What's Changed

• fix: skip yaml encoding when selector filters all documents by @khrm in #1694

Deps

• build(deps): bump the github-actions group with 11 updates by @dependabot[bot] in #1691
• build(deps): bump github.com/sigstore/rekor from 1.5.1 to 1.5.2 by @dependabot[bot] in #1692
• build(deps): bump the gomod group across 1 directory with 9 updates by @dependabot[bot] in #1688

New Contributors

• @khrm made their first contribution in #1694

Full Changelog: v0.19.0...v0.19.1

What's Changed

• Add repeatable --ldflags flag for go build by @imjasonh in #1680
• fix: apply defaultFlags before flag manipulation in .ko.yaml by @mateenali66 in #1612
• fix: write directory headers in kodata tar archives by @0xiso in #1604
• security: reject -toolexec in GOFLAGS environment variable by @mohammadmseet-hue in #1618
• build: prevent kodata symlinks from escaping the kodata root by @evilgensec in #1619
• fix: correct --sbom-dir flag description (file → directory) by @immanuwell in #1648

New Contributors

• @ajayk made their first contribution in #1606
• @mateenali66 made their first contribution in #1612
• @mohammadmseet-hue made their first contribution in #1618
• @alexandear made their first contribution in #1621
• @evilgensec made their first contribution in #1619
• @immanuwell made their first contribution in #1648
• @SebTardif made their first contribution in #1664

Full Changelog: v0.18.1...v0.19.0

What's Changed

• update labelsNode to match new labels interface in kube 1.34 by @ecordell in #1584

