%s, client_id=%s, auth_method=%s",
             room.id,
             self.request.user.id,
-            getattr(self.request.auth, "client_id", "unknown"),
+            client_id,
+            auth_method,
+        )
+
+        analytics.capture(
+            self.request.user,
+            analytics.AnalyticsEvent.ROOM_CREATED,
+            {
+                "room_id": str(room.pk),
+                "access_level": room.access_level,
+                "client_id": client_id,
+                "external_api": True,
+                "auth_method": auth_method,
+            },
         )

src/backend/core/management/commands/merge_duplicate_users.py

@@ -6,6 +6,7 @@ from django.contrib.auth import get_user_model
 from django.core.management.base import BaseCommand, CommandError
 from django.db import transaction
 from django.db.models import Count
+from django.db.models.functions import Lower
 
 from core.models import File, RecordingAccess, ResourceAccess, RoleChoices
 
@@ -20,11 +21,14 @@ ROLE_PRIORITY = {
 
 class Command(BaseCommand):
     """
-    Merge duplicate users sharing the same email into the most recently created one.
+    Merge duplicate users sharing the same email (case-insensitive) into the
+    most recently created one.
 
-    The KEPT user is the most recently created. All room memberships, recording
-    accesses and files are transferred to it. When a conflict exists, the
-    higher-privilege role wins. Stale users are then deleted.
+    Emails are compared case-insensitively, so 'John@Example.com' and
+    'john@example.com' are treated as duplicates. The KEPT user is the most
+    recently created. All room memberships, recording accesses and files are
+    transferred to it. When a conflict exists, the higher-privilege role wins.
+    Stale users are then deleted.
     Each email group is processed inside a single database transaction.
     """
 
@@ -56,13 +60,16 @@ class Command(BaseCommand):
             users_qs = users_qs.filter(email__icontains=email_filter)
             self.stdout.write(f"[INFO] Filtering emails containing '{email_filter}'.\n")
 
+        # Group emails case-insensitively so 'John@X.com' and 'john@x.com'
+        # are detected as duplicates of each other.
         duplicate_emails = (
             users_qs.exclude(email__isnull=True)
             .exclude(email="")
-            .values("email")
+            .annotate(email_lower=Lower("email"))
+            .values("email_lower")
             .annotate(cnt=Count("id"))
             .filter(cnt__gt=1)
-            .values_list("email", flat=True)
+            .values_list("email_lower", flat=True)
         )
 
         if not duplicate_emails:
@@ -78,9 +85,12 @@ class Command(BaseCommand):
         failed_emails = []
 
         for email in duplicate_emails:
+            # Case-insensitive lookup to fetch every casing variant of the email.
             # Secondary sort by id ensures a stable, deterministic order when
             # created_at timestamps are equal (common in tests and bulk imports).
-            users = list(User.objects.filter(email=email).order_by("created_at", "id"))
+            users = list(
+                User.objects.filter(email__iexact=email).order_by("created_at", "id")
+            )
             kept_user = users[-1]
             stale_users = users[:-1]
 
@@ -120,6 +130,10 @@ class Command(BaseCommand):
                 failed_emails.append(email)
                 self.stderr.write(f"[ERROR] Failed to merge '{email}': {exc}")
 
+            if not kept_user.email.islower():
+                kept_user.email = kept_user.email.lower()
+                kept_user.save(update_fields=["email"])
+
         if failed_emails:
             raise CommandError(
                 f"Failed to merge {len(failed_emails)} email group(s): {', '.join(failed_emails)}"

src/backend/core/recording/event/parsers.py

@@ -6,6 +6,7 @@ import re
 from dataclasses import dataclass
 from functools import lru_cache
 from typing import Any, Dict, Optional, Protocol
+from urllib.parse import quote
 
 from django.conf import settings
 from django.utils.module_loading import import_string
@@ -164,6 +165,9 @@ class S3Parser(BaseS3Parser):
             if not filepath:
                 raise ParsingEventDataError("Missing object key name")
             filetype, _ = mimetypes.guess_type(filepath)
+            # Normalize raw S3-compatible object keys without re-encoding
+            # already encoded AWS S3 notification keys.
+            filepath = quote(filepath, safe="%+")
             return StorageEvent(
                 filepath=filepath,
                 filetype=filetype,

