Changelog
- c96a0e0 chore: bump browserslist from 4.21.4 to 4.28.8 in /website (#1693)
- eb02cc2 test: make LogPipe test deterministic (#1696)
- abc1cda fix: nil platform panic and OpenVEX schema compliance (#1672)
- 591eeb4 chore: bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 (#1689)
- bce4922 fix(langmgr): append +incompatible suffix for pre-module major>=2 Go deps (#1682)
- 2a7738b fix(langmgr): skip Go updates where fixed version is not newer than installed (#1683)
- b887c53 chore: bump github.com/testcontainers/testcontainers-go from 0.40.0 to 0.44.0 (#1568)
- 3bfde8d fix: emit Go language updates and rebuild steps in deterministic order (#1680)
- 542b2c4 chore: bump the all group across 1 directory with 18 updates (#1659)
- 7dbf73a feat: add experimental Helm chart-aware patching (#1547)
- 3837b7e feat: support Ubuntu Chiseled image patching (#1667)
- 0cd0da1 chore: bump github.com/moby/buildkit from 0.28.1 to 0.31.1 (#1675)
- 833b457 chore: bump github.com/moby/go-archive from 0.2.0 to 0.3.0 (#1674)
- 4f447a2 fix: update Go to 1.25.13 (#1673)
- a9ce98b fix: skip index entries with no platform in DiscoverPlatformsFromReference (#1647)
- a9ffbdc chore: bump js-yaml from 4.1.0 to 4.3.1 in /website (#1669)
- ac7a016 chore: bump brace-expansion from 1.1.13 to 1.1.18 in /website (#1668)
- e89831e docs: mention experimental Go binary rebuild in FAQ (#1665)
- 5542745 chore: bump nanoid from 3.3.16 to 3.3.18 in /website (#1671)
- 3c62f57 feat: Add support for SLES 16 and update rpm db location (#1621)
- 0a139f4 fix(ci): restore runtime and vulnerability checks (#1670)
- b23efc6 chore: bump websocket-driver from 0.7.4 to 0.7.5 in /website (#1650)
- 520a008 chore: bump svgo from 3.3.3 to 3.3.4 in /website (#1654)
- b8f3644 chore: bump shell-quote from 1.8.4 to 1.10.0 in /website (#1656)
- da6ae37 chore: bump webpack-dev-server from 5.2.5 to 5.2.6 in /website (#1660)
- f686467 chore: bump seroval from 1.5.0 to 1.5.6 in /website (#1662)
- 670ce09 chore: bump body-parser from 1.20.5 to 1.20.6 in /website (#1663)
- 81bf1ce chore: bump postcss from 8.5.10 to 8.5.25 in /website (#1666)
- 9427841 chore: bump the all group across 1 directory with 7 updates (#1658)
- 00cc7ca perf: optimize vex and progress hot paths (#1639)
- 9e8bba2 fix: avoid forced recompression on local export (#1637)
- 28e1fe0 chore: bump github.com/containerd/containerd/v2 from 2.2.1 to 2.2.5 (#1631)
- 0f6f0ab chore: bump http-proxy-middleware from 2.0.9 to 2.0.10 in /website (#1633)
- c0ec6fb chore: bump actions/checkout from 6.0.3 to 7.0.0 in the all group (#1630)
- 391b450 chore: bump webpack-dev-server from 5.2.4 to 5.2.5 in /website (#1632)
- b02d59a chore: bump asciinema-player from 3.15.1 to 3.16.0 in /website in the all group (#1629)
- dd0b185 fix: diff RPM repatch output against current image state (#1589)
- b81e352 fix: bind media type detection to patch context (#1587)
- 979d65f fix: additional issues with hitting the registry instead of the local daemon (#1614)
- 6fe2d2f chore: bump launch-editor from 2.11.1 to 2.14.1 in /website (#1627)
- 1375800 chore: bump shell-quote from 1.8.3 to 1.8.4 in /website (#1624)
- 56a0cc4 chore: bump @babel/core from 7.26.0 to 7.29.7 in /website (#1628)
- 6e4a3e5 chore: bump joi from 17.13.0 to 17.13.4 in /website (#1625)
- bf5ee3d chore: bump the all group across 1 directory with 11 updates (#1626)
- 6b04f5b test(patch): add single-image helper coverage and fix EnsurePath error handling (#1576)
- 17ce60a build(codecov): clean up coverage denominator and add flag_management (#1579)
- 461f3d4 fix(test/e2e): allowlist known transitive CVEs in nodejs patch verification (#1622)
- 4a22fe2 chore: bump the all group in /website with 2 updates (#1619)
- 1670527 fix: update x/crypto for govulncheck (#1617)
- d68411f chore: bump @babel/plugin-transform-modules-systemjs from 7.25.9 to 7.29.4 in /website (#1599)
- 1bbaa77 test(patch): add unit tests for pkg/patch/multi.go (#1577)
- dc58d25 fix(langmgr,provenance): tolerate broken upstream go.mod with 'go mod tidy -e' (#1602)
- c8fc29c docs: add shared agent instructions (#1598)
- a371563 chore: bump webpack-dev-server from 5.2.2 to 5.2.4 in /website (#1611)
- c29b802 chore: bump the all group across 1 directory with 2 updates (#1603)
- fa99dea chore: add @omercnet to CODEOWNERS (#1615)
- 3f8d217 test: convert silent t.Skip to t.Fatal in baseline-scan checks (#1578)
- bffc5a7 chore: bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 (#1600)
- 12a0836 chore: bump github.com/moby/moby/api from 1.54.1 to 1.54.2 (#1584)
- 4a1e60f docs: add FAQ for GPG key expiry (#1610)
- 1f2bfc0 build: add -coverpkg=./pkg/... to unit test target (#1575)
- 1ba3a82 chore: bump the all group across 1 directory with 12 updates (#1606)
- ad69ae9 fix: capture original manifest annotations before patching to prevent tag overwrite (#1605)
- 88248b9 fix: govuln fix - update go version to 1.25.10 (#1608)
- 46882ed ci(integration): pin Trivy DB digest to make CI reproducible (#1592)
- 78d7412 fix(frontend): restore /tmp on scratch image, switch to distroless, build real Dockerfile in e2e (#1597)
- a077ddf docs: document private registry app patching limitation (#1595)
- 1934ba8 chore: bump the all group in /website with 3 updates (#1585)
- 14a42e1 chore: Generate v0.14.x docs (#1590)