Release v0.22.5

What's Changed

• build(deps): bump chainguard.dev/sdk from 0.1.28 to 0.1.29 by @dependabot in #1428
• build(deps): bump sigs.k8s.io/release-utils from 0.8.5 to 0.9.0 by @dependabot in #1459
• build(deps): bump github.com/go-git/go-git/v5 from 5.12.0 to 5.13.0 by @dependabot in #1458
• build(deps): bump github.com/invopop/jsonschema from 0.12.0 to 0.13.0 by @dependabot in #1460
• build(deps): bump golang.org/x/time from 0.8.0 to 0.9.0 by @dependabot in #1462
• build(deps): bump golang.org/x/sys from 0.28.0 to 0.29.0 by @dependabot in #1463
• build(deps): bump github.com/go-git/go-git/v5 from 5.13.0 to 5.13.1 by @dependabot in #1461
• Return err if locking fails by @jonjohnsonjr in #1464

Full Changelog: v0.22.4...v0.22.5

Release v0.22.4

What's Changed

• build(deps): bump google.golang.org/api from 0.213.0 to 0.214.0 by @dependabot in #1452
• build(deps): bump go.step.sm/crypto from 0.55.0 to 0.56.0 by @dependabot in #1451
• Mark base image as experimental by @jonjohnsonjr in #1453

Full Changelog: v0.22.3...v0.22.4

Release v0.22.3

What's Changed

• Add an explicit sort to squash diffs. by @mattmoor in #1443
• Add a unit test for the sort ordering change. by @mattmoor in #1444
• build(deps): bump google.golang.org/api from 0.211.0 to 0.213.0 by @dependabot in #1446
• Create codeql.yml by @some-natalie in #1439
• Make GID its own type to prevent defaulting to 0 by @jdolitsky in #1449

New Contributors

• @some-natalie made their first contribution in #1439

Full Changelog: v0.22.2...v0.22.3

Release v0.22.2

What's Changed

• Lock image configs before building by @jonjohnsonjr in #1441

Full Changelog: v0.22.1...v0.22.2

Release v0.22.1

Changelog

• 0686921 pkg/apk: switch to SHA2-256 based signatures by default (#1440)

Release v0.22.0

Changelog

• e2b26f6 pkg/apk: switch to SHA2-256 based signatures by default

Release v0.21.0

What's Changed

• Make LockImageConfiguration multi-arch aware by @jonjohnsonjr in #1432

Full Changelog: v0.20.2...v0.21.0

Release v0.20.2

What's Changed

• build(deps): bump k8s.io/apimachinery from 0.31.2 to 0.31.3 by @dependabot in #1411
• fix(spdx): more helpful error message on license merge by @luhring in #1413
• Drop tests that are failing by @jonjohnsonjr in #1416
• build(deps): bump google.golang.org/api from 0.207.0 to 0.209.0 by @dependabot in #1414
• build(deps): bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in #1417
• build(deps): bump github.com/chainguard-dev/clog from 1.5.1-0.20240811185937-4c523ae4593f to 1.5.1 by @dependabot in #1418
• build(deps): bump github/codeql-action from 3.27.5 to 3.27.6 by @dependabot in #1420
• build(deps): bump go.step.sm/crypto from 0.54.2 to 0.55.0 by @dependabot in #1419
• build(deps): bump golang.org/x/sys from 0.27.0 to 0.28.0 by @dependabot in #1421
• build(deps): bump golang.org/x/sync from 0.9.0 to 0.10.0 by @dependabot in #1422
• use retryablehttp in DiscoverKeys and pkg/apk by @imjasonh in #1398
• build(deps): bump github/codeql-action from 3.27.6 to 3.27.7 by @dependabot in #1426
• Ignore scripts that aren't executable by @jonjohnsonjr in #1427

Full Changelog: v0.20.1...v0.20.2

Release v0.20.1

What's Changed

• build(deps): bump google.golang.org/api from 0.205.0 to 0.206.0 by @dependabot in #1405
• build(deps): bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #1408
• build(deps): bump google.golang.org/api from 0.206.0 to 0.207.0 by @dependabot in #1409
• build(deps): bump github/codeql-action from 3.27.4 to 3.27.5 by @dependabot in #1410
• fix: Allow accounts to belong to GID 0 by @EyeCantCU in #1407

Full Changelog: v0.20.0...v0.20.1

Release v0.20.0

What's Changed

• docs(apk): document apkindex methods by @luhring in #1393
• Record the apko.json file used to produce this image. by @mattmoor in #1353
• build(deps): bump goreleaser/goreleaser-action from 6.0.0 to 6.1.0 by @dependabot in #1392
• Add support for extras in build-cpio by @mattmoor in #1394
• build(deps): bump golang.org/x/sync from 0.8.0 to 0.9.0 by @dependabot in #1391
• build(deps): bump google.golang.org/api from 0.204.0 to 0.205.0 by @dependabot in #1388
• build(deps): bump go.opentelemetry.io/otel from 1.31.0 to 1.32.0 by @dependabot in #1396
• build(deps): bump github/codeql-action from 3.27.0 to 3.27.1 by @dependabot in #1395
• build(deps): bump github/codeql-action from 3.27.1 to 3.27.2 by @dependabot in #1400
• build(deps): bump golang.org/x/sys from 0.26.0 to 0.27.0 by @dependabot in #1390
• build(deps): bump golang.org/x/time from 0.7.0 to 0.8.0 by @dependabot in #1389
• build(deps): bump go.step.sm/crypto from 0.54.0 to 0.54.2 by @dependabot in #1402
• build(deps): bump github/codeql-action from 3.27.2 to 3.27.4 by @dependabot in #1403
• Pass errors up the stack in CalculateWorld and InstallPackages by @smoser in #1404

New Contributors

• @smoser made their first contribution in #1404

Full Changelog: v0.19.9...v0.20.0