v2.49.0

Security

• GHSA-cfgx-mprf-xh64: Reserved metadata name collision leads to supply chain attack with root code execution and package identity spoofing
• GHSA-839m-5qhj-w4rm: Incorrect escaping in SRPM spec results in Arbitrary Code Execution

Changelog

New Features

• 62f72a6: feat(msix): default publisher from the signing certificate or vendor (#1135) (@djgilcrease)
• edf3552: feat(rpm): add script_requires to require script interpreters (#1151) (@zehome)
• c953fe3: feat: add msi support (#1097) (@djgilcrease)

Bug fixes

• ff7e8cd: fix(apk): Use the configured mtime for install scripts (#1169) (@somaz94)
• 1dc3fcc: fix(ci): allow unsigned RPM acceptance fixtures (#1175) (@caarlos0)
• d2d7180: fix(ci): create generated update PRs with app token (#1176) (@caarlos0)

Dependency updates

• 93d5ad1: fix(deps): bump alpine from 3.24.2 to 3.24.3 (#1166) (@dependabot[bot])
• 582a751: fix(deps): bump alpine from 3.24.2 to 3.24.3 in /testdata/acceptance (#1167) (@dependabot[bot])

Build process updates

• 37cd27d: ci(deps): bump the actions group with 5 updates (#1159) (@dependabot[bot])
• 6880989: ci(deps): bump the actions group with 6 updates (#1162) (@dependabot[bot])
• 9b57a4e: ci(deps): bump the actions group with 6 updates (#1165) (@dependabot[bot])
• eee2bc9: ci(deps): bump the actions group with 6 updates (#1173) (@dependabot[bot])
• 44ea002: ci: combine generation workflows and use GitHub App identity (#1180) (@caarlos0)

Other work

• f01bd40: Merge commit from fork (@caarlos0)
• 7fd9e9b: Merge commit from fork (@caarlos0)
• b06214c: docs: align sponsors page with goreleaser's (#1163) (@caarlos0)
• 3871eb3: docs: update Go and Hextra (#1172) (@caarlos0)
• 92ea769: docs: update cmd docs (#1177) (@goreleaser[bot])

Full Changelog: v2.48.0...v2.49.0

Helping out

This release is only possible thanks to all the support of awesome people!

Want to be one of them?
You can sponsor or contribute with code.

Where to go next?

• nFPM is a satellite project from GoReleaser. Check it out!
• Find examples and commented usage of all options in our website.
• Reach out on Discord and Twitter!