feat(deps): update dependency certifi to v2025.11.12

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -6,13 +6,17 @@ on:
       - dev
       - master
     paths-ignore:
-      - "**/.github/**"
       - "**/.gitignore"
+      - "**/.renovate.json"
       - "**/.vscode/**"
       - "**/README.md"
       - "**/CHANGELOG.md"
       - "**/docs/**"
   workflow_dispatch:
+  pull_request:
+    branches:
+      - master
+      - dev
 
 env:
   REGISTRY: ghcr.io
@@ -52,6 +56,7 @@ jobs:
 
   tag:
     needs: test
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     permissions:
       contents: write # for the tags
@@ -78,7 +83,7 @@ jobs:
           major_pattern: "breaking:"
           minor_pattern: "feat:"
           enable_prerelease_mode: false
-          version_format: "${major}.${minor}.${patch}-rc${increment}"
+          version_format: "${major}.${minor}.${patch}"
 
       - name: Create Tag
         run: git tag ${{ steps.git_version.outputs.version }}
@@ -87,6 +92,7 @@ jobs:
         run: git push origin ${{ steps.git_version.outputs.version }}
 
   build_and_push:
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     permissions: write-all
     needs: tag
@@ -106,7 +112,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-${{ github.ref_name }}
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: latest
 
       - name: Build and push Docker image
@@ -115,7 +121,7 @@ jobs:
           context: .
           file: ./Dockerfile
           build-args: |
-            VERSION=${{ needs.tag.outputs.version }}-${{ github.ref_name }}
+            VERSION=${{ needs.tag.outputs.version }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

Dockerfile

@@ -1,5 +1,8 @@
-FROM python:3.12-slim
-ARG VERSION=unkown
+FROM python:3.13-slim
+ARG VERSION=unknown
+
+# Create a non-root user
+RUN useradd appuser
 
 WORKDIR /app
 COPY . .
@@ -11,15 +14,20 @@ ENV VERSION=${VERSION}
 
 # Install dependencies
 RUN pip install --no-cache-dir --upgrade -r requirements.txt
-RUN pip install 'uvicorn[standard]'
 
 ENV ENV=DEV
 
+# Switch to non-root user
+USER appuser
+
 EXPOSE 8000
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
 
 # Install curl
-RUN apt-get update && apt-get install -y curl && apt-get clean
+USER root
+RUN apt-get update && apt-get install --no-install-recommends -y curl && apt-get clean
 
+# Switch back to non-root user for healthcheck
+USER appuser
 HEALTHCHECK --interval=30s --timeout=10s --retries=5 \
   CMD curl --fail http://localhost:8000/openapi.json || exit 1

app/test_main.py

@@ -1,4 +1,5 @@
 from creyPY.fastapi.testing import GenericClient
+
 from .main import app
 
 

renovate.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    ":semanticCommitTypeAll(feat)"
+  ]
+}

requirements.txt

@@ -1,15 +1,15 @@
-certifi==2023.11.17 # Testing
-iniconfig==2.0.0 # PyTest Testing
-packaging==23.2 # PyTest Testing
-pluggy==1.3.0 # PyTest Testing
-pytest==7.4.3 # PyTest Testing
+certifi==2025.11.12 # Testing
+iniconfig==2.1.0 # PyTest Testing
+packaging==25.0 # PyTest Testing
+pluggy==1.6.0 # PyTest Testing
+pytest==8.4.1 # PyTest Testing
 
-click==8.1.7 # Uvicorn
-httptools==0.6.1 # Uvicorn
-pyyaml==6.0.1 # Uvicorn
-uvicorn==0.27.0.post1 # Uvicorn
-uvloop==0.19.0 # Uvicorn
-watchfiles==0.21.0 # Uvicorn
-websockets==12.0 # Uvicorn
+click==8.2.1 # Uvicorn
+httptools==0.6.4 # Uvicorn
+pyyaml==6.0.2 # Uvicorn
+uvicorn==0.35.0 # Uvicorn
+uvloop==0.21.0 # Uvicorn
+watchfiles==1.1.0 # Uvicorn
+websockets==15.0.1 # Uvicorn
 
-creyPY==1.3.0 # My own package
+creyPY[postgres]==3.0.0 # My own package