v3.11.1

v3.11.1

Sec

• Notary delegation fallback allowed stealthy fallback to targets #2151
• Count distinct trust roots for signature thresholds in cosign #2150, reported by @arpitjain099.

Fix

• Add timeouts to various http clients #2144

Build

• Remove hidden files from build context #2139

Ci

• Limit pr workflow to one concurrent run per branch #2143

Test

• Match go-containerregistry fix #2123

Update

• Bump the gomod-packages group across 1 directory with 6 updates #2148
• Bump the gh-actions-packages group across 1 directory with 7 updates #2149
• Bump the gomod-packages group across 1 directory with 15 updates #2123
• google.golang.org/grpc v1.82.1 #2153

---

What's Changed

• fix: Add timeouts to http clients by @Starkteetje in #2144
• ci: Limit PR workflow to one concurrent run per branch by @Starkteetje in #2143
• update: bump the gomod-packages group across 1 directory with 15 updates by @dependabot[bot] in #2123
• build: Remove hidden files from build context by @Starkteetje in #2139
• update: bump the gh-actions-packages group across 1 directory with 7 updates by @dependabot[bot] in #2149
• update: bump the gomod-packages group across 1 directory with 6 updates by @dependabot[bot] in #2148
• sec: count distinct trust roots for signature thresholds in cosign by @phbelitz in #2150, reported by @arpitjain099. Thank you for the coordinated disclosure.
• sec: Notary delegation fallback allowed stealthy fallback to targets by @Starkteetje in #2151
• update: google.golang.org/grpc v1.82.1 by @phbelitz in #2153
• Develop by @phbelitz in #2152

Full Changelog: v3.11.0...v3.11.1