rack 3.2.6 has a denial of service in the multipart parser
(CVE-2026-125111, GHSA-5v64-555j-wjxm): parsed data stays in the scan
buffer, so a crafted request body makes memory grow without bound.
The site is read-only but reachable from the internet, so take the
fix along with asxpio.
Only the lock changes; the Gemfile already allows ~> 3.2.
Assisted-by: Claude:fable-5-2
The lockfile was generated with Ruby's bundled 2.6.9, so the CI shell's
bundler 2.7.2 refused to install and every gem was missing. Match the
version asxpio locks with.
Assisted-by: Claude:opus-5
The bingo card ran inside the asxpio container, dispatched by Host.
Give the public site its own repo, image and deploy so it can be
released and mirrored independently of asxp.io.
Editing stays in the asxp.io admin, which keeps owning the schema and
the photo pipeline; this app only reads the shared bingo tables and the
bingo/ photos, through a read-only DB role and MinIO user. Tests load a
snapshot of the asxpio-built schema (test/schema.sql).
Assisted-by: Claude:opus-5
