chore: promote UAT to production (CAR-690, Grype CVE ignores + cache-bust)

chore: promote UAT to production (CAR-690, Grype CVE ignores + cache-bust)

.github/workflows/ci.yml

@@ -569,7 +569,6 @@ jobs:
           git config user.name "cartsnitch-ci[bot]"
           git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
           git add apps/overlays/dev/kustomization.yaml
-          git diff --cached --quiet && echo "No image changes to deploy" && exit 0
           git commit -m "ci(dev): update cartsnitch, auth, receiptwitness, and api images"
           git pull --rebase origin main
           git push origin main
@@ -668,7 +667,6 @@ jobs:
           git config user.name "cartsnitch-ci[bot]"
           git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
           git add apps/overlays/uat/kustomization.yaml
-          git diff --cached --quiet && echo "No image changes to deploy" && exit 0
           git commit -m "ci(uat): update cartsnitch, auth, receiptwitness, and api images"
           git pull --rebase origin main
           git push origin main

.grype.yaml

@@ -1,108 +1,4 @@
 ignore:
   # Python 3.12 CVEs — only fixed in 3.13+, cannot upgrade major version safely
   - vulnerability: CVE-2025-13836
-  - vulnerability: CVE-2026-4519
-
-  # Chrome CVEs — Playwright bundles Chromium and controls version separately.
-  # Chrome is not a system package that can be upgraded via apt-get upgrade.
-  # These CVEs are specific to the Chromium version bundled with Playwright.
-  # Upstream fix: upgrade Playwright to a version that includes patched Chrome.
-  - vulnerability: CVE-2026-2313
-  - vulnerability: CVE-2026-2314
-  - vulnerability: CVE-2026-2315
-  - vulnerability: CVE-2026-2319
-  - vulnerability: CVE-2026-2321
-  - vulnerability: CVE-2026-2441
-  - vulnerability: CVE-2026-2648
-  - vulnerability: CVE-2026-2649
-  - vulnerability: CVE-2026-2650
-  - vulnerability: CVE-2026-3061
-  - vulnerability: CVE-2026-3062
-  - vulnerability: CVE-2026-3536
-  - vulnerability: CVE-2026-3537
-  - vulnerability: CVE-2026-3538
-  - vulnerability: CVE-2026-3539
-  - vulnerability: CVE-2026-3540
-  - vulnerability: CVE-2026-3541
-  - vulnerability: CVE-2026-3542
-  - vulnerability: CVE-2026-3543
-  - vulnerability: CVE-2026-3544
-  - vulnerability: CVE-2026-3545
-  - vulnerability: CVE-2026-3913
-  - vulnerability: CVE-2026-3914
-  - vulnerability: CVE-2026-3915
-  - vulnerability: CVE-2026-3916
-  - vulnerability: CVE-2026-3917
-  - vulnerability: CVE-2026-3918
-  - vulnerability: CVE-2026-3919
-  - vulnerability: CVE-2026-3920
-  - vulnerability: CVE-2026-3921
-  - vulnerability: CVE-2026-3922
-  - vulnerability: CVE-2026-3923
-  - vulnerability: CVE-2026-3924
-  - vulnerability: CVE-2026-3926
-  - vulnerability: CVE-2026-3931
-  - vulnerability: CVE-2026-3932
-  - vulnerability: CVE-2026-3936
-  - vulnerability: CVE-2026-5858
-  - vulnerability: CVE-2026-5859
-  - vulnerability: CVE-2026-5860
-  - vulnerability: CVE-2026-5861
-  - vulnerability: CVE-2026-5862
-  - vulnerability: CVE-2026-5863
-  - vulnerability: CVE-2026-5865
-  - vulnerability: CVE-2026-5866
-  - vulnerability: CVE-2026-5868
-  - vulnerability: CVE-2026-5870
-  - vulnerability: CVE-2026-5871
-  - vulnerability: CVE-2026-5872
-  - vulnerability: CVE-2026-5873
-  - vulnerability: CVE-2026-5874
-  - vulnerability: CVE-2026-5877
-  - vulnerability: CVE-2026-5879
-  - vulnerability: CVE-2026-5883
-  - vulnerability: CVE-2026-5884
-  - vulnerability: CVE-2026-5902
-  - vulnerability: CVE-2026-5904
-  - vulnerability: CVE-2026-5907
-  - vulnerability: CVE-2026-5908
-  - vulnerability: CVE-2026-5909
-  - vulnerability: CVE-2026-5910
-  - vulnerability: CVE-2026-5912
-  - vulnerability: CVE-2026-5913
-  - vulnerability: CVE-2026-5914
-  - vulnerability: CVE-2026-5915
-  - vulnerability: CVE-2026-6296
-  - vulnerability: CVE-2026-6297
-  - vulnerability: CVE-2026-6299
-  - vulnerability: CVE-2026-6300
-  - vulnerability: CVE-2026-6301
-  - vulnerability: CVE-2026-6302
-  - vulnerability: CVE-2026-6303
-  - vulnerability: CVE-2026-6304
-  - vulnerability: CVE-2026-6305
-  - vulnerability: CVE-2026-6306
-  - vulnerability: CVE-2026-6307
-  - vulnerability: CVE-2026-6308
-  - vulnerability: CVE-2026-6309
-  - vulnerability: CVE-2026-6310
-  - vulnerability: CVE-2026-6311
-  - vulnerability: CVE-2026-6314
-  - vulnerability: CVE-2026-6315
-  - vulnerability: CVE-2026-6316
-  - vulnerability: CVE-2026-6317
-  - vulnerability: CVE-2026-6318
-  - vulnerability: CVE-2026-6319
-  - vulnerability: CVE-2026-6358
-  - vulnerability: CVE-2026-6359
-  - vulnerability: CVE-2026-6360
-  - vulnerability: CVE-2026-6361
-  - vulnerability: CVE-2026-6363
-
-  # Node.js CVE — comes from Playwright's bundled tooling (playwright-core uses Node.js
-  # for its CLI). The system Node.js is not used by receiptwitness service.
-  # Fix requires upgrading Playwright to a version that ships with patched Node.js.
-  - vulnerability: CVE-2026-21710
-
-  # cryptography GHSA — fixed by upgrading to >=46.0 per requirements
-  - vulnerability: GHSA-r6ph-v2qm-q3c2
+  - vulnerability: CVE-2026-4519

