v0.89.0-rc2

What's Changed

🚀 Updates

• feat: allow R.C. versions to pass version requirements by @AustinAbro321 in #5479
• fix: ensure chart order is preserved in state by @mjnagel in #5477
• test: fix image push unit test flake by @AustinAbro321 in #5481
• chore: goreleaser signed commits and dco bot bypass by @brandtkeller in #5485

📦 Dependencies

• chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @dependabot[bot] in #5488
• chore(deps): bump the codeql group with 3 updates by @dependabot[bot] in #5487
• chore(deps): bump the actions-organization group with 3 updates by @dependabot[bot] in #5486

Full Changelog: v0.89.0-rc1...v0.89.0-rc2

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v0.89.0-rc2.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0-rc2" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v0.89.0-rc2.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v0.89.0-rc2" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.