Sourced from github.com/in-toto/attestation's releases.

v1.1.1

What's Changed

• Fix broken links to ResourceDescriptor by @​alanssitis in in-toto/attestation#367
• Update link to SLSA framework proto file by @​phantomwhale in in-toto/attestation#382
• Simplify SCAI predicate TypeURI by @​marcelamelara in in-toto/attestation#380
• Add the reference predicate by @​mdeicas in in-toto/attestation#375
• Add proto definition for vuln predicate type by @​hectorj2f in in-toto/attestation#345
• vsa: Make verifiedLevels field repeated to match spec by @​adityasaky in in-toto/attestation#429
• fix discrepencies in v0.2 example by @​lumjjb in in-toto/attestation#408
• VulnsV2: Add missing invocation to protos and spec by @​puerco in in-toto/attestation#434
• Expose known algorithms by @​puerco in in-toto/attestation#427
• add slsa provenance predicate v0.2 protobuf by @​kpauljoseph in in-toto/attestation#417

New Contributors

• @​tannerjones4075 made their first contribution in in-toto/attestation#366
• @​alanssitis made their first contribution in in-toto/attestation#367
• @​phantomwhale made their first contribution in in-toto/attestation#382
• @​mdeicas made their first contribution in in-toto/attestation#375
• @​Dman0808 made their first contribution in in-toto/attestation#394
• @​lumjjb made their first contribution in in-toto/attestation#408
• @​puerco made their first contribution in in-toto/attestation#434
• @​kpauljoseph made their first contribution in in-toto/attestation#417

Full Changelog: in-toto/attestation@v1.1.0...v1.1.1

• 7017ad8 Regenerate attestation libraries (#435)
• 808ca43 Merge pull request #417 from kpauljoseph/in-toto-v0.2-provenance
• 2358a9c Merge pull request #427 from puerco/expose-algos
• 6e0b70a Merge pull request #434 from puerco/vulnsv02-proto
• 4d9125d Merge pull request #408 from lumjjb/update-vuln-02
• e474a1f Fix typo in vulns02 example
• 72054e5 Fix inconsistencies in vulnsv2 proto vs spec
• 4a4ddf5 add slsa provenance predicate v0.2
• a50a5a1 Expose known algorithms
• 11ca4fc Regenerate attestation libraries (#430)
• Additional commits viewable in compare view

Sourced from github.com/sigstore/cosign/v2's releases.

v2.4.2

Features

• Updated open-policy-agent to 1.1.0 library (#4036)
  • Note that only Rego v0 policies are supported at this time
• Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
• Add support for verifying root checksum in cosign initialize (#3953)
• Detect if user supplied a valid protobuf bundle (#3931)
• Add a log message if user doesn't provide --trusted-root (#3933)
• Support mTLS towards container registry (#3922)
• Add bundle create helper command (#3901)
• Add trusted-root create helper command (#3876)

Bug Fixes

• fix: set tls config while retaining other fields from default http transport (#4007)
• policy fuzzer: ignore known panics (#3993)
• Fix for multiple WithRemote options (#3982)
• Add nightly conformance test workflow (#3979)
• Fix copy --only for signatures + update/align docs (#3904)

Documentation

• Remove usage.md from spec, point to client spec (#3918)
• move reference from gcr to ghcr (#3897)

Contributors

• AdamKorcz
• Aditya Sirish
• Bob Callaway
• Carlos Tadeu Panato Junior
• Cody Soyland
• Colleen Murphy
• Hayden B
• Jussi Kukkonen
• Marco Franssen
• Nianyu Shen
• Slavek Kabrda
• Søren Juul
• Warren Hodgkinson
• Zach Steindler

Sourced from github.com/sigstore/cosign/v2's changelog.

v2.4.2

Features

• Updated open-policy-agent to 1.1.0 library (#4036)
  • Note that only Rego v0 policies are supported at this time
• Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
• Add support for verifying root checksum in cosign initialize (#3953)
• Detect if user supplied a valid protobuf bundle (#3931)
• Add a log message if user doesn't provide --trusted-root (#3933)
• Support mTLS towards container registry (#3922)
• Add bundle create helper command (#3901)
• Add trusted-root create helper command (#3876)

Bug Fixes

• fix: set tls config while retaining other fields from default http transport (#4007)
• policy fuzzer: ignore known panics (#3993)
• Fix for multiple WithRemote options (#3982)
• Add nightly conformance test workflow (#3979)
• Fix copy --only for signatures + update/align docs (#3904)

Documentation

• Remove usage.md from spec, point to client spec (#3918)
• move reference from gcr to ghcr (#3897)

Contributors

• AdamKorcz
• Aditya Sirish
• Bob Callaway
• Carlos Tadeu Panato Junior
• Cody Soyland
• Colleen Murphy
• Hayden B
• Jussi Kukkonen
• Marco Franssen
• Nianyu Shen
• Slavek Kabrda
• Søren Juul
• Warren Hodgkinson
• Zach Steindler

