v0.2.1

Security

• The Docker image is now built on the Alpine variant of
  Docker Hardened Images for Python instead of python:3.13-slim.
  Trivy findings drop from 193 (50 High, none fixable in Debian) to 0.
• The runtime image has no shell or package manager. GitPulse runs from its own
  virtualenv containing only GitPulse and its dependencies, with no pip.
• urllib3 is 2.8.0 in the Docker image and the Homebrew formula, fixing
  CVE-2026-97687, CVE-2026-97688, and CVE-2026-97689.

Changed

• The container runs as the non-root UID 65532 instead of 1000.
• The Docker image is 105 MB, down from 227 MB.

Upgrading

If you kept snapshot history in a Docker volume or bind mount with 0.2.0, its files
belong to UID 1000. Saving with 0.2.1 then fails with
attempt to write a readonly database. Give the files to the new user once; your
history is kept:

docker run --rm -v gitpulse-data:/data alpine chown -R 65532:65532 /data

For a bind mount, run sudo chown -R 65532:65532 DIR on the host, or keep the old UID
with --user 1000:1000.

See the full changelog.