fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DEBIAN12-ZLIB-6008963
- https://snyk.io/vuln/SNYK-DEBIAN12-KRB5-1549480
- https://snyk.io/vuln/SNYK-DEBIAN12-KRB5-6277411
- https://snyk.io/vuln/SNYK-DEBIAN12-KRB5-6277412
- https://snyk.io/vuln/SNYK-DEBIAN12-KRB5-6277421

.gitea/workflows/build.yaml

@@ -23,18 +23,14 @@ jobs:
         run: apt update && apt install -y python3-pip
       - uses: abatilo/actions-poetry@v2
         with:
-          poetry-version: "1.5.1"
+          poetry-version: "1.6.1"
       - uses: actions/setup-node@v3
       - uses: actions/checkout@v3
-      - name: Set FOO
-        run: echo "FOO=${{ poetry -V }}" >> $GITEA_ENV
-      - name: Test
-        run: echo $FOO
-      - name: Test 2
-        run: poetry -V
-      - name: Build and push
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          push: false
-          tags: ajurna/cbwebreader:${{poetry version -s}}
+      # Extract version from Poetry
+      - name: Get version
+        run: echo "POETRY_VERSION=$(poetry version --short)" >> $GITHUB_ENV
+      - name: Build and push Docker image
+        run: |
+          docker build -t ajurna/cbwebreader:latest -t ajurna/cbwebreader:${{ env.POETRY_VERSION }} .
+          docker push ajurna/cbwebreader:${{ env.POETRY_VERSION }}
+          docker push ajurna/cbwebreader:latest

.pre-commit-config.yaml

@@ -9,7 +9,7 @@ repos:
     -   id: check-yaml
     -   id: check-added-large-files
 -   repo: https://github.com/python-poetry/poetry
-    rev: '1.2.1'  # add version here
+    rev: '1.6.1'  # add version here
     hooks:
     -   id: poetry-check
     -   id: poetry-export

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.10-slim-bullseye
+FROM python:3.14.0a3-slim-bookworm
 
 ENV PYTHONFAULTHANDLER=1 \
     PYTHONHASHSEED=random \
@@ -15,18 +15,17 @@ WORKDIR /src
 
 COPY . /src/
 
+RUN  echo "deb http://ftp.uk.debian.org/debian bookworm non-free non-free-firmware" > /etc/apt/sources.list.d/non-free.list
+
 
 RUN apt update \
-    && apt install -y software-properties-common \
-    && apt-add-repository non-free \
-    && apt update \
-    && apt install -y npm cron unrar libmariadb-dev libpq-dev \
+    && apt install -y npm cron unrar libmariadb-dev libpq-dev pkg-config swig \
     && pip install --upgrade pip \
     && pip install -r requirements.txt \
     && cd frontend \
     && npm install \
     && npm run build \
-    && apt remove -y npm software-properties-common \
+    && apt remove -y npm software-properties-common pkg-config swig \
     && rm -r node_modules \
     && apt -y auto-remove \
     && apt clean \

build.ps1

@@ -1,4 +1,4 @@
 poetry export --without-hashes -f requirements.txt --output requirements.txt
 $version=poetry version -s
-docker build . --no-cache -t ajurna/cbwebreader -t ajurna/cbwebreader:$version
-docker push ajurna/cbwebreader --all-tags
+docker build .  -t ajurna/cbwebreader -t ajurna/cbwebreader:$version
+docker push ajurna/cbwebreader --all-tags

cbreader/settings/base.py

@@ -191,10 +191,13 @@ BOOTSTRAP4 = {
     },
 }
 CSP_DEFAULT_SRC = ("'none'",)
-CSP_STYLE_SRC = ("'self'", "'sha256-MBVp6JYxbC/wICelYC6eULCRpgi9kGezXXSaq/TS2+I='")
+CSP_STYLE_SRC = (
+    "'self'",
+    "'unsafe-inline'"
+)
 CSP_IMG_SRC = ("'self'", "data:")
 CSP_FONT_SRC = ("'self'",)
-CSP_SCRIPT_SRC = ("'self'",)
+CSP_SCRIPT_SRC = ("'self'", "'sha256-IYBrMxCTJ62EwagLTIRncEIpWwTmoXcXkqv3KZm/Wik='")
 CSP_CONNECT_SRC = ("'self'",)
 CSP_INCLUDE_NONCE_IN = ['script-src']
 CSP_SCRIPT_SRC_ATTR = ("'self'",)  # "'unsafe-inline'")

