Security updates

Security updates

Mostly automatic:

• Dependabot opens weekly pull requests for the Python libraries (each pinned to an exact version in requirements.txt), the Python base image and the GitHub Actions; security fixes arrive as soon as GitHub knows about them. Merge the ones where CI is green.
• CI on every push and pull request runs the tests, pip-audit and a Trivy scan of the finished image. A fixable HIGH or CRITICAL issue fails the build, so it never gets published. Reports appear under the repo's Security tab.
• Weekly rebuild: every Monday the image is rebuilt from scratch with the latest Alpine security updates and published as latest (plus weekly-YYYYMMDD), even with no code changes. Your update cron deploys it.
• Small image: Nyerk runs on Alpine Linux, which has a fraction of Debian's system packages (no login, PAM, perl, systemd or ncurses), so there is far less to patch or exploit. CI starts every new image once and checks it drops root, serves the web page and shuts down cleanly before publishing.
• cloudflared: a weekly job opens a pull request when Cloudflare releases a newer version (pinned in compose.yaml, or set CLOUDFLARED_VERSION). It doesn't run CI, so merge with Merge without waiting for requirements, then update the compose file in Dockge and deploy.
• This repository has Dependabot alerts and security updates, secret scanning with push protection, and a protected main that requires the test and image checks. For a fork, turn these on under the repo's Settings.
• On the server: keep the host patched (sudo apt install unattended-upgrades on Debian/Ubuntu) and update Docker and Dockge every month or two.