[ralyodio]

Pins the video runner image published by video-runner.yml for #185 (run 42585847716, commit 7813c10). This is the image whose manifest carries wan2.1-t2v-1.3b and whose runner has the 8 GiB offload path.

• node/crates/c0mpute-core/src/video.rs RUNNER_DIGEST / RUNNER_PULL_REF
• plugins/video/module.toml [module.dispatch] image
• plugins/video/install.sh default PULL_REF

New digest: ghcr.io/profullstack/c0mpute-video-runner@sha256:daf24f7547678e325ba60bb78cc03f20577598463f1e9587df5890c935945022. The published image's own selftest lists all five models.

The package is still not anonymously pullable, which the workflow warns about. An org admin needs to set it Public once in the GHCR package settings. Until then, c0mpute video setup builds the same Dockerfile from source.

Ships as part of v0.2.90.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

13 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 8 | LOW: 4

Severity	Rule	Location
HIGH	js-ssrf-outbound-request	apps/web/public/sw.js:24
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM	js-unescaped-html-sink	apps/web/src/app/layout.tsx:80
MEDIUM	sh-remote-script-execution	scripts/dev-setup.sh:25
MEDIUM	sh-eval-expansion	scripts/dev-setup.sh:35
MEDIUM	sh-remote-script-execution	scripts/install.sh:181
MEDIUM	sh-remote-script-execution	scripts/install.sh:206
MEDIUM	sh-remote-script-execution	scripts/install.sh:324
MEDIUM	sh-remote-script-execution	scripts/install.sh:366
LOW	py-ssrf-outbound-request	examples/business-strategist-agent/chat.py:37
LOW	py-ssrf-outbound-request	examples/business-strategist-agent/train.py:54
LOW	secret-generic-credential	node/crates/c0mpute-core/src/webhook.rs:1165
LOW	py-path-traversal	node/crates/c0mpute-core/tests/fixtures/fake-infernet-text:29

Snippets are redacted; ThreatCrush never prints matched credential material.