src/backend/core/tests/analytics/test_posthog.py

@@ -0,0 +1,263 @@
+"""
+Unit tests for PostHogAnalytics.
+"""
+
+# pylint: disable=redefined-outer-name,unused-argument,protected-access
+
+from unittest.mock import patch
+
+from django.contrib.auth.models import AnonymousUser
+
+import pytest
+
+from core.analytics.events import AnalyticsEvent
+from core.analytics.posthog import PostHogAnalytics
+from core.factories import UserFactory
+
+pytestmark = pytest.mark.django_db
+
+
+# ==============================
+# __init__
+# ==============================
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_init_constructs_posthog_client_with_api_key_and_host(mock_posthog_cls):
+    """Should forward api_key and host to the Posthog SDK constructor."""
+    PostHogAnalytics(api_key="my-key", host="https://custom.i.posthog.com")
+
+    mock_posthog_cls.assert_called_once_with(
+        project_api_key="my-key",
+        host="https://custom.i.posthog.com",
+    )
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_init_defaults_to_eu_host(mock_posthog_cls):
+    """Should default host to the EU PostHog cloud when not specified."""
+    PostHogAnalytics(api_key="my-key")
+
+    _, kwargs = mock_posthog_cls.call_args
+    assert kwargs["host"] == "https://eu.i.posthog.com"
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_init_forwards_extra_kwargs_to_client(mock_posthog_cls):
+    """Should pass through arbitrary extra kwargs (e.g. debug, disabled) to the SDK."""
+    PostHogAnalytics(api_key="my-key", debug=True, disabled=False)
+
+    _, kwargs = mock_posthog_cls.call_args
+    assert kwargs["debug"] is True
+    assert kwargs["disabled"] is False
+
+
+# ==============================
+# _distinct_id
+# ==============================
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_distinct_id_returns_none_for_none_user(mock_posthog_cls):
+    """Should return None when user is None."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+
+    assert backend._distinct_id(None) is None
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_distinct_id_returns_none_for_anonymous_user(mock_posthog_cls):
+    """Should return None when user.is_authenticated is falsy."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+
+    assert backend._distinct_id(AnonymousUser()) is None
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_distinct_id_returns_none_when_attribute_missing(mock_posthog_cls):
+    """Should return None when the user object has no is_authenticated attribute at all."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+
+    assert backend._distinct_id(object()) is None
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_distinct_id_returns_stringified_pk_for_authenticated_user(mock_posthog_cls):
+    """Should return str(user.pk) for an authenticated user."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+    user = UserFactory()
+
+    assert backend._distinct_id(user) == str(user.pk)
+
+
+# ==============================
+# identify
+# ==============================
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_identify_noop_for_anonymous_user(mock_posthog_cls):
+    """Should not call the SDK when the user is anonymous."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+
+    backend.identify(AnonymousUser(), {"email": "a@example.com"})
+
+    mock_posthog_cls.return_value.set.assert_not_called()
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_identify_noop_for_none_user(mock_posthog_cls):
+    """Should not call the SDK when user is None."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+
+    backend.identify(None, {"email": "a@example.com"})
+
+    mock_posthog_cls.return_value.set.assert_not_called()
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_identify_sends_set_properties_for_authenticated_user(mock_posthog_cls):
+    """Should call capture with event=$identify and properties wrapped in $set."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+    user = UserFactory()
+
+    backend.identify(user, {"email": "a@example.com", "name": "A"})
+
+    mock_posthog_cls.return_value.set.assert_called_once_with(
+        distinct_id=str(user.pk),
+        properties={"email": "a@example.com", "name": "A"},
+    )
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_identify_defaults_properties_to_empty_dict(mock_posthog_cls):
+    """Should send an empty $set payload when properties is None."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+    user = UserFactory()
+
+    backend.identify(user, None)
+
+    mock_posthog_cls.return_value.set.assert_called_once_with(
+        distinct_id=str(user.pk),
+        properties={},
+    )
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_identify_swallows_sdk_exceptions(mock_posthog_cls):
+    """Should log and not raise when the SDK call fails."""
+    mock_posthog_cls.return_value.set.side_effect = RuntimeError("network down")
+    backend = PostHogAnalytics(api_key="test-api-key")
+    user = UserFactory()
+
+    # Must not propagate.
+    backend.identify(user, {"email": "a@example.com"})
+
+
+# ==============================
+# capture
+# ==============================
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_capture_noop_for_anonymous_user(mock_posthog_cls):
+    """Should not call the SDK when the user is anonymous."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+
+    backend.capture(AnonymousUser(), AnalyticsEvent.ROOM_CREATED, {"room_id": "1"})
+
+    mock_posthog_cls.return_value.capture.assert_not_called()
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_capture_noop_for_none_user(mock_posthog_cls):
+    """Should not call the SDK when user is None."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+
+    backend.capture(None, AnalyticsEvent.ROOM_CREATED, {"room_id": "1"})
+
+    mock_posthog_cls.return_value.capture.assert_not_called()
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_capture_sends_event_and_properties_for_authenticated_user(mock_posthog_cls):
+    """Should call capture with the distinct_id, event name, and properties."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+    user = UserFactory()
+
+    backend.capture(user, AnalyticsEvent.ROOM_CREATED, {"room_id": "room-1"})
+
+    mock_posthog_cls.return_value.capture.assert_called_once_with(
+        distinct_id=str(user.pk),
+        event="room_created",
+        properties={"room_id": "room-1"},
+    )
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_capture_serializes_event_enum_to_plain_string(mock_posthog_cls):
+    """Should send the wire string, not the AnalyticsEvent enum member, to the SDK."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+    user = UserFactory()
+
+    backend.capture(user, AnalyticsEvent.ROOM_CREATED)
+
+    _, kwargs = mock_posthog_cls.return_value.capture.call_args
+    assert kwargs["event"] == "room_created"
+    assert isinstance(
+        kwargs["event"], str
+    )  # not AnalyticsEvent, not StrEnum subclass leaking through
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_capture_defaults_properties_to_empty_dict(mock_posthog_cls):
+    """Should send an empty properties dict when properties is None."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+    user = UserFactory()
+
+    backend.capture(user, AnalyticsEvent.ROOM_CREATED, None)
+
+    mock_posthog_cls.return_value.capture.assert_called_once_with(
+        distinct_id=str(user.pk),
+        event="room_created",
+        properties={},
+    )
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_capture_swallows_sdk_exceptions(mock_posthog_cls):
+    """Should log and not raise when the SDK call fails."""
+    mock_posthog_cls.return_value.capture.side_effect = RuntimeError("network down")
+    backend = PostHogAnalytics(api_key="test-api-key")
+    user = UserFactory()
+
+    # Must not propagate.
+    backend.capture(user, AnalyticsEvent.ROOM_CREATED, {"room_id": "1"})
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_capture_logs_the_failing_event_name_on_exception(mock_posthog_cls, caplog):
+    """Should log which event failed, to aid debugging without crashing the caller."""
+    mock_posthog_cls.return_value.capture.side_effect = RuntimeError("network down")
+    backend = PostHogAnalytics(api_key="test-api-key")
+    user = UserFactory()
+
+    with caplog.at_level("ERROR"):
+        backend.capture(user, AnalyticsEvent.ROOM_CREATED)
+
+    assert any("PostHog capture failed" in record.message for record in caplog.records)
+
+
+# ==============================
+# shutdown
+# ==============================
+
+
+@patch("core.analytics.posthog.Posthog")
+def test_shutdown_flushes_the_client(mock_posthog_cls):
+    """Should delegate to the SDK's shutdown to flush pending events."""
+    backend = PostHogAnalytics(api_key="test-api-key")
+
+    backend.shutdown()
+
+    mock_posthog_cls.return_value.shutdown.assert_called_once()

