derekcandClaude Opus 5.5
4130467b22
- Backend retries DB connection at startup (up to 180s) so host reboots no longer crash-loop it; add backend and frontend healthchecks - Docker log rotation (json-file 10m x 3) on all services - ntfy alerts use X-Real-IP (set by nginx after real_ip resolution) instead of the client-controlled first X-Forwarded-For entry - Frontend build on Node 24 LTS with package-lock.json + npm ci; axios 1.20.0, vite 5.4.21 - README: backup/restore/rollback runbook, real-IP proxy trust notes - Release-Notes/v1.1.md; version 1.1.0 Co-Authored-By: Claude Opus 5.5 <[email protected]>
2.0 KiB
2.0 KiB
v1.1
v1.1.0 — 2026-09-24
Maintenance release from the 2026-09-24 review (reports/maintenance-2026-09-24.md).
Security
- Rate limits now apply to each client. nginx resolves the real client IP through Cloudflare → NPM (
set_real_ip_from+real_ip_recursive). Before this, every request looked like it came from NPM, so all users shared one login limit. - ntfy alerts show the real client IP (
X-Real-IPfrom nginx). They no longer use the firstX-Forwarded-Forentry, which the client controls. - Python dependency updates:
- PyJWT 2.15.0 (fixes an auth bypass)
- anyio 4.15.1
- fastapi 0.141.1 / starlette 1.7.0
- cryptography 50.0.1
- python-multipart 0.0.32
- alembic 1.20.0 / Mako 1.4.3
- Base images:
- python 3.12.14-slim, with
apt-get upgradeand without the unused gcc/mysqlclient headers - nginx 1.30.5-alpine (stable), with
apk upgrade - Node 24 LTS for the build stage
- python 3.12.14-slim, with
- axios 1.20.0 and vite 5.4.21. Frontend dependencies are now locked in
package-lock.jsonand installed withnpm ci.
Platform
- MySQL 8.0.40 (EOL) → 8.4.11 LTS. The data dictionary is upgraded in place, and you can't downgrade in place. Restore the pre-upgrade volume copy or dump instead; see README "Backup, Restore & Rollback".
Reliability
- The backend retries the DB connection for up to 180s at startup. Before this it crash-looped after host reboots, because the restart policy ignores
depends_on. - Healthchecks on backend (
/api/health) and frontend. The db healthcheck hasstart_period: 180s. - Docker log rotation on all services: json-file, 10 MB × 3.
Fixes
- The meeting alert catch-up window fix (
8e92ae6) is now deployed.
Known / accepted
- npm audit: vite ≤6.4.2 and esbuild advisories affect only the dev server, which production never runs (it serves the static build). Fixing them fully needs Vite 6.4+/7.
- mysql:8.4.11 has upstream findings in Oracle's image: curl, bundled Python tools, and gosu's Go stdlib.