docker-compose.yml

@@ -13,7 +13,7 @@ services:
     expose:
       - 8000
     volumes:
-      - ${COMIC_BOOK_VOLUME}:${COMIC_BOOK_VOLUME}
+      - ${COMIC_BOOK_VOLUME}:/comics
 #      - c:/comics:/comics
       - static_files:/static
       - media_files:/media
@@ -35,7 +35,7 @@ services:
 #    command: /bin/bash entrypoint-cron.sh
 
   database:
-    image: postgres:14-alpine
+    image: postgres:16-alpine
     expose:
       - 5432
     volumes:
@@ -62,4 +62,4 @@ services:
       - cbwebreader
 volumes:
   static_files:
-  media_files:
+  media_files:

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frontend",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "scripts": {
     "serve": "webpack-dev-server --config webpack.dev.js",
@@ -18,7 +18,7 @@
     "pdfvuer": "^2.0.1",
     "reveal.js": "^4.3.1",
     "timeago.js": "^4.0.2",
-    "vue": "^3.2.13",
+    "vue": "^3.2.26",
     "vue-router": "^4.0.3",
     "vue-toast-notification": "3.0",
     "vuejs-paginate-next": "^1.0.2",
@@ -37,12 +37,12 @@
     "eslint-plugin-vue": "^8.0.3",
     "jshint": "^2.13.5",
     "mini-css-extract-plugin": "^2.6.1",
-    "terser-webpack-plugin": "^5.3.6",
-    "webpack-bundle-analyzer": "^4.6.1",
-    "webpack-cli": "^4.10.0",
-    "webpack-bundle-tracker": "^1.6.0",
     "style-loader": "^3.3.1",
-    "vue-loader": "^17.0.0"
+    "terser-webpack-plugin": "^5.3.6",
+    "vue-loader": "^17.0.0",
+    "webpack-bundle-analyzer": "^4.6.1",
+    "webpack-bundle-tracker": "^1.6.0",
+    "webpack-cli": "^4.10.0"
   },
   "eslintConfig": {
     "root": true,

pyproject.toml

@@ -3,36 +3,36 @@ line_length = 119
 
 [tool.poetry]
 name = "cbwebreader"
-version = "1.1.5"
+version = "1.1.8"
 description = "CBR/Z Web Reader"
 authors = ["ajurna <ajurna@gmail.com>"]
 license = "Creative Commons Attribution-ShareAlike 4.0 International License"
 
 [tool.poetry.dependencies]
-python = "^3.10"
+python = "^3.12"
 Django = "^4.1"
-gunicorn = "^20.0.4"
-dj-database-url = "^1.3.0"
+gunicorn = "^21.2.0"
+dj-database-url = "^2.1.0"
 python-dotenv = "^1.0.0"
 loguru = "^0.7.0"
 django-silk = "^5.0.0"
 mysqlclient = "^2.0.1"
-psycopg2 = "^2.9.6"
+psycopg2-binary = "^2.9.6"
 rarfile = "^4.0"
 django-extensions = "^3.2.1"
-Pillow = "^9.3.0"
-django-imagekit = "^4.0.2"
+Pillow = "^10.0.1"
+django-imagekit = "^5.0.0"
 PyMuPDF = "~1.20.2"
 django-bootstrap4 = "^23.1"
 django-csp = "^3.7"
 django-boost = "^2.1"
-django-sri = "^0.5.0"
+django-sri = "^0.7.0"
 django-permissions-policy = "^4.15.0"
 djangorestframework = "^3.13.1"
 django-filter = "^23.1"
-django-cors-headers = "^3.14.0"
+django-cors-headers = "^4.2.0"
 djangorestframework-simplejwt = "^5.2.0"
-django-webpack-loader = "^1.6.0"
+django-webpack-loader = "^2.0.1"
 drf-yasg = "^1.20.0"
 drf-extensions = "^0.7.1"
 

