🔒 Security: Upgrade Python 3.13 and update dependencies

.github/workflows/sync-version.yaml

@@ -0,0 +1,54 @@
+name: Sync Version
+
+permissions:
+  contents: write
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  sync-version:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0  # Need full history for tag operations
+
+      - name: Extract version from tag
+        id: version
+        run: |
+          # Remove 'v' prefix if present (v1.9.0 -> 1.9.0)
+          VERSION="${GITHUB_REF_NAME#v}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
+
+      - name: Update pyproject.toml
+        run: |
+          sed -i 's/^version = ".*"/version = "${{ steps.version.outputs.version }}"/' pyproject.toml
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet pyproject.toml; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Commit, push, and move tag
+        if: steps.changes.outputs.changed == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Commit version bump
+          git add pyproject.toml
+          git commit -m "🔖 Bump version to ${{ steps.version.outputs.version }}"
+          git push
+
+          # Move tag to the new commit
+          git tag -f ${{ steps.version.outputs.tag }}
+          git push --force origin ${{ steps.version.outputs.tag }}

.github/workflows/test.yaml

@@ -1,5 +1,8 @@
 name: Test
 
+permissions:
+  contents: read
+
 on:
   push:
   pull_request:
@@ -18,15 +21,15 @@ jobs:
         uses: actions/checkout@v4
 
       - id: setup-python
-        name: Set up Python 3.11
+        name: Set up Python 3.13
         uses: actions/setup-python@v5
         with:
-          python-version: 3.11
+          python-version: 3.13
 
       - name: Install Poetry
         uses: snok/install-poetry@v1
         with:
-          version: 1.8.2
+          version: 2.1.3
           virtualenvs-create: true
           virtualenvs-in-project: true
           installer-parallel: true

Dockerfile.base

@@ -1,9 +1,11 @@
 ARG APP_NAME=hackster
-ARG PYTHON_VERSION=3.11.2
-ARG POETRY_VERSION=1.8.2
+ARG PYTHON_VERSION=3.13.9
 
 # `python-base` sets up all our shared environment variables
-FROM python:${PYTHON_VERSION}-slim as python-base
+FROM python:${PYTHON_VERSION}-slim AS python-base
+
+# Poetry version used in this stage
+ARG POETRY_VERSION=2.1.3
 
 # python
 ENV \
@@ -28,7 +30,7 @@ ENV \
 ENV APP_PATH="/opt/hackster"
 
 # `builder-base` stage is used to build deps + create our virtual environment
-FROM python-base as builder-base
+FROM python-base AS builder-base
 RUN apt-get update \
     && apt-get install --no-install-recommends -y \
     # deps for installing poetry