[Snyk] Fix for 21 vulnerabilities

requirements.txt

@@ -1,4 +1,4 @@
-cryptography==42.0.8
+cryptography==42.0.8 # ssl issue prevents upgrade
 Pillow==11.1.0
 numpy==1.26.4
 pandas==2.1.1
@@ -20,9 +20,8 @@ python-dateutil
 # gpiozero
 # git+https://github.com/waveshare/e-Paper.git#subdirectory=RaspberryPi_JetsonNano/python&egg=waveshare-epd
 
-# requests>=2.32.3 # not directly required, pinned by Snyk to avoid a vulnerability
-# setuptools>=75.6.0 # not directly required, pinned by Snyk to avoid a vulnerability
-# urllib3>=2.2.3 # not directly required, pinned by Snyk to avoid a vulnerability
-# zipp>=3.21.0 # not directly required, pinned by Snyk to avoid a vulnerability
-# aiohttp>=3.10.11 # not directly required, pinned by Snyk to avoid a vulnerability   
-fonttools>=4.43.0 # not directly required, pinned by Snyk to avoid a vulnerability
+aiohttp>=3.10.11 # not directly required, pinned by Snyk to avoid a vulnerability
+requests>=2.32.2 # not directly required, pinned by Snyk to avoid a vulnerability
+urllib3>=2.2.2 # not directly required, pinned by Snyk to avoid a vulnerability
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability
+fonttools>=4.43.0 # not directly required, pinned by Snyk to avoid a vulnerability

test.dockerfile

@@ -0,0 +1,45 @@
+# Stage 1: Build stage
+FROM python:3.11-slim-bookworm AS builder
+
+# Avoid bytecode baggage
+ENV PYTHONDONTWRITEBYTECODE=1
+
+# Create a virtual environment
+RUN python3 -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Update pip
+RUN python3 -m pip install --upgrade pip --no-cache-dir
+
+# Copy and install Python dependencies
+COPY requirements.txt .
+
+RUN python3 -m pip install -v \
+    --prefer-binary \
+    -r requirements.txt \
+    --extra-index-url https://www.piwheels.org/simple \
+    --no-cache-dir
+
+# Stage 2: Final stage
+FROM python:3.11-slim-bookworm
+
+# Avoid bytecode baggage
+ENV PYTHONDONTWRITEBYTECODE=1
+
+# Install only the necessary runtime dependencies
+RUN apt-get update -y && \
+    apt-get install -y \
+    --no-install-recommends \
+    libopenblas-dev libopenjp2-7 libtiff6 libxcb1 libfreetype6-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy the virtual environment from the builder stage
+COPY --from=builder /opt/venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Copy only the necessary application code
+WORKDIR /code
+COPY . .
+
+# Set the default command
+CMD ["python", "run.py"]