project-copacetic/copacetic v0.11.0

on GitHub

Notable Changes

• 📦 Copa now supports multi-platform patching!
• 🦭 Support for buildkit instance running on podman
• 🧩 Support for OCI Media Types in addition to Docker

Changelog

• 15ced60 feat: support update all for multi platform patching (#1141)
• c990ce8 chore(security): ignore irrelevant vulnerabilities in osv-scanner.toml (#1177)
• d49d655 fix: Revert "chore: bump cbl-mariner/distroless/base from 2.0.20240112 to 2.0.20250602 in /integration/singlearch/fixtures/openssl-test-img-rpm" (#1173)
• 9ba82fc chore: bump the all group across 1 directory with 2 updates (#1174)
• bb3afac chore: bump dotenv from 17.0.0 to 17.0.1 in /website in the all group (#1170)
• c6568e7 chore: bump github.com/aquasecurity/trivy from 0.63.0 to 0.64.0 (#1169)
• 72904a4 chore: bump github.com/moby/buildkit from 0.23.1 to 0.23.2 (#1168)
• 3513093 chore: bump cbl-mariner/distroless/base from 2.0.20240112 to 2.0.20250602 in /integration/singlearch/fixtures/openssl-test-img-rpm (#1165)
• 26faaa5 ci: [StepSecurity] Apply security best practices (#1156)
• 20d5b6f fix: retain multiplatform manifest list annotations (#1120)
• 4533dc6 docs: add openssf best practices badge (#1157)
• e9da0ea feat: enhance multi platform summary report (#1123)
• 59d16ba chore: bump github.com/cpuguy83/go-docker from 0.3.0 to 0.3.1 (#1148)
• af11c14 chore: bump the all group with 2 updates (#1147)
• 8b65f29 chore: bump github.com/docker/cli from 28.2.2+incompatible to 28.3.0+incompatible (#1146)
• 7ffde2a chore: bump github.com/docker/docker from 28.2.2+incompatible to 28.3.0+incompatible (#1145)
• d7f0d63 chore: bump dotenv from 16.5.0 to 17.0.0 in /website in the all group (#1144)
• 0353afa chore: bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#1142)
• 8dc0e18 docs: update release doc to include cncf guidance (#1066)
• 6a0f03c fix: handle docker load generically (#1059)
• b4488bf docs: Update ADOPTERS.md to link to official adopters webpage (#1140)
• bcd4a41 fix: ensure tooling image is tried with platform (#1134)
• 0f3e14b docs: improve multiplatform docs (#1129)
• a0ede72 fix: preseve all platforms in manifest (#1121)
• e40e73d chore: bump k8s.io/apimachinery from 0.33.1 to 0.33.2 (#1126)
• 384ce30 chore: bump github.com/moby/buildkit from 0.22.0 to 0.23.1 (#1125)
• 98f4b8d chore: bump github.com/docker/buildx from 0.24.0 to 0.25.0 (#1124)
• 1d8182d feat: add multiplatform e2e plugin test (#1114)
• 936e5ee docs: Add Search to website using Algolia (#1082)
• d59dc84 chore: bump brace-expansion from 1.1.11 to 1.1.12 in /website (#1118)
• de8cc86 chore: bump the all group with 3 updates (#1117)
• 6f82a2b chore: bump github.com/quay/claircore from 1.5.38 to 1.5.39 (#1116)
• 3554dd4 chore: bump github.com/google/go-containerregistry from 0.20.5 to 0.20.6 (#1115)
• 980a86a feat: Add Multi Arch Enhancements (#1098)
• 0cb1e36 fix: remove directory and platform-specific-errors args from multi platform (#1105)
• ec81db9 chore: bump google.golang.org/grpc from 1.72.2 to 1.73.0 (#1102)
• 22d2dfb chore: bump the all group with 2 updates (#1103)
• c7b7620 chore: bump golang.org/x/sync from 0.14.0 to 0.15.0 (#1100)
• 81e2984 chore: bump github.com/quay/claircore from 1.5.37 to 1.5.38 (#1099)
• abc8a2d chore: bump the all group in /website with 3 updates (#1101)
