Skip to content

0.5.6 (2026-05-25)

Security hardening: new Alpine base image, critical password-change fix, and test suite cleanup.

🐛 Fixes

  • Critical: change_password and confirm_password_reset were reverting the new password hash. The flow loaded the user, called repository.update_password (which persisted the new hash), and then ran user.save() on a stale in-memory copy that restored the old hash. In practice, passwords were not actually changing. Fix: update_password now updates the hash and password_changed_at atomically in a single save().
  • streaming_integration tests updated: assertions expected 403 but HTTPBearer now returns 401 by default since FastAPI 0.128+.
  • tests/conftest.py registers the 11 missing Beanie document models (PlanInDB, SubscriptionInDB, DiagramInDB, FolderInDB, etc.), removing intermittent errors in tests that depend on those documents.
  • Autouse reset of the in-memory login_rate_limiter and account_lockout state between tests, preventing accumulated logins from earlier tests from blocking later fixtures.
  • tests/test_openai_models.py: function test_model (an executable script, not a test) renamed to run_model_check so pytest no longer collects it and fails for missing fixtures.

⬆️ Upgrades

  • Backend Docker base image: python:3.13-slim-trixie → python:3.13-alpine3.22. Reduces CVE surface by removing Debian packages (util-linux, systemd, perl, shadow, tar, etc.) that don't exist on Alpine.
  • Alpine build adds gcc, musl-dev, libffi-dev, openssl-dev, cargo as virtual .build-deps (purged at the end) to compile native wheels (cryptography, bcrypt, pillow, uvloop, pydantic-core).

🔧 Internal

  • Full test suite green after the fixes: 210 passed, 0 failed, 0 errors.
  • Verified compatibility of all Python dependencies with musl libc (cp313/musllinux wheels).