• b6df9c7 update v2.4.2 changelog (#4045)
• ff13ba4 chore(deps): bump github.com/open-policy-agent/opa from 0.68.0 to 1.1.0 (#4036)
• 4dc18dd test against newer k8s, scaffolding release (#4044)
• e4ff8e2 chore(deps): bump cuelang.org/go from 0.11.2 to 0.12.0 (#4035)
• cced656 fix warning message from golangci-lint (#4043)
• 486937b chore(deps): move github.com/xanzy/go-gitlab to gitlab.com/gitlab-org/api/cli...
• 9f142a5 chore(deps): bump github.com/sigstore/sigstore-go (#4034)
• 4937bca chore(deps): bump the gomod group across 1 directory with 2 updates (#4042)
• a71220e chore(deps): bump google.golang.org/api from 0.218.0 to 0.219.0 (#4038)
• fcf13eb chore(deps): bump sigs.k8s.io/release-utils from 0.9.0 to 0.11.0 (#4040)
• Additional commits viewable in compare view

Sourced from github.com/sigstore/rekor's releases.

v1.3.9

Changelog

• f3db95b2bb18be7e1904fa25d1bcdb7d55caa73a Cache checkpoint for inactive shards (#2332)
• f875aa2d39b2bcef0e84e43a6153447bed0077f6 Support per-shard signing keys (#2330)

Thanks for all contributors!

Sourced from github.com/sigstore/rekor's changelog.

v1.3.9

Features

• Cache checkpoint for inactive shards (#2332)
• Support per-shard signing keys (#2330)

Contributors

• Hayden B

• b67ee82 build(deps): Bump google.golang.org/grpc from 1.69.4 to 1.70.0
• 40f29ba build(deps): Bump golang from 51a6466 to 8c10f21
• 2497b42 build(deps): Bump google/cloud-sdk from 506.0.0 to 507.0.0
• ac42c19 build(deps): Bump google.golang.org/api from 0.217.0 to 0.218.0
• 10e8115 build(deps): Bump the all group with 3 updates
• 2f182a1 build(deps): Bump google.golang.org/protobuf in the all group
• f3db95b Cache checkpoint for inactive shards (#2332)
• 1cb78ca build(deps): Bump google/cloud-sdk from 505.0.0 to 506.0.0
• b68f6bb build(deps): Bump google.golang.org/api from 0.216.0 to 0.217.0
• 15c696c build(deps): Bump github.com/tink-crypto/tink-go/v2 from 2.2.0 to 2.3.0
• Additional commits viewable in compare view

Sourced from github.com/spiffe/go-spiffe/v2's releases.

v2.5.0

Added

• workloadapi.TargetFromAddress function to parse out a gRPC target from a SPIFFE_ENDPOINT_SOCKET compatible address (#321)

Changed

• Minimum Go version is now go1.22.11, matching our downstream dependencies (#325)

Sourced from github.com/spiffe/go-spiffe/v2's changelog.

[2.5.0] - 2025-01-31

Added

• workloadapi.TargetFromAddress function to parse out a gRPC target from a SPIFFE_ENDPOINT_SOCKET compatible address (#321)

Changed

• Minimum Go version is now go1.22.11, matching our downstream dependencies (#325)

• dd15542 Changelog for 2.5.0 (#326)
• f1afca7 Export function to get target from address (#321)
• 078393f Bump google.golang.org/grpc from 1.67.1 to 1.70.0 in /v2 (#324)
• 3a87d63 Upgrade to go1.22 (#325)
• 896d311 Bump golang.org/x/net from 0.28.0 to 0.33.0 in /v2 (#322)
• 49cafab Bump golang.org/x/crypto from 0.26.0 to 0.31.0 in /v2 (#323)
• d5cb2fc Bump google.golang.org/protobuf from 1.34.2 to 1.36.1 in /v2 (#317)
• b82bcea Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 in /v2 (#312)
• 7c29672 Bump github.com/zeebo/errs from 1.3.0 to 1.4.0 in /v2 (#308)
• 87cfecf doc: minor doc updates (#295)
• See full diff in compare view

Sourced from github.com/tektoncd/pipeline's releases.

Tekton Pipeline release v0.68.0 "LaPerm Giskard Reventlov" LTS

-Docs @ v0.68.0 -Examples @ v0.68.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.68.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a666d35f8508100e4c8e112033d805978d152a05eef3872377816f3756a588089

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a666d35f8508100e4c8e112033d805978d152a05eef3872377816f3756a588089
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.68.0/release.yaml
REKOR_UUID=108e9186e8c5677a666d35f8508100e4c8e112033d805978d152a05eef3872377816f3756a588089
Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.68.0@sha256:" + .digest.sha256')
Download the release file
curl "$RELEASE_FILE" > release.yaml
For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

• ✨ feat: improve step.Script variables references validation message (#8312)

... (truncated)

Sourced from github.com/tektoncd/pipeline's changelog.

