Release v2.0.0-beta.1 · notaryproject/ratify

💥 Breaking Changes

chore: rename CRD group ratify.dev to ratify.sh by @fseldow in #2822
chore: drop leftover config.ratify.deislabs.io ClusterRole rules by @fseldow in #2832

feat: support multi-tenancy via namespaced Executor CRD by @fseldow in #2862
feat(cosign): allow key-based verification without a timestamp by @charleswool in #2753
feat(helm): add provider.mutationExcludedNamespaces for Assign mutation webhook exclusions by @eric-nichols-cava in #2755
feat: add liveness and readiness probes to gatekeeper provider by @charleswool in #2772
feat: gate readiness on the executor being loaded by @charleswool in #2840
feat: set container resource requests and limits by @charleswool in #2841
feat: make log level configurable by @charleswool in #2846
feat: expose provider metrics in the Helm chart by @charleswool in #2848

fix(notation): reject leaf cert trust anchors by @fseldow in #2723
fix(cosign): honor ignoreCTLog instead of forcing it for key-based policies by @charleswool in #2838

fix: bump google.golang.org/grpc to v1.82.1 to fix GHSA-hrxh-6v49-42gf (gRPC-Go xDS RBAC & HTTP/2 vulnerabilities) by @charleswool in #2791
chore: bump sigstore-go to 1.2.2 to fix CVE-2026-54787 (signature timestamp not checked against signing key validity) by @dependabot in #2764

Full Changelog: v2.0.0-alpha.2...v2.0.0-beta.1