Release v0.25.3

What's Changed

• Add SubFS implementation for Melange by @egibs in #1560
• Use sync.Pools for allocations by @jonjohnsonjr in #1568

Full Changelog: v0.25.2...v0.25.3

Release v0.25.2

What's Changed

• build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by @dependabot in #1531
• build(deps): bump step-security/harden-runner from 2.10.4 to 2.11.0 by @dependabot in #1533
• build(deps): bump google.golang.org/api from 0.220.0 to 0.222.0 by @dependabot in #1534
• build(deps): bump github.com/sigstore/cosign/v2 from 2.4.2 to 2.4.3 by @dependabot in #1535
• build(deps): bump github.com/klauspost/compress from 1.17.11 to 1.18.0 by @dependabot in #1536
• build(deps): bump k8s.io/apimachinery from 0.32.1 to 0.32.2 by @dependabot in #1527
• build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0 by @dependabot in #1532
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 in the go_modules group by @dependabot in #1539
• build(deps): bump github.com/google/go-cmp from 0.6.0 to 0.7.0 by @dependabot in #1542
• build(deps): bump sigstore/cosign-installer from 3.8.0 to 3.8.1 by @dependabot in #1537
• Make LockImageConfiguration incorporate options by @jonjohnsonjr in #1540
• build(deps): bump docker/setup-qemu-action from 3.4.0 to 3.5.0 by @dependabot in #1549
• build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 in the go_modules group by @dependabot in #1547
• build(deps): bump github.com/go-git/go-git/v5 from 5.13.2 to 5.14.0 by @dependabot in #1548
• build(deps): bump google.golang.org/api from 0.222.0 to 0.223.0 by @dependabot in #1545
• apk/signature: remove support for creating new SHA1 signatures by @xnox in #1496
• dot: Do a slightly better job by @jonjohnsonjr in #1553
• spdx: add attributionText field by @xnox in #1554
• build(deps): bump github.com/chainguard-dev/clog from 1.6.1 to 1.7.0 by @dependabot in #1555
• build(deps): bump docker/setup-qemu-action from 3.5.0 to 3.6.0 by @dependabot in #1552
• apko: make apk cache safer for multi-writers by @tcnghia in #1564

Full Changelog: v0.25.1...v0.25.2

Release v0.25.1

What's Changed

• Improve conflict error by @jonjohnsonjr in #1529

Full Changelog: v0.25.0...v0.25.1

Release v0.25.0

What's Changed

• build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.0 by @dependabot in #1512
• build(deps): bump sigstore/cosign-installer from 3.7.0 to 3.8.0 by @dependabot in #1513
• build(deps): bump google.golang.org/api from 0.217.0 to 0.220.0 by @dependabot in #1514
• build(deps): bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 by @dependabot in #1520
• clean up ci permissions and update golangci-lint by @cpanato in #1523
• build(deps): bump golangci/golangci-lint-action from 6.3.0 to 6.3.2 by @dependabot in #1521
• build(deps): bump github.com/sigstore/cosign/v2 from 2.4.1 to 2.4.2 by @dependabot in #1517
• build(deps): bump docker/setup-qemu-action from 3.3.0 to 3.4.0 by @dependabot in #1515
• build(deps): bump chainguard.dev/sdk from 0.1.29 to 0.1.31 by @dependabot in #1498
• build(deps): bump go.step.sm/crypto from 0.57.0 to 0.57.1 by @dependabot in #1504
• build(deps): bump golang.org/x/time from 0.9.0 to 0.10.0 by @dependabot in #1509
• move some unnecessary logs to debug by @imjasonh in #1522
• build(deps): bump github.com/chainguard-dev/clog from 1.5.1 to 1.6.1 by @dependabot in #1500
• build(deps): bump golang.org/x/sync from 0.10.0 to 0.11.0 by @dependabot in #1510
• build(deps): bump golang.org/x/sys from 0.29.0 to 0.30.0 by @dependabot in #1511
• build(deps): bump github.com/go-git/go-git/v5 from 5.13.1 to 5.13.2 by @dependabot in #1491
• Consider already selected packages during solve by @jonjohnsonjr in #1406
• spdx: explain SHA1 usage by @xnox in #1501

