3.7.12

Mobile performance, resource limits and security patches

Mobile

• The decorative 3D background is now skipped on phones (under 768px) and on
  Save-Data / 2G connections, saving mobile visitors ~700 KB of transfer and a
  continuous WebGL render loop. Desktop keeps the effect, and the existing
  prefers-reduced-motion opt-out is unchanged.
• Version-stamped CSS and JS are cached for a year instead of a week, so repeat
  visits stop revalidating assets whose URL already changes every release.

Resource limits

• Every service now carries a CPU ceiling. The long-running ones sum to 5
  cores, so the stack can no longer take more than half of a 10-core host when
  the web app, the analyzer worker and Postgres all peak at once.

Security

• urllib3 2.8.0 (PYSEC-2026-4175, -4176, -4177)
• Werkzeug 3.1.9 (CVE-2026-102598)

Dependencies

• numpy 2.5.3, psycopg2-binary 2.9.13, markdown 3.11
• Tooling: ruff 0.16.9, ty 0.0.84, virtualenv 21.7.13, docker/build-push-action 7.4.0

Full changelog: 3.7.11...3.7.12