From 0b2d479cb2e20b6fe2c213eaba5c9bee10ad815e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 02:08:36 +0000 Subject: [PATCH 1/4] Bump pytz from 2026.3.post1 to 2026.4 Bumps [pytz](https://github.com/stub42/pytz) from 2026.3.post1 to 2026.4. - [Release notes](https://github.com/stub42/pytz/releases) - [Commits](https://github.com/stub42/pytz/compare/release_2026.3.post1...release_2026.4) --- updated-dependencies: - dependency-name: pytz dependency-version: '2026.4' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index df4d5e2..77d558a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -12,5 +12,5 @@ sqlalchemy==2.0.54 flask-sqlalchemy==3.1.1 wtforms==3.2.2 gunicorn==26.2.0 -pytz==2026.3.post1 +pytz==2026.4 From 3faa6b8744143c501f0e9653d8bf1299ced05f03 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 02:08:41 +0000 Subject: [PATCH 2/4] Bump werkzeug from 3.1.8 to 3.1.9 Bumps [werkzeug](https://github.com/pallets/werkzeug) from 3.1.8 to 3.1.9. - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/werkzeug/compare/3.1.8...3.1.9) --- updated-dependencies: - dependency-name: werkzeug dependency-version: 3.1.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index df4d5e2..bb5e6df 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,7 +1,7 @@ flask==3.1.3 flask-login==0.6.3 flask-wtf==1.3.0 -werkzeug==3.1.8 +werkzeug==3.1.9 bcrypt==5.0.0 APScheduler==3.11.3 PyGithub==2.10.0 From c52ae29c74c39c9c77668331f8fc6db2573fe663 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 02:08:49 +0000 Subject: [PATCH 3/4] Bump sqlalchemy from 2.0.54 to 2.1.1 Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) from 2.0.54 to 2.1.1. - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) --- updated-dependencies: - dependency-name: sqlalchemy dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index df4d5e2..9be5cb6 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8,7 +8,7 @@ PyGithub==2.10.0 gitpython==3.1.62 python-dotenv==1.2.3 requests==2.34.2 -sqlalchemy==2.0.54 +sqlalchemy==2.1.1 flask-sqlalchemy==3.1.1 wtforms==3.2.2 gunicorn==26.2.0 From f4607e1e08d1f2e38f0f6a5425eecf2b11240966 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 1 Oct 2026 12:22:42 +0000 Subject: [PATCH 4/4] Reduce idle memory by lazy-loading PyGithub and requests backup_service imported GitPython (unused - clones use the git CLI), PyGithub and requests at module level, so the gunicorn worker kept them loaded while idle. Import PyGithub/requests only inside the methods that use them and drop the unused GitPython import and dependency. Measured idle gunicorn worker RSS: ~82 MB -> ~58 MB. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01WiQL2WwE6y3RnK8p6LncYz --- backup_service.py | 8 +++++--- requirements.txt | 1 - 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/backup_service.py b/backup_service.py index 6bab580..4322ae3 100644 --- a/backup_service.py +++ b/backup_service.py @@ -1,14 +1,13 @@ import os import re -import git import shutil -import requests import zipfile import tarfile import logging from datetime import datetime, timedelta from pathlib import Path -from github import Github +# PyGithub and requests are imported inside the methods that use them, so the +# idle web process doesn't keep these heavy modules (~30 MB) in memory. from models import db, BackupJob, RELEASE_MODES from urllib.parse import urlparse @@ -326,6 +325,7 @@ def _safe_filename(self, name): def _download_file(self, url, destination, headers): """Stream a file from the GitHub API to disk""" + import requests with requests.get(url, headers=headers, stream=True, timeout=(30, 300), allow_redirects=True) as response: response.raise_for_status() with open(destination, 'wb') as f: @@ -348,6 +348,7 @@ def _download_releases(self, repository, releases_dir): owner, repo_name = owner_repo token = repository.github_token.strip() if repository.github_token else '' + from github import Github g = Github(token) if token else Github() gh_repo = g.get_repo(f"{owner}/{repo_name}") @@ -520,6 +521,7 @@ def verify_github_access(self, repo_url, github_token=None): if repo_name.endswith('.git'): repo_name = repo_name[:-4] + from github import Github if github_token: g = Github(github_token) else: diff --git a/requirements.txt b/requirements.txt index df4d5e2..61f7d36 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5,7 +5,6 @@ werkzeug==3.1.8 bcrypt==5.0.0 APScheduler==3.11.3 PyGithub==2.10.0 -gitpython==3.1.62 python-dotenv==1.2.3 requests==2.34.2 sqlalchemy==2.0.54