v2026.06.02

Verification

This release is signed with Sigstore (keyless, via GitHub OIDC) and has a SLSA build-provenance attestation.

Verification commands: VERIFICATION.md

Changes

What's Changed

• Date the trim entry as [2026.05.21.2] post-release by @wnstfy in #29
• chore(deps): update docker.io/mariadb docker tag to v11.8.7 by @renovate[bot] in #30
• Record round-2 upgrade verification (app image bumps) by @wnstfy in #43
• chore(deps): update lscr.io/linuxserver/jellyfin docker tag to v10.11.9 by @renovate[bot] in #32
• chore(deps): update freshrss/freshrss docker tag to v1.29.1 by @renovate[bot] in #31
• chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.22.1 by @renovate[bot] in #33
• chore(deps): update mongo docker tag to v8.3.2 by @renovate[bot] in #34
• chore(deps): update n8nio/runners docker tag to v2.22.1 by @renovate[bot] in #35
• chore(deps): update actions/upload-artifact action to v7 by @renovate[bot] in #38
• chore(deps): update dawidd6/action-download-artifact action to v21 by @renovate[bot] in #39
• chore(deps): update peter-evans/create-pull-request action to v8 by @renovate[bot] in #41
• chore(deps): update docker.io/mariadb docker tag to v12 by @renovate[bot] in #40
• chore(deps): update stoatchat to v0.13.6 by @renovate[bot] in #37
• chore(deps): update redis docker tag to v8 by @renovate[bot] in #42
• chore(deps): update rabbitmq to v4.3.0 by @renovate[bot] in #36
• Switch app-image Renovate to auto-merge, harden PR gates, auto-generate CHANGELOG by @wnstfy in #44
• Add CODEOWNERS for plumbing + unblock Scorecard Dependency-Update-Tool by @wnstfy in #45
• Un-ignore .github/ in release tarball to unblock Scorecard workflow checks by @wnstfy in #48
• Clarify Releases page is the canonical changelog source by @wnstfy in #49
• chore(deps): update adguard/adguardhome docker tag to v0.107.76 by @renovate[bot] in #50
• Weekly audit refresh: 26388722176 by @github-actions[bot] in #51
• Auto-enable PR auto-merge in weekly-audit workflow by @wnstfy in #52
• Fix CODEOWNERS owner: @wnstify (org, invalid) → @wnstfy (user) by @wnstfy in #53
• Fix CVE gate hard-failing on baseline runs by @wnstfy in #55
• Add hardened Syncthing Docker Compose template by @wnstfy in #54
• Weekly audit refresh: 26741497515 by @github-actions[bot] in #56
• Add hardened Vaultwarden template by @wnstfy in #57

New Contributors

• @github-actions[bot] made their first contribution in #51

Full Changelog: v2026.05.21.2...v2026.06.02

v2026.05.26

Verification

This release is signed with Sigstore (keyless, via GitHub OIDC) and has a SLSA build-provenance attestation.

Verification commands: VERIFICATION.md

Changes

What's Changed

• Date the trim entry as [2026.05.21.2] post-release by @wnstfy in #29
• chore(deps): update docker.io/mariadb docker tag to v11.8.7 by @renovate[bot] in #30
• Record round-2 upgrade verification (app image bumps) by @wnstfy in #43
• chore(deps): update lscr.io/linuxserver/jellyfin docker tag to v10.11.9 by @renovate[bot] in #32
• chore(deps): update freshrss/freshrss docker tag to v1.29.1 by @renovate[bot] in #31
• chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.22.1 by @renovate[bot] in #33
• chore(deps): update mongo docker tag to v8.3.2 by @renovate[bot] in #34
• chore(deps): update n8nio/runners docker tag to v2.22.1 by @renovate[bot] in #35
• chore(deps): update actions/upload-artifact action to v7 by @renovate[bot] in #38
• chore(deps): update dawidd6/action-download-artifact action to v21 by @renovate[bot] in #39
• chore(deps): update peter-evans/create-pull-request action to v8 by @renovate[bot] in #41
• chore(deps): update docker.io/mariadb docker tag to v12 by @renovate[bot] in #40
• chore(deps): update stoatchat to v0.13.6 by @renovate[bot] in #37
• chore(deps): update redis docker tag to v8 by @renovate[bot] in #42
• chore(deps): update rabbitmq to v4.3.0 by @renovate[bot] in #36
• Switch app-image Renovate to auto-merge, harden PR gates, auto-generate CHANGELOG by @wnstfy in #44
• Add CODEOWNERS for plumbing + unblock Scorecard Dependency-Update-Tool by @wnstfy in #45
• Un-ignore .github/ in release tarball to unblock Scorecard workflow checks by @wnstfy in #48
• Clarify Releases page is the canonical changelog source by @wnstfy in #49
• chore(deps): update adguard/adguardhome docker tag to v0.107.76 by @renovate[bot] in #50
• Weekly audit refresh: 26388722176 by @github-actions[bot] in #51
• Auto-enable PR auto-merge in weekly-audit workflow by @wnstfy in #52
• Fix CODEOWNERS owner: @wnstify (org, invalid) → @wnstfy (user) by @wnstfy in #53

