v0.3.2

This release is primary to expose new client-side features, as server-side changes are available in the rolling release of the Helm chart.

Client Changes

The new provider_trait functionality allows rule authors to indicate which provider capabilities are needed to evaluate a rule. This allows a repository rule (for example) to be conditioned on GitHub's branch protection API, and ignore (not be executed or skipped) repositories provider by GitLab or other providers with different branch protection APIs. As this is a new field in the RuleType, it requires a new client to parse and send the content to the server. There were also a number of improvements to mindev test based on implementation experience, including reporting of rules which are not tested, and json.encode and json.decode Starlark built-ins.

• Add provider_trait field to RuleType.Definition by @intelligent-ears in #6669
• Simplify spacing requirements for rego format by @evankanderson in #6730
• feat(mindev): add --junit-file flag to test command and add Starlark testing docs by @krrish175-byte in #6690
• Add Starlark JSON module by @evankanderson in #6755
• Add coverage tracking for mindev test by @evankanderson in #6749

Server Changes

New Features

Major new features include the provider_trait evaluation support and OCI artifact support for both Quay.io and additional information to support additional OCI artifact ruletypes. There were also additional improvements in REST data sources and quota reporting to operators.

• Gate rule type engine construction on provider_traits by @intelligent-ears in #6702
• docs: document provider_traits for rule type authors by @intelligent-ears in #6728
• Add gitlab to the provider_type enum and report it in SupportedProviderTypes by @intelligent-ears in #6748

Improvements to OCI providers (still in initial / partially-documented status, protected by flags):

• Fix DockerHub provider-class manager missing OAuthManager by @shreyaabaranwal in #6756
• Add Quay.io provider (first slice of #6436) by @shreyaabaranwal in #6753
• Expose OCI image identity in artifact ingester by @shreyaabaranwal in #6775

General operational improvements:

• Make REST data source limits configurable by @maxi-maxima in #6700
• feat(github): record remaining API quota gauges by @jeremychoi in #6703
• Add fallback support for REST data source handler by @shreyaabaranwal in #6729

Bug Fixes

• Retry remediations after transient errors by @maxi-maxima in #6684
• fix(gitlab): request project license from the API by @YAshhh29 in #6724
• Fix panic recovery logging and OAuth callback race by @NAME-ASHWANIYADAV in #6733
• Surface the HTTP status when REST remediation fails by @NAME-ASHWANIYADAV in #6747
• Fix timing attack in GitLab webhook secret verification by @th3Gli4ch in #6772
• fix: apply repository filter in ListArtifacts by @th3Gli4ch in #6769

