)]}'
{
  "log": [
    {
      "commit": "86d2b4dbadc324b53e28670af93d2484e3716ba5",
      "tree": "e7eb5379e65cca14ed776a568dfa11998573ae45",
      "parents": [
        "d48641e641338394d1039c009ba15e0f04b82610"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 21 23:15:31 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 15:15:31 2026 -0700"
      },
      "message": "chore(deps): update go dependencies (#310)\n\n* chore(deps): update go dependencies\n\n* update\n\n---------\n\nCo-authored-by: Ville Brofeldt \u003cville.v.brofeldt@gmail.com\u003e"
    },
    {
      "commit": "d48641e641338394d1039c009ba15e0f04b82610",
      "tree": "62b2c8cfc6c0e069026cb128b79ffeed5a1f604a",
      "parents": [
        "8106d0cd44386a4d30e8ce5b46aacfacb8a360c6"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 21 22:39:59 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 14:39:59 2026 -0700"
      },
      "message": "chore(renovate): disable major updates for indirect Go modules (#308)\n\n* chore(deps): update go dependencies\n\n* chore(renovate): disable major updates for indirect Go modules\n\nRenovate\u0027s \"major indirect\" gomod updates cannot produce a correct\ngo.mod for path-versioned modules. The major version is encoded in the\nimport path (…/v5, go.yaml.in/yaml/v3, gopkg.in/…​.v4), so different\nmajors are distinct modules that coexist, and an indirect module\u0027s major\nis owned by whichever upstream direct dependency pins it — not by this\nrepo. When Renovate attempts such a bump it rewrites the import-path\nmajor segment, which either collides with the copy already pulled in\ntransitively (duplicate `require` directive → invalid go.mod, e.g. the\nearlier revisions of #308) or lands as an unused extra require while the\nold major is still needed, and it can even downgrade a sibling module.\n\nSuppress major indirect gomod bumps; minor/patch indirect bumps stay\nenabled and CI-gated as before. These majors advance naturally when the\nupstream consumer migrates.\n\nThis also repurposes the #308 branch: the invalid dependency bump is\nreverted (go.mod/go.sum restored to main) and replaced with this config\nrule so the change lands without a new PR.\n\n---------\n\nCo-authored-by: Ville Brofeldt \u003cville.v.brofeldt@gmail.com\u003e"
    },
    {
      "commit": "8106d0cd44386a4d30e8ce5b46aacfacb8a360c6",
      "tree": "1b065e6d690857e55d47e7ffe710804beee651dc",
      "parents": [
        "8c864bc2ef43b730c2ea2cde1c664a51da1910a3"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 21 22:18:57 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 14:18:57 2026 -0700"
      },
      "message": "chore(deps): update gcr.io/distroless/static:nonroot docker digest to 1c2c046 (#309)"
    },
    {
      "commit": "8c864bc2ef43b730c2ea2cde1c664a51da1910a3",
      "tree": "bc223635638a80397c52c7c1f062e5b2b5748792",
      "parents": [
        "7c46683f2a44919cb01405ecaa045a82c9e0b980"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 21 22:08:13 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 14:08:13 2026 -0700"
      },
      "message": "chore(deps): update module gomodules.xyz/jsonpatch/v2 to v2.5.0 (#307)"
    },
    {
      "commit": "7c46683f2a44919cb01405ecaa045a82c9e0b980",
      "tree": "e3189d10760616ec074bdfdf1663e1d928794025",
      "parents": [
        "8f61a96bf77baef45c63b1121fef7991074934da"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Fri Aug 21 11:59:27 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 11:59:27 2026 -0700"
      },
      "message": "chore(deps): align go directive to 1.27 and auto-track it (#306)\n\n* chore(deps): align go directive with 1.27 toolchain\n\nPR #299 bumped the Dockerfile builder image to golang:1.27.0 but left the\ngo.mod `go` directive at 1.26.6, so CI (which resolves go-version-file:\ngo.mod) and the language level stayed on 1.26 while the release image built\nwith 1.27. Bump the directive to 1.27.0 so the language level, CI, and the\nbuilder image are all on 1.27.\n\n* chore(renovate): bump go.mod go directive in lockstep\n\nRenovate parses the go.mod `go` directive with go-mod-directive\nversioning, treating `go 1.27.0` as a `\u003e\u003d1.27.0` minimum constraint.\nUnder the default `replace` rangeStrategy a range is only rewritten when\nthe new version falls outside it, so every newer Go still satisfies the\nconstraint and the directive never moves — leaving it frozen (it sat at\n1.26.6 while the golang image advanced to 1.26.7 and then 1.27.0).\n\nSet rangeStrategy:bump for the `go` directive so a Go release raises it\nto the latest in lockstep. The existing \"Go toolchain\" group already\nmatches depName `go`, so the directive bump now rides in the same PR as\nthe Dockerfile and devcontainer image bumps."
