Release v0.21.0

What's Changed

• Make LockImageConfiguration multi-arch aware by @jonjohnsonjr in #1432

Full Changelog: v0.20.2...v0.21.0

Release v0.20.2

What's Changed

• build(deps): bump k8s.io/apimachinery from 0.31.2 to 0.31.3 by @dependabot in #1411
• fix(spdx): more helpful error message on license merge by @luhring in #1413
• Drop tests that are failing by @jonjohnsonjr in #1416
• build(deps): bump google.golang.org/api from 0.207.0 to 0.209.0 by @dependabot in #1414
• build(deps): bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in #1417
• build(deps): bump github.com/chainguard-dev/clog from 1.5.1-0.20240811185937-4c523ae4593f to 1.5.1 by @dependabot in #1418
• build(deps): bump github/codeql-action from 3.27.5 to 3.27.6 by @dependabot in #1420
• build(deps): bump go.step.sm/crypto from 0.54.2 to 0.55.0 by @dependabot in #1419
• build(deps): bump golang.org/x/sys from 0.27.0 to 0.28.0 by @dependabot in #1421
• build(deps): bump golang.org/x/sync from 0.9.0 to 0.10.0 by @dependabot in #1422
• use retryablehttp in DiscoverKeys and pkg/apk by @imjasonh in #1398
• build(deps): bump github/codeql-action from 3.27.6 to 3.27.7 by @dependabot in #1426
• Ignore scripts that aren't executable by @jonjohnsonjr in #1427

Full Changelog: v0.20.1...v0.20.2

Release v0.20.1

What's Changed

• build(deps): bump google.golang.org/api from 0.205.0 to 0.206.0 by @dependabot in #1405
• build(deps): bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #1408
• build(deps): bump google.golang.org/api from 0.206.0 to 0.207.0 by @dependabot in #1409
• build(deps): bump github/codeql-action from 3.27.4 to 3.27.5 by @dependabot in #1410
• fix: Allow accounts to belong to GID 0 by @EyeCantCU in #1407

Full Changelog: v0.20.0...v0.20.1

Release v0.20.0

What's Changed

• docs(apk): document apkindex methods by @luhring in #1393
• Record the apko.json file used to produce this image. by @mattmoor in #1353
• build(deps): bump goreleaser/goreleaser-action from 6.0.0 to 6.1.0 by @dependabot in #1392
• Add support for extras in build-cpio by @mattmoor in #1394
• build(deps): bump golang.org/x/sync from 0.8.0 to 0.9.0 by @dependabot in #1391
• build(deps): bump google.golang.org/api from 0.204.0 to 0.205.0 by @dependabot in #1388
• build(deps): bump go.opentelemetry.io/otel from 1.31.0 to 1.32.0 by @dependabot in #1396
• build(deps): bump github/codeql-action from 3.27.0 to 3.27.1 by @dependabot in #1395
• build(deps): bump github/codeql-action from 3.27.1 to 3.27.2 by @dependabot in #1400
• build(deps): bump golang.org/x/sys from 0.26.0 to 0.27.0 by @dependabot in #1390
• build(deps): bump golang.org/x/time from 0.7.0 to 0.8.0 by @dependabot in #1389
• build(deps): bump go.step.sm/crypto from 0.54.0 to 0.54.2 by @dependabot in #1402
• build(deps): bump github/codeql-action from 3.27.2 to 3.27.4 by @dependabot in #1403
• Pass errors up the stack in CalculateWorld and InstallPackages by @smoser in #1404

New Contributors

• @smoser made their first contribution in #1404

Full Changelog: v0.19.9...v0.20.0

Release v0.19.9

What's Changed

• Attempt to flush renamed files in cache by @jonjohnsonjr in #1387
• fix: ensure cacheTransport returns an error for non-200 responses by @lyoung-confluent in #1381
• fix: --cache-dir broken after in 0.19.3+ by @lyoung-confluent in #1382

Full Changelog: v0.19.8...v0.19.9

Release v0.19.8

What's Changed

• Re-instantiate each APK's tarfs after caching by @jonjohnsonjr in #1383
• build(deps): bump google.golang.org/api from 0.203.0 to 0.204.0 by @dependabot in #1384

Full Changelog: v0.19.7...v0.19.8

Release v0.19.7

What's Changed

• Allow multiauthenticator to try all authenticators by @wlynch in #1379
• Drop errgroup.WithContext and add withCause by @jonjohnsonjr in #1380

Full Changelog: v0.19.6...v0.19.7

Release v0.19.6

What's Changed

• MergeInto should include Volumes by @jonjohnsonjr in #1376

Full Changelog: v0.19.5...v0.19.6

Release v0.19.5

What's Changed

• fix bug with triggers encoded in triggers file by @imjasonh in #1358
• rsa: remove backwards compat APIs by @xnox in #1307

Full Changelog: v0.19.4...v0.19.5

Release v0.19.4

What's Changed

• fix data race in index cache by @imjasonh in #1369
• fix concurrent annotation map update by @imjasonh in #1370
• set downloadLocation to NOASSERTION when apk.URL is unset by @imjasonh in #1372
• Make MergeInto threadsafe by @jonjohnsonjr in #1374

Full Changelog: v0.19.3...v0.19.4