src/backend/core/tests/management/test_management_merge_duplicate_users.py

@@ -36,6 +36,26 @@ def test_merge_keeps_most_recently_created_user():
     assert User.objects.filter(id=user2.id).exists()
 
 
+def test_merge_user_case_insensitive():
+    """Emails differing only by case should be treated as duplicates and merged,
+    keeping the most recently created user."""
+    user1 = UserFactory(email="Dup@example.com")
+    user2 = UserFactory(email="dup@example.com")
+    call_command("merge_duplicate_users")
+
+    assert not User.objects.filter(id=user1.id).exists()
+    assert User.objects.filter(id=user2.id).exists()
+
+    user3 = UserFactory(email="joe@example.com")
+    user4 = UserFactory(email="Joe@example.com")
+    call_command("merge_duplicate_users")
+    assert not User.objects.filter(id=user3.id).exists()
+    assert User.objects.filter(id=user4.id).exists()
+
+    user4.refresh_from_db()
+    assert user4.email.islower()
+
+
 def test_merge_deletes_all_stale_users():
     """Command should delete all stale users and keep only the most recently created one."""
     email = "many@example.com"
@@ -457,4 +477,4 @@ def test_merge_email_filter_is_case_insensitive():
     UserFactory(email="user1@Example.com")
     UserFactory(email="user1@Example.com")
     call_command("merge_duplicate_users", email_filter="@example.com")
-    assert User.objects.filter(email="user1@Example.com").count() == 1
+    assert User.objects.filter(email="user1@example.com").count() == 1

src/backend/core/tests/recording/event/test_parsers.py

@@ -360,6 +360,75 @@ def test_s3_parse_unrecognized_extension(s3_parser):
         s3_parser.parse(event_with_unknown_ext)
 