    },
    {
      "commit": "8f61a96bf77baef45c63b1121fef7991074934da",
      "tree": "7ba0ecabf18c788616bd3ed83e09544a174b5f16",
      "parents": [
        "8d09c9d715f5219467933d3522072c0f3a1edc4c"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 21 19:42:07 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 11:42:07 2026 -0700"
      },
      "message": "chore(deps): update go dependencies (#305)"
    },
    {
      "commit": "8d09c9d715f5219467933d3522072c0f3a1edc4c",
      "tree": "4c549057df22eb94586c5febe8c7f1dd95aed03c",
      "parents": [
        "424db1a085847431614820c407d968f50d6e24da"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 21 18:39:58 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 10:39:58 2026 -0700"
      },
      "message": "chore(deps): update go dependencies (#303)"
    },
    {
      "commit": "424db1a085847431614820c407d968f50d6e24da",
      "tree": "14a537ad2826627d297f965d7dd68936e3ecdb5a",
      "parents": [
        "26b1e39f6cd11023846d87e72edb01b6f6f000e8"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 21 18:31:27 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 10:31:27 2026 -0700"
      },
      "message": "chore(deps): update go dependencies (#304)"
    },
    {
      "commit": "26b1e39f6cd11023846d87e72edb01b6f6f000e8",
      "tree": "e764a3e2f11d4025773f640336b1b0114c5fef44",
      "parents": [
        "edb0c03e16f339f4a33c941df78d01421a90d075"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Fri Aug 21 10:18:52 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 10:18:52 2026 -0700"
      },
      "message": "chore(renovate): track indirect Go modules at latest (#291)\n\nRenovate disables indirect (transitive) gomod dependencies by default, so\nGo\u0027s minimal-version-selection only floats them up when a direct parent\nrequires a newer version. That leaves transitive modules pinned below their\nlatest supported SemVer and behind version-based advisories that Scorecard\u0027s\nOSV scan flags (but reachability-based govulncheck does not) -- the root cause\nof the four advisories fixed by the manual bump in the prior PR.\n\nEnable indirect deps so they track latest. Every bump is gated by the existing\nCI suite (build, unit/integration/e2e, govulncheck, Trivy), so a breaking\ntransitive update fails its PR rather than merging. If a module genuinely\nbreaks at latest, hold it lower with a per-package allowedVersions/enabled:false\nrule."
    },
    {
      "commit": "edb0c03e16f339f4a33c941df78d01421a90d075",
      "tree": "58cce9e075ee6afe7136f2d995697ce0aa276974",
      "parents": [
        "4dea2c230a7b94fc9daf246611c9d9beee19a3b4"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Fri Aug 21 09:44:20 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 09:44:20 2026 -0700"
      },
      "message": "docs(api-ref): collapse doc-comment line breaks in API reference (#292)\n\ncrd-ref-docs turns every newline in a Go doc comment into a \u003cbr /\u003e, so\nwrapped comments render as awkward mid-sentence breaks in the Description\ncolumn of the generated API reference tables (flagged in the PR #279\nreview). Add a small awk post-processing pass to the docs-api pipeline\nthat collapses \u003cbr /\u003e to spaces in every column except Validation, where\nthe tags intentionally stack distinct constraints (Minimum / Maximum /\nOptional / ...) and read well as-is."