Full Changelog: v0.24.0...v0.25.0

Release v0.24.0

What's Changed

• Revert "Disallow / in key names" by @tcnghia in #1493
• Disallow '/' in key name by @tcnghia in #1494
• Return an if fetching index fails by @jonjohnsonjr in #1495
• fix(apk/client): silence request logging by @luhring in #1497
• Allow passing in an http.RoundTripper by @jonjohnsonjr in #1505

Full Changelog: v0.23.0...v0.24.0

Release v0.23.0

What's Changed

• fix multi key support in APKINDEX verification by @tcnghia in #1490

New Contributors

• @tcnghia made their first contribution in #1490

Full Changelog: v0.22.7...v0.23.0

Release v0.22.7

What's Changed

• Improve error graph for failed solve by @jonjohnsonjr in #1474
• build(deps): bump step-security/harden-runner from 2.10.2 to 2.10.3 by @dependabot in #1476
• build(deps): bump google.golang.org/api from 0.215.0 to 0.216.0 by @dependabot in #1473
• Fix package name handling to retain version and strip ‘@’ suffix by @eminaktas in #1472
• build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 by @dependabot in #1483
• build(deps): bump github.com/google/go-containerregistry from 0.20.2 to 0.20.3 by @dependabot in #1481
• build(deps): bump step-security/harden-runner from 2.10.3 to 2.10.4 by @dependabot in #1484
• build(deps): bump go.step.sm/crypto from 0.56.0 to 0.57.0 by @dependabot in #1479
• build(deps): bump k8s.io/apimachinery from 0.32.0 to 0.32.1 by @dependabot in #1482
• build(deps): bump go.opentelemetry.io/otel from 1.33.0 to 1.34.0 by @dependabot in #1486
• build(deps): bump google.golang.org/api from 0.216.0 to 0.217.0 by @dependabot in #1480
• build(deps): bump actions/setup-go from 5.2.0 to 5.3.0 by @dependabot in #1487
• Guard against os-release panic by @jonjohnsonjr in #1488

New Contributors

• @eminaktas made their first contribution in #1472

Full Changelog: v0.22.6...v0.22.7

Release v0.22.6

What's Changed

• build(deps): bump google.golang.org/api from 0.214.0 to 0.215.0 by @dependabot in #1465
• Fix logging output of user.GID by @jdolitsky in #1466
• Add the extra flags to build-minirootfs by @mattmoor in #1467
• build(deps): bump docker/setup-qemu-action from 3.2.0 to 3.3.0 by @dependabot in #1469
• Base32-encode etag values by @jonjohnsonjr in #1470

Full Changelog: v0.22.5...v0.22.6

Release v0.22.5

What's Changed

• build(deps): bump chainguard.dev/sdk from 0.1.28 to 0.1.29 by @dependabot in #1428
• build(deps): bump sigs.k8s.io/release-utils from 0.8.5 to 0.9.0 by @dependabot in #1459
• build(deps): bump github.com/go-git/go-git/v5 from 5.12.0 to 5.13.0 by @dependabot in #1458
• build(deps): bump github.com/invopop/jsonschema from 0.12.0 to 0.13.0 by @dependabot in #1460
• build(deps): bump golang.org/x/time from 0.8.0 to 0.9.0 by @dependabot in #1462
• build(deps): bump golang.org/x/sys from 0.28.0 to 0.29.0 by @dependabot in #1463
• build(deps): bump github.com/go-git/go-git/v5 from 5.13.0 to 5.13.1 by @dependabot in #1461
• Return err if locking fails by @jonjohnsonjr in #1464

Full Changelog: v0.22.4...v0.22.5

Release v0.22.4

What's Changed

• build(deps): bump google.golang.org/api from 0.213.0 to 0.214.0 by @dependabot in #1452
• build(deps): bump go.step.sm/crypto from 0.55.0 to 0.56.0 by @dependabot in #1451
• Mark base image as experimental by @jonjohnsonjr in #1453

Full Changelog: v0.22.3...v0.22.4