Release v1.4.3 · notaryproject/ratify

🐛 Bug Fixes

fix: initialize registryHostGetter in MIAuthProvider to prevent nil pointer panic by @fseldow in #2509
fix: add emptyDir for ORAS local cache to support non-root image builds by @fseldow in #2516
fix: use tenant authority for Azure workload identity by @fseldow in #2554
fix: repair AKS E2E validation by updating a dead URL, Key Vault principal type, and Kubernetes version by @charleswool in #2574
fix: upgrade Helm chart version to 1.15.4 to correct the chart repository configuration by @fseldow in #2728

chore: bump Go and dependencies for the release-1.4 branch by @fseldow in #2507
chore: bump dependencies to fix CVE-2026-32952 and CVE-2026-39984 by @fseldow in #2520
chore: ignore GO-2026-4529 in govulncheck for cosign v2.6.3 by @fseldow in #2525
chore: bump security and supply-chain related dependencies including sigstore/fulcio, sigstore/rekor, timestamp-authority, in-toto-golang, ORAS, OPA, Kubernetes libraries, Docker CLI, Azure SDK, AWS SDK, and go-containerregistry in #2518, #2528, #2545, #2547, #2548, #2614, #2615, #2616, #2624, #2645, #2646, #2651, #2652, #2658, #2706, #2708, #2721
chore: update signing certificate and signature verification values by @wangxiaoxuan273 in #2684 and #2687

chore: publish Helm chart only after image publish succeeds by @fseldow in #2529
chore: prepare v1.4.1, v1.4.3 release charts, and chart/image version updates by @fseldow in #2510, #2512, #2690
chore: update Go builder and container images for release and httpserver builds by @fseldow and @dependabot in #2519, #2567, #2578, #2586, #2612, #2640, #2722
ci: update AKS, E2E, Gatekeeper, Trivy, Scorecard, SBOM, and markdown link-check automation by @fseldow, @wangxiaoxuan273, and @dependabot in #2575, #2587, #2593, #2631, #2641, #2656
ci: temporarily migrate publish package CI to azure-test and revert the migration by @fseldow in #2689 and #2715

Full Changelog: v1.4.0...v1.4.3