v0.4.0

Container image (linux/amd64, linux/arm64):
ghcr.io/kruatech/turna:v0.4.0

Supply chain

The image is cosign-signed (keyless) and carries SLSA
provenance + SBOM attestations. Verify:

cosign verify ghcr.io/kruatech/turna:v0.4.0 \
  --certificate-identity-regexp '^https://github.com/kruatech/turna/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Binary tarballs ship with .sha256 checksums and an SPDX SBOM
(*.spdx.json), plus a GitHub build-provenance attestation.

What's Changed

• docs: add the OpenSSF Best Practices badge by @kruatech in #111
• fix(health): refuse to start when the health port cannot be bound by @kruatech in #112
• SCTP hardening, AF_XDP validation, DTLS log noise, RFC 6062 gate by @kruatech in #113
• Enterprise readiness: RBAC, revocation, capacity thresholds, and a shutdown defect that was always there by @kruatech in #121
• deps(docker): bump debian from abd67ff to 8820086 in /deploy by @dependabot[bot] in #114
• deps(docker): bump rust from e70e2ee to 82150a5 in /deploy by @dependabot[bot] in #115
• ci: bump github/codeql-action/init from 3.37.3 to 4.37.9 by @dependabot[bot] in #120
• deps: bump aes-gcm from 0.11.0 to 0.11.1 by @dependabot[bot] in #118
• ci: bump actions/checkout from 4 to 7 by @dependabot[bot] in #116
• Address the CodeQL 4.x findings by @kruatech in #122
• docs: release 0.4.0 by @kruatech in #123

Full Changelog: v0.3.1...v0.4.0

v0.3.1

Container image (linux/amd64, linux/arm64):
ghcr.io/kruatech/turna:v0.3.1

Supply chain

The image is cosign-signed (keyless) and carries SLSA
provenance + SBOM attestations. Verify:

cosign verify ghcr.io/kruatech/turna:v0.3.1 \
  --certificate-identity-regexp '^https://github.com/kruatech/turna/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Binary tarballs ship with .sha256 checksums and an SPDX SBOM
(*.spdx.json), plus a GitHub build-provenance attestation.

What's Changed

• ci(deny): ignore RUSTSEC-2025-0141 (bincode) and RUSTSEC-2024-0436 (paste); drop stale 2025-0134 by @kruatech in #62
• ci: bump EmbarkStudios/cargo-deny-action from 2.0.20 to 2.1.1 by @dependabot[bot] in #41
• ci: bump actions/setup-node from 4.0.3 to 7.0.0 by @dependabot[bot] in #39
• ci: bump azure/setup-helm from 4.3.1 to 5.0.1 by @dependabot[bot] in #44
• chore(security): resolve OSSF Scorecard findings by @kruatech in #63
• deps(fuzz): bump thiserror from 2.0.18 to 2.0.19 in /fuzz by @dependabot[bot] in #57
• deps: bump io-uring from 0.7.12 to 0.7.13 by @dependabot[bot] in #53
• deps(fuzz): bump rand from 0.8.6 to 0.8.7 in /fuzz by @dependabot[bot] in #45
• deps(fuzz): bump sha1 from 0.10.6 to 0.10.7 in /fuzz by @dependabot[bot] in #43
• deps: bump toml from 0.8.23 to 1.1.3+spec-1.1.0 by @dependabot[bot] in #51
• deps: bump md5 from 0.7.0 to 0.8.1 by @dependabot[bot] in #49
• ci: bump actions/attest-build-provenance from 2.4.0 to 4.1.1 by @dependabot[bot] in #42
• ci: bump softprops/action-gh-release from 2.6.2 to 3.0.2 by @dependabot[bot] in #38
• fix(fuzz): drop duplicate sha2 entry from fuzz/Cargo.lock by @kruatech in #64
• Transport verification: interop and endurance for every path, nine fixes by @kruatech in #87
• deps: bump clap from 4.6.4 to 4.6.6 by @dependabot[bot] in #85
• deps(fuzz): bump thiserror from 2.0.19 to 2.0.20 in /fuzz by @dependabot[bot] in #84
• deps: bump futures-util from 0.3.33 to 0.3.34 by @dependabot[bot] in #83
• deps: bump toml from 1.1.3+spec-1.1.0 to 1.1.4+spec-1.1.0 by @dependabot[bot] in #82
• deps: bump rustls from 0.23.42 to 0.23.43 by @dependabot[bot] in #80
• ci: bump docker/setup-qemu-action from 3.7.0 to 4.2.0 by @dependabot[bot] in #77
• ci: bump actions/cache from 4.3.0 to 6.1.0 by @dependabot[bot] in #74
• deps(docker): bump debian from 7b140f3 to abd67ff in /deploy by @dependabot[bot] in #79
• ci: bump postcss from 8.5.19 to 8.5.26 in /services/admin/frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in #88
• deps: bump base64 from 0.22.1 to 0.23.1 by @dependabot[bot] in #86
• deps: bump jsonwebtoken from 10.4.0 to 11.0.0 by @dependabot[bot] in #78
• deps: bump tower-http from 0.6.11 to 0.7.0 by @dependabot[bot] in #70
• ci: bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #76
• ci: bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by @dependabot[bot] in #72
• ci: bump github/codeql-action/upload-sarif from 3.36.2 to 4.37.3 by @dependabot[bot] in #71
• deps(docker): bump node from 22-bookworm-slim to 25-bookworm-slim in /deploy by @dependabot[bot] in #67
• ci(dependabot): raise github-actions PR limit to 10 by @kruatech in #65
• deps: bump aes-gcm from 0.10.3 to 0.11.0 by @dependabot[bot] in #75
• deps: bump rand from 0.8.7 to 0.10.2 by @dependabot[bot] in #73
• deps: bump sysinfo from 0.30.13 to 0.39.6 by @dependabot[bot] in #69
• ci: pin the af-xdp check image by digest by @kruatech in #89
• deps: bump wtransport from 0.7.1 to 0.7.2 by @dependabot[bot] in #106
• deps: bump async-trait from 0.1.91 to 0.1.92 by @dependabot[bot] in #105
• deps: bump uuid from 1.24.0 to 1.24.1 by @dependabot[bot] in #104
• deps: bump thiserror from 2.0.19 to 2.0.20 by @dependabot[bot] in #103
• deps: bump io-uring from 0.7.13 to 0.7.14 by @dependabot[bot] in #102
• deps: bump futures from 0.3.33 to 0.3.34 by @dependabot[bot] in #101
• ci: bump github/codeql-action/analyze from f081e69141f6ea0aa740920b0c7012cd81a4fbe6 to 4187e74d05793876e9989daffde9c3e66b4acd07 by @dependabot[bot] in #100
• deps(docker): bump rust from 1.95.0-bookworm to 1.98.0-bookworm in /deploy by @dependabot[bot] in #99
• ci: bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in #98
• ci: bump docker/login-action from 3.7.0 to 4.6.0 by @dependabot[bot] in #97
• ci: bump ossf/scorecard-action from 2.4.1 to 2.4.4 by @dependabot[bot] in #96
• ci: bump dtolnay/rust-toolchain from 3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 by @dependabot[bot] in #95
• ci: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.8 by @dependabot[bot] in #94
• ci: bump Swatinem/rust-cache from e18b497796c12c097a38f9edb9d0641fb99eee32 to f0d9c3887740aee45f6153b24b3a6b815192ec16 by @dependabot[bot] in #93
• fix(auth): request the getrandom feature that OsRng needs by @kruatech in #107
• ci: bump docker/build-push-action from 6.19.2 to 7.3.0 by @dependabot[bot] in #90
• ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #91
• ci: bump github/codeql-action/init from f081e69141f6ea0aa740920b0c7012cd81a4fbe6 to 4187e74d05793876e9989daffde9c3e66b4acd07 by @dependabot[bot] in #92
• test(stun): kill the surviving mutants in the attribute getters by @kruatech in #108
• docs: state that changes come with tests by @kruatech in #109
• release: 0.3.1 by @kruatech in #110

Full Changelog: v0.3.0...v0.3.1