v2.2.1

Security

• Refresh .trivyignore against currently open Trivy alerts (#143, #147)
  • Re-triaged newly-flagged and version-fixed CVEs, then restored 6 entries that had been wrongly removed as version-fixed

Improvements

• Reformat the explicit engine's "Communication details" report section (#150)
  • Aligned with the rest of the report's conventions (emoji-prefixed heading, BLOCKED list moved ahead of the per-step breakdown), and reformatted each RUN step's request log as a code block

Documentation

• Document how to fix npm's CA trust gap under the explicit engine, including a worked example (#152)
• Add MAINTAINERS.md documenting project roles and access (#153)
• Add release-verification and dependency-management guidance to SECURITY.md (#154)

CI / Maintenance

• Cross-compile buildkit-proxy instead of emulating the build stage under QEMU (#146)
  • Pins the build stage to the host's own platform so the Go toolchain always compiles natively, regardless of the image's target platform
• Skip CI test jobs unaffected by a PR's changed paths (#148)
  • A new changes job classifies a PR's changed paths and skips downstream jobs (Docker test matrix, multiarch check, test_action) whose inputs didn't change
• Eliminate a flaky SIGPIPE/pipefail race in test assert scripts (#144)
  • echo "$VAR" | grep -q PATTERN chains under set -o pipefail could report FAIL even when the pattern matched, if grep -q exited early and killed echo with SIGPIPE before it finished writing
• Skip blocked-connection annotations when not running as the report action (#149)
  • report/src/main.js's annotations were gated only on blockedCount, so they leaked into the explicit-mode test CI job (which clears GITHUB_STEP_SUMMARY to test proxy enforcement directly and was never meant to produce them); annotation output is now gated the same way as the Job Summary write

Dependencies

• Bump self-referential dash14/buildcage action pin to v2.2.0 (#145)

Full Changelog: v2.2.0...v2.2.1