Post

Today Pinokio 8.3.7 is released. Combined with the last version (v8.3.1), these updates lay the foundation for a security-first approach to Pinokio, with more of the ongoing security maintenance handled by Pinokio itself, so app developers don't have to worry about the infrastructure and system dependencies, and focus on making their apps useful for the users.

To make sure your pinokio is secure, please update to 8.3.7 (if you haven't autoupdated yet) here:

https://desktop.pinokio.co

Security-First Approach

• A shared security foundation. Certificate checks, runtime updates, and repairs can be managed centrally, reducing dependence on each app’s launcher being maintained individually.
• Fixes that reach existing apps. Protections can be automatically applied when older app environments are launched, without waiting for every app developer to release an update.
• Checks built into installation and startup. Required security updates, verification of critical setup downloads, and clear recovery instructions become part of the normal workflow.
• A foundation that can keep improving. The mechanisms introduced for this incident provide a way to deliver future certificate and runtime protections across apps.

The goal is for users to rely on Pinokio to maintain the shared localhost infrastructure their apps run on, while app developers remain responsible for the security of their own code.

What has changed?

• The desktop app’s browser engine has been updated. Pinokio moved to a new version of the browser engine which includes eMudhra protections for both browser requests and Node.js connections, and later to 43.8.7.
• Certificate errors are handled strictly. The desktop app previously allowed connections to continue despite certificate validation errors. That override has been removed.
• The tools bundled with Pinokio have been updated. This includes Node.js, uv, etc.
• Updated certificates and pip are now required by the installation checks. Pinokio requires ca-certificates and certifi version 2026.10.19 or newer, and pip 26.2.2 or newer. Outdated installations no longer pass those checks. Python 3.10.20 has been retained for app compatibility, with certificate requirements enforced separately.
• Certificate updates have been extended to existing apps. Common Python networking libraries now default to Pinokio’s managed certificate bundle on Windows, macOS, and Linux. Older app environments pick up those defaults when launched, while explicitly configured certificate settings are respected.
• The separate certificate list bundled inside pip is now repaired automatically. Updating system certificates alone doesn’t remove pip’s own copy. That copy is now replaced with Pinokio’s managed bundle when existing app environments are activated, without upgrading their other dependencies.
• The initial pip installation used by new Python environments has been fixed. Python’s bundled ensurepip is repaired to use the updated pip wheel, preventing newly created environments from bringing back the older version.
• Download verification has been added to the repair process. Miniforge installers and the pip wheel are checked against pinned SHA-256 hashes before use. Downloads that don’t match are rejected.
• Repair failures are now surfaced instead of silently skipped. If pip’s certificate file cannot be replaced, the app launch is stopped and recovery instructions identify the affected file. Repair logs include timestamps and file hashes, and regression tests cover stale certificates, damaged downloads, missing files, and permission failures.

What next?

As mentioned above, this release is laying the foundation, and will evolve to a general purpose security architecture that can quickly respond to all kinds of security issues we will encounter as AI agent based exploits become more and more prevalent.

In fact I expect to see more frequent security updates over the coming weeks and months, and the goal is to make the update process as seamless as possible. Stay tuned!