From 5b40cfd5e82de0e53fc30aecda2438eae487da3e Mon Sep 17 00:00:00 2001 From: Jonas Thelemann Date: Sat, 24 Oct 2026 03:54:52 +0200 Subject: [PATCH] feat(postgraphile): migrate to 3.0.0-beta.3 The new image reads the schema and default role from the environment, which the stack already sets (POSTGRAPHILE_SCHEMA, POSTGRAPHILE_DEFAULT_ROLE). It enforces the password strength policy server-side on registration, reset, and change, matching what the app already validates client-side (see docs/password-strength.md). Turnstile verification now talks to Cloudflare directly and covers only the mutations on resources tagged @turnstileProtected (jwt_create and account_registration, tagged since sqitch 12.3.0; the stack pins 12.3.5) instead of all non-query requests proxied to the vibetype service. --- src/production/postgraphile/compose.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/production/postgraphile/compose.yaml b/src/production/postgraphile/compose.yaml index eb2636fa..554af243 100644 --- a/src/production/postgraphile/compose.yaml +++ b/src/production/postgraphile/compose.yaml @@ -7,7 +7,7 @@ services: - traefik.http.routers.postgraphile-secure-ruru.tls.certresolver=default update_config: order: start-first - image: ghcr.io/maevsi/postgraphile:2.3.2 + image: ghcr.io/maevsi/postgraphile:3.0.0-beta.3 logging: driver: json-file options: