CooperandGoodman/homeschool
1
0 Fork 0
Code Issues Pull Requests Activity

Fix HIGH findings from 2026-09-24 maintenance review

Browse Source 
- nginx: resolve real client IP through Cloudflare -> NPM so rate limits
  are per client instead of shared across all users
- Bump vulnerable Python deps (PyJWT auth bypass, anyio, starlette via
  fastapi 0.141.1, cryptography, python-multipart, Mako); pin PyMySQL
  1.1.2 since 1.2.x breaks SQLAlchemy 2.0.35's aiomysql ping
- Backend: python 3.12.14-slim, apt-get upgrade, drop unneeded build deps
- Frontend: nginx 1.30.5-alpine (stable) + apk upgrade
- MySQL 8.0.40 (EOL) -> 8.4.11 LTS; add healthcheck start_period so
  slow startups (e.g. data upgrades) don't abort dependent services
- Add maintenance review report

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
derekcandClaude Opus 5.5 committed 2026-09-24 23:38:16 -07:00
1 parent 8e92ae6073
commit 3170c7f4eb
6 files changed
+260 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

frontend/Dockerfile
+3 -1
View File
@@ -10,7 +10,9 @@ COPY . .
RUN npm run build
# Stage 2: Serve with nginx
FROM nginx:1.29.6-alpine
FROM nginx:1.30.5-alpine
RUN apk upgrade --no-cache
COPY --from=builder /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/conf.d/default.conf