oUpdate 0.2.5

Security release. Upgrade from 0.2.4 or earlier.

Review

• oupdate image reads layer contents: it builds each image's merged filesystem from its layers and verified blobs, diffs the two images into ranked reviewer parts, and holds anything it cannot read. Removals of startup, maintainer and trust files hold, links are resolved by one resolver, and --no-layers skips the layer read.
• Files that package code loads are shown: a binary is judged by its magic bytes, not its name, and a loaded ttf or text-signature binary is shown.
• pnpm v9 snapshots are diffed per installed instance, and whitespace-only changes in long lines are marked.
• bun.lock private non-.tgz tarball URLs count as URL dependencies, and a Gitea file list that does not match x-total-count fails closed.
• Reviewer blocks refuse unknown keys.

Gate

• Gate comment details render as code spans, so paths cannot mention or autolink.

Host

• Homebrew bun is held while the host run is executing it.
• Upstream bumps to pinned host tools are reported, and versioned GitHub asset names are rewritten.

Release

• Release tags are signed. Public CI is pinned to the Bun the suite passes on.