🔖(minor) bump release to 1.8.0

Update changelog.

.github/workflows/crowdin-download.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Download Crowdin files
         uses: crowdin/github-action@v2

.github/workflows/docker-hub.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Docker meta
         id: meta
@@ -59,7 +59,7 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Docker meta
         id: meta
@@ -96,7 +96,7 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Docker meta
         id: meta
@@ -133,7 +133,7 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Docker meta
         id: meta
@@ -152,7 +152,7 @@ jobs:
         uses: numerique-gouv/action-trivy-cache@main
         continue-on-error: true
         with:
-          docker-build-args: '-f src/summary/Dockerfile --target summary-production'
+          docker-build-args: '-f src/summary/Dockerfile --target production'
           docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
           docker-context: './src/summary'
       -
@@ -161,7 +161,7 @@ jobs:
         with:
           context: ./src/summary
           file: ./src/summary/Dockerfile
-          target: summary-production
+          target: production
           build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
@@ -172,7 +172,7 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Docker meta
         id: meta
@@ -191,7 +191,7 @@ jobs:
         uses: numerique-gouv/action-trivy-cache@main
         continue-on-error: true
         with:
-          docker-build-args: '-f src/agents/Dockerfile --target agents-production'
+          docker-build-args: '-f src/agents/Dockerfile --target production'
           docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
           docker-context: './src/agents'
       -
@@ -200,7 +200,7 @@ jobs:
         with:
           context: ./src/agents
           file: ./src/agents/Dockerfile
-          target: agents-production
+          target: production
           build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

.github/workflows/meet.yml

@@ -14,7 +14,7 @@ jobs:
     if: github.event_name == 'pull_request' # Makes sense only for pull requests
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: show
@@ -41,7 +41,7 @@ jobs:
       github.event_name == 'pull_request'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 50
       - name: Check that the CHANGELOG has been modified in the current branch
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Check CHANGELOG max line length
         run: |
           max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -67,15 +67,15 @@ jobs:
         working-directory: src/mail
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "18"
 
       - name: Restore the mail templates
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: mail-templates
         with:
           path: "src/backend/core/templates/mail"
@@ -95,7 +95,7 @@ jobs:
 
       - name: Cache mail templates
         if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: "src/backend/core/templates/mail"
           key: mail-templates-${{ hashFiles('src/mail/mjml') }}
@@ -107,9 +107,9 @@ jobs:
         working-directory: src/backend
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
           cache: "pip"
@@ -129,9 +129,9 @@ jobs:
         working-directory: src/agents
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
           cache: "pip"
@@ -149,9 +149,9 @@ jobs:
         working-directory: src/summary
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
           cache: "pip"
@@ -216,7 +216,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Create writable /data
         run: |
@@ -224,7 +224,7 @@ jobs:
           sudo mkdir -p /data/static
 
       - name: Restore the mail templates
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: mail-templates
         with:
           path: "src/backend/core/templates/mail"
@@ -258,7 +258,7 @@ jobs:
             mc mb meet/meet-media-storage"
 
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
           cache: "pip"
@@ -281,7 +281,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: cd src/frontend/ && npm ci
@@ -299,7 +299,7 @@ jobs:
         working-directory: src/sdk/library
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: npm ci
@@ -318,7 +318,7 @@ jobs:
         working-directory: src/sdk/library
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install dependencies
         run: npm ci

.github/workflows/release-helm-chart.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 

CHANGELOG.md

@@ -8,6 +8,19 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [1.8.0] - 2026-02-20
+
+### Changed
+
+- 🔒️(agents) uninstall pip from the agents image
+- 🔒️(summary) switch to Alpine base image
+- 🔒️(backend) uninstall pip in the production image 
+
+### Fixed
+
+- 🔒️(agents) upgrade OpenSSL to address CVE-2025-15467
+- 📌(agents) pin protobuf to 6.33.5 to fix CVE-2026-0994
+
 ## [1.7.0] - 2026-02-19
 
 ### Added

Dockerfile

@@ -127,6 +127,9 @@ ARG MEET_STATIC_ROOT=/data/static
 RUN mkdir -p /usr/local/etc/gunicorn
 COPY docker/files/usr/local/etc/gunicorn/meet.py /usr/local/etc/gunicorn/meet.py
 
+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}

Makefile

@@ -40,9 +40,9 @@ DOCKER_GID          = $(shell id -g)
 DOCKER_USER         = $(DOCKER_UID):$(DOCKER_GID)
 COMPOSE             = DOCKER_USER=$(DOCKER_USER) docker compose
 COMPOSE_EXEC        = $(COMPOSE) exec
-COMPOSE_EXEC_APP    = $(COMPOSE_EXEC) app-development
+COMPOSE_EXEC_APP    = $(COMPOSE_EXEC) app-dev
 COMPOSE_RUN         = $(COMPOSE) run --rm
-COMPOSE_RUN_APP     = $(COMPOSE_RUN) app-development
+COMPOSE_RUN_APP     = $(COMPOSE_RUN) app-dev
 COMPOSE_RUN_CROWDIN = $(COMPOSE_RUN) crowdin crowdin
 WAIT_DB             = @$(COMPOSE_RUN) dockerize -wait tcp://$(DB_HOST):$(DB_PORT) -timeout 60s
 
