Release v1.2.12

Changelog

• b7931ba build(deps): bump chainguard-dev/actions from 1.6.17 to 1.6.19 (#2219)
• 34a7530 fix(ci): harden against template injection and credential exposure (#2217)

Release v1.2.11

Changelog

• bfd6776 Tweak solver's same-origin heuristic (#2208)
• 1564c07 build(deps): bump chainguard-dev/actions from 1.6.15 to 1.6.17 (#2215)
• 4700edf build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 (#2211)
• b593d2c build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#2213)
• 9157b1a build(deps): bump google.golang.org/api from 0.276.0 to 0.277.0 (#2212)
• 0e4728d build(deps): bump k8s.io/apimachinery from 0.35.4 to 0.36.0 (#2189)
• d81a5d4 build(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 (#2214)
• 5644a41 retry package fetch+expand on transient errors (#2210)

Release v1.2.10

Changelog

• 0670f22 build(deps): bump go.step.sm/crypto from 0.77.2 to 0.77.9 (#2209)
• eebbe62 build(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 (#2207)

Release v1.2.9

Changelog

• 8d34c75 apk: verify package data hash against .PKGINFO for completeness (#2206)
• 312a150 build(deps): bump chainguard.dev/sdk from 0.1.52 to 0.1.54 (#2199)
• 5f7949b build(deps): bump github.com/invopop/jsonschema from 0.13.0 to 0.14.0 (#2197)
• e7c2fdf build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 (#2198)
• 0d06d1c chore(zizmor): trigger zizmor on updates to dependabot config [PSEC-871] (#2186)
• a7f10d8 ci: bump golangci-lint to v2.11 and clear new findings (#2205)
• 8ccb1ed testdata: refresh apko-discover lock for rotated chainguard key (#2203)

Release v1.2.8

Changelog

• beb2867 release: fetch full history for goreleaser changelog (#2192)

Release v1.2.7

Changelog

• a118c3d apk: verify package control hash against signed APKINDEX (#2191)

Release v1.2.6

Changelog

• 09b82d6 fs: strip special mode bits in OpenFile/WriteFile (#2188)

Release v1.2.5

Changelog

• f5a96e1 fs: Scope all DirFS operations through os.Root (#2187)

Release v1.2.4

Changelog

• 4556aed build(deps): bump k8s.io/apimachinery from 0.35.3 to 0.35.4 (#2180)

Release v1.2.3

Changelog

• 6f90ec8 build(deps): bump google.golang.org/api from 0.274.0 to 0.275.0 (#2169)