Security Platform

Laying the foundation for a security-first approach to Pinokio.

See https://pinokio.co/posts/01m6p6xbzg1eef92h0ry7929ht

Pinokio Release

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Remote

1. Pinokio Remote

A personal portal for all your apps on all your pinokio computers https://pinokio.co/connect

2. Security Update

Added proactive protection against eMudhra certificate exploit, not just for core modules (conda, python, node.js, etc.) but also for each app environment (automatically patches the certificate to block eMudhra)

• Updated pip, node.js, etc. to apply security patches
• Automatic certificate repair for existing venvs (even the ones already impacted)

3. Other updates

• Huggingface Token Fix: a bug where huggingface token would show up expired even when it isn't
• The default bun dependency was removed because it was causing install issues for some people without providing any meaningful benefit. Can always be installed through shell.run commands when needed.
• While running brew install gettext --force-bottle, would get: Cannot relocate build prefix /opt/homebrew to longer prefix /Users/x/pinokio/bin/homebrew. Now fixed by setting HOMEBREW_NO_RELOCATE_BUILD_PREFIX: "1"
• Support for Mac OS Golden Gate 27.2
• Windows path bug fix: The problem: Pinokio accidentally added % characters to Windows library paths:
  • Wrong: %C:\pinokio\bin\miniforge%\Library\lib
  • Correct: C:\pinokio\bin\miniforge\Library\lib

Pinokio Release

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Universal Disk Saver

Free up hundreds of gigabytes, even terabytes, of disk space you didn't know you were wasting.

Learn more: https://desktop.pinokio.co/docs/disk-saver/

Nested Pinokio Folder Support

Previously, pinokio.js had to live at the root of a project. Now it can also live at pinokio/pinokio.js, and Pinokio will automatically discover the scripts.

BEFORE:

pinokio.js
install.js
start.js
update.js
reset.js
app.py
requirements.txt

AFTER:

pinokio/
  pinokio.js
  install.js
  start.js
  update.js
  reset.js
app.py
requirements.txt

This means now you can easily pinokio-fy any existing git repository simply by creating an isolated pinokio folder and including all the script files inside it.

My Apps

Previously you had to click the home icon to go back to Pinokio home, and there was no indication of which tab was selected. Now the default home page is called "My Apps", and you can always click the tab to switch to home

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Huggingface Hotfix

Recommendation: High

Problem

Huggingface got hacked by an autonomous agent from OpenAI:

• https://huggingface.co/blog/security-incident-july-2026
• https://openai.com/index/hugging-face-model-evaluation-security-incident/

And as a result, Huggingface seems to have invalidated all of their tokens--even the ones that are supposed to be valid.

This resulted in anything related to huggingface silently failing: they would say something like "repository not found", which normally means the repo actually doesn't exist, or more often, that you're not logged in when the repo requires you to be logged in. This even happened for PUBLIC repos, the ones that normally do not need you to login.

What made it worse is, it looked as if the token is valid because the token technically IS valid, but just invalidated on the huggingface side.

Solution

To fix this, and also fix similar potential situations in the future, now Pinokio actually checks for the token validity and if there's something wrong, it treats the rest of the session as NOT logged in.

What to do

You don't have to do anything for most cases. Most apps on pinokio do not require you to log into huggingface. It should just work.

But if you ever logged into huggingface, or if you want huggingface downloads to work faster, you are recommended to log in, which means you will need to log in again, even if you logged in previously. That's all!

Pinokio Release

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

8.0.35

1. Ask Grok

Now you can ask Grok (via Grok Build) in the "Ask AI" panel, not to mention build apps using Grok.

2. Fullscreen mode

Now you can hide the navbar

3. Bugfix (README related)

The last release made a breaking change that affected some users who have been using customized UI (by changing the ~/pinokio/views folder, or by using apps like Customokio https://beta.pinokio.co/apps/github-com-wang-thunder-customokio

This has been fixed, and now everything should work fine.

Pinokio Release

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Huggingface Login Bug Hotfix

This is a freshly discovered bug, and important enough that i'm making a hot fix, for those affected.

If you saw the following when trying to log into huggingface from the login page, this is now fixed:

Pinokio Release

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

8.0.30

1. Opencode Plugin
2. Hom Server Fix
3. Conda Update Fix
4. Completely Hide Sidebar

1. Opencode plugin

Now you can launch Opencode as a plugin, so you can use opencode to ask questions about any app.

2. Home Server Fix

There was one hole with home server. You could connect to your Pinokio home server from any other machine on the same network (such as another laptop, tablet, or phone), BUT, you couldn't install apps from the Explore page. This is now fixed. Now 100% of the home server features work.

3. Conda Update Fix

Some people had problem upgrading since Pinokio 8.0.0 because the miniconda/miniforge folders were not getting reset properly (which was needed for these versions). This would happen if one of your other programs were opening one of the files inside pinokio.

Now when this happens, Pinokio displays precisely which process is holding those files so you can kill them, and once that's done, automatically proceeds with the rest of the update process. For example, here I turn off an older version of Logitech G Hub, after which the update proceeds:

4. Completely Hide Sidebar

Previously when you hide the sidebar, it would still show up when you hover your mouse over to the left side of the screen. But often you do not want this. You want your app to take up the full width, period.

Now you can toggle this behavior by turning off "Show on hover". Notice how after you turn it off, it doesn't come back even if you hover your mouse over to the left. You can of course open it by clicking the expand button at the top.

Pinokio Release

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

8.0.8 -- Hotfix

A handful of important bugs were fixed.

ESM Support

When you install an app that used ESM in a script, it would just hang the entire app and brick Pinokio (For example if you tried to install https://pinokio.co/apps/github-com-dudarenok-maker-castwright and failed, you would get in this state, because the previous versions of pinokio didn't support ESM, so if you were one of those, update pinokio to 8.0.8 and reinstall the broken apps from scratch)

This has now been fixed. Although ESM is NOT recommended for writing pinokio scripts, at least now it doesn't crash the entire app.

Custom Conda Environment Fix

Apps that use custom conda environments were broken at install time. This was a conda (miniforge) internals issue, and this has been fixed by invalidating the conda environment and forcing reinstall of the entire conda environment and conda dependencies (Sorry for the inconvenience, but this was the cleanest fix without introducing technical debt).

It should just tell you conda needs to be updated (as well as other conda dependencies). Just install and it should be fine.

Github login fix

Github login was broken. Now properly uses git credential manager, waits for your login on the web, and auto closes the credential manager after logging in.

Huggingface login fix

When you use "hf.login" method, it would open a modal that displays the code, which you have to paste into the huggingface auth screen. But previously the code was not automatically copied to the clipboard so it was confusing. Now the code is automatically copied to the clipboard, so you can just paste into the huggingface auth screen.

Instant login page

Previously the Instant login page took long to load, but now it instantly loads and dynamically refreshes the state

Pinokio Release

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Pinokio 8

1. ALL New UI
2. Home Server
3. Process Monitor
4. Autolaunch
5. Orchestration
6. 1-Click Help
7. Faster
8. End-to-End Open License

Check out every single update in detail here: https://cocktailpeanutlabs.github.io/p8

Pinokio Release

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Bugfix Patch

1. FFMPEG Fix

Installs the latest version of FFMPEG to support new features, including torchcodec APIs: Without this, some newer apps were breaking (ACE-Step Audio, etc.)

2. Task Fix

There was a bug where starting a task from the task page (not inside universal modals) would hang the app. This has been fixed.

Pinokio Release Info

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Privacy Policy

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.