v1.5.2

1.5.2 (2026-09-20)

Bug Fixes

• ci: align codeql-action to v4.38.0 and read go version from go.mod (#102) (133913e)
• ci: keep actions: read on the job that uploads sarif (#101) (60ba06c)

v1.5.1

1.5.1 (2026-09-11)

Bug Fixes

• release: let the release PR carry a token that isn't GITHUB_TOKEN (#89) (3d68dfa)

v1.5.0

1.5.0 (2026-09-10)

Features

• add --keep-loopback and --log-external flags (169af4c)
• add the eight-verb repo contract (#69) (67f2702)
• docs: build the docs site in Actions and drop Read the Docs (#46) (3f10500)
• packaging: man page, OS packages and a staged install (#73) (f32b461)

Bug Fixes

• build: build against libseccomp with cgo, statically linked (#78) (e3523e6)
• build: install the arm64 libc headers for the cross build (#80) (1662942)
• ci: pin the editorconfig-checker binary version (#65) (c0231eb)
• deps: pin the Go toolchain to 1.26.5 for the stdlib CVE fixes (b5ea232)
• drop the PID namespace so /proc describes the sandboxed process (#48) (fcb5fa6)
• lint: funnel the re-exec env reads through one accessor (#76) (5e39fdf)
• pre-commit: stop check-yaml failing on Helm templates and multi-doc manifests (dad11c0)
• release: sign checksums with a Sigstore bundle (#75) (89e5d36)
• security and code-quality findings (#31) (557bba0)
• security: skip the SARIF upload on private repos (bf5f667)
• unblock quality and clear the Scorecard pinned-dependencies finding (#54) (04218f2)

v1.2.0

1.2.0 (2026-09-08)

Features

• add the eight-verb repo contract (#69) (67f2702)

v1.1.2

1.1.2 (2026-09-04)

Bug Fixes

• ci: pin the editorconfig-checker binary version (#65) (c0231eb)

v1.1.1

1.1.1 (2026-08-29)

Bug Fixes

• drop the PID namespace so /proc describes the sandboxed process (#48) (fcb5fa6)
• unblock quality and clear the Scorecard pinned-dependencies finding (#54) (04218f2)

v1.1.0

1.1.0 (2026-08-25)

Features

• docs: build the docs site in Actions and drop Read the Docs (#46) (3f10500)

v1.0.2

1.0.2 (2026-08-13)

Bug Fixes

• security and code-quality findings (#31) (557bba0)

v1.0.1

1.0.1 (2026-08-06)

Bug Fixes

• deps: pin the Go toolchain to 1.26.5 for the stdlib CVE fixes (b5ea232)
• pre-commit: stop check-yaml failing on Helm templates and multi-doc manifests (dad11c0)
• security: skip the SARIF upload on private repos (bf5f667)

v1.0.0

1.0.0 (2026-08-01)

Features

• add --keep-loopback and --log-external flags (169af4c)