ArtifactFlow v0.3.5

Container image (pin by digest):

ghcr.io/gadsotek/artifactflow@sha256:65b989e63761174448f80bd58628cf66d669ff8be34836d0cfdf20a1b46eff60

Dedicated PDF processor image (pin by digest):

ghcr.io/gadsotek/artifactflow-pdf-processor@sha256:1eadfba81eb0be7186651dabc69bfe464cee00a961419346835f100be7ed80f7

Dedicated XLSX processor image (pin by digest):

ghcr.io/gadsotek/artifactflow-xlsx-processor@sha256:b1f4446b21eaa53fca014a4e242c66c9548ce3698c6cbdf3b243656f4028acaf

Dedicated DOCX processor image (pin by digest):

ghcr.io/gadsotek/artifactflow-docx-processor@sha256:894e77f369173114d46d4b564194fdf41da76089a11c26d4ba65a2de5cb3de86

Verify build provenance and SBOM before running any image (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/gadsotek/artifactflow@sha256:65b989e63761174448f80bd58628cf66d669ff8be34836d0cfdf20a1b46eff60 --repo Gadsotek/artifactflow
gh attestation verify oci://ghcr.io/gadsotek/artifactflow-pdf-processor@sha256:1eadfba81eb0be7186651dabc69bfe464cee00a961419346835f100be7ed80f7 --repo Gadsotek/artifactflow
gh attestation verify oci://ghcr.io/gadsotek/artifactflow-xlsx-processor@sha256:b1f4446b21eaa53fca014a4e242c66c9548ce3698c6cbdf3b243656f4028acaf --repo Gadsotek/artifactflow
gh attestation verify oci://ghcr.io/gadsotek/artifactflow-docx-processor@sha256:894e77f369173114d46d4b564194fdf41da76089a11c26d4ba65a2de5cb3de86 --repo Gadsotek/artifactflow

SLSA build provenance and CycloneDX SBOMs are keyless-signed (Sigstore), attested to all four image digests, pushed alongside them in the registry, and attached to this release.
All four images were scanned with Trivy (vuln, secret, misconfig; HIGH/CRITICAL gate) before publishing.
Self-hosting docs: docs/OPERATIONS.md. AGPL Section 13 applies to network use; see COMMERCIAL.md for the commercial path.

What's Changed

• fix: bump @lezer/highlight from 1.2.4 to 1.2.5 in the npm-minor-patch group by @dependabot[bot] in #167
• fix: bump tabulator-tables from 6.5.3 to 6.6.0 in the npm-minor-patch group by @dependabot[bot] in #169
• fix: bump laravel/framework from 13.33.0 to 13.34.0 in the composer-minor-patch group by @dependabot[bot] in #168
• fix: bump the npm-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in #171
• fix: update npm dependencies and restore security gates by @dependabot[bot] in #172
• fix: patch DOMPurify and source-map-js security advisories by @Gadsotek in #173
• fix: patch shell-quote and KaTeX security advisories by @Gadsotek in #175
• fix: bump larastan/larastan from 3.12.2 to 3.12.3 in the composer-minor-patch group by @dependabot[bot] in #176
• chore: prepare v0.3.5 release by @Gadsotek in #177

Full Changelog: v0.3.4...v0.3.5