A small patch release that fixes GitHub artifact attestation verification failures affecting some tools installed via the github: backend.
Fixed
- GitHub artifact attestation verification failing for some tools -- Tools installed via the
github:backend that use GitHub release attestations (e.g.github:jdx/communique@0.1.9,github:jdx/fnox@1.20.0) could fail verification because the upstreamsigstore-verificationlibrary did not handle GitHub release attestation certificates whose Subject Alternative Name (SAN) URL lacked a trailing slash. The dependency has been bumped from 0.2.3 to 0.2.5, which includes the upstream fix. #9128 by @jdx
Full Changelog: v2026.4.13...v2026.4.14