New Contributors

• @github-actions[bot] made their first contribution in #51

Full Changelog: v2026.05.21.2...v2026.05.26

v2026.05.21.2

Verification

This release is signed with Sigstore (keyless, via GitHub OIDC) and has a SLSA build-provenance attestation.

Verification commands: VERIFICATION.md

Changes

What's Changed

• Date [Unreleased] block as [2026.05.21.1] post-release by @wnstfy in #27
• Trim release tarball via .gitattributes export-ignore by @wnstfy in #28

Full Changelog: v2026.05.21.1...v2026.05.21.2

v2026.05.21.1

Verification

This release is signed with Sigstore (keyless, via GitHub OIDC) and has a SLSA build-provenance attestation.

Verification commands: VERIFICATION.md

Changes

What's Changed

• Add Releases & Verification section to README by @wnstfy in #18
• Attach SLSA provenance bundle as release asset by @wnstfy in #19
• Add weekly auto-tag for CalVer releases by @wnstfy in #20
• Fix pr-misconfig-scan comment wording on clean runs by @wnstfy in #21
• Add OpenSSF Best Practices badge to README by @wnstfy in #22
• Add TEST.md: upgrade-testing methodology by @wnstfy in #23
• Remove TEST.md from the public repo (internal-only) by @wnstfy in #24
• Record pre-flight upgrade verification in CHANGELOG by @wnstfy in #25
• Lock rabbitmq Erlang node name to a stable hostname (zulip + stoat) by @wnstfy in #26

Full Changelog: v2026.05.21...v2026.05.21.1

v2026.05.21

Verification

This release is signed with Sigstore (keyless, via GitHub OIDC) and has a SLSA build-provenance attestation.

Verification commands: VERIFICATION.md

Changes

What's Changed

• chore(deps): update docker.io/alpine docker tag to v3.23.4 by @renovate[bot] in #3
• chore(deps): update nginx docker tag to v1.31.0 by @renovate[bot] in #4
• Run PR CVE gate on every PR so it can serve as a required check by @wnstfy in #9
• chore(deps): update actions/cache action to v5 by @renovate[bot] in #6
• chore(config): migrate Renovate config by @renovate[bot] in #5
• Harden CI: SHA-pin actions, isolate PR scripts, pin Trivy installer by @wnstfy in #10
• Add Scorecard, Trivy misconfig scan, and actionlint by @wnstfy in #11
• Add OpenSSF Scorecard badge to README by @wnstfy in #12
• Score-driven hardening: least-privilege tokens + checksummed Trivy by @wnstfy in #13
• Pass SCORECARD_TOKEN so Branch-Protection check can actually run by @wnstfy in #14
• Add CONTRIBUTING and Contributor Covenant 2.1 Code of Conduct by @wnstfy in #15
• Add CHANGELOG and signed-release workflow (cosign + SLSA) by @wnstfy in #16
• Fix release workflow: use cosign bundle format by @wnstfy in #17

New Contributors

• @renovate[bot] made their first contribution in #3
• @wnstfy made their first contribution in #9

Full Changelog: https://github.com/wnstify/docker/commits/v2026.05.21