Other

• build(deps): bump k8s.io/apimachinery from 0.33.0 to 0.33.1 by @dependabot[bot] in #1513
• Revert "drop -m flag" to fix empty SBOM generation in v0.18.0 by @0xiso in #1514
• build(deps): bump github.com/google/go-containerregistry from 0.20.4-0.20250225234217-098045d5e61f to 0.20.4 by @dependabot[bot] in #1516
• build(deps): bump sigs.k8s.io/kind from 0.27.0 to 0.29.0 by @dependabot[bot] in #1517
• build(deps): bump github.com/google/go-containerregistry from 0.20.4 to 0.20.5 by @dependabot[bot] in #1518
• Update ko version used in CI by @maboehm in #1501
• build(deps): bump golang.org/x/sync from 0.14.0 to 0.15.0 by @dependabot[bot] in #1522
• build(deps): bump golang.org/x/tools from 0.33.0 to 0.34.0 by @dependabot[bot] in #1521
• build(deps): bump github.com/google/go-containerregistry from 0.20.5 to 0.20.6 by @dependabot[bot] in #1527
• build(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 by @dependabot[bot] in #1529
• build(deps): bump github.com/sigstore/cosign/v2 from 2.5.0 to 2.5.1 by @dependabot[bot] in #1530
• build(deps): bump github.com/sigstore/cosign/v2 from 2.5.1 to 2.5.2 by @dependabot[bot] in #1531
• build(deps): bump k8s.io/apimachinery from 0.33.1 to 0.33.2 by @dependabot[bot] in #1532
• build(deps): bump github.com/docker/docker from 28.2.2+incompatible to 28.3.0+incompatible by @dependabot[bot] in #1533
• build(deps): bump github.com/docker/docker from 28.3.0+incompatible to 28.3.1+incompatible by @dependabot[bot] in #1535
• build(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 by @dependabot[bot] in #1537
• build(deps): bump github.com/docker/docker from 28.3.1+incompatible to 28.3.2+incompatible by @dependabot[bot] in #1538
• build(deps): bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 by @dependabot[bot] in #1540
• build(deps): bump k8s.io/apimachinery from 0.33.2 to 0.33.3 by @dependabot[bot] in #1541
• build(deps): bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.5.3 by @dependabot[bot] in #1542
• bump cosign and rekor to HEAD to fix cve for go-chi/chi dep by @cpanato in #1547
• build(deps): bump golang.org/x/tools from 0.34.0 to 0.36.0 by @dependabot[bot] in #1546
• build(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible by @dependabot[bot] in #1544
• build(deps): bump k8s.io/apimachinery from 0.33.3 to 0.33.4 by @dependabot[bot] in #1549
• build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 by @dependabot[bot] in #1551
• build(deps): bump github.com/stretchr/testify from 1.11.0 to 1.11.1 by @dependabot[bot] in #1553
• build(deps): bump sigs.k8s.io/kind from 0.29.0 to 0.30.0 by @dependabot[bot] in #1552
• build(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @dependabot[bot] in #1555
• build(deps): bump github.com/docker/docker from 28.3.3+incompatible to 28.4.0+incompatible by @dependabot[bot] in #1556
• build(deps): bump golang.org/x/tools from 0.36.0 to 0.37.0 by @dependabot[bot] in #1561
• Update go-chi by @gcemaj in #1567
• build(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 by @dependabot[bot] in #1559
• build(deps): bump github.com/docker/docker from 28.4.0+incompatible to 28.5.0+incompatible by @dependabot[bot] in #1570
• build(deps): bump golang.org/x/tools from 0.37.0 to 0.38.0 by @dependabot[bot] in #1573
• build(deps): bump github.com/docker/docker from 28.5.0+incompatible to 28.5.1+incompatible by @dependabot[bot] in #1572
• Split stdout and stderr when running go env by @DrJosh9000 in #1574
• build(deps): bump github.com/docker/docker from 28.5.1+incompatible to 28.5.2+incompatible by @dependabot[bot] in #1575
• build(deps): bump golang.org/x/sync from 0.17.0 to 0.18.0 by @dependabot[bot] in #1576
• build(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login from 0.10.1 to 0.11.0 by @dependabot[bot] in #1577
• build(deps): bump golang.org/x/tools from 0.38.0 to 0.39.0 by @dependabot[bot] in #1579
• build(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 by @dependabot[bot] in #1581
• build(deps): bump github.com/google/go-containerregistry from 0.20.6 to 0.20.7 by @dependabot[bot] in #1582
• build(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 by @dependabot[bot] in #1583
• build(deps): bump golang.org/x/sync from 0.18.0 to 0.19.0 by @dependabot[bot] in #1586
• build(deps): bump golang.org/x/tools from 0.39.0 to 0.40.0 by @dependabot[bot] in #1585
• update labelsNode to match new labels interface in kube 1.34 by @ecordell in #1584
• update deps by @imjasonh in #1589

New Contributors

• @0xiso made their first contribution in #1514
• @maboehm made their first contribution in #1501
• @gcemaj made their first contribution in #1567
• @DrJosh9000 made their first contribution in #1574
• @ecordell made their first contribution in #1584

Full Changelog: v0.18.0...v0.18.1

What's Changed

• add documentation for installing custom root ca certificates by @kosamson in #1428
• fix(formatting): Updated the codeblock for Dockerfile to make it more readable by @userbradley in #1447
• fix(debug): ensure reproducible builds in debug mode by @l-qing in #145
• Updates on go.mod and ci by @cpanato in #1502
• Adding labels to make it easier k8s.md by @salaboy in #1495
• Fix concurrent writes happening when setting the annotation by @dprotaso in #1505

New Contributors

• @kosamson made their first contribution in #1428
• @l-qing made their first contribution in #1451
• @salaboy made their first contribution in #1495

Full Changelog: v0.17.1...v0.18.0

What's Changed

• Remove cycle in release process by @jonjohnsonjr in #1435

Full Changelog: v0.17.0...v0.17.1

What's Changed

• allow setting annotations by @seankhliao in #1426
• Update recorder to lazy create file. by @jeffmendoza in #1379
• Change OCI Layout publisher to lazy create layout after build. by @jeffmendoza in #1385
• feat: add image user option by @maxbrunet in #1266

