Merge branch 'chore/create-flag-migration' into feat/edit-versioned-change-request

Author: kyle-ssg

.github/actions/e2e-tests/action.yml

@@ -44,6 +44,8 @@ runs:
         max_attempts: 2
         retry_on: error
         timeout_minutes: 20
+        on_retry_command: |
+          lsof -ti:3000 | xargs kill -9 || true
       env:
         E2E_TEST_TOKEN: ${{ inputs.e2e_test_token }}
         SLACK_TOKEN: ${{ inputs.slack_token }}

.github/workflows/.reusable-docker-e2e-tests.yml

@@ -76,6 +76,9 @@ jobs:
           max_attempts: 2
           retry_on: error
           timeout_minutes: 20
+          on_retry_command: |
+            cd frontend
+            docker compose down --remove-orphans || true
         env:
           opts: ${{ inputs.args }}
           API_IMAGE: ${{ inputs.api-image }}

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.14.6
+    rev: v0.14.10
     hooks:
       # Run the linter.
       - id: ruff
@@ -41,13 +41,17 @@ repos:
         require_serial: true
         pass_filenames: false
         types: [python]
+        stages: [pre-push]
 
   - repo: https://github.com/python-poetry/poetry
     rev: 2.2.1
     hooks:
       - id: poetry-check
         args: ["-C", "api"]
 
+default_install_hook_types: [pre-commit, pre-push]
+default_stages: [pre-commit]
+
 ci:
   skip: [generate-docs, python-typecheck]
   autoupdate_commit_msg: "ci: pre-commit autoupdate"

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "2.205.1"
+  ".": "2.205.7"
 }

CHANGELOG.md

@@ -1,5 +1,61 @@
 # Changelog
 
+## [2.205.7](https://github.com/Flagsmith/flagsmith/compare/v2.205.6...v2.205.7) (2026-01-04)
+
+
+### Bug Fixes
+
+* optimise influxdb calls from handle_api_usage_notifications task ([#6458](https://github.com/Flagsmith/flagsmith/issues/6458)) ([26ac021](https://github.com/Flagsmith/flagsmith/commit/26ac0211e51c08ebc14d4903c79beffb6290627a))
+
+## [2.205.6](https://github.com/Flagsmith/flagsmith/compare/v2.205.5...v2.205.6) (2026-01-02)
+
+
+### Bug Fixes
+
+* add a batch size to the bulk_update of OrganisationSubscriptionInformationCache objects ([#6456](https://github.com/Flagsmith/flagsmith/issues/6456)) ([38ac162](https://github.com/Flagsmith/flagsmith/commit/38ac16206879e67ea3d72485659231fd61c3d362))
+
+## [2.205.5](https://github.com/Flagsmith/flagsmith/compare/v2.205.4...v2.205.5) (2026-01-02)
+
+
+### Bug Fixes
+
+* add throttle to flag analytics endpoint ([#6454](https://github.com/Flagsmith/flagsmith/issues/6454)) ([23d37ca](https://github.com/Flagsmith/flagsmith/commit/23d37ca202487dd9523bb5face31a098dd3e77b9))
+
+## [2.205.4](https://github.com/Flagsmith/flagsmith/compare/v2.205.3...v2.205.4) (2026-01-02)
+
+
+### Bug Fixes
+
+* add throttling for influx query endpoints ([#6453](https://github.com/Flagsmith/flagsmith/issues/6453)) ([64a216a](https://github.com/Flagsmith/flagsmith/commit/64a216a02bbf7639dbd2d1906f0bb4e9b99445cc))
+* clean-up-ci-cafe-port-3000-on-error ([#6430](https://github.com/Flagsmith/flagsmith/issues/6430)) ([e6aeff8](https://github.com/Flagsmith/flagsmith/commit/e6aeff8521109eb3a183ae9f86122419461ed785))
+* ignore-stale-identity-overrides ([#6444](https://github.com/Flagsmith/flagsmith/issues/6444)) ([5ce3df6](https://github.com/Flagsmith/flagsmith/commit/5ce3df6a3681de9eaa238e7e9a0e2b64f8f27720))
+
+
+### Dependency Updates
+
+* bump filelock from 3.16.1 to 3.20.1 in /api ([#6425](https://github.com/Flagsmith/flagsmith/issues/6425)) ([d859638](https://github.com/Flagsmith/flagsmith/commit/d859638f256ccc9894e8a4f8f2678d1592b48a17))
+* bump js-yaml from 3.14.1 to 3.14.2 in /frontend ([#6329](https://github.com/Flagsmith/flagsmith/issues/6329)) ([5b8292b](https://github.com/Flagsmith/flagsmith/commit/5b8292b32554cfa716b732dc1677f258429e6f60))
+* bump marshmallow from 3.20.1 to 3.26.2 in /api ([#6440](https://github.com/Flagsmith/flagsmith/issues/6440)) ([c1d787f](https://github.com/Flagsmith/flagsmith/commit/c1d787f328ca0f2a09b9309abd550443d7244dd4))
+* bump qs and express in /docs ([#6449](https://github.com/Flagsmith/flagsmith/issues/6449)) ([bff8570](https://github.com/Flagsmith/flagsmith/commit/bff85709b8a2035ef11571f6ea1003e96203357b))
+* bump tmp, testcafe and inquirer in /frontend ([#6450](https://github.com/Flagsmith/flagsmith/issues/6450)) ([bdd9e87](https://github.com/Flagsmith/flagsmith/commit/bdd9e873f55c4a9e794030b2768a810f34acb267))
+* bump werkzeug from 3.0.6 to 3.1.4 in /api ([#6348](https://github.com/Flagsmith/flagsmith/issues/6348)) ([60506b9](https://github.com/Flagsmith/flagsmith/commit/60506b9594a59d8e30bee1188b06ab2649249f28))
+
+## [2.205.3](https://github.com/Flagsmith/flagsmith/compare/v2.205.2...v2.205.3) (2025-12-19)
+
+
+### Dependency Updates
+
+* bump urllib3 dependency ([#6435](https://github.com/Flagsmith/flagsmith/issues/6435)) ([2d208b1](https://github.com/Flagsmith/flagsmith/commit/2d208b18c383a756703eba926830770546eac6ff))
+
+## [2.205.2](https://github.com/Flagsmith/flagsmith/compare/v2.205.1...v2.205.2) (2025-12-17)
+
+
+### Bug Fixes
+
+* prevent infinite loading on Identity Overrides tab ([#6404](https://github.com/Flagsmith/flagsmith/issues/6404)) ([5295a74](https://github.com/Flagsmith/flagsmith/commit/5295a74a478c686ec3aa9cf5a8a314bc51a7ce13))
+* prevent invites with invalid permission groups ([#6407](https://github.com/Flagsmith/flagsmith/issues/6407)) ([d5fbcd7](https://github.com/Flagsmith/flagsmith/commit/d5fbcd784037c39f691ae1760b720110c49c19e1))
+* removed-skip-organisation-tests ([#6418](https://github.com/Flagsmith/flagsmith/issues/6418)) ([c69409f](https://github.com/Flagsmith/flagsmith/commit/c69409fe1f75625ba58d7500083d1c283bdc8772))
+
 ## [2.205.1](https://github.com/Flagsmith/flagsmith/compare/v2.205.0...v2.205.1) (2025-12-16)
 
