Release v0.50.0

What's Changed

• build(deps): bump the gomod group with 3 updates by @dependabot[bot] in #2477
• fix(qemu): improve VM shutdown with graceful timeouts and PID safety by @smoser in #2479
• feat(pipelines): add reason fields to fetch and git-checkout by @xnox in #2480
• build(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 in the actions group by @dependabot[bot] in #2483
• feat(qemu): add DNS search domains by @egibs in #2481
• fix(observability): probe only when observability hook is installed. by @smoser in #2482
• build(deps): bump step-security/harden-runner from 2.17.0 to 2.18.0 in the actions group by @dependabot[bot] in #2486
• build(deps): bump github.com/github/go-spdx/v2 from 2.4.0 to 2.5.0 in the gomod group by @dependabot[bot] in #2485

Full Changelog: v0.49.0...v0.50.0

Release v0.49.0

What's Changed

• build(deps): bump the gomod group across 1 directory with 4 updates by @dependabot[bot] in #2462
• chore(workflows): add actionlint and zizmor action linters [SECINT-75] by @stevebeattie in #2463
• build(deps): bump step-security/harden-runner from 2.16.0 to 2.16.1 in the actions group by @dependabot[bot] in #2465
• build(deps): bump the gomod group with 3 updates by @dependabot[bot] in #2464
• build(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0 in the gomod group by @dependabot[bot] in #2466
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.40.0 to 1.43.0 by @dependabot[bot] in #2467
• build(deps): bump step-security/harden-runner from 2.16.1 to 2.17.0 in the actions group by @dependabot[bot] in #2469
• build(deps): bump the gomod group with 2 updates by @dependabot[bot] in #2468
• feat(qemu): apply reasonable CPU/memory defaults by @egibs in #2470
• build(deps): bump step-security/action-actionlint from 1.69.1 to 1.72.0 in the actions group by @dependabot[bot] in #2474
• build(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0 in the gomod group by @dependabot[bot] in #2473
• fix(pipelines/autoconf/configure): add libtool by @xnox in #2472
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 in the actions group by @dependabot[bot] in #2476

Full Changelog: v0.48.2...v0.49.0

Release v0.48.2

What's Changed

• renovate/bump: always update branch-only git-checkout nodes by @vishal-chdhry in #2457
• build(deps): bump chainguard.dev/apko from 1.2.0 to 1.2.1 in the gomod group by @dependabot[bot] in #2459

Full Changelog: v0.48.1...v0.48.2

Release v0.48.1

What's Changed

• pipelines/git-am: use xargs and quote the patches input by @justinvreeland in #2455
• fix: remove moby/moby/v2 dependency for compatibility by @antitree in #2456

Full Changelog: v0.48.0...v0.48.1

Release v0.48.0

What's Changed

• qemu: resolve vmlinuz symlinks and try to fix them by @89luca89 in #2445
• build(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to 5.17.1 by @dependabot[bot] in #2449
• feat(qemu): optional build observability event logging by @antitree in #2394
• SCA: Generate Perl dependency by @sergiodj in #2453
• build(deps): bump the gomod group across 1 directory with 4 updates by @dependabot[bot] in #2451
• build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2452
• sca: Adjust generate{Perl,Ruby}Deps to account for non-usrmerge by @sergiodj in #2454

Full Changelog: v0.47.0...v0.48.0

Release v0.47.0

What's Changed

• feat(harden-runner): move to inline block policies by @egibs in #2438
• build(deps): bump github.com/moby/moby/v2 from 2.0.0-beta.7 to 2.0.0-beta.8 by @dependabot[bot] in #2441
• build(deps): bump github.com/docker/cli from 29.3.0+incompatible to 29.3.1+incompatible in the gomod group by @dependabot[bot] in #2439
• build(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.1 in the actions group by @dependabot[bot] in #2440
• chore(harden-runner): add more Go endpoints by @egibs in #2442
• Expose schema to dependents by @jonjohnsonjr in #2443

Full Changelog: v0.46.1...v0.47.0

Release v0.46.1

What's Changed

• build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 by @dependabot[bot] in #2432
• Source fetch from melange by @justinvreeland in #2170
• build(deps): bump the gomod group across 1 directory with 3 updates by @dependabot[bot] in #2433
• chore(pipelines/python/import): Add virtual env support by @EyeCantCU in #2436
• chore(melange): Add OCI update monitor config and docs by @EyeCantCU in #2435

Full Changelog: v0.46.0...v0.46.1

Release v0.46.0

What's Changed

• fix(build): guard against nil runner in NewTest by @maxgio92 in #2421
• Revert "feat(config): point CARGO_HOME to /var/cache/melange/cargo (#2349)" by @toabctl in #2422
• build(deps): bump the gomod group across 1 directory with 15 updates by @dependabot[bot] in #2424
• pipeline: execute them with set -eo pipefail by @aborrero in #2423
• Add clang support for package metadata ELF notes by @dannf in #2338
• build(deps): bump the actions group across 1 directory with 3 updates by @dependabot[bot] in #2425
• build(deps): bump github.com/google/go-containerregistry from 0.21.2 to 0.21.3 in the gomod group by @dependabot[bot] in #2426
• build(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by @dependabot[bot] in #2427
• qemu: allow selection of alternate source for microvm initramfs by @a-crate in #2414
• build(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 in the gomod group by @dependabot[bot] in #2428
• sbom: Emit CPE when available by @xnox in #2373
• fix(renovate): detect version-derived vars instead of checking specific vars by @vishal-chdhry in #2429
• ci: Make verify failures more obvious by @jonjohnsonjr in #2431

Full Changelog: v0.45.4...v0.46.0

Release v0.45.4

What's Changed

• chore(config): Support var substitutions for update monitors by @EyeCantCU in #2413
• qemu: always attach serial console for boot diagnostics by @jonjohnsonjr in #2416
• qemu: log VM resources (arch, cpus, memory) before boot by @89luca89 in #2417
• test: strip sed integration test down to just git-checkout by @justinvreeland in #2420

Full Changelog: v0.45.3...v0.45.4

Release v0.45.3

What's Changed

• qemu: set conservative guest MTU to prevent hangs in nested environments by @jonjohnsonjr in #2411
• qemu: add SSH keepalives, handshake timeouts, and error wrapping by @jonjohnsonjr in #2412

Full Changelog: v0.45.2...v0.45.3