Other changes

• update k8s for kind e2e tests by @cpanato in #1352
• Bump github.com/docker/docker from 26.1.4+incompatible to 27.2.1+incompatible by @dependabot in #1387
• Bump golang.org/x/tools from 0.21.0 to 0.25.0 by @dependabot in #1386
• Bump reviewdog/action-misspell from 1.19.0 to 1.23.0 by @dependabot in #1357
• Bump github/codeql-action from 3.25.7 to 3.26.6 by @dependabot in #1383
• Bump imjasonh/setup-crane from 0.3 to 0.4 by @dependabot in #1335
• Bump actions/checkout from 4.1.6 to 4.1.7 by @dependabot in #1336
• Bump github.com/google/go-containerregistry from 0.19.1 to 0.20.2 by @dependabot in #1370
• Bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @dependabot in #1341
• Bump k8s.io/apimachinery from 0.30.1 to 0.31.0 by @dependabot in #1374
• Bump goreleaser/goreleaser-action from 5.1.0 to 6.0.0 by @dependabot in #1328
• Bump ko-build/setup-ko from 0.6 to 0.7 by @dependabot in #1392
• Bump actions/setup-go from 5.0.1 to 5.0.2 by @dependabot in #1390
• Bump actions/setup-python from 5.1.0 to 5.2.0 by @dependabot in #1388
• Bump golangci/golangci-lint-action from 6.0.1 to 6.1.0 by @dependabot in #1389
• Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 by @dependabot in #1391
• docs: kamaji is a ko adopter by @prometherion in #1384
• Bump sigs.k8s.io/kind from 0.23.0 to 0.24.0 by @dependabot in #1394
• build with go1.23 and general housekeeping by @cpanato in #1396
• Bump actions/upload-artifact from 4.3.3 to 4.4.0 by @dependabot in #1397
• Bump github/codeql-action from 3.26.6 to 3.26.7 by @dependabot in #1399
• Bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.4.0 by @dependabot in #1393
• Bump k8s.io/apimachinery from 0.31.0 to 0.31.1 by @dependabot in #1398
• Bump github.com/docker/docker from 27.2.1+incompatible to 27.3.0+incompatible by @dependabot in #1402
• Bump github/codeql-action from 3.26.7 to 3.26.8 by @dependabot in #1401
• Bump github.com/docker/docker from 27.3.0+incompatible to 27.3.1+incompatible by @dependabot in #1404
• Bump go.uber.org/automaxprocs from 1.5.3 to 1.6.0 by @dependabot in #1405
• Bump github/codeql-action from 3.26.8 to 3.26.9 by @dependabot in #1406
• Bump actions/checkout from 4.1.7 to 4.2.0 by @dependabot in #1408
• Bump github/codeql-action from 3.26.9 to 3.26.10 by @dependabot in #1410
• Bump golang/govulncheck-action from 1.0.3 to 1.0.4 by @dependabot in #1411
• Bump github/codeql-action from 3.26.10 to 3.26.11 by @dependabot in #1414
• Bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 by @dependabot in #1412
• Bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by @dependabot in #1413
• Bump golang.org/x/tools from 0.25.0 to 0.26.0 by @dependabot in #1415
• Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 by @dependabot in #1416
• Bump actions/checkout from 4.2.0 to 4.2.1 by @dependabot in #1419
• Bump actions/upload-artifact from 4.4.0 to 4.4.1 by @dependabot in #1418
• Bump github/codeql-action from 3.26.11 to 3.26.12 by @dependabot in #1417
• debug: separate target and delve parameters by @zregvart in #1368
• Bump actions/upload-artifact from 4.4.1 to 4.4.2 by @dependabot in #1420
• Fix config links by @jeffmendoza in #1380
• Bump k8s.io/apimachinery from 0.31.1 to 0.31.2 by @dependabot in #1432
• Bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot in #1431
• Bump actions/upload-artifact from 4.4.2 to 4.4.3 by @dependabot in #1421
• Bump github/codeql-action from 3.26.12 to 3.27.0 by @dependabot in #1429
• Remove remaining references to vendor/ by @rsrchboy in #1427
• Document linux_capabilities in builds section by @mejedi in #1430
• feat(docs): Add dark theme by @gabe565 in #1422

