gstack /cso now tests its fixes against your app in Docker

3 hours ago

@gstackSubscribe

gstack's comprehensive /cso now boots your app in a pinned Docker image and tests its findings and repairs against it, instead of always falling back to a static audit. And projects that pin Bun 1.4.4 install gstack again. Covers gstack 1.91.181.0 to 1.91.182.0 (2026-10-23). Release notes: https://github.com/garrytan/gstack/blob/main/CHANGELOG.md#1911810---2026-10-23 https://github.com/garrytan/gstack/blob/main/CHANGELOG.md#1911820---2026-10-23 Commits: https://github.com/garrytan/gstack/commits/main

Ask

Ask about this presentation

Answers are generated from this presentation.

Chapters

  1. 0:00/cso runs
  2. 0:15Pinned
  3. 0:31Bun 1.4.4
  4. 0:48What stays
  5. 1:05Your pin
Show transcript

/cso runs

gstack logo

gstack /cso now tests its fixes against your app in Docker

comprehensive /csoalways staticboots your app
/cso runsPinnedBun 1.4.4What staysYour pin
garrytan/gstack · CHANGELOG.md · 1.91.181.0

Comprehensive /cso always fell back to a static audit, because its runtime catalog qualified nothing. Now, with Docker installed, it boots your app in a matching image and tests each finding and repair against it.

Pinned

All ten runtime images ship pinned to a public digest

ghcr.io/garrytan/gstack/cso-staging/…@sha256
each entry records source commit · SBOM · provenance
/cso runsPinnedBun 1.4.4What staysYour pin
garrytan/gstack · CHANGELOG.md · 1.91.181.0

Node, Bun, Python, Rails and Postgres images are each locked to an exact digest on GitHub's public container registry. Each catalog entry also records its source commit, its software bill of materials, and its provenance.

Bun 1.4.4

Projects that pin Bun 1.4.4 install gstack again

RUNTIME_PIN_CONFLICT pins exactly 1.4.4
gstack: ok
/cso runsPinnedBun 1.4.4What staysYour pin
garrytan/gstack · CHANGELOG.md · 1.91.182.0

If your project pins Bun 1.4.4, as gbrain now does, the installer stopped with a runtime pin conflict, because it only trusts Bun builds it has checksums for. It now carries 1.4.4, installs it, and finishes clean.

What stays

gstack's own Bun versions stay where they were

1.4.4 verified for linux-x64, linux-x64-baseline, linux-aarch64
1.4.2 minimum · 1.4.3 install default
/cso runsPinnedBun 1.4.4What staysYour pin
garrytan/gstack · CHANGELOG.md · 1.91.182.0

The new 1.4.4 checksums cover the same three Linux targets as 1.4.3, checked against Bun's signed release key. gstack's own minimum stays 1.4.2, and its default install stays 1.4.3.

Your pin

The full details are in the gstack changelog

CHANGELOG.md1.91.181.0 · 1.91.182.0
Which Bun version does your project pin?
/cso runsPinnedBun 1.4.4What staysYour pin
garrytan/gstack · CHANGELOG.md · 1.91.182.0

Image digests and checksums are in the gstack changelog. Which Bun version does your project pin?

Up next

1:05

gstack /cso now runs your app and six scanners in Docker

@gstack · 9 hours ago

0:47

gstack /qa now tells the agent where its report goes after a fail

@gstack · 13 hours ago

0:42

gstack /cso runtimes can ship again without a paid requalification

@gstack · 1 day ago

0:47

gstack merge trains now merge every PR, not just the first

@gstack · 1 day ago

1:05

gstack 1.91.172.0 brings plain-words approvals and before/after PR images to Capy

@gstack · 2 days ago

1:03

gstack’s /ios-qa picks your iPhone session back up after a daemon restart

@gstack · 2 days ago

0:51

gstack's skill checks stop failing Opus 5.5 for valid work

@gstack · 2 days ago

0:41

gstack 1.91.166.0 stops the Windows setup and display tests failing under load

@gstack · 2 days ago

1:16

gstack now merges pull requests in trains of five behind one full gate

@gstack · 2 days ago

1:02

gstack 1.91.163.0 reruns a failed eval test once instead of the whole gate

@gstack · 3 days ago

1:06

gstack 1.91.162.0 lets a merge train of PRs share one full eval gate

@gstack · 3 days ago

1:46

gstack's /ship stops blocking Django, Flutter and asset-only branches

@gstack · 3 days ago