What's Changed
- fix(maven): backport flat-key attribution ledger-first ordering to 1.6.x (#2943) by @brandonrc in #2946
- Release v1.6.4 — Maven flat-key tenant-isolation security patch + restore enforcing Security Scan gate by @brandonrc in #2964
- security(images): suppress CVE-2026-56852 in the vendored trivy CLI (unblocks v1.6.4) by @brandonrc in #2990
- security(images): suppress CVE-2026-46600 in the vendored trivy CLI (unblocks v1.6.4) by @brandonrc in #2997
Full Changelog: v1.6.3...v1.6.4