auth/src/auth.ts

@@ -37,7 +37,7 @@ export const auth = betterAuth({
     maxPasswordLength: 128,
     password: {
       hash: async (password: string) => {
-        return bcrypt.hash(password, 12);
+        return bcrypt.hash(password, 10);
       },
       verify: async (data: { hash: string; password: string }) => {
         return bcrypt.compare(data.password, data.hash);

receiptwitness/Dockerfile

@@ -5,7 +5,7 @@ WORKDIR /app
 
 # build-essential and libpq-dev are needed to compile any C-extension wheels
 # (e.g. psycopg2 fallback).  No git needed — common/ is copied from the repo root.
-ARG APT_CACHE_BUST=1
+ARG APT_CACHE_BUST=0
 RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \
     libpq-dev \
     build-essential \
@@ -26,7 +26,7 @@ FROM python:3.12-slim AS prod
 WORKDIR /app
 
 # Install Playwright system dependencies for Chromium
-ARG APT_CACHE_BUST=1
+ARG APT_CACHE_BUST=0
 RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \
     libnss3 \
     libatk1.0-0 \

receiptwitness/pyproject.toml

@@ -11,7 +11,7 @@ dependencies = [
     "cartsnitch-common>=0.1.0",
     "playwright>=1.49,<2.0",
     "playwright-stealth>=1.0,<2.0",
-    "cryptography>=46.0,<47.0",
+    "cryptography>=42.0,<44.0",
     "fastapi>=0.115,<1.0",
     "uvicorn[standard]>=0.30,<1.0",
     "beautifulsoup4>=4.12,<5.0",

src/pages/Login.tsx

@@ -1,14 +1,13 @@
 import { useState } from 'react'
-import { Link } from 'react-router-dom'
+import { Link, useNavigate } from 'react-router-dom'
 import { authClient } from '../lib/auth-client.ts'
-import { useAuthStore } from '../stores/auth.ts'
 
 export function Login() {
   const [email, setEmail] = useState('')
   const [password, setPassword] = useState('')
   const [error, setError] = useState('')
   const [loading, setLoading] = useState(false)
-  const setAuthenticated = useAuthStore((s) => s.setAuthenticated)
+  const navigate = useNavigate()
 
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault()
@@ -30,22 +29,16 @@ export function Login() {
         throw new Error(authError.message ?? 'Sign in failed')
       }
 
-      // After successful signIn, force a full page reload so Better-Auth's
-      // useSession() reinitializes with fresh cookie-backed session state.
-      // Using React Router's navigate() races with Better-Auth's internal update.
+      // After successful signIn, force a session fetch to confirm the cookie is set
+      // before navigating to the protected route
       const sessionResult = await authClient.getSession()
       if (sessionResult.data) {
-        window.location.href = '/'
+        navigate('/')
       } else {
         setError('Sign in failed. Please try again.')
       }
     } catch {
-      if (import.meta.env.VITE_MOCK_AUTH === 'true') {
-        setAuthenticated(true)
-        window.location.href = '/'
-      } else {
-        setError('Invalid email or password. Please try again.')
-      }
+      setError('Invalid email or password. Please try again.')
     } finally {
       setLoading(false)
     }
@@ -100,4 +93,4 @@ export function Login() {
       </p>
     </main>
   )
-}
+}