New Contributors

• @zregvart made their first contribution in #1368
• @jeffmendoza made their first contribution in #1380
• @gabe565 made their first contribution in #1422
• @rsrchboy made their first contribution in #1427
• @maxbrunet made their first contribution in #1266

Full Changelog: v0.16.0...v0.17.0

What's Changed

• Add debug flag to include delve by @luhring in #1320
• remove support for CycloneDX SBOMs by @imjasonh in #1333

Other changes

• Fix a typo in terraform.md by @chaodaiG in #1323
• Bump github.com/sigstore/cosign/v2 from 2.2.3 to 2.2.4 by @dependabot in #1276
• Bump k8s.io/apimachinery from 0.29.4 to 0.30.1 by @dependabot in #1313
• Bump github.com/spf13/viper from 1.18.2 to 1.19.0 by @dependabot in #1324
• Bump github/codeql-action from 3.25.6 to 3.25.7 by @dependabot in #1325
• Bump golang/govulncheck-action from 1.0.2 to 1.0.3 by @dependabot in #1326
• Bump github.com/docker/docker from 26.1.3+incompatible to 26.1.4+incompatible by @dependabot in #1331
• Update CONTRIBUTING.md by @caniszczyk in #1250
• Bump reviewdog/action-misspell from 1.17.0 to 1.19.0 by @dependabot in #1332

New Contributors

• @chaodaiG made their first contribution in #1323
• @caniszczyk made their first contribution in #1250

Full Changelog: v0.15.4...v0.16.0

What's Changed

• Refactor global values to be defaults by @nmittler in #1318

• Bump actions/checkout from 4.1.5 to 4.1.6 by @dependabot in #1316

• Bump github.com/docker/docker from 26.1.2+incompatible to 26.1.3+incompatible by @dependabot in #1315

• Bump github/codeql-action from 2.13.4 to 3.25.5 by @dependabot in #1319

• Bump github/codeql-action from 3.25.5 to 3.25.6 by @dependabot in #1321

Full Changelog: v0.15.3...v0.15.4

🚨 We are investigating an issue with this release 🚨
See #1317 for more details.