 
+def test_s3_parser_keeps_encoded_filepath_compatible(settings):
+    """Test S3 parser keeps already encoded object keys compatible."""
+    settings.RECORDING_OUTPUT_FOLDER = "recordings"
+
+    recording_id = "80ae9fe5-639a-438b-b86e-9e3dd2d55f4d"
+    parser = S3Parser(bucket_name="recordings-bucket")
+
+    data = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "recordings-bucket"},
+                    "object": {
+                        "key": f"recordings%2F{recording_id}.mp4",
+                    },
+                }
+            }
+        ]
+    }
+
+    assert parser.get_recording_id(data) == recording_id
+
+
+def test_s3_parser_accepts_unencoded_filepath(settings):
+    """Test S3 parser accepts raw object keys with slash separators."""
+    settings.RECORDING_OUTPUT_FOLDER = "recordings"
+
+    recording_id = "80ae9fe5-639a-438b-b86e-9e3dd2d55f4d"
+    parser = S3Parser(bucket_name="recordings-bucket")
+
+    data = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "recordings-bucket"},
+                    "object": {
+                        "key": f"recordings/{recording_id}.mp4",
+                    },
+                }
+            }
+        ]
+    }
+
+    assert parser.get_recording_id(data) == recording_id
+
+
+def test_s3_parser_preserves_plus_signs_in_encoded_filepath(settings):
+    """Test S3 parser preserves plus signs in already encoded object keys."""
+    settings.RECORDING_OUTPUT_FOLDER = "recordings"
+
+    recording_id = "80ae9fe5-639a-438b-b86e-9e3dd2d55f4d"
+    parser = S3Parser(bucket_name="recordings-bucket")
+
+    data = {
+        "Records": [
+            {
+                "s3": {
+                    "bucket": {"name": "recordings-bucket"},
+                    "object": {
+                        "key": f"folder+name%2Frecordings%2F{recording_id}.mp4",
+                    },
+                }
+            }
+        ]
+    }
+
+    assert parser.get_recording_id(data) == recording_id
+
+
 def test_s3_get_recording_id_success(s3_parser, valid_s3_event):
     """Test successful extraction of recording ID from S3 event."""
     recording_id = s3_parser.get_recording_id(valid_s3_event)

src/backend/meet/settings.py

@@ -323,8 +323,7 @@ class Base(Configuration):
 
     REST_FRAMEWORK = {
         "DEFAULT_AUTHENTICATION_CLASSES": (
-            "mozilla_django_oidc.contrib.drf.OIDCAuthentication",
-            "rest_framework.authentication.SessionAuthentication",
+            "core.authentication.backends.SessionAuthenticationWith401",
         ),
         "DEFAULT_PARSER_CLASSES": [
             "rest_framework.parsers.JSONParser",
@@ -762,6 +761,14 @@ class Base(Configuration):
         None, environ_name="RECORDING_DOWNLOAD_BASE_URL", environ_prefix=None
     )
 
+    # Analytics
+    ANALYTICS_BACKEND = values.Value(
+        None, environ_name="ANALYTICS_BACKEND", environ_prefix=None
+    )
+    ANALYTICS_BACKEND_SETTINGS = values.DictValue(
+        {}, environ_name="ANALYTICS_BACKEND_SETTINGS", environ_prefix=None
+    )
+
     # Marketing and communication settings
     SIGNUP_NEW_USER_TO_MARKETING_EMAIL = values.BooleanValue(
         False,  # When enabled, new users are automatically added to mailing list.

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "uv_build"
 
 [project]
 name = "meet"
-version = "1.21.0"
+version = "1.22.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -24,23 +24,23 @@ keywords = ["Django", "Contacts", "Templates", "RBAC"]
 license = "MIT"
 requires-python = ">=3.13"
 dependencies = [
-    "boto3==1.43.14",
+    "boto3==1.43.36",
     "Brotli==1.2.0",
     "brevo-python==1.2.0",
     "celery[redis]==5.6.3",
     "dj-database-url==3.1.2",
     "django-configurations==2.5.1",
     "django-cors-headers==4.9.0",
-    "django-countries==8.2.0",
+    "django-countries==9.0.0",
     "django-filter==25.2",
-    "django-lasuite[all]==0.0.26",
+    "django-lasuite[all]==0.0.27",
     "django-parler==2.4",
     "redis==5.2.1",
-    "django-redis==6.0.0",
+    "django-redis==7.0.0",
     "django-storages[s3]==1.14.6",
     "django-timezone-field>=5.1",
     "django-pydantic-field==0.5.4",
-    "django==5.2.15",
+    "django==5.2.14",
     "djangorestframework==3.17.1",
     "drf_spectacular==0.29.0",
     "dockerflow==2026.3.4",
@@ -50,19 +50,20 @@ dependencies = [
     "jsonschema==4.26.0",
     "markdown==3.10.2",
     "nested-multipart-parser==1.6.0",
+    "posthog==7.16.1",
     "psycopg[binary]==3.3.4",
     "pydantic==2.13.4",
     "PyJWT==2.13.0",
     "python-frontmatter==1.3.0",
     "python-magic==0.4.27",
     "requests==2.34.2",
-    "sentry-sdk==2.60.0",
+    "sentry-sdk==2.63.0",
     "whitenoise==6.12.0",
     "mozilla-django-oidc==5.0.2",
-    "livekit-api==1.1.0",
-    "aiohttp==3.14.0",
+    "livekit-api==1.1.1",
+    "aiohttp==3.14.1",
     "urllib3==2.7.0",
-    "phonenumbers==9.0.31",
+    "phonenumbers==9.0.33",
 ]
 
