Pullbox v1.0.3

What's Changed

Maintenance release focused on faster multi-architecture image publication and
dependency security while preserving the existing release gates.

Fixed

• Raised the Pillow dependency floor to 12.3.0 to include upstream fixes for
  crafted font/image memory exhaustion and Windows viewer command injection.

CI / Build

• Parallelized AMD64 and ARM64 release builds across two Docker runners while
  preserving Grype, smoke-test, dual-registry, attestation, and signing gates.

Commit Details

🐛 Bug Fixes

• evict platform image between release checks (#81)

🧰 Chores

• bump version to 1.0.3 for release
• sync develop after v1.0.2 release

🏗️ CI / Build

• parallelize Docker release platform builds (#79)
• add isolated Docker release benchmark (#77) (#78)
• add isolated Docker release benchmark (#77)

🐳 Docker Images

docker pull ghcr.io/pullboxapp/pullbox:1.0.3
docker pull docker.io/pullbox/pullbox:1.0.3

Digest: sha256:3672f34321deef16fae9cb5367813a24e23966e85e736cdd6310807f9be47a5c

🔐 Image Verification

Release images are signed with keyless Sigstore/Cosign using GitHub Actions OIDC.
These commands verify the exact multi-architecture image digest published by this release.

cosign verify \
  --certificate-identity-regexp '^https://github.com/pullboxapp/pullbox/\.github/workflows/docker-release\.yml@refs/tags/v1.0.3$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/pullboxapp/pullbox@sha256:3672f34321deef16fae9cb5367813a24e23966e85e736cdd6310807f9be47a5c

cosign verify \
  --certificate-identity-regexp '^https://github.com/pullboxapp/pullbox/\.github/workflows/docker-release\.yml@refs/tags/v1.0.3$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  docker.io/pullbox/pullbox@sha256:3672f34321deef16fae9cb5367813a24e23966e85e736cdd6310807f9be47a5c

Full Changelog: v1.0.2...v1.0.3