What's Changed
- cg auth: fix sometimes by @imjasonh in #1314
- set OCI created annotation by @imjasonh in #1316
- Cache some more expensive operations by @jonjohnsonjr in #1317
- build(deps): bump github/codeql-action from 3.26.8 to 3.26.9 by @dependabot in #1318
- build(deps): bump github.com/klauspost/compress from 1.17.9 to 1.17.10 by @dependabot in #1315
- build(deps): bump actions/checkout from 4.1.7 to 4.2.0 by @dependabot in #1319
- Fail if APKINDEX has single-character lines by @jonjohnsonjr in #1321
- fix(ci): mark GitHub releases as latest from prerelease by @p5 in #1277
- build(deps): bump github/codeql-action from 3.26.9 to 3.26.10 by @dependabot in #1323
- build(deps): bump google.golang.org/api from 0.198.0 to 0.199.0 by @dependabot in #1320
- build(deps): bump go.step.sm/crypto from 0.52.0 to 0.53.0 by @dependabot in #1322
- Drop a period from a command's help by @murraybd in #1312
- use slog default logger for CG auth exchange by @imjasonh in #1324
- cleanup: remove Lima documentation by @luhring in #1325
- don't attempt to discover keys for file path repos by @imjasonh in #1326
- Make etag checks optional by @jonjohnsonjr in #1327
- build(deps): bump sigstore/cosign-installer from 3.6.0 to 3.7.0 by @dependabot in #1333
- build(deps): bump github/codeql-action from 3.26.10 to 3.26.11 by @dependabot in #1332
- build(deps): bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by @dependabot in #1329
- build(deps): bump chainguard.dev/sdk from 0.1.25 to 0.1.26 by @dependabot in #1328
- build(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 by @dependabot in #1331
- Update go to 1.23.2 and golangci-lint by @cpanato in #1334
- build(deps): bump golang.org/x/time from 0.6.0 to 0.7.0 by @dependabot in #1336
- build(deps): bump golang.org/x/sys from 0.25.0 to 0.26.0 by @dependabot in #1335
- build(deps): bump go.step.sm/crypto from 0.53.0 to 0.54.0 by @dependabot in #1338
- build(deps): bump github/codeql-action from 3.26.11 to 3.26.12 by @dependabot in #1339
- build(deps): bump actions/checkout from 4.2.0 to 4.2.1 by @dependabot in #1340
- build(deps): bump google.golang.org/api from 0.199.0 to 0.201.0 by @dependabot in #1348
- build(deps): bump chainguard.dev/sdk from 0.1.26 to 0.1.27 by @dependabot in #1347
- build(deps): bump github/codeql-action from 3.26.12 to 3.26.13 by @dependabot in #1344
- build(deps): bump go.opentelemetry.io/otel from 1.30.0 to 1.31.0 by @dependabot in #1346
- build(deps): bump github.com/klauspost/compress from 1.17.10 to 1.17.11 by @dependabot in #1343
- build(deps): bump chainguard.dev/sdk from 0.1.27 to 0.1.28 by @dependabot in #1351
- Preserve APK timestamps when using dirfs by @jonjohnsonjr in #1352
- Work around sendfile bug by @jonjohnsonjr in #1359
- don't attempt to discover chainguard keys for local file paths by @imjasonh in #1360
- SBOM test cleanup by @luhring in #1361
- allow key lookups for http by @ajayk in #1365
- fix(sbom): deduplicate SBOM packages by ID by @luhring in #1366
- Stop using real headers for side channels by @jonjohnsonjr in #1367
- Avoid race when mutating annotations by @jonjohnsonjr in #1368
- build(deps): bump google.golang.org/api from 0.201.0 to 0.203.0 by @dependabot in #1362
- build(deps): bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot in #1355
- build(deps): bump github/codeql-action from 3.26.13 to 3.27.0 by @dependabot in #1356
- build(deps): bump k8s.io/apimachinery from 0.31.1 to 0.31.2 by @dependabot in #1363
New Contributors
Full Changelog: v0.19.2...v0.19.3