v1.4.8

Changelog

• 61a8328 chore(deps): update dependency go to v1.23.6 (#52)
• 4c55ea7 docs: add attestation verification instructions to README.md

v1.4.7

Changelog

• 71b8692 ci: add build provenance and SBOMs, update .goreleaser.yaml
• 90f6417 chore(deps): update dependency go to v1.23.5 (#51)
• 4a1608b fix(deps): update module github.com/spf13/afero to v1.12.0 (#50)
• 89c45cc chore(deps): update anchore/scan-action action to v6 (#49)
• 184710a chore(deps): update dependency go to v1.23.4 (#48)
• 057cb37 chore(deps): update dependency go to v1.23.3
• d9bd6c2 chore(deps): update anchore/scan-action action to v5 (#46)
• 64634a7 chore(deps): update anothrnick/github-tag-action action to v1.71.0 (#43)
• 2efbd5e chore(deps): update dependency go to v1.23.2

v1.4.6

Changelog

• aa45de1 chore(deps): update dependency go to v1.23.1
• 51ff56d chore(deps): update dependency go to v1.23.0 (#40)
• e913408 chore(deps): update dependency dominikh/go-tools to v2024 (#41)
• a09fe13 chore(deps): update dependency go to v1.22.6
• 1ec69fc ci: fix coverage-badge-for-prs.yml syntax
• 9b3b566 chore(deps): update dependency go to v1.22.5
• 35fabe8 ci: disable coverage-badge-for-prs.yml for Renovate PRs
• 0ebca03 ci: enable auto-merging for Golang versions in the GHA workflows, and for Go dependencies
• 8752ac4 ci: apply the Golang version detection approach to all files
• 74c15f4 Attempt to detect Golang version updates in the setup-go action

v1.4.5

Changelog

• 21c6ddc ci: use custom PAT in release-security-fix workflow
• c5a49a8 ci: fully activate the release-security-fix.yml workflow
• 59fadee ci: set Gryft scan output format to "table"
• 5571ea1 ci: add workflow that auto-creates a new tag on vulnerability fixes

v1.4.4

This is only a dependency-update release (rebuild using the latest Go 1.21.11) to fix CVE-2024-24790 (see #37).

Changelog

• 8271343 chore(deps): update goreleaser/goreleaser-action action to v6 (#36)
• 442b0fc chore(deps): update dependency dominikh/go-tools to v2023.1.7 (#34)
• e98cbac Fix Renovate RegEx manager syntax
• b9c18f9 Configure Renovate (#16)

v1.4.3

This is only a dependency-update release to fix CVE-2023-45288 (see #31).

Changelog

• 2ad5f0f Bump tj-actions/verify-changed-files from 19 to 20 (#30)
• 7d7e785 Bump dominikh/staticcheck-action from 1.3.0 to 1.3.1 (#29)
• 6b54905 Bump tj-actions/verify-changed-files from 18 to 19 (#28)
• a7cf2b0 Bump tj-actions/verify-changed-files from 17 to 18 (#27)
• 2dd46ad Bump tj-actions/verify-changed-files from 16 to 17 (#26)
• bfebc38 Bump actions/setup-go from 4 to 5 (#25)

v1.4.2

Changelog

This is only a dependency-update release. As of the release date, there are no known vulnerabilities, thanks to #22

• 237d281 Merge pull request #23 from MShekow/chore/update-go
• 0e8370c chore: bump Go to 1.21
• 4e9a040 Merge pull request #22 from MShekow/dependabot/go_modules/main/github.com/spf13/afero-1.11.0
• dd04913 Bump github.com/spf13/afero from 1.9.5 to 1.11.0
• 4cc4363 Merge pull request #20 from MShekow/dependabot/go_modules/main/github.com/go-errors/errors-1.5.1
• 5cc9f14 Bump github.com/go-errors/errors from 1.5.0 to 1.5.1
• 38c7959 Merge pull request #18 from MShekow/dependabot/go_modules/main/github.com/go-errors/errors-1.5.0
• 34e0717 Merge pull request #19 from MShekow/dependabot/github_actions/main/goreleaser/goreleaser-action-5
• ef08282 Bump goreleaser/goreleaser-action from 4 to 5
• 4eb52ce Bump github.com/go-errors/errors from 1.4.2 to 1.5.0
• 311f185 Merge pull request #17 from MShekow/dependabot/github_actions/main/actions/checkout-4
• 1a8e63a Bump actions/checkout from 3 to 4
• 5494587 Merge pull request #15 from MShekow/dependabot/github_actions/main/tj-actions/verify-changed-files-16
• 1785f23 Bump tj-actions/verify-changed-files from 15 to 16
• 733bb8b Merge pull request #14 from MShekow/dependabot/github_actions/main/tj-actions/verify-changed-files-15
• 22f3ae1 Bump tj-actions/verify-changed-files from 14 to 15

v1.4.1

Changelog

• Update transitive golang.org/x/text dependency to 0.3.7 to fix CVE-2021-38561 (note: we need to wait for afero to update to 0.3.8 to fix CVE-2022-32149, see spf13/afero#381)

v1.4

Changelog

• Skip files with unsupported mode (e.g. character device or socket), print a warning instead

v1.3

Changelog

• Handle unhandled error of f.Close() in computeFileChecksum() with a print
• Use "go-errors/errors" for proper error stack traces