All pull requests

Pull requests

• build(deps): bump google.golang.org/api from 0.301.0 to 0.302.0

  approvedarea/artifactsarea/dependencyarea/release-engcncf-cla: yeslgtmok-to-testrelease-note-nonesig/releasesize/M
  #2035·by dependabot[bot] was merged Oct 16, 2026Bot·

  ·
  2

  

• build(deps): bump the gomod group with 4 updates

  approvedarea/artifactsarea/dependencyarea/release-engcncf-cla: yeslgtmok-to-testrelease-note-nonesig/releasesize/L
  #2034·by dependabot[bot] was merged Oct 15, 2026Bot·

  ·
  2

  

• build(deps): bump google.golang.org/api from 0.300.0 to 0.301.0

  approvedarea/artifactsarea/dependencyarea/release-engcncf-cla: yeslgtmok-to-testrelease-note-nonesig/releasesize/S
  #2033·by dependabot[bot] was merged Oct 12, 2026Bot·

  ·
  2

  

• build(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0

  approvedarea/artifactsarea/dependencyarea/release-engcncf-cla: yeslgtmok-to-testrelease-note-nonesig/releasesize/XS
  #2031·by dependabot[bot] was merged Oct 12, 2026Bot·

  ·
  2

  

• build(deps): bump the gomod group with 4 updates

  approvedarea/artifactsarea/dependencyarea/release-engcncf-cla: yeslgtmok-to-testrelease-note-nonesig/releasesize/L
  #2032·by dependabot[bot] was merged Oct 12, 2026Bot·

  ·
  2

  

• Use the SPDX 3 predicate type in the provenance policy example

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/documentationlgtmrelease-note-nonesig/releasesize/XS
  #2030·by saschagrunert was merged Oct 9, 2026Member·

  ·
  3

  

• build(deps): bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3 in the gomod group

  approvedarea/artifactsarea/dependencyarea/release-engcncf-cla: yeslgtmok-to-testrelease-note-nonesig/releasesize/S
  #2029·by dependabot[bot] was merged Oct 8, 2026Bot·

  ·
  2

  

• Document that only the promotion account signs as krel-trust

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/documentationlgtmrelease-note-nonesig/releasesize/M
  #2028·by saschagrunert was merged Oct 6, 2026Member·

  ·
  1

  

• Require SLSA build levels per image in provenance policies

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/featurelgtmrelease-notesig/releasesize/XL
  #2024·by saschagrunert was merged Oct 6, 2026Member·

  ·
  1

  2

  

• Drop the canary manifests and the latest-canary tag

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/cleanuplgtmrelease-notesig/releasesize/S
  #2023·by saschagrunert was merged Oct 6, 2026Member·

  ·
  2

  

• build(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2

  approvedarea/artifactsarea/dependencyarea/release-engcncf-cla: yeslgtmok-to-testrelease-note-nonesig/releasesize/XS
  #2022·by dependabot[bot] was merged Oct 6, 2026Bot·

  ·
  3

  

• Report the release version in the kpromo image

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/buglgtmrelease-notesig/releasesize/S
  #2020·by saschagrunert was merged Oct 5, 2026Member·

  ·
  1

  

• Move to the policylabs modules and slsa-framework/verifier v0.1.0

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/cleanuplgtmrelease-notesig/releasesize/L
  #2019·by saschagrunert was merged Oct 6, 2026Member·

  ·
  2

  

• Release prep: bump version to v4.7.1

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/cleanuplgtmrelease-note-nonesig/releasesize/S
  #2018·by saschagrunert was merged Oct 6, 2026Member·

  ·
  3

  

• Find the manifest repository of Prow checkouts

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/buglgtmrelease-notesig/releasesize/L
  #2017·by saschagrunert was merged Oct 5, 2026Member·

  ·
  2

  

• build(deps): bump google.golang.org/api from 0.299.0 to 0.300.0

  approvedarea/artifactsarea/dependencyarea/release-engcncf-cla: yeslgtmok-to-testrelease-note-nonesig/releasesize/M
  #2016·by dependabot[bot] was merged Oct 5, 2026Bot·

  ·
  2

  

• build(deps): bump cloud.google.com/go/storage from 1.68.0 to 1.69.0

  approvedarea/artifactsarea/dependencyarea/release-engcncf-cla: yeslgtmok-to-testrelease-note-nonesig/releasesize/S
  #2015·by dependabot[bot] was merged Oct 5, 2026Bot·

  ·
  2

  

• build(deps): bump the gomod group with 2 updates

  approvedarea/artifactsarea/dependencyarea/release-engcncf-cla: yeslgtmok-to-testrelease-note-nonesig/releasesize/S
  #2014·by dependabot[bot] was merged Oct 5, 2026Bot·

  ·
  2

  

• Document how to get verification summaries for promoted images

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/documentationlgtmrelease-notesig/releasesize/L
  #2013·by saschagrunert was merged Oct 6, 2026Member·

  ·
  1

  2

  

• Release prep: bump version to v4.7.0

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/cleanuplgtmrelease-note-nonesig/releasesize/S
  #2010·by saschagrunert was merged Oct 2, 2026Member·

  ·
  1

  

• Report the highest SLSA build level of an image's provenance

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/buglgtmrelease-notesig/releasesize/M
  #2009·by saschagrunert was merged Oct 2, 2026Member·

  ·
  3

  

• Bind provenance policy builders to their signers

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/featurelgtmrelease-notesig/releasesize/XL
  #2008·by saschagrunert was merged Oct 2, 2026Member·

  ·
  2

  

• Report staging signatures accepted by provenance policies

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/buglgtmrelease-notesig/releasesize/L
  #2007·by saschagrunert was merged Oct 2, 2026Member·

  ·
  2

  

• Verify SLSA build levels against the level of the builders

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/api-changekind/buglgtmrelease-notesig/releasesize/L
  #2006·by saschagrunert was merged Oct 1, 2026Member·

  ·
  3

  

• Bump release-utils to v0.12.5

  approvedarea/artifactsarea/release-engcncf-cla: yeskind/documentationlgtmrelease-note-nonesig/releasesize/S
  #2005·by saschagrunert was merged Oct 1, 2026Member·

  ·
  2