💥 Breaking Changes
- feat!: suppport scoped executors by @binbin-li in #2302
- feat!: add v2alpha1 CRD by @binbin-li in #2310
- feat!: support providing inline certificate in CR by @binbin-li in #2312
- feat!: add keyless cosign verifier by @binbin-li in #2339
- fix!: override store scopes only when it is a single store by @binbin-li in #2388
🚀 Features
- feat: support reloading executors by CRs by @binbin-li in #2311
- feat: add native ACR auth by @binbin-li in #2323
- feat: support fetching certs from AKV by @binbin-li in #2325
- feat: add cache to registry token by @binbin-li in #2329
- feat: support private registry over TLS by @binbin-li in #2355
- feat: support concurrent executor by @binbin-li in #2420
- feat: support key-based cosign verifier by @binbin-li in #2425
- feat: add akv key provider by @binbin-li in #2432
- feat: add benchmark regression gate and executor benchmarks for Perf test by @charleswool in #2566
- feat: add stores[].plainHttp for HTTP registries by @fseldow in #2582
🐛 Bug Fixes
- fix: fix parsing policy error by @binbin-li in #2337
- fix: fix parsing numeric value from json by @binbin-li in #2338
- fix(logger): default plugin logger to stdout for info/debug/warn by @charleswool in #2521
- fix: executor template inline cert must use {certs: PEM} format by @fseldow in #2670
- fix: strip namespace prefix from artifact in executor scope matching by @fseldow in #2671
🔐 Security
- chore: bump sigstore-go to resolve vulnerability by @akashsinghal in #2448
- chore(ci): resolve scan-vulns CI failures by updating Go, deps, and Trivy by @YitongFeng-git in #2522
- chore: update signing certificate by @fseldow in #2694
- chore: bump golang.org/x/text to solve CVE-2026-56852 by @fseldow in #2740
🎉 New Contributors
- @shizhMSFT made their first contribution in #2331
- @oglok made their first contribution in #2493
Full Changelog: v2.0.0-alpha.1...v2.0.0-alpha.2