v13.2.0 - Migrations & Security Hardening

Upgrade notes

• Logout is POST-only (Flask-Security 5.9). Replace href="/logout" links in custom templates with a form posting to /logout.
• psycopg2-binary replaced by psycopg 3. Run uv sync; postgresql:// URLs keep working.
• Databases created before migrations: run uv run flask db stamp head once.

Added

• Alembic migrations via Flask-Migrate; flask create-db stamps new databases.
• Login/logout smoke check in checks.py.
• CI on PostgreSQL across Python 3.11 to 3.14, plus a production container build.

Security

• Flask-Security-Too 5.9.0 fixes GHSA-f66q-9rf6-8795 (WebAuthn reauthentication freshness bypass).
• nh3 replaces the deprecated bleach.
• Docker Compose no longer publishes Postgres/Redis ports and requires explicit passwords.
• Updated vendored Vue, Vuetify and Axios.

Thanks to Ali Tanveer (@alivirgo) for privately reporting the Docker Compose port and default password issues.

Fixes

• Admin pages froze the browser on Vue 3.5 (nav role filter mutated reactive state in a computed).
• Vuetify built-in icons (sort, pagination, selects, checkboxes) rendered blank; now mapped to Tabler.
• Celery and Redis now installed in the production image.
• User menu shows the email when a user has no name.

Other

• All dependencies upgraded: SQLAlchemy 2.1, Flask-Security-Too 5.9, oauthlib 4.0.
• Production image on Python 3.13.
• Tabler Icons vendored and pinned (3.48.0); 5 MB unused MDI bundle removed.