# v2026.10.47

Code steps run in a sealed sandbox

Security fixes to the JavaScript engine, and every sandbox process is now sealed by the operating system where it can be.

## What changed

## When you update

GoRunner’s image is private for now. With Docker, [sign in to the registry](https://docs.gorunner.io/self-host/install-docker#sign-in-to-the-registry) first. On Kubernetes, [sign Helm in and give the cluster its pull Secret](https://docs.gorunner.io/self-host/install-kubernetes#make-a-namespace). See [Update](https://docs.gorunner.io/self-host/update) for the whole procedure, or [Install with Docker](https://docs.gorunner.io/self-host/install-docker) and [Install on Kubernetes](https://docs.gorunner.io/self-host/install-kubernetes) to install this version anew.

**Docker**

```bash
# Check the image first: its Digest must be sha256:7ab2467c796133b3d3c47eaf1d68a5e37e224cecc8094a99d3d9d5db8338f0b9
docker buildx imagetools inspect ghcr.io/ralve-org/gorunner-selfhost:v2026.10.47

# Update
./deploy.sh v2026.10.47
```

**Kubernetes**

```bash
helm upgrade gorunner oci://ghcr.io/ralve-org/charts/gorunner --version 2026.10.47 -f values.yaml
```

## Going back

To go back, run `./deploy.sh v2026.10.46`. There is no migration, so no flag is needed.

Source: https://docs.gorunner.io/changelog/v2026.10.47