Skip to content

v1.1.0

Latest
Latest

Choose a tag to compare

View all tags
@xinitd xinitd released this 24 Oct 21:23
· 13 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.1.0
This tag was signed with the committer’s verified signature.
xinitd Shakhzhakhan Maxudbek
SSH Key Fingerprint: iDj0ziPM3bkSnKItLSlsDWhFYzRkL6zpTwev2wyX8vs
Verified
Learn about vigilant mode.
acd0a99
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The first update since the release on October 11: the Python base image is pinned by digest, CI checks every build of the image against requirements.txt, and the README covers what to check after an update.

Upgrading from 1.0.0

docker-compose.yaml, .env.example, webserver/ and static/ are unchanged, and main.py only has the new version number, so a deployment of 1.0.0 updates in place: git pull and docker compose up -d --build, then the checks in After an update.

If you copied 1.0.0 into a project of your own:

  • Take the FROM line from the Dockerfile. The Python base image is now pinned by digest and changes only through a pull request, so keep Dependabot on: without it the base image never gets updates, security fixes included.
  • Take requirements.txt as a whole: it pins the full set the image was tested with.
  • If you take the CI workflow, take the github-actions entry in .github/dependabot.yml with it, so the action pinned by SHA keeps getting updates.
  • FastAPI 0.144 to 0.157 removed openapi_prefix and extra keyword arguments from FastAPI() and deprecated root_path. Sclerotin uses none of them, but code you added on top might.

What's changed

Build and updates

  • Pin the Python base image by digest (#19). With the tag alone, the build checked it against Docker Hub every time, so a rebuilt python:3.14.8-slim reached the server without passing CI (#15)
  • Add a CI workflow that builds the image, compares pip freeze with requirements.txt and runs pip check on every pull request and every commit to main (#4, #18). Dependabot now updates the action it uses (#4)

Security policy

  • Add SECURITY.md: private reporting through GitHub, scope and supported versions (#3)

Documentation

  • Add what to do after an update: the commit to return to, checks on the server and from another machine, and cleanup, including the previous Nginx image (#11, #20)
  • Correct the README sentence that said the build reuses a cached Python base image (#19)

Dependencies

  • Python from 3.14.7 to 3.14.8, an expedited security release (#7)
  • FastAPI from 0.142.3 to 0.157.0 (#6, #8, #14)
  • Starlette from 1.7.0 to 1.9.0 (#9, #13)
  • Pydantic from 2.13.5 to 2.14.1 (#5, #10)

Full Changelog: v1.0.0...v1.1.0

Assets 3
Loading