Release v0.25.0

What's Changed

• build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.0 by @dependabot in #1512
• build(deps): bump sigstore/cosign-installer from 3.7.0 to 3.8.0 by @dependabot in #1513
• build(deps): bump google.golang.org/api from 0.217.0 to 0.220.0 by @dependabot in #1514
• build(deps): bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 by @dependabot in #1520
• clean up ci permissions and update golangci-lint by @cpanato in #1523
• build(deps): bump golangci/golangci-lint-action from 6.3.0 to 6.3.2 by @dependabot in #1521
• build(deps): bump github.com/sigstore/cosign/v2 from 2.4.1 to 2.4.2 by @dependabot in #1517
• build(deps): bump docker/setup-qemu-action from 3.3.0 to 3.4.0 by @dependabot in #1515
• build(deps): bump chainguard.dev/sdk from 0.1.29 to 0.1.31 by @dependabot in #1498
• build(deps): bump go.step.sm/crypto from 0.57.0 to 0.57.1 by @dependabot in #1504
• build(deps): bump golang.org/x/time from 0.9.0 to 0.10.0 by @dependabot in #1509
• move some unnecessary logs to debug by @imjasonh in #1522
• build(deps): bump github.com/chainguard-dev/clog from 1.5.1 to 1.6.1 by @dependabot in #1500
• build(deps): bump golang.org/x/sync from 0.10.0 to 0.11.0 by @dependabot in #1510
• build(deps): bump golang.org/x/sys from 0.29.0 to 0.30.0 by @dependabot in #1511
• build(deps): bump github.com/go-git/go-git/v5 from 5.13.1 to 5.13.2 by @dependabot in #1491
• Consider already selected packages during solve by @jonjohnsonjr in #1406
• spdx: explain SHA1 usage by @xnox in #1501

Full Changelog: v0.24.0...v0.25.0

Release v0.24.0

What's Changed

• Revert "Disallow / in key names" by @tcnghia in #1493
• Disallow '/' in key name by @tcnghia in #1494
• Return an if fetching index fails by @jonjohnsonjr in #1495
• fix(apk/client): silence request logging by @luhring in #1497
• Allow passing in an http.RoundTripper by @jonjohnsonjr in #1505

Full Changelog: v0.23.0...v0.24.0

Release v0.23.0

What's Changed

• fix multi key support in APKINDEX verification by @tcnghia in #1490

New Contributors

• @tcnghia made their first contribution in #1490

Full Changelog: v0.22.7...v0.23.0

Release v0.22.7

What's Changed

• Improve error graph for failed solve by @jonjohnsonjr in #1474
• build(deps): bump step-security/harden-runner from 2.10.2 to 2.10.3 by @dependabot in #1476
• build(deps): bump google.golang.org/api from 0.215.0 to 0.216.0 by @dependabot in #1473
• Fix package name handling to retain version and strip ‘@’ suffix by @eminaktas in #1472
• build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 by @dependabot in #1483
• build(deps): bump github.com/google/go-containerregistry from 0.20.2 to 0.20.3 by @dependabot in #1481
• build(deps): bump step-security/harden-runner from 2.10.3 to 2.10.4 by @dependabot in #1484
• build(deps): bump go.step.sm/crypto from 0.56.0 to 0.57.0 by @dependabot in #1479
• build(deps): bump k8s.io/apimachinery from 0.32.0 to 0.32.1 by @dependabot in #1482
• build(deps): bump go.opentelemetry.io/otel from 1.33.0 to 1.34.0 by @dependabot in #1486
• build(deps): bump google.golang.org/api from 0.216.0 to 0.217.0 by @dependabot in #1480
• build(deps): bump actions/setup-go from 5.2.0 to 5.3.0 by @dependabot in #1487
• Guard against os-release panic by @jonjohnsonjr in #1488

New Contributors

• @eminaktas made their first contribution in #1472

Full Changelog: v0.22.6...v0.22.7

Release v0.22.6

What's Changed

• build(deps): bump google.golang.org/api from 0.214.0 to 0.215.0 by @dependabot in #1465
• Fix logging output of user.GID by @jdolitsky in #1466
• Add the extra flags to build-minirootfs by @mattmoor in #1467
• build(deps): bump docker/setup-qemu-action from 3.2.0 to 3.3.0 by @dependabot in #1469
• Base32-encode etag values by @jonjohnsonjr in #1470

Full Changelog: v0.22.5...v0.22.6

Release v0.22.5

What's Changed

• build(deps): bump chainguard.dev/sdk from 0.1.28 to 0.1.29 by @dependabot in #1428
• build(deps): bump sigs.k8s.io/release-utils from 0.8.5 to 0.9.0 by @dependabot in #1459
• build(deps): bump github.com/go-git/go-git/v5 from 5.12.0 to 5.13.0 by @dependabot in #1458
• build(deps): bump github.com/invopop/jsonschema from 0.12.0 to 0.13.0 by @dependabot in #1460
• build(deps): bump golang.org/x/time from 0.8.0 to 0.9.0 by @dependabot in #1462
• build(deps): bump golang.org/x/sys from 0.28.0 to 0.29.0 by @dependabot in #1463
• build(deps): bump github.com/go-git/go-git/v5 from 5.13.0 to 5.13.1 by @dependabot in #1461
• Return err if locking fails by @jonjohnsonjr in #1464

Full Changelog: v0.22.4...v0.22.5

Release v0.22.4

What's Changed

• build(deps): bump google.golang.org/api from 0.213.0 to 0.214.0 by @dependabot in #1452
• build(deps): bump go.step.sm/crypto from 0.55.0 to 0.56.0 by @dependabot in #1451
• Mark base image as experimental by @jonjohnsonjr in #1453

Full Changelog: v0.22.3...v0.22.4

Release v0.22.3

What's Changed

• Add an explicit sort to squash diffs. by @mattmoor in #1443
• Add a unit test for the sort ordering change. by @mattmoor in #1444
• build(deps): bump google.golang.org/api from 0.211.0 to 0.213.0 by @dependabot in #1446
• Create codeql.yml by @some-natalie in #1439
• Make GID its own type to prevent defaulting to 0 by @jdolitsky in #1449

New Contributors

• @some-natalie made their first contribution in #1439

Full Changelog: v0.22.2...v0.22.3

Release v0.22.2

What's Changed

• Lock image configs before building by @jonjohnsonjr in #1441

Full Changelog: v0.22.1...v0.22.2

Release v0.22.1

Changelog

• 0686921 pkg/apk: switch to SHA2-256 based signatures by default (#1440)