Security Patch & AI steering files

What's Changed

• fix(code-quality): Code quality changes and error corrections by @jackseceng in #518
• ci(security): Remove detect changes step from security workflow by @jackseceng in #522
• build(deps): update zipp requirement from >=3.19.1 to >=3.23.1 by @dependabot[bot] in #520
• ci(blacksmith): Update build-push-action to version 2.2.0 by @jackseceng in #523
• ci(trivy): Update Trivy action version to 0.36.0 by @jackseceng in #524
• refactor(turso): Switch to new pyturso library away from libsql by @jackseceng in #529
• ci(security): Allow all actors to run security workflows by @jackseceng in #528
• build(deps): bump cryptography from 46.0.7 to 47.0.0 by @dependabot[bot] in #527
• build(deps): bump webiny/action-conventional-commits from 1.3.1 to 1.4.2 by @dependabot[bot] in #526
• build(deps): bump useblacksmith/setup-docker-builder from 1.7.0 to 1.8.0 by @dependabot[bot] in #525
• ci(runners): switch back to github actions for runners by @jackseceng in #530
• docs(readme): Remove CI Runners section from readme by @jackseceng in #531
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in #532
• build(deps): bump docker/setup-buildx-action from 3.10.0 to 4.0.0 by @dependabot[bot] in #535
• build(deps): bump docker/build-push-action from 6.15.0 to 7.1.0 by @dependabot[bot] in #536
• ci(kiro): ignore kiro IDE settings files by @jackseceng in #538
• build(deps): bump urllib3 from 2.6.3 to 2.7.0 in the pip group across 1 directory by @dependabot[bot] in #537
• build(deps): bump cryptography from 47.0.0 to 48.0.0 by @dependabot[bot] in #534
• build(deps): bump gunicorn from 25.3.0 to 26.0.0 by @dependabot[bot] in #533
• feat(kiro): setup files for kiro agent steering by @jackseceng in #539
• refactor(dockerfile): remove unnecessary build deps and copy steps by @jackseceng in #540
• fix: remove pip from runtime image and exclude app/.env from build co… by @jackseceng in #541

Full Changelog: 0.52.0...0.74.0

Bug fixes

What's Changed

• feat(pr-summary): Security summary comment in PRs by @jackseceng in #505
• ci(summary): adjust logic to not post a comment if no vulnerabilities… by @jackseceng in #507
• .github/workflows: Migrate workflows to Blacksmith runners by @blacksmith-sh[bot] in #508
• docs(contributing): Clarify PR process and update wiki link by @jackseceng in #511
• ci(security): Add username and token to build workflow step by @jackseceng in #512
• build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #510
• ci(codeql): Skip codeql for dependabot commits by @jackseceng in #513
• build(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 by @dependabot[bot] in #509
• ci(security): Remove write-comment from security.yml by @jackseceng in #514
• fix(python): Address code quality issues and logic bugs by @jackseceng in #515
• fix(code-quality): Fix for Explicit returns mixed with implicit (fall through) returns by @jackseceng in #516
• fix(code-quality): Fix for Explicit returns mixed with implicit (fall through) returns by @jackseceng in #517

New Contributors

• @blacksmith-sh[bot] made their first contribution in #508
• @dependabot[bot] made their first contribution in #510

Full Changelog: 0.33.0...0.52.0

HTML Integrity

What's Changed

• chore(deps): update alpine docker tag to v3.23 by @renovate[bot] in #497
• chore(deps): update docker/scout-action action to v1.20.4 by @renovate[bot] in #499
• chore(deps): update dependency cryptography to v46.0.7 by @renovate[bot] in #498
• chore(ci): Refactor semgrep workflow configuration by @jackseceng in #500
• fix(docker-security): Use non-privileged user for gunicorn execution by @jackseceng in #501
• chore(deps): update docker/build-push-action action to v7.1.0 by @renovate[bot] in #502
• fix(integrity-checks): Adding integrity checks to html files for the … by @jackseceng in #503
• docs(readme): update instructions for purging R2 cache for integrity … by @jackseceng in #504

Full Changelog: 0.25.0...0.33.0

Security Patch

What's Changed

• fix(python-vulns): Compiling python from source in dockerfile to avoi… by @jackseceng in #496

Full Changelog: 0.24.0...0.25.0

Bug Fix

What's Changed

• fix(unique-collision-logic): Fixed issue where a unique hash collisio… by @jackseceng in #495
• chore(deps): update docker/login-action action to v4.1.0 by @renovate[bot] in #492
• fix(docker-vulns): Change python version to reduce vulnerabilities by @jackseceng in #493
• chore(deps): update python docker tag to v3.14 by @renovate[bot] in #494
• fix(unique-collision-logic): Fixed issue where a unique hash collisio… by @jackseceng in #495

Full Changelog: 0.16.0...0.24.0

Feature Complete

All features of application are now deployed