Tekton Pipeline Releases

Release Frequency

Tekton Pipelines follows the Tekton community [release policy][release-policy] as follows:

• Versions are numbered according to semantic versioning: vX.Y.Z
• A new release is produced on a monthly basis
• Four releases a year are chosen for long term support (LTS). All remaining releases are supported for approximately 1 month (until the next release is produced)
  • LTS releases take place in January, April, July and October every year
  • The first Tekton Pipelines LTS release will be v0.41.0 in October 2022
  • Releases happen towards the middle of the month, between the 13th and the 20th, depending on week-ends and readiness

Tekton Pipelines produces nightly builds, publicly available on gcr.io/tekton-nightly.

Transition Process

Before release v0.41 Tekton Pipelines has worked on the basis of an undocumented support period of four months, which will be maintained for the releases between v0.37 and v0.40.

Release Process

Tekton Pipeline releases are made of YAML manifests and container images. Manifests are published to cloud object-storage as well as [GitHub][tekton-pipeline-releases]. Container images are signed by [Sigstore][sigstore] via [Tekton Chains][tekton-chains]; signatures can be verified through the [public key][chains-public-key] hosted by the Tekton Chains project.

Further documentation available:

• The Tekton Pipeline [release process][tekton-releases-docs]
• [Installing Tekton][tekton-installation]
• Standard for [release notes][release-notes-standards]

Release

v0.68 (LTS)

• Latest Release: [v0.68.0][v0.68-0] (2025-01-30) ([docs][v0.68-0-docs], [examples][v0.68-0-examples])
• Initial Release: [v0.68.0][v0.68-0] (2025-01-30)
• End of Life: 2026-01-30
• Patch Releases: [v0.68.0][v0.68-0]

v0.65 (LTS)

... (truncated)

• c6d38c9 test: check for circular dependency in stepaction validation
• 8df0a96 fix: reference params in default values, allow chained references
• cc7f613 build(deps): bump github.com/google/cel-go from 0.22.1 to 0.23.1
• f6259fd build(deps): bump the all group in /tekton with 2 updates
• 3f8855a fix(computeresource/tasklevel): Fixed a bug where abnormal calculations cause...
• 7021f7b Fix deprecated golangci-lint configuration
• cef86d1 fix: inline error check and assert invalid step result ref error
• 8777a96 docs: parameter substitution precedence
• 68d09e3 fix: check for duplicates after applying the substitutions
• 7d5a534 test: invalid step result reference
• Additional commits viewable in compare view

• 9290511 go.mod: update golang.org/x dependencies
• fa5273e x509roots/fallback: update bundle
• a8ea4be ssh: add ServerConfig.PreAuthConnCallback, ServerPreAuthConn (banner) interface
• 71d3a4c acme: support challenges that require the ACME client to send a non-empty JSO...
• See full diff in compare view

• See full diff in compare view

Sourced from google.golang.org/grpc's releases.

Release 1.70.0

Behavior Changes

• client: reject service configs containing an invalid retryPolicy in accordance with gRFCs A21 and A6. (#7905)
  • Note that this is a potential breaking change for some users using an invalid configuration, but continuing to allow this behavior would violate our cross-language compatibility requirements.

New Features

• xdsclient: fallback to a secondary management server (if specified in the bootstrap configuration) when the primary is down is enabled by default. Can be disabled by setting the environment variable GRPC_EXPERIMENTAL_XDS_FALLBACK to false. (#7949)
• experimental/credentials: experimental transport credentials are added which don't enforce ALPN. (#7980)
  • These credentials will be removed in an upcoming grpc-go release. Users must not rely on these credentials directly. Instead, they should either vendor a specific version of gRPC or copy the relevant credentials into their own codebase if absolutely necessary.

Bug Fixes

• xds: fix a possible deadlock that happens when both the client application and the xDS management server (responsible for configuring the client) are using the xds:/// scheme in their target URIs. (#8011)

Performance

• server: for unary requests, free raw request message data as soon as parsing is finished instead of waiting until the method handler returns. (#7998)
  • Special Thanks: @​lqs

Documentation

• examples/features/gracefulstop: add example to demonstrate server graceful stop. (#7865)

• 98a0092 Change version to 1.70.0 (#7984)
• bf380de Cherrypick #7998, #8011, #8010 into 1.70.x (#8028)
• 54b3eb9 experimental/credentials: Add credentials that don't enforce ALPN (#7980) (#8...
• 62b9185 clustetresolver: Copy endpoints.Addresses slice from DNS updates to avoid dat...
• 724f450 examples/features/csm_observability: use helloworld client and server instead...
• e8d5feb rbac: add method name to :path in headers (#7965)
• e912015 cleanup: Fix usages of non-constant format strings (#7959)
• 681334a cleanup: replace dial with newclient (#7943)
• 063d352 internal/resolver: introduce a new resolver to handle target URI and proxy ad...
• 10c7e13 outlierdetection: Support health listener for ejection updates (#7908)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions