v3.0.2: resolve Dependabot alerts, pin Docker Python to 3.12

.version

@@ -1 +1 @@
-v3.0.0
+v3.0.2

CLAUDE.md

@@ -131,3 +131,12 @@ Pytest configuration is in `pyproject.toml` (`-v -ra -q` flags).
 ## Version Management
 
 Version is set in `pyproject.toml` under `[project] version`. The build script reads it and writes `v{VERSION}` to `.version`. Update `pyproject.toml` when bumping versions.
+
+**Every code change bumps the patch (z in x.y.z).** Every commit that changes code, dependencies (`pyproject.toml`/`uv.lock`), templates, static assets, Docker or Helm files increments z by one, relative to the version in its parent commit (e.g. 3.0.0 → 3.0.1 → 3.0.2 across two code commits). The bump goes in the same commit as the change. Docs-only commits (`*.md`, `docs/`) do not bump. Minor/major bumps stay a deliberate, separate decision.
+
+A patch bump touches exactly three files, kept in sync so a build does not produce a diff:
+- `pyproject.toml` — `[project] version` (source of truth)
+- `.version` — `v{VERSION}`
+- `uv.lock` — the `fw-gui` package entry (run `uv lock` after editing `pyproject.toml`)
+
+Leave "As of X" / "pre-X" references in comments and docs alone; they mark when a behavior changed, not the current version.

docker/Dockerfile

@@ -36,6 +36,10 @@ WORKDIR /opt/fw-gui
 ENV UV_CACHE_DIR=/tmp/uv-cache
 ENV UV_TOOL_DIR=/tmp/uv-tools
 ENV UV_PYTHON_INSTALL_DIR=/tmp/uv-python
+# Pin the interpreter: the base image has no python3, so without this uv
+# downloads the newest CPython, which can outrun wheel availability (3.15 +
+# cffi 2.0.0 had no wheel, and the image has no compiler). Matches CI.
+ENV UV_PYTHON=3.12
 
 # Install pip modules
 RUN uv sync

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "FW-GUI"
-version = "3.0.0"
+version = "3.0.2"
 description = "Basic Flask app to present web forms and process posts from them.  Generates VyOS firewall CLI configuration commands to create the corresponding firewall filters, chains and rules."
 authors = [{ name = "Isaac Behrens", email = "isaac@behrenshome.com" }]
 maintainers = [{ name = "Isaac Behrens", email = "isaac@behrenshome.com" }]
@@ -28,9 +28,9 @@ dependencies = [
     "python-dotenv>=1.2.2",
     "requests>=2.33.0",
     "setuptools>=83.0.0",
-    "urllib3>=2.7.0",
+    "urllib3>=2.8.0",
     "waitress",
-    "werkzeug>=3.1.6",
+    "werkzeug>=3.1.9",
 ]
 
 [project.optional-dependencies]