- Added new integrations for Telegram, DingTalk, and Mattermost IM channels.
- Introduced a pluggable slash command system and a suggested questions feature for enhanced user interaction.
- Implemented VLM auto-description for images returned by MCP tools.
- Improved stability of MCP tool names and added channel tracking for knowledge entries.
- Fixed multiple bugs including empty responses when no knowledge base is configured and UTF-8 truncation issues.
- Updated documentation to reflect new features and enhancements.
- Add crypto utility (internal/utils/crypto.go) with AES-256-GCM encrypt/decrypt
using SYSTEM_AES_KEY env var, with "enc:v1:" prefix for versioned ciphertext
- Encrypt tenant API key via GORM BeforeSave/AfterFind hooks and manual
encryption in CreateTenant/UpdateAPIKey (db.Updates bypasses hooks)
- Encrypt model API key in ModelParameters Value/Scan (driver.Valuer)
- Widen api_key column from varchar(64) to varchar(256) across all DB dialects
(MySQL, ParadeDB, SQLite) and add versioned migration 000018
- Propagate SYSTEM_AES_KEY through docker-compose, Helm secrets and values
- Fix migration 000017 PL/pgSQL dollar-quoting syntax ($ -> $$)
Official Docker images (nginx, postgres, redis, paradedb) run as root
by default. Disabled runAsNonRoot and readOnlyRootFilesystem to ensure
compatibility.
Changes:
- global.podSecurityContext: removed runAsNonRoot
- global.containerSecurityContext: removed runAsNonRoot, readOnlyRootFilesystem
- Component securityContext: commented out incompatible settings
- app.image.tag: changed from "" to "latest" (versioned tags not available)
Tested on local Kubernetes cluster (k3s) with all pods running successfully.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
wizardchen