Pillow was only a transitive dep via matplotlib, locked at 12.2.0.
Pin it directly in requirements.in so pip-compile resolves 12.3.0,
which patches all currently-open high/medium severity advisories
(decompression bomb bypasses, heap OOB writes, DoS via JPEG2000/EPS,
OS command injection in WindowsViewer, etc).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

… deps, usability

Resolves the review findings (docs/review-2026-09-03.md) in one pass. Touches no
docker-compose.yml / compose.sh / logs.sh, so the diverged test tree stays ff-safe.

- H1 availability: run the eval via asyncio.create_subprocess_exec + wait_for so a
  heavy/hung expression no longer blocks the event loop (3 concurrent heavy reqs
  measured ~2s parallel, was ~6s serialized). Privilege drop / clean env / cwd kept.
- H2 exposure: optional shared secret (WEBHOOK_SECRET, env or config.json). When set,
  /message and /inline require a matching Authorization header (hmac.compare_digest)
  -> 401; unset by default, so the existing gateway is unaffected.
- M1 robustness: drop updates with no 'from' (anon admin / channel / auto-forward)
  instead of raising KeyError -> 500 -> gateway retry loop.
- M2 attack surface: trim requirements to the only reachable third-party deps
  (fastapi, uvicorn, pyTelegramBotAPI); recompiled lock drops the pillow/scipy/
  matplotlib/pandas/sympy/ipython/numpy/nose/aiohttp trees (removes the pillow CVE
  class). Image builds wheels-only; dropped build-essential/gfortran (~150MB image).
- M3 usability: prune harmless words from the blocklist (ord, chr, id, read, write,
  file, dir, code, ...). AST + OS layers stay the boundary; 33/33 malicious payloads
  still blocked, 21/21 legit still allowed.
- M4 containment: seccomp install is fail-closed on supported arches (verified
  install()=True in the container). Added RLIMIT_FSIZE (16 MiB).
- Usability/cleanups: richer /start and /help; /cl is a prefix command (handles
  /cl@bot) not a substring replace; on_event -> lifespan; logging.info -> logger.info;
  broadened token output-filter regex; removed dead sequrity().

Validated locally and in the built image: startup, eval, multiline, blocked imports,
M1/M3, /cl, compact mode, 401 auth on both endpoints, concurrency, seccomp, FSIZE.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JSZLkCWquZMTzRTYh8dk1V

Per feedback: /start and /help now render examples as Telegram code blocks and no
longer advertise the CPU/memory limits or the "sandboxed: no files/network" line
(less useful signal to an attacker). Built from structured segments so MarkdownV2
escaping is programmatic (prose via telebot escape_markdown, examples in fenced
blocks), with a plain-text fallback so a formatting slip can never blank the message.
Mirrors the MarkdownV2 approach used in pantherabot.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JSZLkCWquZMTzRTYh8dk1V

Independent one-liners shared a single code block, so pasting the block ran them as
one program and only echoed the last line (e.g. `2` instead of each result). Now each
standalone example is its own fenced block, with a line of prose between every block
so Telegram won't re-merge adjacent blocks. Genuine multi-line programs (the loop, the
Fraction import) stay as one block each. Verified every example passes the filter and
computes: 2+2->4, (3.14*100)/2->157.0, math.factorial(10)->3628800, loop->55,
Fraction(1,3)+Fraction(1,6)->1/2.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JSZLkCWquZMTzRTYh8dk1V

…-2026-63374/63349/64847)

Co-Authored-By: Claude Fable 5.1 <[email protected]>
(cherry picked from commit eecf5df)

…yphs

- _init_db chmods /server/data to 0700: seccomp allows file reads, and the
  compact-users DB (Telegram user IDs) was world-readable to uid 5000.
- AST check rejects non-ASCII identifiers (Python NFKC-folds fullwidth /
  mathematical letters, e.g. 'ｏｐｅｎ' -> open).
- Regex layer: decode \uXXXX via latin-1 + backslashreplace (the old utf-8
  encode turned every non-ASCII char into mojibake, so the blocklist never
  saw Cyrillic/fullwidth text correctly), then NFKC-fold before matching.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Unbounded chunk-size line buffering in HTTPResponse.stream()/read_chunked().
Transitive via requests (pyTelegramBotAPI); lock regenerated with
pip-compile --upgrade-package urllib3, no other pins changed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Xov4eeU12j9iyR4JUsjF1R