Releases · joshuadavidthomas/go-selfupdate

What's Changed

Bump github.com/klauspost/compress from 1.18.7 to 1.19.1 in the go group by @dependabot[bot] in #1
Cover security-critical paths; parameterize tar expansion limit for fast tests by @joshuadavidthomas in #2
Enforce the host allowlist across asset-download redirects by @joshuadavidthomas in #3
Stop the 60-second client timeout from aborting large asset downloads by @joshuadavidthomas in #4
Bind attestation verification to the source repository via Fulcio extensions by @joshuadavidthomas in #6
Make staged executables inert until complete and reclaim abandoned stages by @joshuadavidthomas in #7
Declare the minimum Go language version instead of a patch pin by @joshuadavidthomas in #11
Split Sigstore verification into an opt-in subpackage by @joshuadavidthomas in #12
Report asset-download progress through an optional callback by @joshuadavidthomas in #14
Stream asset downloads to disk and extract without buffering by @joshuadavidthomas in #15
ci: add release workflow by @joshuadavidthomas in #16

Full Changelog: https://github.com/joshuadavidthomas/go-selfupdate/commits/v0.1.0