- Build Next.js as a standalone server and copy only that into the
runtime image, instead of the whole node_modules tree
- Mark three dynamic file reads with turbopackIgnore so the standalone
trace does not pull in the entire project
- Deploy workflow prunes unused images and build cache older than a day
at the start and end of every run, including failed ones, and logs
disk usage before building
Failed builds were leaving their layers behind until the server's disk
filled, which broke the deploy, the database and Gitea sign-in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Upgrade next 16.0.3 -> 16.3.5 and react/react-dom 19.2.0 -> 19.3.0
(CVE-2025-55182 / CVE-2025-66478 unauthenticated RCE), next-auth -> 4.24.15
- Require admin role on /api/users, /api/courses and /api/enrollments,
which were unauthenticated
- Replace ALLOWED_ADMINS checks that allowed any signed-in user when the
variable was empty with the role-based requireAdmin
- Sanitize upload filenames, restrict thumbnail extensions, store edited
thumbnails in UPLOADS_DIR, tighten traversal checks in file routes
- Dockerfile: Node 22, pinned pnpm, non-root user, critical audit gate
- Compose: read-only rootfs, dropped caps, no-new-privileges, Postgres
password from env
- Exclude .env from Docker build context; add security headers
- Deploy with git reset --hard instead of git pull
- Remove stale package-lock.json
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
twotalesanimation