requirements.txt

@@ -1,60 +1,46 @@
-asgiref==3.6.0 ; python_version >= "3.10" and python_version < "4.0"
-autopep8==2.0.2 ; python_version >= "3.10" and python_version < "4.0"
-beautifulsoup4==4.12.2 ; python_version >= "3.10" and python_version < "4.0"
-certifi==2022.12.7 ; python_version >= "3.10" and python_version < "4"
-charset-normalizer==3.1.0 ; python_version >= "3.10" and python_version < "4"
-colorama==0.4.6 ; python_version >= "3.10" and python_version < "4.0" and sys_platform == "win32"
-coreapi==2.3.3 ; python_version >= "3.10" and python_version < "4.0"
-coreschema==0.0.4 ; python_version >= "3.10" and python_version < "4.0"
-dj-database-url==1.3.0 ; python_version >= "3.10" and python_version < "4.0"
-django-appconf==1.0.5 ; python_version >= "3.10" and python_version < "4.0"
-django-boost==2.1 ; python_version >= "3.10" and python_version < "4.0"
-django-bootstrap4==23.1 ; python_version >= "3.10" and python_version < "4.0"
-django-cors-headers==3.14.0 ; python_version >= "3.10" and python_version < "4.0"
-django-csp==3.7 ; python_version >= "3.10" and python_version < "4.0"
-django-extensions==3.2.1 ; python_version >= "3.10" and python_version < "4.0"
-django-filter==23.1 ; python_version >= "3.10" and python_version < "4.0"
-django-imagekit==4.1.0 ; python_version >= "3.10" and python_version < "4.0"
-django-permissions-policy==4.15.0 ; python_version >= "3.10" and python_version < "4.0"
-django-silk==5.0.3 ; python_version >= "3.10" and python_version < "4.0"
-django-sri==0.5.0 ; python_version >= "3.10" and python_version < "4.0"
-django-webpack-loader==1.8.1 ; python_version >= "3.10" and python_version < "4.0"
-django==4.2 ; python_version >= "3.10" and python_version < "4.0"
-djangorestframework-simplejwt==5.2.2 ; python_version >= "3.10" and python_version < "4.0"
-djangorestframework==3.14.0 ; python_version >= "3.10" and python_version < "4.0"
-drf-extensions==0.7.1 ; python_version >= "3.10" and python_version < "4.0"
-drf-yasg==1.21.5 ; python_version >= "3.10" and python_version < "4.0"
-gprof2dot==2022.7.29 ; python_version >= "3.10" and python_version < "4.0"
-gunicorn==20.1.0 ; python_version >= "3.10" and python_version < "4.0"
-idna==3.4 ; python_version >= "3.10" and python_version < "4"
-inflection==0.5.1 ; python_version >= "3.10" and python_version < "4.0"
-itypes==1.2.0 ; python_version >= "3.10" and python_version < "4.0"
-jinja2==3.1.2 ; python_version >= "3.10" and python_version < "4.0"
-loguru==0.7.0 ; python_version >= "3.10" and python_version < "4.0"
-markupsafe==2.1.2 ; python_version >= "3.10" and python_version < "4.0"
-mysqlclient==2.1.1 ; python_version >= "3.10" and python_version < "4.0"
-packaging==23.1 ; python_version >= "3.10" and python_version < "4.0"
-pilkit==2.0 ; python_version >= "3.10" and python_version < "4.0"
-pillow==9.5.0 ; python_version >= "3.10" and python_version < "4.0"
-psycopg2==2.9.6 ; python_version >= "3.10" and python_version < "4.0"
-pycodestyle==2.10.0 ; python_version >= "3.10" and python_version < "4.0"
-pyjwt==2.6.0 ; python_version >= "3.10" and python_version < "4.0"
-pymupdf==1.20.2 ; python_version >= "3.10" and python_version < "4.0"
-python-dotenv==1.0.0 ; python_version >= "3.10" and python_version < "4.0"
-pytz==2023.3 ; python_version >= "3.10" and python_version < "4.0"
-rarfile==4.0 ; python_version >= "3.10" and python_version < "4.0"
-requests==2.28.2 ; python_version >= "3.10" and python_version < "4"
-ruamel-yaml-clib==0.2.7 ; platform_python_implementation == "CPython" and python_version < "3.11" and python_version >= "3.10"
-ruamel-yaml==0.17.21 ; python_version >= "3.10" and python_version < "4.0"
-setuptools==67.6.1 ; python_version >= "3.10" and python_version < "4.0"
-six==1.16.0 ; python_version >= "3.10" and python_version < "4.0"
-soupsieve==2.4.1 ; python_version >= "3.10" and python_version < "4.0"
-sqlparse==0.4.3 ; python_version >= "3.10" and python_version < "4.0"
-tomli==2.0.1 ; python_version >= "3.10" and python_version < "3.11"
