v0.2.1

Security

• The Docker image is now built on the Alpine variant of
  Docker Hardened Images for Python instead of python:3.13-slim.
  Trivy findings drop from 193 (50 High, none fixable in Debian) to 0.
• The runtime image has no shell or package manager. GitPulse runs from its own
  virtualenv containing only GitPulse and its dependencies, with no pip.
• urllib3 is 2.8.0 in the Docker image and the Homebrew formula, fixing
  CVE-2026-97687, CVE-2026-97688, and CVE-2026-97689.

Changed

• The container runs as the non-root UID 65532 instead of 1000.
• The Docker image is 105 MB, down from 227 MB.

Upgrading

If you kept snapshot history in a Docker volume or bind mount with 0.2.0, its files
belong to UID 1000. Saving with 0.2.1 then fails with
attempt to write a readonly database. Give the files to the new user once; your
history is kept:

docker run --rm -v gitpulse-data:/data alpine chown -R 65532:65532 /data

For a bind mount, run sudo chown -R 65532:65532 DIR on the host, or keep the old UID
with --user 1000:1000.

See the full changelog.

v0.2.0

First public release of GitPulse, a CLI for GitHub traffic, clones, referrers, and release downloads.

Highlights

• gitpulse org ORG builds a dashboard for an entire organization or user account. It prints a Rich summary in the terminal and writes a self-contained HTML dashboard with daily traffic, top repositories, languages, referrers, release downloads, and a sortable table of every repository.
• Per-repository commands: repos, traffic, snapshot, history, downloads.
• Local SQLite snapshots to keep traffic history beyond GitHub's 14-day window.

Install

brew install fullstackspectrum/gitpulse/gitpulse
pipx install gitpulse-analytics
docker run --rm -e GITHUB_TOKEN -v "$PWD:/data" fullstackspectrum/gitpulse org ORG

See the README for token permissions and every option.