• c8c5df7 feat: Add native v1alpha1 report support (#1079)
• f194e33 fix: run go mod tidy (#1089)
• 96b5f22 feat: add multiarch patching workflow changes (#1067)
• 5de655e chore: bump ossf/scorecard-action from 2.4.1 to 2.4.2 in the all group (#1088)
• d9a2b22 chore: bump the all group in /website with 3 updates (#1087)
• c4652e3 chore: bump github.com/aquasecurity/trivy from 0.62.1 to 0.63.0 (#1085)
• 08de1fe chore: bump github.com/docker/cli from 28.1.1+incompatible to 28.2.2+incompatible (#1084)
• 5cb0072 fix: add shorthand flag for report-dir (#1081)
• b23909e docs: Add Governance Documentation (#1056)
• 476bf93 docs: add contributor ladder (#1052)
• 976af1c feat: Improve EOL Logging (#1069)
• 4ce713b docs: consistent community docs (#1078)
• 2461712 chore: bump github.com/docker/buildx from 0.23.0 to 0.24.0 (#1076)
• e826c73 chore: bump google.golang.org/grpc from 1.72.1 to 1.72.2 (#1075)
• f03e9b6 chore: bump github.com/google/go-containerregistry from 0.20.3 to 0.20.5 (#1074)
• c13b260 chore: bump github.com/moby/buildkit from 0.21.1 to 0.22.0 (#1073)
• 65af385 docs: Keep FAQ headings consistent (#1062)
• c514838 docs: Clarify no VEX Document generation with update all (#1055)
• c83e230 feat: add multi arch command changes (#1009)
• 22714f0 chore: bump the all group with 4 updates (#1065)
• 0791d0d chore: bump k8s.io/apimachinery from 0.33.0 to 0.33.1 (#1064)
• 51540fd chore: bump google.golang.org/grpc from 1.72.0 to 1.72.1 (#1063)
• d134be6 chore: Add some tests for buildx context support (#1057)
• 2b1b860 chore: bump github.com/aquasecurity/trivy from 0.61.1 to 0.62.1 (#1050)
• 6527c0d chore: bump golang.org/x/sync from 0.13.0 to 0.14.0 (#1049)
• 8971c34 fix: Debian temprootfs (#997)
• 683fe61 chore: Fix some issues with docker and buildx connections (#1053)
• 088581a fix: oci media type should be respected (#949)
• 51d2f93 chore: bump the all group with 2 updates (#1051)
• aeadfd4 fix: upgrade golangci-lint to v2.1.0 (#1045)
• 7aaade6 chore: bump the all group with 3 updates (#1043)
• b133904 chore: bump github.com/quay/claircore from 1.5.36 to 1.5.37 (#1042)
• b556d47 chore: bump github.com/moby/buildkit from 0.21.0 to 0.21.1 (#1040)
• 64eea74 fix: guard against error buildkit solve (#1037)
• 4acc8bb chore: bump the all group with 2 updates (#1032)
• ae6a236 chore: bump github.com/docker/buildx from 0.22.0 to 0.23.0 (#1030)
• 1114d38 chore: bump github.com/docker/cli from 28.0.4+incompatible to 28.1.1+incompatible (#1029)
• 5a92c7a chore: bump github.com/docker/docker from 28.0.4+incompatible to 28.1.1+incompatible (#1028)
• bab90f9 fix: apt apk images fail tooling images missing (#985)
• efaf4ac fix: ignore shadow cves for integration test (#1027)
• d40cc92 feat: add push images on patch flag (#1004)
• 3450998 chore: bump the all group across 1 directory with 3 updates (#1025)
• 4e06b3e chore: bump github.com/quay/claircore from 1.5.35 to 1.5.36 (#1023)
• f8611f5 chore: bump google.golang.org/grpc from 1.71.1 to 1.72.0 (#1021)
• 7295d74 chore: bump github.com/moby/buildkit from 0.20.2 to 0.21.0 (#1020)
• 4249b87 chore: bump github.com/aquasecurity/trivy from 0.61.0 to 0.61.1 (#1019)
• 7bb6f12 feat: Discover Platforms Utility (#1017)
• 17087bb chore: bump http-proxy-middleware from 2.0.7 to 2.0.9 in /website (#1024)
