README section documenting the containerd image store and a troubleshooting checklist for ImagePullBackOff after a deploy.
Changed
The registry auth payload sent during push now includes serveraddress, so Docker Desktop routes credentials to the pinexq registry on every version.
Update build backend uv_build to >=0.12.6,<0.13.0.
Fixed
deploy now aborts when the image push reports an error instead of reporting success. Previously a failed or partial push was swallowed and an unpullable code hash was registered, causing rare ImagePullBackOff failures in Kubernetes.
The registered code hash is now the digest reported for the push and is verified to exist in the registry before it is assigned, instead of a locally derived digest (RepoDigests/image ID) that could name a manifest the registry does not hold.
Security
Update dependency copier to 9.17.2, fixing CVE-2026-53951 (trust-prefix bypass via path traversal that could run template tasks unprompted).
Update dev dependency pytest to 9.1.1, fixing CVE-2025-71176 (unsafe /tmp directory handling).
