From c4a09638ff00ce996c1f8474a68ecfbc1bd5163d Mon Sep 17 00:00:00 2001
From: alexeybe1kin <210597588+alexeybe1kin@users.noreply.github.com>
Date: Thu, 5 Nov 2026 20:10:31 +0200
Subject: [PATCH] Release 0.8.1: image takes Debian security fixes newer than
 its base

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md             | 5 +++++
 services/api/Dockerfile  | 4 ++++
 services/api/app/main.py | 2 +-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a87181d..2d2e6c6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ a decision with visible consequences.
 
 ## Unreleased
 
+## 0.8.1
+
+- **The image takes Debian's security fixes newer than its base** (apt, CVE-2026-109518).
+  No code change.
+
 ## 0.8.0
 
 - **Refused request bodies are never echoed back.** A 422 lists only `loc`, `msg` and `type` for
diff --git a/services/api/Dockerfile b/services/api/Dockerfile
index 5986a58..48cf168 100644
--- a/services/api/Dockerfile
+++ b/services/api/Dockerfile
@@ -1,6 +1,10 @@
 FROM python:3.11-slim
 WORKDIR /app
 ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
+# Debian security fixes newer than the base image.
+RUN apt-get update \
+    && apt-get upgrade -y --no-install-recommends \
+    && rm -rf /var/lib/apt/lists/*
 COPY requirements.txt .
 # The base image's setuptools and wheel are build tools the service never imports; removing
 # them keeps their vendored copies (and their advisories) out of the running image.
diff --git a/services/api/app/main.py b/services/api/app/main.py
index 75d2b56..2719f97 100644
--- a/services/api/app/main.py
+++ b/services/api/app/main.py
@@ -47,7 +47,7 @@
 
 log = logging.getLogger("memorygate")
 
-SERVICE_VERSION = "0.8.0"
+SERVICE_VERSION = "0.8.1"
 
 app = FastAPI(title="MemoryGate", version=SERVICE_VERSION)