v0.4.0

What's Changed

• Fix failing GitHub Actions job Local CLI and JVM (tiers 1-2) by Bruno Borges (@brunoborges) with @Copilot in #10
• Prefix container images with Brewlet by Bruno Borges (@brunoborges) in #11
• Prepare Brewlet for open source release by Bruno Borges (@brunoborges) in #14
• Add third-party notices to release artifacts by Bruno Borges (@brunoborges) in #16
• Harden tar extraction against path traversal by Bruno Borges (@brunoborges) with @Copilot in #15
• Remove unused Lunr language assets by Bruno Borges (@brunoborges) in #17
• Prepare repository for open source release by Bruno Borges (@brunoborges) in #18
• Verify provisioner downloads and pin container images by Bruno Borges (@brunoborges) in #32
• Secure node-shared AppCDS cache isolation by Bruno Borges (@brunoborges) in #31
• Bind Brewlet execution to CRI image identity by Bruno Borges (@brunoborges) in #33
• Require explicit digest-pinned JDK and launcher sources by Bruno Borges (@brunoborges) in #34
• Fix provisioner lifecycle test error capture by Bruno Borges (@brunoborges) with @Copilot in #35
• Prefix E2E jobs with tier numbers by Bruno Borges (@brunoborges) in #38
• Prevent artifact launch config from overriding pod identity by Bruno Borges (@brunoborges) in #37
• Harden webhook credentials and network access by Bruno Borges (@brunoborges) in #39
• Update security review remediation status by Bruno Borges (@brunoborges) in #40
• Pin GitHub Actions and publish release build provenance by Bruno Borges (@brunoborges) in #42
• Validate mainJar as a bare filename and contain staging paths by Bruno Borges (@brunoborges) in #41
• chore(deps-dev): Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.3.0 to 3.5.1 in /maven-plugin by Dependabot (@dependabot)[bot] in #44
• chore(deps-dev): Bump org.apache.maven.plugins:maven-surefire-plugin from 3.2.3 to 3.5.6 in /maven-plugin by Dependabot (@dependabot)[bot] in #45
• chore(deps): Bump maven.version from 3.9.0 to 3.9.16 in /maven-plugin by Dependabot (@dependabot)[bot] in #46
• fix(security): reject non-canonical OCI digests before path construction by Bruno Borges (@brunoborges) in #43
• chore(deps-dev): Bump org.junit.jupiter:junit-jupiter from 5.10.1 to 6.1.3 in /maven-plugin by Dependabot (@dependabot)[bot] in #47
• chore(deps): Bump github.com/containerd/typeurl/v2 from 2.1.1 to 2.3.0 in /core by Dependabot (@dependabot)[bot] in #48
• chore(deps): Bump github.com/containerd/containerd from 1.7.33 to 1.7.34 in /core by Dependabot (@dependabot)[bot] in #52
• chore(deps): Bump github.com/prometheus/client_golang from 1.19.1 to 1.24.1 in /kubernetes by Dependabot (@dependabot)[bot] in #57
• chore(deps): Bump actions/setup-node from 6.5.0 to 7.0.0 by Dependabot (@dependabot)[bot] in #59
• chore(deps): Bump tslib from 2.7.0 to 2.8.1 in /site/notices by Dependabot (@dependabot)[bot] in #53
• docs: clarify the How it works diagram in the README by Bruno Borges (@brunoborges) in #60
• chore(deps): Bump @fortawesome/fontawesome-free from 7.1.0 to 7.3.1 in /site/notices by Dependabot (@dependabot)[bot] in #54
• chore(deps): Bump github.com/containerd/ttrpc from 1.2.7 to 1.2.9 in /core by Dependabot (@dependabot)[bot] in #50
• chore(deps): Bump com.fasterxml.jackson.core:jackson-databind from 2.18.9 to 2.22.2 in /maven-plugin by Dependabot (@dependabot)[bot] in #49
• chore(deps): Bump sigs.k8s.io/controller-runtime from 0.19.0 to 0.24.1 in /kubernetes by Dependabot (@dependabot)[bot] in #58
• Harden registry credential transport and origin policy by Bruno Borges (@brunoborges) in #61
• chore(deps): Bump k8s.io/apimachinery from 0.36.0 to 0.37.0 in /kubernetes by Dependabot (@dependabot)[bot] in #56
• chore(deps): Bump k8s.io/client-go from 0.31.1 to 0.37.0 in /kubernetes by Dependabot (@dependabot)[bot] in #55
• fix(security): restrict privileged provisioner node placement by Bruno Borges (@brunoborges) in #63
• chore(deps): Bump github.com/containerd/containerd/api from 1.8.0 to 1.11.1 in /core by Dependabot (@dependabot)[bot] in #51
• fix(security): confine launcher and JDK annotations to the runtime roots by Bruno Borges (@brunoborges) in #62
• fix(metrics): give the exporter a writable telemetry socket mount by Bruno Borges (@brunoborges) in #67
• feat(shim)!: migrate to containerd/v2 and serve task API v3 by Bruno Borges (@brunoborges) in #64
• docs(security): reconcile the security review with the merged remediations by Bruno Borges (@brunoborges) in #68
• Fix fail-open admission policy, JDK root leak, and capability-label contract violation by Bruno Borges (@brunoborges) in #70
• Deliver jvm.args as argv so deployment tuning wins (BREAKING) by Bruno Borges (@brunoborges) in #71
• Freeze the 1.0 observable contract by Bruno Borges (@brunoborges) in #72
• Cover the §14 failure contract and fix residual bugs by Bruno Borges (@brunoborges) in #73
• docs: make NOTICE.txt an explicit, navigable notice index by Bruno Borges (@brunoborges) in #74
• Fix failing GitHub Actions job Tier 14: Custom JDK NodeProfile by Bruno Borges (@brunoborges) with @Copilot in #69
• Prepare the 0.4.0 release by Bruno Borges (@brunoborges) in #75
• fix(release): render the chart with the JDK sources it requires by Bruno Borges (@brunoborges) in #76
• fix(release): give the chart attestation registry credentials by Bruno Borges (@brunoborges) in #77

New Contributors

• Bruno Borges (@brunoborges) with @Copilot made their first contribution in #10

Full Changelog: v0.3.1...v0.4.0