What's Changed

• Bump golang/govulncheck-action from 1.0.1 to 1.0.2 by @dependabot in #1244
• Fix fly.io deployment docs by @imjasonh in #1247
• Bump golang.org/x/tools from 0.18.0 to 0.19.0 by @dependabot in #1249
• Update setup-ko action link in install.md by @koki-develop in #1256
• Fix kind image names with --bare by @aidy in #1027
• fix: update github.com/awslabs/amazon-ecr-credential-helper to latest version by @nesty92 in #1267
• drop go1.20 and start testing with go1.22 and ci updates by @cpanato in #1251
• Bump slsa-framework/slsa-github-generator from 1.9.0 to 1.10.0 by @dependabot in #1265
• Bump reviewdog/action-misspell from 1.15.0 to 1.16.0 by @dependabot in #1252
• Bump github.com/google/go-containerregistry from 0.19.0 to 0.19.1 by @dependabot in #1258
• Bump actions/checkout from 4.1.1 to 4.1.2 by @dependabot in #1255
• Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 by @dependabot in #1257
• Bump gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3 by @dependabot in #1253
• Bump actions/setup-python from 5.0.0 to 5.1.0 by @dependabot in #1269
• Bump k8s.io/apimachinery from 0.29.2 to 0.29.3 by @dependabot in #1259
• Bump github.com/docker/docker from 25.0.3+incompatible to 26.0.0+incompatible by @dependabot in #1263
• Bump reviewdog/action-misspell from 1.16.0 to 1.17.0 by @dependabot in #1270
• Add support for setting capabilities on the app binary by @mejedi in #1271
• Bump golang.org/x/sync from 0.6.0 to 0.7.0 by @dependabot in #1273
• Bump golang.org/x/tools from 0.19.0 to 0.20.0 by @dependabot in #1272
• Bump sigstore/cosign-installer from 3.4.0 to 3.5.0 by @dependabot in #1275
• Bump github.com/docker/docker from 26.0.0+incompatible to 26.0.1+incompatible by @dependabot in #1277
• chore: fix function names in comment by @camcui in #1278
• Bump k8s.io/apimachinery from 0.29.3 to 0.29.4 by @dependabot in #1279
• Fix AWS Lambda advanced docs by @mattn in #1281
• Bump actions/upload-artifact from 4.3.1 to 4.3.2 by @dependabot in #1284
• Bump github.com/docker/docker from 26.0.1+incompatible to 26.0.2+incompatible by @dependabot in #1283
• Bump actions/checkout from 4.1.2 to 4.1.3 by @dependabot in #1285
• Bump github.com/docker/docker from 26.0.2+incompatible to 26.1.0+incompatible by @dependabot in #1286
• Bump actions/upload-artifact from 4.3.2 to 4.3.3 by @dependabot in #1288
• Bump slsa-framework/slsa-github-generator from 1.10.0 to 2.0.0 by @dependabot in #1287
• Bump actions/checkout from 4.1.3 to 4.1.4 by @dependabot in #1290
• Bump golangci/golangci-lint-action from 4.0.0 to 5.0.0 by @dependabot in #1289
• Bump golangci/golangci-lint-action from 5.0.0 to 5.1.0 by @dependabot in #1291
• Bump github.com/docker/docker from 26.1.0+incompatible to 26.1.1+incompatible by @dependabot in #1292
• Bump actions/setup-go from 5.0.0 to 5.0.1 by @dependabot in #1293
• Bump golangci/golangci-lint-action from 5.1.0 to 5.3.0 by @dependabot in #1294
• Update index.md by @xcloudscript in #1295
• Bump golang.org/x/tools from 0.20.0 to 0.21.0 by @dependabot in #1299
• Bump actions/checkout from 4.1.4 to 4.1.5 by @dependabot in #1298
• Bump golangci/golangci-lint-action from 5.3.0 to 6.0.0 by @dependabot in #1297
• update golangci-lint by @cpanato in #1296
• Bump github.com/docker/docker from 26.1.1+incompatible to 26.1.2+incompatible by @dependabot in #1303
• Bump goreleaser/goreleaser-action from 5.0.0 to 5.1.0 by @dependabot in #1309
• Bump golangci/golangci-lint-action from 6.0.0 to 6.0.1 by @dependabot in #1300
• Bump sigs.k8s.io/kind from 0.22.0 to 0.23.0 by @dependabot in #1311
• feat: Add global env by @nmittler in #1310
• feat: Add template params for git by @nmittler in #1307
• Remove vendor directory by @nmittler in #1312
• feat: add template params for platform info by @nmittler in #1302
• Add global flags and ldflags by @nmittler in #1314

New Contributors

• @koki-develop made their first contribution in #1256
• @nesty92 made their first contribution in #1267
• @mejedi made their first contribution in #1271
• @camcui made their first contribution in #1278
• @mattn made their first contribution in #1281
• @xcloudscript made their first contribution in #1295
• @nmittler made their first contribution in #1310