 [project.urls]
@@ -74,20 +75,20 @@ dependencies = [
 [dependency-groups]
 dev = [
     "django-extensions==4.1",
-    "drf-spectacular-sidecar==2026.5.1",
+    "drf-spectacular-sidecar==2026.6.1",
     "freezegun==1.5.5",
     "ipdb==0.13.13",
-    "ipython==9.13.0",
+    "ipython==9.14.1",
     "pyfakefs==6.2.0",
     "pylint-django==2.7.0",
     "pylint<4.0.0",
     "pytest-cov==7.1.0",
     "pytest-django==4.12.0",
-    "pytest==9.0.3",
+    "pytest==9.1.1",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.8.0",
     "responses==0.26.1",
-    "ruff==0.15.14",
+    "ruff==0.15.19",
     "types-requests==2.33.0.20260518",
 ]
 

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.21.0",
+  "version": "1.22.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",
@@ -23,7 +23,6 @@
     "@livekit/components-styles": "1.2.0",
     "@livekit/track-processors": "0.7.2",
     "@pandacss/preset-panda": "1.11.3",
-    "@react-aria/toast": "3.0.10",
     "@react-types/overlays": "3.10.0",
     "@remixicon/react": "4.9.0",
     "@tanstack/react-query": "5.100.14",
@@ -32,16 +31,18 @@
     "derive-valtio": "0.2.0",
     "hoofd": "1.7.3",
     "humanize-duration": "3.33.2",
-    "i18next": "26.2.0",
+    "i18next": "26.3.1",
     "i18next-browser-languagedetector": "8.2.1",
     "i18next-parser": "9.4.0",
     "i18next-resources-to-backend": "1.2.1",
     "livekit-client": "2.19.0",
-    "posthog-js": "1.382.0",
+    "posthog-js": "1.386.5",
     "react": "18.3.1",
-    "react-aria-components": "1.14.0",
+    "react-aria": "3.49.0",
+    "react-aria-components": "1.18.0",
     "react-dom": "18.3.1",
     "react-i18next": "17.0.8",
+    "react-stately": "3.47.0",
     "use-sound": "5.0.0",
     "valtio": "2.3.2",
     "wouter": "3.10.0"
@@ -52,6 +53,7 @@
     "@tanstack/eslint-plugin-query": "5.100.14",
     "@tanstack/react-query-devtools": "5.100.14",
     "@types/humanize-duration": "3.27.4",
+    "@types/node": "24.12.4",
     "@types/react": "18.3.12",
     "@types/react-dom": "18.3.1",
     "@vitejs/plugin-react": "6.0.2",

src/frontend/src/api/useConfig.ts

@@ -9,6 +9,7 @@ export interface ApiConfig {
   analytics?: {
     id: string
     host: string
+    flags_api_host?: string
   }
   support?: {
     id: string

src/frontend/src/features/analytics/hooks/useAnalytics.ts

@@ -28,10 +28,16 @@ export const terminateAnalyticsSession = async () => {
 export type useAnalyticsProps = {
   id?: string
   host?: string
+  flags_api_host?: string
   isDisabled?: boolean
 }
 
-export const useAnalytics = ({ id, host, isDisabled }: useAnalyticsProps) => {
+export const useAnalytics = ({
+  id,
+  host,
+  flags_api_host,
+  isDisabled,
+}: useAnalyticsProps) => {
   const [location] = useLocation()
   const { user } = useUser()
 
@@ -39,9 +45,13 @@ export const useAnalytics = ({ id, host, isDisabled }: useAnalyticsProps) => {
     if (!id || !host || isDisabled) return
     getPosthog().then((ph) => {
       if (ph.__loaded) return
-      ph.init(id, { api_host: host, person_profiles: 'always' })
+      ph.init(id, {
+        api_host: host,
+        flags_api_host: flags_api_host,
+        person_profiles: 'always',
+      })
     })
-  }, [id, host, isDisabled])
+  }, [id, host, flags_api_host, isDisabled])
 
   useEffect(() => {
     if (!user) return

src/frontend/src/features/notifications/components/Toast.tsx

@@ -1,10 +1,10 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { Button } from '@/primitives'
 import { RiCloseLine } from '@remixicon/react'
 import { useRef } from 'react'
-import type { ToastState } from '@react-stately/toast'
+import type { ToastState } from 'react-stately'
 import type { ToastData } from './ToastProvider'
-import type { QueuedToast } from '@react-stately/toast'
+import type { QueuedToast } from 'react-stately'
 import { StyledToastContainer } from './StyledToastContainer'
 import { StyledToast } from './StyledToast'
 

src/frontend/src/features/notifications/components/ToastAnyRecording.tsx

@@ -1,4 +1,4 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { useMemo, useRef } from 'react'
 
 import type { ToastProps } from './Toast'

src/frontend/src/features/notifications/components/ToastAutoMuteLargeRoom.tsx

@@ -1,4 +1,4 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { useRef } from 'react'
 
 import { type ToastProps } from './Toast'