• 4f277eb chore: bump golang.org/x/net from 0.37.0 to 0.38.0 (#1018)
• 0c56944 chore: bump the all group with 2 updates (#1016)
• b2df9d8 chore: bump estree-util-value-to-estree from 3.1.1 to 3.3.3 in /website (#1015)
• 775c4f5 chore: bump the all group with 3 updates (#1014)
• 08b45f3 chore: bump typescript from 5.8.2 to 5.8.3 in /website in the all group (#1013)
• d4d8249 chore: bump golang.org/x/sync from 0.12.0 to 0.13.0 (#1012)
• dc47244 chore: bump google.golang.org/grpc from 1.71.0 to 1.71.1 (#1011)
• 1c9fa0b docs: explain EOL image error messages in FAQ (#966)
• 2ddba47 feat: invalidate tdnf cache when patching (#973)
• 1c860be fix: fast fail for no upgrades (#1005)
• ef76edc docs: Add community docs (#996)
• ca76352 chore: bump image-size from 1.1.1 to 1.2.1 in /website (#1008)
• 4c3ddb8 fix: lint fixes for ci (#1006)
• 8d913bc chore: upgrade trivy to 0.61.0 (#1007)
• 79a73e8 chore: bump github.com/docker/buildx from 0.21.3 to 0.22.0 (#983)
• 0cc06f5 feat: add copa install command (#987)
• 7ffe2cd fix: rpm fails if mirror tooling image not present (#978)
• 1831fa8 chore: bump goreleaser/goreleaser-action from 6.2.1 to 6.3.0 in the all group (#1003)
• 6ec1a39 chore: bump github.com/docker/cli from 28.0.2+incompatible to 28.0.4+incompatible (#1002)
• 248e3f1 chore: bump github.com/spf13/viper from 1.20.0 to 1.20.1 (#1001)
• 885e8bd chore: bump github.com/moby/buildkit from 0.20.1 to 0.20.2 (#1000)
• 7548292 chore: bump the all group in /website with 2 updates (#999)
• 805cccc fix: golangci-lint v1 is not supported by golangci-lint-action v7 (#994)
• 6c3ef53 chore: bump the all group with 6 updates (#984)
• 2b7208b chore: add cbl-mariner/base/core:1.0 to mirrored tooling images (#979)
• 807ffe4 chore: bump k8s.io/apimachinery from 0.32.2 to 0.32.3 (#982)
• ac4b67e chore: bump github.com/docker/cli from 28.0.0-rc.2+incompatible to 28.0.2+incompatible (#981)
• d785a5c feat: add support for custom suffix tag (#961)
• 57bc16b chore: bump github.com/moby/buildkit from 0.19.0 to 0.20.1 (#943)
• b14e2c6 fix: dependency update for docker/buildx v0.21.3 (#972)
• 5d063c6 chore: bump github.com/spf13/viper from 1.19.0 to 1.20.0 (#963)
• 1870dbe chore: bump github.com/containerd/containerd from 1.7.25 to 1.7.27 (#969)
• 91bd53f chore: bump github.com/containerd/containerd/v2 from 2.0.2 to 2.0.4 (#968)
• 9ac05a3 chore: bump the all group with 3 updates (#964)
• bd9af6c chore: bump github.com/opencontainers/image-spec from 1.1.0 to 1.1.1 (#962)
• 4f5f2b8 chore: bump @babel/runtime from 7.26.0 to 7.26.10 in /website (#959)
• 68d8145 chore: bump @babel/runtime-corejs3 from 7.26.0 to 7.26.10 in /website (#958)
• 0cfae3f chore: bump @babel/helpers from 7.26.0 to 7.26.10 in /website (#957)
• 575ced0 chore: bump golang.org/x/net from 0.34.0 to 0.36.0 (#956)
• a5218a0 fix: update docs with mirrored tooling images (#955)
• a2bc70d feat: mirror tooling images to ghcr - part 2 (#947)
• 14844ad chore: bump prismjs from 1.29.0 to 1.30.0 in /website (#954)
• 1c7e595 chore: bump the all group with 2 updates (#950)
• b378a16 chore: bump google.golang.org/grpc from 1.70.0 to 1.71.0 (#951)
• 3c23ec6 chore: bump golang.org/x/sync from 0.11.0 to 0.12.0 (#952)
• 10d8ab0 feat: mirror tooling images to ghcr (#946)
• 1a84f1b docs: add docker extension (#948)
• d6cb5be chore: Generate v0.10.x docs (#945)