Dependency Updates

• build(deps-dev): bump globals from 17.8.0 to 17.9.0 in /docs by @dependabot[bot] in #6692
• build(deps): bump the buf group with 2 updates by @dependabot[bot] in #6695
• build(deps): bump the otel group with 11 updates by @dependabot[bot] in #6694
• build(deps): bump styled-components from 6.4.4 to 6.5.0 in /docs by @dependabot[bot] in #6693
• build(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6698
• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.29 to 1.6.30 by @dependabot[bot] in #6699
• build(deps): bump github.com/openfga/openfga from 1.18.1 to 1.18.3 by @dependabot[bot] in #6697
• build(deps): bump github.com/go-openapi/loads from 0.23.3 to 0.25.0 by @dependabot[bot] in #6696
• build(deps): bump mobx from 6.16.1 to 7.0.0 in /docs by @dependabot[bot] in #6691
• build(deps): bump github.com/lestrrat-go/httprc/v3 from 3.0.5 to 3.0.6 by @dependabot[bot] in #6708
• build(deps-dev): bump globals from 17.9.0 to 17.10.0 in /docs by @dependabot[bot] in #6707
• build(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6710
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.3 by @dependabot[bot] in #6709
• build(deps): bump github.com/nats-io/nats.go from 1.52.0 to 1.53.1 by @dependabot[bot] in #6706
• build(deps): bump styled-components from 6.5.0 to 6.5.2 in /docs by @dependabot[bot] in #6705
• build(deps): bump github.com/sigstore/sigstore-go from 1.2.1 to 1.3.0 by @dependabot[bot] in #6704
• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.30 to 1.6.31 by @dependabot[bot] in #6711
• build(deps): bump the tools group across 1 directory with 5 updates by @dependabot[bot] in #6657
• build(deps): bump github.com/moby/buildkit from 0.28.1 to 0.31.1 by @dependabot[bot] in #6712
• build(deps): bump github.com/stacklok/frizbee from 0.1.7 to 0.1.11 by @dependabot[bot] in #6720
• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.31 to 1.6.32 by @dependabot[bot] in #6723
• build(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6722
• build(deps): bump github.com/open-feature/go-sdk from 1.17.2 to 1.18.0 by @dependabot[bot] in #6721
• build(deps): bump github.com/zitadel/oidc/v3 from 3.47.5 to 3.49.2 by @dependabot[bot] in #6719
• build(deps): bump styled-components from 6.5.2 to 6.5.3 in /docs by @dependabot[bot] in #6716
• build(deps-dev): bump globals from 17.10.0 to 17.11.0 in /docs by @dependabot[bot] in #6717
• build(deps): bump github.com/mikefarah/yq/v4 from 4.48.1 to 4.53.6 by @dependabot[bot] in #6718
• build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot[bot] in #6743
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /tools by @dependabot[bot] in #6742
• build(deps): bump fast-uri from 3.1.5 to 3.1.7 in /docs by @dependabot[bot] in #6744
• build(deps): bump github.com/nats-io/nats-server/v2 from 2.14.2 to 2.14.6 by @dependabot[bot] in #6738
• build(deps): bump github.com/rs/zerolog from 1.34.0 to 1.35.1 by @dependabot[bot] in #6737
• build(deps): bump mobx from 7.0.0 to 7.0.3 in /docs by @dependabot[bot] in #6734
• build(deps-dev): bump @humanfs/node from 0.16.6 to 0.16.8 in /docs by @dependabot[bot] in #6745
• build(deps): bump the otel group across 1 directory with 11 updates by @dependabot[bot] in #6735
• build(deps): bump buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go from 1.36.12-20260709200747-435963d16310.1 to 1.36.12-20260825204119-511051f7f437.1 in the buf group across 1 directory by @dependabot[bot] in #6736
• build(deps): bump the codeql group with 3 updates by @dependabot[bot] in #6739
• build(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 by @dependabot[bot] in #6740
• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.32 to 1.6.33 by @dependabot[bot] in #6741
• build(deps): bump the tools group in /tools with 6 updates by @dependabot[bot] in #6731
• build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /tools by @dependabot[bot] in #6757
• build(deps-dev): bump js-yaml from 3.14.2 to 3.15.2 in /docs by @dependabot[bot] in #6760
• build(deps): bump chainguard-dev/actions/boilerplate from 1.6.33 to 1.6.34 by @dependabot[bot] in #6767
• build(deps): bump the buf group with 2 updates by @dependabot[bot] in #6763
• build(deps): bump github.com/charmbracelet/glamour from 0.10.0 to 1.0.0 by @dependabot[bot] in #6764
• build(deps-dev): bump globals from 17.11.0 to 17.12.0 in /docs by @dependabot[bot] in #6762
• build(deps): bump golang.org/x/oauth2 from 0.36.0 to 0.37.0 by @dependabot[bot] in #6765
• build(deps): bump github.com/grpc-ecosystem/go-grpc-middleware/v2 from 2.3.3 to 2.3.4 by @dependabot[bot] in #6766
• build(deps): bump svgo from 2.8.3 to 2.8.4 in /docs by @dependabot[bot] in #6758
• build(deps): bump colord from 2.9.3 to 2.10.0 in /docs by @dependabot[bot] in #6759
• build(deps): bump github.com/containerd/containerd from 1.7.33 to 1.7.35 by @dependabot[bot] in #6770
• build(deps): bump joi from 17.12.2 to 17.13.7 in /docs by @dependabot[bot] in #6761
• build(deps): bump glob from 10.4.5 to 10.5.0 in /docs by @dependabot[bot] in #6771
• build(deps): bump github.com/google/osv-scalibr from 0.3.4 to 0.5.2 by @dependabot[bot] in #6179

New Contributors

• @jeremychoi made their first contribution in #6703
• @YAshhh29 made their first contribution in #6724
• @shreyaabaranwal made their first contribution in #6729
• @NAME-ASHWANIYADAV made their first contribution in #6733
• @th3Gli4ch made their first contribution in #6772

Full Changelog: v0.3.1...v0.3.2