src/frontend/src/features/notifications/components/ToastJoined.tsx

@@ -1,4 +1,4 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { useRef } from 'react'
 import { Button as RACButton } from 'react-aria-components'
 import { Track } from 'livekit-client'

src/frontend/src/features/notifications/components/ToastLowerHand.tsx

@@ -1,4 +1,4 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { useRef } from 'react'
 
 import { type ToastProps } from './Toast'

src/frontend/src/features/notifications/components/ToastMessageReceived.tsx

@@ -1,4 +1,4 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { useEffect, useRef } from 'react'
 
 import { type ToastProps } from './Toast'

src/frontend/src/features/notifications/components/ToastMuted.tsx

@@ -1,4 +1,4 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { useRef } from 'react'
 
 import { type ToastProps } from './Toast'

src/frontend/src/features/notifications/components/ToastPermissionsRemoved.tsx

@@ -1,4 +1,4 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { useMemo, useRef } from 'react'
 
 import { type ToastProps } from './Toast'

src/frontend/src/features/notifications/components/ToastProvider.tsx

@@ -1,5 +1,5 @@
 /* eslint-disable react-refresh/only-export-components */
-import { ToastQueue, useToastQueue } from '@react-stately/toast'
+import { ToastQueue, useToastQueue } from 'react-stately'
 import { ToastRegion } from './ToastRegion'
 import { Participant } from 'livekit-client'
 import type { NotificationType } from '../NotificationType'

src/frontend/src/features/notifications/components/ToastRaised.tsx

@@ -1,4 +1,4 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { useRef } from 'react'
 
 import { type ToastProps } from './Toast'

src/frontend/src/features/notifications/components/ToastRecordingRequest.tsx

@@ -1,4 +1,4 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { useMemo, useRef } from 'react'
 
 import { type ToastProps } from './Toast'

src/frontend/src/features/notifications/components/ToastRecordingSaving.tsx

@@ -1,4 +1,4 @@
-import { useToast } from '@react-aria/toast'
+import { useToast } from 'react-aria'
 import { useMemo, useRef } from 'react'
 import { Text } from '@/primitives'
 

src/frontend/src/features/notifications/components/ToastRegion.tsx

@@ -1,5 +1,5 @@
-import { AriaToastRegionProps, useToastRegion } from '@react-aria/toast'
-import type { QueuedToast, ToastState } from '@react-stately/toast'
+import { AriaToastRegionProps, useToastRegion } from 'react-aria'
+import type { QueuedToast, ToastState } from 'react-stately'
 import { Toast } from './Toast'
 import { useRef } from 'react'
 import { NotificationType } from '../NotificationType'

src/frontend/src/features/pip/components/controls/PipOptionsMenu.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useRef, useState } from 'react'
 import { RiMoreFill } from '@remixicon/react'
-import { FocusScope } from '@react-aria/focus'
+import { FocusScope } from 'react-aria'
 import { Box, Button } from '@/primitives'
 import { css } from '@/styled-system/css'
 import { useTranslation } from 'react-i18next'

src/frontend/src/features/pip/components/layout/StageFrame.tsx

@@ -1,12 +1,19 @@
 import { useTranslation } from 'react-i18next'
 import { styled } from '@/styled-system/jsx'
+import { useLocalParticipant } from '@livekit/components-react'
 
 export const StageFrame = ({ children }: { children: React.ReactNode }) => {
   const { t } = useTranslation('rooms', {
     keyPrefix: 'pictureInPicture',
   })
+  const { localParticipant } = useLocalParticipant()
+
   return (
-    <Container role="region" aria-label={t('stage')} {...{ inert: '' }}>
+    <Container
+      role="region"
+      aria-label={t('stage')}
+      {...(!localParticipant.isScreenShareEnabled ? { inert: '' } : {})}
+    >
       {children}
     </Container>
   )

src/frontend/src/features/reactions/components/toolbar/ReactionButtonsContainer.tsx

@@ -12,7 +12,7 @@ import { useSize } from '@/features/rooms/livekit/hooks/useResizeObserver'
 import { RiArrowLeftSLine, RiArrowRightSLine } from '@remixicon/react'
 import { Button } from '@/primitives'
 import { ReactionsKeyboardNavigation } from './ReactionsKeyboardNavigation'
-import { FocusScope } from '@react-aria/focus'
+import { FocusScope } from 'react-aria'
 
 import { CONTROL_BAR_REGION_ID } from '@/features/layout/components/ControlBarRegion'
 import { REACTIONS_TOGGLE_ID } from '../ReactionsToggle'

src/frontend/src/features/reactions/components/toolbar/ReactionsKeyboardNavigation.tsx

