zarf-dev/zarf v0.89.0-rc3 on GitHub

What's Changed

🚀 Updates

fix: catch and handle empty digests by @eoghanriley in #5501
feat(oci): support custom credential providers by @s-urbaniak in #5502
chore: update go version to 1.26.10 by @brandtkeller in #5509
docs: remove outdated note from package-signing doc by @jonnyborbs in #5508
feat!: remove defense unicorn shortcuts from oci package refs by @AustinAbro321 in #5504
fix: correctly save chart removal progress after subsequent chart removal fails by @AustinAbro321 in #5492
feat!: required injector image in proxy mode by @AustinAbro321 in #5494
fix!: simplify image layer caching to avoid concurrency issues by @AustinAbro321 in #5495
test: cover localhost NodePorts with nftables in kind by @aditya-rai-5 in #5513
feat!: stop duplicating package data in package secret by @AustinAbro321 in #5527
feat(v1beta1)!: make sbom and documentation into granular files and layers by @brandtkeller in #5421
fix!: remove ###ZARF builtins from v1beta1 by @AustinAbro321 in #5506
feat!: add id to image object by @AustinAbro321 in #5480
feat: remove BuildData from output of zarf dev upgrade by @AustinAbro321 in #5522
feat(v1beta1)!: limit annotation size by @AustinAbro321 in #5526
feat: improve v1beta1 component config override import logic by @AustinAbro321 in #5474
fix(cmd): don't redefine vendored tool flag shorthands by @a1994sc in #5496
feat(v1beta1)!: rename documentation to attachments by @AustinAbro321 in #5518
feat(v1beta1)!: change differential to an object by @AustinAbro321 in #5541
chore: contributor ladder enhancements by @brandtkeller in #5543
feat(create)!: validate package secret size by @AustinAbro321 in #5528
chore(lint): update to golangci-lint v2.15 by @AustinAbro321 in #5540
fix: use canonical reference for sbom source by @brandtkeller in #5545
feat(zoci)!: support granular layers from Load api by @brandtkeller in #5538
feat: introduce v1beta1 init package by @AustinAbro321 in #5453
feat: release v1beta1 by @AustinAbro321 in #5551
feat!: explit opt in to kustomize plugins on read only dev commands by @AustinAbro321 in #5558
fix: component publish values schema by @AustinAbro321 in #5565
fix: initialize cluster state before recording init status by @AustinAbro321 in #5566

📦 Dependencies

chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5533
chore(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 in the actions-organization group across 1 directory by @dependabot[bot] in #5532
chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 by @dependabot[bot] in #5555

New Contributors

@eoghanriley made their first contribution in #5501
@s-urbaniak made their first contribution in #5502
@aditya-rai-5 made their first contribution in #5513

Full Changelog: v0.89.0-rc2...v0.89.0-rc3

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.89.0-rc3.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0-rc3" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.89.0-rc3.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0-rc3" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.