Pullrun

v0.6.2 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 13d Containers & Orchestration

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

ReleasePort's take

Light signal

editorial:auto 12d

ReleasePort Layer 1 v0.6.2 resolves a save/load digest mismatch and refines several CLI behaviors.

Why it matters: Fixes round‑trip data corruption in air‑gapped workflows, improves list command timestamps on Linux, and clarifies push authentication errors for smoother operations.

Summary

AI summary

Fixed save/load digest mismatch for air‑gapped import, corrected timestamp handling in list commands, improved push auth error message.

Changes in this release

Type	Severity	Summary	CVE
Feature	Low	Adds `--version` / `-V` flags to the CLI and introduces `pullrun-runtime version` subcommand. Adds `--version` / `-V` flags to the CLI and introduces `pullrun-runtime version` subcommand. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Adds non‑sudo fallback in `install.sh` to install into `~/.local/bin/` when sudo is unavailable. Adds non‑sudo fallback in `install.sh` to install into `~/.local/bin/` when sudo is unavailable. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes save/load round‑trip digest mismatch by removing incorrect blob verification. Fixes save/load round‑trip digest mismatch by removing incorrect blob verification. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Adds timestamp_from_meta() fallback for `secret ls` and `config ls` CREATED timestamps on Linux filesystems lacking created time. Adds timestamp_from_meta() fallback for `secret ls` and `config ls` CREATED timestamps on Linux filesystems lacking created time. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Improves `pullrun push` auth error handling to print a clear “not authenticated” message instead of leaking HTTP details. Improves `pullrun push` auth error handling to print a clear “not authenticated” message instead of leaking HTTP details. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Low	Improves `install.sh` GitHub API rate‑limit handling by exiting with a clear error when TAG is empty. Improves `install.sh` GitHub API rate‑limit handling by exiting with a clear error when TAG is empty. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

Bug fixes

save/load round-trip digest mismatch — removed incorrect blob content verification on import. The blob path uses the parent node's digest (SHA-256 of rkyv-serialized DagNode), not a hash of the raw blob data. Air-gapped export/import now works correctly.
secret ls / config ls CREATED timestamp — added timestamp_from_meta() helper that falls back to meta.modified() when meta.created() is unavailable (Linux ext4/xfs/btrfs). Also fixed list_images to read the node file's mtime.
pullrun push auth error message — detects 401/Unauthorized/no Location header and prints not authenticated — run 'pullrun login <registry>' instead of leaking HTTP-level details.
--version / -V flags — added to the CLI. Also added pullrun-runtime version subcommand.
install.sh GitHub API rate-limit handling — detects empty TAG and exits with a clear error suggesting VERSION=v0.6.2.
install.sh non-sudo fallback — installs to ~/.local/bin/ when sudo is unavailable.

Documentation

README: removed non-functional pullrun diff <tag1> <tag2> example; fixed --network my-net to correct --net bridge.
pullrun workload help text corrected to reality.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Pullrun

Get notified when new releases ship.

About Pullrun

All releases →