@@ -1,5 +1,5 @@
 import { useTranslation } from 'react-i18next'
-import { useFocusManager } from '@react-aria/focus'
+import { useFocusManager } from 'react-aria'
 import { getFirstControlBarFocusable } from '@/utils/dom'
 import { REACTIONS_TOOLBAR_ID } from '../../constants'
 import { useReactionsToolbar } from '../../hooks/useReactionsToolbar'

src/frontend/src/features/rooms/livekit/components/FullScreenShareWarning.tsx

@@ -1,6 +1,6 @@
 import { css } from '@/styled-system/css'
 import { Button, Text } from '@/primitives'
-import { useMemo, useRef } from 'react'
+import { useCallback, useMemo, useRef } from 'react'
 import { screenSharePreferenceStore } from '@/stores/screenSharePreferences'
 import { useSnapshot } from 'valtio'
 import { useLocalParticipant } from '@livekit/components-react'
@@ -61,9 +61,19 @@ export const FullScreenShareWarning = ({
     await localParticipant.setScreenShareEnabled(false, {}, {})
   }
 
-  const handleDismissWarning = () => {
+  const handleDismissWarning = useCallback(() => {
     screenSharePreferenceStore.enabled = false
-  }
+  }, [])
+
+  const handleKeyDown = useCallback(
+    (e: React.KeyboardEvent) => {
+      if (e.key === 'Escape') {
+        e.stopPropagation()
+        handleDismissWarning()
+      }
+    },
+    [handleDismissWarning]
+  )
 
   if (!shouldShowWarning) return null
 
@@ -98,6 +108,7 @@ export const FullScreenShareWarning = ({
             })}
           >
             <Text
+              role="alert"
               style={{
                 color: 'white',
                 flexBasis: '55%',
@@ -117,11 +128,14 @@ export const FullScreenShareWarning = ({
               })}
             >
               <Button
+                // eslint-disable-next-line jsx-a11y/no-autofocus
+                autoFocus
                 variant="tertiary"
                 size="sm"
                 style={{
                   height: 'fit-content',
                 }}
+                onKeyDown={handleKeyDown}
                 onPress={async () => {
                   await handleStopScreenShare()
                 }}
@@ -134,6 +148,7 @@ export const FullScreenShareWarning = ({
                 style={{
                   height: 'fit-content',
                 }}
+                onKeyDown={handleKeyDown}
                 onPress={() => handleDismissWarning()}
               >
                 {t('ignore')}

src/helm/meet/Chart.yaml

@@ -1,4 +1,4 @@
 apiVersion: v2
 type: application
 name: meet
-version: 0.0.25
+version: 0.0.26

src/helm/meet/templates/ingress_posthog.yaml

@@ -72,11 +72,11 @@ spec:
             backend:
             {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
               service:
-                name: {{ include "meet.posthog.fullname" . }}-proxy
+                name: {{ include "meet.posthog.fullname" $ }}-proxy
                 port:
                   number: {{ $.Values.posthog.service.port }}
             {{- else }}
-              serviceName: {{ include "meet.posthog.fullname" . }}-proxy
+              serviceName: {{ include "meet.posthog.fullname" $ }}-proxy
               servicePort: {{ $.Values.posthog.service.port }}
           {{- end }}
         {{- with $.Values.posthog.assetsService.customBackends }}

src/helm/meet/templates/ingress_posthog_assets.yaml

@@ -72,11 +72,11 @@ spec:
             backend:
             {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
               service:
-                name: {{ include "meet.posthog.fullname" . }}-assets-proxy
+                name: {{ include "meet.posthog.fullname" $ }}-assets-proxy
                 port:
                   number: {{ $.Values.posthog.assetsService.service.port }}
             {{- else }}
-              serviceName: {{ include "meet.posthog.fullname" . }}-assets-proxy
+              serviceName: {{ include "meet.posthog.fullname" $ }}-assets-proxy
               servicePort: {{ $.Values.posthog.assetsService.service.port }}
           {{- end }}
         {{- with $.Values.posthog.assetsService.customBackends }}

src/mail/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "mail_mjml",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mail_mjml",
-      "version": "1.21.0",
+      "version": "1.22.0",
       "license": "MIT",
       "dependencies": {
         "@html-to/text-cli": "0.5.4",

src/mail/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mail_mjml",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "description": "An util to generate html and text django's templates from mjml templates",
   "type": "module",
   "dependencies": {

src/sdk/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "sdk",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "sdk",
-      "version": "1.21.0",
+      "version": "1.22.0",
       "license": "ISC",
       "workspaces": [
         "./library",

src/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sdk",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "author": "",
   "license": "ISC",
   "description": "",

src/summary/Dockerfile

@@ -1,9 +1,9 @@
-FROM python:3.13-alpine3.23 AS base
+FROM python:3.13-alpine3.24 AS base
 
 
 # Install ffmpeg for audio/video processing (format conversion, extraction, compression)
 # See summary/core/file_service.py for usage.
-RUN apk add --no-cache "ffmpeg=8.0.1-r1"
+RUN apk add --no-cache "ffmpeg=8.1.2-r0"
 