 

api/app/settings/common.py

@@ -320,6 +320,7 @@
         "mfa_code": "5/min",
         "invite": "10/min",
         "user": USER_THROTTLE_RATE,
+        "influx_query": "5/min",
     },
     "DEFAULT_FILTER_BACKENDS": ["django_filters.rest_framework.DjangoFilterBackend"],
     "DEFAULT_RENDERER_CLASSES": [
@@ -1468,3 +1469,5 @@
 )
 
 PYLON_IDENTITY_VERIFICATION_SECRET = env.str("PYLON_IDENTITY_VERIFICATION_SECRET", None)
+
+OSIC_UPDATE_BATCH_SIZE = env.int("OSIC_UPDATE_BATCH_SIZE", default=500)

api/app/settings/test.py

@@ -11,6 +11,7 @@
     "invite": "10/min",
     "signup": "100/min",
     "user": "100000/day",
+    "influx_query": "50/min",
 }
 
 AWS_SSE_LOGS_BUCKET_NAME = "test_bucket"

api/app_analytics/constants.py

@@ -36,7 +36,10 @@
         "unknown",
         "5.0.0",
     ],
-    "flagsmith-java-sdk": ["unknown"],
+    "flagsmith-java-sdk": [
+        "unknown",
+        "8.0.0",
+    ],
     "flagsmith-js-sdk": [
         "unknown",
         "9.3.1",

api/app_analytics/throttles.py

@@ -0,0 +1,23 @@
+from django.views import View
+from rest_framework.request import Request
+from rest_framework.throttling import SimpleRateThrottle
+
+
+class InfluxQueryThrottle(SimpleRateThrottle):
+    scope = "influx_query"
+
+    def get_cache_key(self, request: Request, view: View) -> str:
+        """
+        Since we want to throttle requests across multiple views and viewsets that don't
+        necessarily have the option to define the scope themselves, we override the
+        get_cache_key method to ensure that the throttling logic behaves as expected.
+        """
+        if request.user and request.user.is_authenticated:
+            return self.cache_format % {
+                "scope": self.scope,
+                "ident": request.user.pk,
+            }
+        return self.cache_format % {  # pragma: no cover
+            "scope": self.scope,
+            "ident": self.get_ident(request),
+        }

api/app_analytics/views.py

@@ -4,7 +4,7 @@
 from common.core.utils import using_database_replica
 from drf_yasg.utils import swagger_auto_schema  # type: ignore[import-untyped]
 from rest_framework import status
-from rest_framework.decorators import api_view, permission_classes
+from rest_framework.decorators import api_view, permission_classes, throttle_classes
 from rest_framework.fields import IntegerField
 from rest_framework.generics import CreateAPIView
 from rest_framework.permissions import IsAuthenticated
@@ -20,6 +20,7 @@
 from app_analytics.mappers import (
     map_request_to_labels,
 )
+from app_analytics.throttles import InfluxQueryThrottle
 from environments.authentication import EnvironmentKeyAuthentication
 from environments.permissions.permissions import EnvironmentKeyPermissions
 from features.models import FeatureState
@@ -135,6 +136,7 @@ class SelfHostedTelemetryAPIView(CreateAPIView):  # type: ignore[type-arg]
 )
 @api_view(["GET"])
 @permission_classes([IsAuthenticated, UsageDataPermission])
+@throttle_classes([InfluxQueryThrottle])
 def get_usage_data_total_count_view(request: Request, organisation_pk: int) -> Response:
     organisation = using_database_replica(Organisation.objects).get(id=organisation_pk)
     count = get_total_events_count(organisation)
@@ -151,6 +153,7 @@ def get_usage_data_total_count_view(request: Request, organisation_pk: int) -> R
 )
 @api_view(["GET"])
 @permission_classes([IsAuthenticated, UsageDataPermission])
+@throttle_classes([InfluxQueryThrottle])
 def get_usage_data_view(request: Request, organisation_pk: int) -> Response:
     filters = UsageDataQuerySerializer(data=request.query_params)
     filters.is_valid(raise_exception=True)