fix: replace vulnerable container bases and release v0.1.21

2026-10-18 19:10:00 +08:00
parent 0d691826b6
commit dec17aeb1d
24 changed files with 195 additions and 189 deletions
@@ -21,7 +21,8 @@ for endpoint coverage. Their source code was not incorporated into runtime.

 FastAPI, Starlette, Uvicorn, Requests, croniter, PyYAML, Pydantic and their transitive
 dependencies retain their respective upstream licenses. Pillow uses its upstream
-HPND license. Debian Noto CJK fonts retain their font package license.
+HPND license. Noto CJK fonts use SIL OFL 1.1; the license is included in
+`vendor/noto-cjk-OFL-1.1.txt`, with copyright notices retained in font metadata.
 Development dependencies (pytest, Ruff, mypy, pip-audit, HTTPX2, Playwright) retain
 their upstream licenses and are not shipped in the runtime image.