suzuki-shunsuke/tfmv v1.0.1

on GitHub

v1.0.0...v1.0.1

Security

#782 Update Go to v1.27.3

v1.0.0 was built with Go 1.25.5. This release is built with Go 1.27.3, and includes the security fixes of the Go releases between them.

Go 1.27.3 fixes CVE-2026-111943 in crypto/x509, but tfmv doesn't access the network, so it isn't affected.

ref.

• https://go.dev/doc/devel/release

⚠️ Changes of Release Assets

The tfmv binary itself isn't affected, but the release assets for verification have changed.

• #644 *.sig and *.pem aren't published anymore, and *.bundle is renamed to *.sigstore.json (Sigstore bundle)
• #756 multiple.intoto.jsonl isn't published anymore. Use Cosign, GitHub Artifact Attestations, or packslip instead
• #798 A signed packslip packslip.sigstore.json is published. You can verify downloaded assets with packslip

Documentation

#671 #672 Fix the installation guide

Dependency Updates

#479 #506 #513 #538 #558 #601 #627 #665 #707 #710 #725 #763 #782 Update Go to v1.27.3

#738 github.com/hashicorp/hcl/v2 v2.25.0
#598 github.com/minamijoyo/hcledit v0.2.18
#566 github.com/google/go-jsonnet v0.22.0
#491 #545 github.com/suzuki-shunsuke/slog-util v0.3.2
#478 github.com/suzuki-shunsuke/slog-error v0.2.2