 FROM base AS builder
 

src/summary/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "summary"
-version = "1.21.0"
+version = "1.22.0"
 dependencies = [
     "fastapi[standard]>=0.105.0",
     "uvicorn>=0.24.0",
@@ -10,17 +10,17 @@ dependencies = [
     "celery==5.6.3",
     "redis==5.2.1",
     "minio==7.2.20",
-    "openai==2.38.0",
-    "posthog==7.15.4",
+    "openai==2.44.0",
+    "posthog==7.20.5",
     "requests==2.34.2",
-    "sentry-sdk[fastapi, celery]==2.60.0",
-    "langfuse==4.6.1"
+    "sentry-sdk[fastapi, celery]==2.63.0",
+    "langfuse==4.11.0"
 ]
 
 [project.optional-dependencies]
 dev = [
-    "ruff==0.15.14",
-    "pytest==9.0.3",
+    "ruff==0.15.19",
+    "pytest==9.1.1",
     "responses>=0.25.8",
 ]
 

src/summary/summary/core/file_service.py

@@ -142,6 +142,7 @@ class MediaInfo:
     has_video: bool
     audio_duration_seconds: float | None
     audio_codec_name: str | None
+    has_bad_stream: bool = False
 
 
 def get_media_info(local_path: Path) -> MediaInfo:
@@ -174,8 +175,9 @@ def get_media_info(local_path: Path) -> MediaInfo:
     data = json.loads(result.stdout)
 
     streams = data.get("streams", [])
-    has_audio = any(el["codec_type"] == "audio" for el in streams)
-    has_video = any(el["codec_type"] == "video" for el in streams)
+    has_audio = any(el.get("codec_type") == "audio" for el in streams)
+    has_video = any(el.get("codec_type") == "video" for el in streams)
+    has_bad_stream = any(el.get("codec_type", None) is None for el in streams)
     audio_codec_name = next(
         (
             stream.get("codec_name")
@@ -193,10 +195,11 @@ def get_media_info(local_path: Path) -> MediaInfo:
         has_video=has_video,
         audio_duration_seconds=audio_duration_seconds,
         audio_codec_name=audio_codec_name,
+        has_bad_stream=has_bad_stream,
     )
 
 
-def extract_audio_from_video(media_info: MediaInfo) -> Path:
+def extract_audio_from_media(media_info: MediaInfo) -> Path:
     """Extracts the audio track from a video file and saves it as a separate audio file.
 
     Based on the provided audio codec,
@@ -451,7 +454,12 @@ class FileService:
 
             if media_info.has_video:
                 logger.info("Video file detected, extracting audio...")
-                processed_path = extract_audio_from_video(media_info)
+                processed_path = extract_audio_from_media(media_info)
+            # Bad streams may cause transcription issues on WhisperX,
+            # So we extract the audio properly
+            elif media_info.has_bad_stream:
+                logger.info("Bad stream detected, extracting audio...")
+                processed_path = extract_audio_from_media(media_info)
             else:
                 processed_path = downloaded_path
 

src/summary/tests/unit/test_file_service.py

@@ -1,12 +1,15 @@
 """Unit tests for the file service."""
 
+import json
 from pathlib import Path
+from unittest.mock import Mock
 
 import pytest
 
+from summary.core import file_service
 from summary.core.file_service import (
     MediaInfo,
-    extract_audio_from_video,
+    extract_audio_from_media,
     get_media_info,
 )
 
@@ -110,12 +113,40 @@ def test_media_info_invalid_file() -> None:
     )
 
 
+def test_media_info_ignores_empty_stream_entry(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Test stream parsing when ffprobe returns an empty stream object."""
+    ffprobe_payload = {
+        "programs": [],
+        "stream_groups": [],
+        "streams": [
+            {"codec_name": "vorbis", "codec_type": "audio"},
+            {},
+        ],
+    }
+
+    run_mock = Mock(
+        return_value=Mock(stdout=json.dumps(ffprobe_payload), stderr="", returncode=0)
+    )
+    monkeypatch.setattr(file_service.subprocess, "run", run_mock)
+    monkeypatch.setattr(
+        file_service, "get_media_duration_seconds", Mock(return_value=2.5)
+    )
+
+    media_info = get_media_info(BASE_PATH / "audio-sample-android-firefox.ogg")
+
+    assert media_info.has_audio is True
+    assert media_info.has_video is False
+    assert media_info.has_bad_stream is True
+    assert media_info.audio_codec_name == "vorbis"
+    assert media_info.audio_duration_seconds == 2.5
+
+
 def test_extract_audio_from_video():
     """Test that extract_audio_from_video can extract audio from a video file."""
     path = None
     # A bit of cleanup logic since this is not a generator
     try:
-        path = extract_audio_from_video(MEDIA_INFO_SAMPLE_VISIO)
+        path = extract_audio_from_media(MEDIA_INFO_SAMPLE_VISIO)
         assert path.name.endswith(".m4a")
     except Exception as e:
         pytest.fail(f"Failed to extract audio from video: {e}")