v0.23.1

What's Changed

• Keep upgrade.sh from reading the SSH stream in the demo deploy by @haksungjang in #545
• Bump BomLens to 1.13.5 and allow its Go cache variables in stage 1 by @haksungjang in #546
• ci: suppress CVE-2026-56851 in the bundled cosign until it ships x/text 0.41 by @haksungjang in #548
• docs: describe BomLens as an optional scan engine in the README by @haksungjang in #547
• Refresh worker image dependencies to clear the image-scan gate by @haksungjang in #554
• Create the sca-self-scan label before the self-scan files its alert by @haksungjang in #550
• Keep the gate policy editor closed until the policy has loaded by @haksungjang in #552
• Recover from failed lazy chunk loads and contain route crashes by @haksungjang in #553
• Show load failures as errors and recover RFC 7807 bodies from blob downloads by @haksungjang in #555
• Keep error toasts until dismissed and announce them as alerts by @haksungjang in #556
• Point install defaults at v0.23.0 and gate releases on them by @haksungjang in #561
• Send an empty body with the remediation no-op 204 by @haksungjang in #562
• Fix dead repo links, DT leftovers, suppression docs and release history by @haksungjang in #564
• Pin the Trivy database the golden nightly scans with by @haksungjang in #563
• Deliver each notification unit once across retries and redelivery by @haksungjang in #559
• Reconcile vulnerability findings by key instead of replacing them by @haksungjang in #560
• Patch worker image packages flagged by new advisories by @haksungjang in #577
• Release 0.23.1 by @haksungjang in #576

Full Changelog: v0.23.0...v0.23.1