Full Changelog: v0.15.2...v0.15.3

What's Changed

• Fix kind image loading for MacOS by @aidy in #1057
• Bump golang.org/x/tools from 0.15.0 to 0.16.0 by @dependabot in #1185
• (feat) Adding styling to code blocks by @userbradley in #1187
• Bump github.com/google/go-containerregistry from 0.16.1 to 0.17.0 by @dependabot in #1188
• Correct cluster name in error message when no nodes are found by @SaschaSchwarze0 in #1189
• Bump actions/setup-python from 4.7.1 to 4.8.0 by @dependabot in #1192
• Bump github.com/sigstore/cosign/v2 from 2.2.1 to 2.2.2 by @dependabot in #1191
• Bump github.com/spf13/viper from 1.17.0 to 1.18.0 by @dependabot in #1196
• Bump actions/setup-python from 4.8.0 to 5.0.0 by @dependabot in #1195
• Bump actions/setup-go from 4.1.0 to 5.0.0 by @dependabot in #1194
• Bump actions/stale from 8.0.0 to 9.0.0 by @dependabot in #1197
• Bump reviewdog/action-misspell from 1.14.0 to 1.14.1 by @dependabot in #1200
• Bump github.com/spf13/viper from 1.18.0 to 1.18.1 by @dependabot in #1199
• chore: add capsule as lover by @oliverbaehler in #1193
• Bump sigstore/cosign-installer from 3.2.0 to 3.3.0 by @dependabot in #1201
• Bump golang.org/x/tools from 0.16.0 to 0.16.1 by @dependabot in #1202
• Bump k8s.io/apimachinery from 0.28.4 to 0.29.0 by @dependabot in #1203
• Bump actions/upload-artifact from 3.1.3 to 4.0.0 by @dependabot in #1204
• Bump github.com/spf13/viper from 1.18.1 to 1.18.2 by @dependabot in #1206
• Bump golang.org/x/crypto from 0.16.0 to 0.17.0 by @dependabot in #1205
• Bump reviewdog/action-misspell from 1.14.1 to 1.15.0 by @dependabot in #1207
• Fix the KO_CONFIG_PATH default value in the documentation by @amirh in #1208
• Bump golang.org/x/sync from 0.5.0 to 0.6.0 by @dependabot in #1209
• Bump golang.org/x/tools from 0.16.1 to 0.17.0 by @dependabot in #1211
• Bump actions/upload-artifact from 4.0.0 to 4.1.0 by @dependabot in #1212
• Bump k8s.io/apimachinery from 0.29.0 to 0.29.1 by @dependabot in #1213
• Bump github.com/google/go-containerregistry from 0.17.0 to 0.18.0 by @dependabot in #1214
• Bump actions/upload-artifact from 4.1.0 to 4.2.0 by @dependabot in #1215
• Bump actions/upload-artifact from 4.2.0 to 4.3.0 by @dependabot in #1219
• Bump github.com/google/go-containerregistry from 0.18.0 to 0.19.0 by @dependabot in #1222
• Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 by @dependabot in #1224
• Bump github.com/sigstore/cosign/v2 from 2.2.2 to 2.2.3 by @dependabot in #1223
• Bump github.com/docker/docker from 24.0.7+incompatible to 25.0.2+incompatible by @dependabot in #1225
• Bump sigs.k8s.io/kind from 0.20.0 to 0.21.0 by @dependabot in #1226
• Bump github.com/opencontainers/image-spec from 1.1.0-rc5 to 1.1.0-rc6 by @dependabot in #1230
• Bump actions/upload-artifact from 4.3.0 to 4.3.1 by @dependabot in #1229
• Bump github.com/docker/docker from 25.0.2+incompatible to 25.0.3+incompatible by @dependabot in #1234
• Bump aws-actions/configure-aws-credentials from 4.0.1 to 4.0.2 by @dependabot in #1233
• Bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 by @dependabot in #1237
• Bump golang.org/x/tools from 0.17.0 to 0.18.0 by @dependabot in #1238
• Bump sigs.k8s.io/kind from 0.21.0 to 0.22.0 by @dependabot in #1239
• Bump k8s.io/apimachinery from 0.29.1 to 0.29.2 by @dependabot in #1240
• Bump github.com/opencontainers/image-spec from 1.1.0-rc6 to 1.1.0 by @dependabot in #1242

New Contributors

• @userbradley made their first contribution in #1187
• @SaschaSchwarze0 made their first contribution in #1189
• @oliverbaehler made their first contribution in #1193
• @amirh made their first contribution in #1208

Full Changelog: v0.15.1...v0.15.2