v3.11.1
Sec
- Notary delegation fallback allowed stealthy fallback to targets #2151
- Count distinct trust roots for signature thresholds in cosign #2150, reported by @arpitjain099.
Fix
- Add timeouts to various http clients #2144
Build
- Remove hidden files from build context #2139
Ci
- Limit pr workflow to one concurrent run per branch #2143
Test
- Match go-containerregistry fix #2123
Update
- Bump the gomod-packages group across 1 directory with 6 updates #2148
- Bump the gh-actions-packages group across 1 directory with 7 updates #2149
- Bump the gomod-packages group across 1 directory with 15 updates #2123
- google.golang.org/grpc v1.82.1 #2153
What's Changed
- fix: Add timeouts to http clients by @Starkteetje in #2144
- ci: Limit PR workflow to one concurrent run per branch by @Starkteetje in #2143
- update: bump the gomod-packages group across 1 directory with 15 updates by @dependabot[bot] in #2123
- build: Remove hidden files from build context by @Starkteetje in #2139
- update: bump the gh-actions-packages group across 1 directory with 7 updates by @dependabot[bot] in #2149
- update: bump the gomod-packages group across 1 directory with 6 updates by @dependabot[bot] in #2148
- sec: count distinct trust roots for signature thresholds in cosign by @phbelitz in #2150, reported by @arpitjain099. Thank you for the coordinated disclosure.
- sec: Notary delegation fallback allowed stealthy fallback to targets by @Starkteetje in #2151
- update: google.golang.org/grpc v1.82.1 by @phbelitz in #2153
- Develop by @phbelitz in #2152
Full Changelog: v3.11.0...v3.11.1