Issues

An older varve refuses every operation when given varve's own current realms file — 'unknown field retired-roots', a field the file documents as diagnostic-only
pulseengine/varve#234 · opened on Oct 2, 2026
A composition's support window can outlive every layer it composes
pulseengine/varve#226 · opened on Sep 30, 2026
1
Rule 3: varve spells structured output two ways (--json vs --format), and list/which have none
pulseengine/varve#225 · opened on Sep 30, 2026
A signed advisory can only reach a consumer at install time, so the frozen consumer varve is built for never learns
pulseengine/varve#224 · opened on Sep 30, 2026
Spike: offering the wit payload kind, and keeping the air gap when we do
pulseengine/varve#220 · opened on Sep 30, 2026
2
Spike: carrying Rust toolchains, and link as the alternative to copying them
pulseengine/varve#218 · opened on Sep 30, 2026
1
Declining auto-deposit also turned off detection: wasm-layers has pinned a wasmtime with two advisories for five days and nothing would ever say so
pulseengine/varve#216 · opened on Sep 30, 2026
1
No published layer ships a sound ordeal: 2026.09.16 carries 0.22.0, inside GHSA-xfxf-qxr3-435x's affected range
pulseengine/varve#214 · opened on Sep 30, 2026
2
The anti-rollback high-water mark lives in per-worker local state, so the same pin gets four different verdicts on one CI fleet
pulseengine/varve#210 · opened on Sep 30, 2026
2
v0.44.0 — Layers beyond our own tools, and stop copying to use them
pulseengine/varve#206 · opened on Sep 29, 2026
2
v0.43.0 — Keys, custody and roles before the v1.0 ceremony
pulseengine/varve#205 · opened on Sep 29, 2026
v0.42.0 — The first hour: the errors and docs a new consumer actually hits
pulseengine/varve#204 · opened on Sep 29, 2026
1
v0.41.0 — Evidence travels in the layer
pulseengine/varve#203 · opened on Sep 29, 2026
1
v0.40.0 — The layer tells the truth about what it carries
pulseengine/varve#202 · opened on Sep 29, 2026
1