What's Changed

• Document immutable release tag recovery by @nodeselector in #25
• Tighten release recovery guidance by @nodeselector in #26
• Add hostname to lockfile dependencies by @kaibocai in #29

New Contributors

• @kaibocai made their first contribution in #29

Full Changelog: go/v0.0.5-rc.2...go/v0.0.6-rc.1

What's Changed

• Add Dependency Review workflow by @nodeselector in #18
• lockfile: emit domain-specific duplicate dependency key parse error by @nodeselector in #22
• Release tooling supports sequential release candidates by @nodeselector in #23
• Release workflow preserves annotated tag refs by @nodeselector in #24

Full Changelog: https://github.com/github/actions-lockfile/commits/go/v0.0.5-rc.2

What's Changed

• Security hardening: input validation and resource limits by @nodeselector in #6
• Beginner UX pass: godoc clarity across the lockfile package by @nodeselector in #5
• lockfile: v0.0.2 schema - drop branch, ref required, multi-version parsing by @nodeselector in #7

Full Changelog: go/v0.0.3...go/v0.0.4

What's Changed

• Rename gh-actions-pin references to gh-actions-lock by @nodeselector in #4

Full Changelog: go/v0.0.2...go/v0.0.3

What's Changed

• Strict field validation and scoped per-workflow Parse by @nodeselector in #3

Full Changelog: go/v0.0.1...go/v0.0.2

What's Changed

• feat(lockfile): migrate parser package from gh-actions-pin by @nodeselector in #1

New Contributors

• @nodeselector made their first contribution in #1

Full Changelog: https://github.com/github/actions-lockfile/commits/go/v0.0.1