@@ -94,8 +94,8 @@ build: ## build the project containers
 	@$(MAKE) build-frontend
 .PHONY: build
 
-build-backend: ## build the app-development container
-	@$(COMPOSE) build app-development
+build-backend: ## build the app-dev container
+	@$(COMPOSE) build app-dev
 .PHONY: build-backend
 
 
@@ -107,12 +107,12 @@ down: ## stop and remove containers, networks, images, and volumes
 	@$(COMPOSE) down
 .PHONY: down
 
-logs: ## display app-development logs (follow mode)
-	@$(COMPOSE) logs -f app-development
+logs: ## display app-dev logs (follow mode)
+	@$(COMPOSE) logs -f app-dev
 .PHONY: logs
 
 run-backend: ## start only the backend application and all needed services
-	@$(COMPOSE) up --force-recreate -d celery-development
+	@$(COMPOSE) up --force-recreate -d celery-dev
 	@echo "Wait for postgresql to be up..."
 	@$(WAIT_DB)
 .PHONY: run-backend
@@ -227,14 +227,14 @@ back-i18n-generate: ## create the .pot files used for i18n
 	@$(MANAGE) makemessages -a --keep-pot
 .PHONY: back-i18n-generate
 
-shell: ## open a Django Python shell
+shell: ## connect to database shell
 	@$(MANAGE) shell #_plus
-.PHONY: shell
+.PHONY: dbshell
 
 # -- Database
 
 dbshell: ## connect to database shell
-	docker compose exec app-development python manage.py dbshell
+	docker compose exec app-dev python manage.py dbshell
 .PHONY: dbshell
 
 resetdb: FLUSH_ARGS ?=
@@ -348,16 +348,16 @@ build-k8s-cluster: ## build the kubernetes cluster using kind
 
 install-external-secrets: ## install the kubernetes secrets from Vaultwarden
 	./bin/install-external-secrets.sh
-.PHONY: install-external-secrets
+.PHONY: build-k8s-cluster
 
 start-tilt: ## start the kubernetes cluster using kind
 	tilt up -f ./bin/Tiltfile
-.PHONY: start-tilt
+.PHONY: build-k8s-cluster
 
 start-tilt-keycloak: ## start the kubernetes cluster using kind, without Pro Connect for authentication, use keycloak
 	DEV_ENV=dev-keycloak tilt up -f ./bin/Tiltfile
-.PHONY: start-tilt-keycloak
+.PHONY: build-k8s-cluster
 
 start-tilt-dinum: ## start the kubernetes cluster using kind, without Pro Connect for authentication, but with DINUM styles
 	DEV_ENV=dev-dinum tilt up -f ./bin/Tiltfile
-.PHONY: start-tilt-dinum
+.PHONY: build-k8s-cluster

bin/Tiltfile

@@ -18,6 +18,7 @@ docker_build(
     'localhost:5001/meet-backend:latest',
     context='..',
     dockerfile='../Dockerfile',
+    build_args={'DOCKER_USER': '1001:127'},
     only=['./src/backend', './src/mail', './docker'],
     target = 'backend-production',
     live_update=[
@@ -33,6 +34,7 @@ clean_old_images('localhost:5001/meet-backend')
 docker_build(
     'localhost:5001/meet-frontend-dinum:latest',
     context='..',
+    build_args={'DOCKER_USER': '1001:127'},
     dockerfile='../docker/dinum-frontend/Dockerfile',
     only=['./src/frontend', './docker', './.dockerignore'],
     target = 'frontend-production',
@@ -57,9 +59,10 @@ clean_old_images('localhost:5001/meet-frontend-generic')
 docker_build(
     'localhost:5001/meet-summary:latest',
     context='../src/summary',
+    build_args={'DOCKER_USER': '1001:127'},
     dockerfile='../src/summary/Dockerfile',
     only=['.'],
-    target = 'summary-production',
+    target = 'production',
     live_update=[
         sync('../src/summary', '/app'),
     ]
@@ -69,9 +72,10 @@ clean_old_images('localhost:5001/meet-summary')
 docker_build(
     'localhost:5001/meet-agents:latest',
     context='../src/agents',
+    build_args={'DOCKER_USER': '1001:127'},
     dockerfile='../src/agents/Dockerfile',
-   only=['.'],
-    target = 'agents-production',
+    only=['.'],
+    target = 'production',
     live_update=[
         sync('../src/agents', '/app'),
     ]

bin/_config.sh

@@ -89,5 +89,5 @@ function _dc_exec() {
 #
 # ARGS : django's manage.py command arguments
 function _django_manage() {
-    _dc_run "app-development" python manage.py "$@"
+    _dc_run "app-dev" python manage.py "$@"
 }

bin/pytest

@@ -4,5 +4,5 @@ source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
 
 _dc_run \
     -e DJANGO_CONFIGURATION=Test \
-    app-development \
+    app-dev \
     pytest "$@"

bin/update-openapi-schema

@@ -4,7 +4,7 @@ source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
 
 _dc_run \
     -e DJANGO_CONFIGURATION=Test \
-    app-development \
+    app-dev \
     python manage.py spectacular \
     --api-version 'v1.0' \
     --urlconf 'meet.api_urls' \

compose.yml

@@ -55,13 +55,13 @@ services:
     entrypoint: >
       sh -c "
       /usr/bin/mc alias set meet http://minio:9000 meet password &&
-      /usr/bin/mc admin config set meet notify_webhook:meet-webhook endpoint='http://app-development:8000/api/v1.0/recordings/storage-hook/' auth_token='Bearer password' &&
+      /usr/bin/mc admin config set meet notify_webhook:meet-webhook endpoint='http://app-dev:8000/api/v1.0/recordings/storage-hook/' auth_token='Bearer password' &&
       /usr/bin/mc admin service restart meet --wait --json &&
       sleep 15 &&
       /usr/bin/mc event add meet/meet-media-storage arn:minio:sqs::meet-webhook:webhook --event put &&
       exit 0;"
 
-  app-development:
+  app-dev:
     build:
       context: .
       target: backend-development
@@ -94,7 +94,7 @@ services:
       - resource-server
       - default
   
-  celery-development:
+  celery-dev:
     user: ${DOCKER_USER:-1000}
     image: meet:backend-development
     command: ["celery", "-A", "meet.celery_app", "worker", "-l", "DEBUG"]
@@ -107,9 +107,9 @@ services:
       - ./src/backend:/app
       - ./data/static:/data/static
     depends_on:
-      - app-development
+      - app-dev
 
-  app-production:
+  app:
     build:
       context: .
       target: backend-production
@@ -128,7 +128,7 @@ services:
       - livekit
       - minio
 
-  celery-production:
+  celery:
     user: ${DOCKER_USER:-1000}
     image: meet:backend-production
     command: ["celery", "-A", "meet.celery_app", "worker", "-l", "INFO"]
@@ -138,7 +138,7 @@ services:
       - env.d/development/common
       - env.d/development/postgresql
     depends_on:
-      - app-production
+      - app
 
   nginx:
     image: nginx:1.25
@@ -161,7 +161,7 @@ services:
       args:
         VITE_API_BASE_URL: "http://localhost:8071"
         VITE_APP_TITLE: "LaSuite Meet"
-    image: meet:frontend-production
+    image: meet:frontend-development
     ports:
       - "3000:8080"
 
@@ -249,10 +249,10 @@ services:
     ports:
       - "6379:6379"
 
-  app-summary-development:
+  app-summary-dev:
     build:
       context: src/summary
-      target: summary-development
+      target: development
       args:
         DOCKER_USER: ${DOCKER_USER:-1000}
     user: ${DOCKER_USER:-1000}
@@ -270,7 +270,7 @@ services:
     build:
       context: ./src/summary
       dockerfile: Dockerfile
-      target: summary-production
+      target: production
     command: celery -A summary.core.celery_worker worker --pool=solo --loglevel=debug -Q transcribe-queue
     env_file:
       - env.d/development/summary
@@ -278,7 +278,7 @@ services:
       - ./src/summary:/app
     depends_on:
       - redis-summary
-      - app-summary-development
+      - app-summary-dev
       - minio
     develop:
       watch:
@@ -290,7 +290,7 @@ services:
     build:
       context: ./src/summary
       dockerfile: Dockerfile
-      target: summary-production
+      target: production
     command: celery -A summary.core.celery_worker worker --pool=solo --loglevel=debug -Q summarize-queue
     env_file:
       - env.d/development/summary
@@ -298,7 +298,7 @@ services:
       - ./src/summary:/app
     depends_on:
       - redis-summary
-      - app-summary-development
+      - app-summary-dev
       - minio
     develop:
       watch:

docker/livekit/config/livekit-server.yaml

@@ -7,4 +7,4 @@ keys:
 webhook:
   api_key: devkey
   urls:
-      - http://app-development:8000/api/v1.0/rooms/webhooks-livekit/
+      - http://app-dev:8000/api/v1.0/rooms/webhooks-livekit/

env.d/development/common.dist

@@ -61,7 +61,7 @@ ALLOW_UNREGISTERED_ROOMS=False
 RECORDING_ENABLE=True
 RECORDING_STORAGE_EVENT_ENABLE=True
 RECORDING_STORAGE_EVENT_TOKEN=password
-SUMMARY_SERVICE_ENDPOINT=http://app-summary-development:8000/api/v1/tasks/
+SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v1/tasks/
 SUMMARY_SERVICE_API_TOKEN=password
 RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording
 

env.d/development/summary.dist

@@ -1,4 +1,4 @@
-APP_NAME="meet-app-summary-development"
+APP_NAME="meet-app-summary-dev"
 APP_API_TOKEN="password"
 
 AWS_STORAGE_BUCKET_NAME="http://meet-media-storage"

src/agents/Dockerfile

@@ -4,6 +4,8 @@ FROM python:3.13-slim AS base
 RUN apt-get update && apt-get install -y \
     libglib2.0-0 \
     libgobject-2.0-0 \
+    "openssl=3.5.4-1~deb13u2" \
+    "libssl3t64=3.5.4-1~deb13u2" \
     && rm -rf /var/lib/apt/lists/*
 
 FROM base AS builder
@@ -15,10 +17,13 @@ COPY pyproject.toml .
 RUN mkdir /install && \
   pip install --prefix=/install .
 
-FROM base AS agents-production
+FROM base AS production
 
 WORKDIR /app
 
+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 ARG DOCKER_USER
 USER ${DOCKER_USER}
 

src/agents/pyproject.toml

@@ -1,14 +1,15 @@
 
 [project]
 name = "agents"
-version = "1.7.0"
+version = "1.8.0"
 requires-python = ">=3.12"
 dependencies = [
     "livekit-agents==1.3.10",
     "livekit-plugins-deepgram==1.3.10",
     "livekit-plugins-silero==1.3.10",
     "livekit-plugins-kyutai-lasuite==0.0.6",
-    "python-dotenv==1.2.1"
+    "python-dotenv==1.2.1",
+    "protobuf==6.33.5"
 ]
 
 [project.optional-dependencies]

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meet"
-version = "1.7.0"
+version = "1.8.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",

src/frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "meet",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "meet",
-      "version": "1.7.0",
+      "version": "1.8.0",
       "dependencies": {
         "@fontsource-variable/material-symbols-outlined": "5.2.34",
         "@fontsource/material-icons-outlined": "5.2.6",

src/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "meet",
   "private": true,
-  "version": "1.7.0",
+  "version": "1.8.0",
   "type": "module",
   "scripts": {
     "dev": "panda codegen && vite",

src/mail/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "mail_mjml",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mail_mjml",
-      "version": "1.7.0",
+      "version": "1.8.0",
       "license": "MIT",
       "dependencies": {
         "@html-to/text-cli": "0.5.4",

src/mail/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mail_mjml",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "An util to generate html and text django's templates from mjml templates",
   "type": "module",
   "dependencies": {

src/sdk/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "sdk",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "sdk",
-      "version": "1.7.0",
+      "version": "1.8.0",
       "license": "ISC",
       "workspaces": [
         "./library",

src/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sdk",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "author": "",
   "license": "ISC",
   "description": "",

src/summary/Dockerfile

@@ -1,12 +1,9 @@
-FROM python:3.13-slim AS base
+FROM python:3.13-alpine3.23 AS base
 
 
 # Install ffmpeg for audio/video processing (format conversion, extraction, compression)
 # See summary/core/file_service.py for usage.
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends ffmpeg=7:7.1.3-* && \
-    apt-get clean && \
-    rm -rf /var/lib/apt/lists/*
+RUN apk add --no-cache "ffmpeg=8.0.1-r1"
 
 FROM base AS builder
 
@@ -14,20 +11,23 @@ WORKDIR /app
 
 COPY pyproject.toml .
 
-RUN pip3 install --no-cache-dir .
+RUN pip install --no-cache-dir .
 
-FROM base AS summary-development
+FROM base AS development
 WORKDIR /app
 
 COPY . .
-RUN pip3 install --no-cache-dir -e ".[dev]" || pip3 install --no-cache-dir -e .
+RUN pip install --no-cache-dir -e ".[dev]" || pip install --no-cache-dir -e .
 
 CMD ["uvicorn", "summary.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]
 
-FROM base AS summary-production
+FROM base AS production
 
 WORKDIR /app
 
+# Remove pip to reduce attack surface in production
+RUN pip uninstall -y pip
+
 # Un-privileged user running the application
 ARG DOCKER_USER
 USER ${DOCKER_USER}

src/summary/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "summary"
-version = "1.7.0"
+version = "1.8.0"
 dependencies = [
     "fastapi[standard]>=0.105.0",
     "uvicorn>=0.24.0",