finnandClaude Opus 5.5
53081dd553
Only the direct dependencies were pinned. Werkzeug, Jinja2, MarkupSafe, itsdangerous and the other transitive packages were resolved at build time, so builds of the same commit could differ, and pip did not verify the downloaded files. There was also no vulnerability scan. - requirements.in / requirements-dev.in list the direct dependencies. requirements.txt / requirements-dev.txt are lockfiles generated by pip-compile with exact versions and hashes for every package. The dev lockfile is constrained by the production one. - Makefile targets: lock-deps, update-deps, sync-deps and audit (pip-audit against requirements.txt). - The locked production versions match the previously installed ones. The first audit found no known vulnerabilities. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MAX
A small little program to manage emails.
The proxy should add X-Real-IP to get a better logging.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.st
Dependencies
Direct dependencies are listed in requirements.in (production) and
requirements-dev.in (development tools). requirements.txt and
requirements-dev.txt are lockfiles with exact versions and hashes
- After changing a
.infile:make lock-depsandmake sync-deps - Update all dependencies:
make update-depsandmake sync-deps - Check for known vulnerabilities:
make audit(before every release)