CooperandGoodman/homeschool
1
0 Fork 0
Code Issues Pull Requests Activity

Fix HIGH findings from 2026-09-24 maintenance review

Browse Source 
- nginx: resolve real client IP through Cloudflare -> NPM so rate limits
  are per client instead of shared across all users
- Bump vulnerable Python deps (PyJWT auth bypass, anyio, starlette via
  fastapi 0.141.1, cryptography, python-multipart, Mako); pin PyMySQL
  1.1.2 since 1.2.x breaks SQLAlchemy 2.0.35's aiomysql ping
- Backend: python 3.12.14-slim, apt-get upgrade, drop unneeded build deps
- Frontend: nginx 1.30.5-alpine (stable) + apk upgrade
- MySQL 8.0.40 (EOL) -> 8.4.11 LTS; add healthcheck start_period so
  slow startups (e.g. data upgrades) don't abort dependent services
- Add maintenance review report

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
derekcandClaude Opus 5.5 committed 2026-09-24 23:38:16 -07:00
1 parent 8e92ae6073
commit 3170c7f4eb
6 files changed
+260 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/Dockerfile
+2 -3
View File
@@ -1,9 +1,8 @@
FROM python:3.12.13-slim
FROM python:3.12.14-slim
WORKDIR /app
RUN apt-get update && apt-get install -y --no-install-recommends \
default-libmysqlclient-dev gcc pkg-config \
RUN apt-get update && apt-get upgrade -y \
&& rm -rf /var/lib/apt/lists/*
COPY requirements.txt .