-typing-extensions==4.5.0 ; python_version >= "3.10" and python_version < "4.0"
-tzdata==2023.3 ; python_version >= "3.10" and python_version < "4.0" and sys_platform == "win32"
-ua-parser==0.16.1 ; python_version >= "3.10" and python_version < "4.0"
-uritemplate==4.1.1 ; python_version >= "3.10" and python_version < "4.0"
-urllib3==1.26.15 ; python_version >= "3.10" and python_version < "4"
-user-agents==2.2.0 ; python_version >= "3.10" and python_version < "4.0"
-win32-setctime==1.1.0 ; python_version >= "3.10" and python_version < "4.0" and sys_platform == "win32"
+asgiref==3.7.2 ; python_version >= "3.12" and python_version < "4.0"
+autopep8==2.0.4 ; python_version >= "3.12" and python_version < "4.0"
+beautifulsoup4==4.12.2 ; python_version >= "3.12" and python_version < "4.0"
+colorama==0.4.6 ; python_version >= "3.12" and python_version < "4.0" and sys_platform == "win32"
+dj-database-url==2.1.0 ; python_version >= "3.12" and python_version < "4.0"
+django-appconf==1.0.5 ; python_version >= "3.12" and python_version < "4.0"
+django-boost==2.1 ; python_version >= "3.12" and python_version < "4.0"
+django-bootstrap4==23.2 ; python_version >= "3.12" and python_version < "4.0"
+django-cors-headers==4.2.0 ; python_version >= "3.12" and python_version < "4.0"
+django-csp==3.7 ; python_version >= "3.12" and python_version < "4.0"
+django-extensions==3.2.3 ; python_version >= "3.12" and python_version < "4.0"
+django-filter==23.3 ; python_version >= "3.12" and python_version < "4.0"
+django-imagekit==5.0.0 ; python_version >= "3.12" and python_version < "4.0"
+django-permissions-policy==4.17.0 ; python_version >= "3.12" and python_version < "4.0"
+django-silk==5.0.4 ; python_version >= "3.12" and python_version < "4.0"
+django-sri==0.7.0 ; python_version >= "3.12" and python_version < "4.0"
+django-webpack-loader==2.0.1 ; python_version >= "3.12" and python_version < "4.0"
+django==4.2.5 ; python_version >= "3.12" and python_version < "4.0"
+djangorestframework-simplejwt==5.3.0 ; python_version >= "3.12" and python_version < "4.0"
+djangorestframework==3.14.0 ; python_version >= "3.12" and python_version < "4.0"
+drf-extensions==0.7.1 ; python_version >= "3.12" and python_version < "4.0"
+drf-yasg==1.21.7 ; python_version >= "3.12" and python_version < "4.0"
+gprof2dot==2022.7.29 ; python_version >= "3.12" and python_version < "4.0"
+gunicorn==21.2.0 ; python_version >= "3.12" and python_version < "4.0"
+inflection==0.5.1 ; python_version >= "3.12" and python_version < "4.0"
+loguru==0.7.2 ; python_version >= "3.12" and python_version < "4.0"
+mysqlclient==2.2.0 ; python_version >= "3.12" and python_version < "4.0"
+packaging==23.2 ; python_version >= "3.12" and python_version < "4.0"
+pilkit==3.0 ; python_version >= "3.12" and python_version < "4.0"
+pillow==10.0.1 ; python_version >= "3.12" and python_version < "4.0"
+psycopg2-binary==2.9.9 ; python_version >= "3.12" and python_version < "4.0"
+pycodestyle==2.11.0 ; python_version >= "3.12" and python_version < "4.0"
+pyjwt==2.8.0 ; python_version >= "3.12" and python_version < "4.0"
+pymupdf==1.20.2 ; python_version >= "3.12" and python_version < "4.0"
+python-dotenv==1.0.0 ; python_version >= "3.12" and python_version < "4.0"
+pytz==2023.3.post1 ; python_version >= "3.12" and python_version < "4.0"
+pyyaml==6.0.1 ; python_version >= "3.12" and python_version < "4.0"
+rarfile==4.1 ; python_version >= "3.12" and python_version < "4.0"
+soupsieve==2.5 ; python_version >= "3.12" and python_version < "4.0"
+sqlparse==0.4.4 ; python_version >= "3.12" and python_version < "4.0"
+typing-extensions==4.8.0 ; python_version >= "3.12" and python_version < "4.0"
+tzdata==2023.3 ; python_version >= "3.12" and python_version < "4.0" and sys_platform == "win32"
+ua-parser==0.18.0 ; python_version >= "3.12" and python_version < "4.0"
+uritemplate==4.1.1 ; python_version >= "3.12" and python_version < "4.0"
+user-agents==2.2.0 ; python_version >= "3.12" and python_version < "4.0"
+win32-setctime==1.1.0 ; python_version >= "3.12" and python_version < "4.0" and sys_platform == "win32"