    },
    {
      "commit": "4dea2c230a7b94fc9daf246611c9d9beee19a3b4",
      "tree": "b0f19a4c258893a61514bd89b8ac649600b560c3",
      "parents": [
        "d09dd22540fec8084063cbdc386d09f50d558d48"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Fri Aug 21 09:43:50 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 09:43:50 2026 -0700"
      },
      "message": "fix(deps): bump cel-go, otel, x/mod for known advisories (#290)\n\nThe OpenSSF Scorecard Vulnerabilities check flags four advisories against\nindirect dependencies pinned below their fixed versions:\n\n- GO-2026-6094  github.com/google/cel-go    0.29.0 -\u003e 0.30.0\n- GO-2026-5158  go.opentelemetry.io/otel     1.43.0 -\u003e 1.44.0 (CVE-2026-41178)\n- GO-2026-6179  golang.org/x/mod             0.37.0 -\u003e 0.40.0 (CVE-2026-56865)\n- GO-2026-6180  golang.org/x/mod             0.37.0 -\u003e 0.40.0 (CVE-2026-56864)\n\nThese are transitive modules, so Go\u0027s minimal-version-selection kept them at\nthe version their parents require and Renovate\u0027s normal cadence did not raise\nthem. Our govulncheck gate stays green because the built binary never reaches\nthe vulnerable symbols (cel-go/ext, otel baggage/propagation, x/mod/sumdb);\nScorecard uses version-based OSV scanning with no reachability, so it flags\nthem regardless. Bump the modules to their fixed versions to clear the finding.\n\nThe otel v1.x family (metric, trace, sdk) is bumped together to avoid version\nskew. go mod tidy also carried adjacent golang.org/x updates along."
    },
    {
      "commit": "d09dd22540fec8084063cbdc386d09f50d558d48",
      "tree": "3891a029a176ac28a821625c1bd82309391dab7a",
      "parents": [
        "3783e9dfe59922edf70da066b1aeaf49170b8d85"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 21 16:42:26 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 21 08:42:26 2026 -0700"
      },
      "message": "chore(deps): update github/codeql-action digest to db488dd (#302)"
    },
    {
      "commit": "3783e9dfe59922edf70da066b1aeaf49170b8d85",
      "tree": "ff8344a377c800225cef332afb6783c93b580503",
      "parents": [
        "44be294e307d08f707887f466b91e40d86024944"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 21 05:13:16 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 20 21:13:16 2026 -0700"
      },
      "message": "fix(deps): update go dependencies to v0.36.4 (#301)"
    },
    {
      "commit": "44be294e307d08f707887f466b91e40d86024944",
      "tree": "0e306bc561f63a1ebfe7497c14d6d4f06889e150",
      "parents": [
        "0dd5fea08b8136986df780b7c2f991bf2c14c472"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 20 23:40:20 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 20 15:40:20 2026 -0700"
      },
      "message": "chore(deps): update dependency mikefarah/yq to v4.53.6 (#298)"
    },
    {
      "commit": "0dd5fea08b8136986df780b7c2f991bf2c14c472",
      "tree": "4f917a90cbb43011d598ad0b48041dca751228ce",
      "parents": [
        "ffdd9f8665fee32ad2efd76dff08d3f59ad6ec83"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 20 21:55:14 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 20 13:55:14 2026 -0700"
      },
      "message": "chore(deps): update dependency golangci/golangci-lint to v2.13.1 (#300)"
    },
    {
      "commit": "ffdd9f8665fee32ad2efd76dff08d3f59ad6ec83",
      "tree": "dba1d5c6a4013095197bce119951fee49963f032",
      "parents": [
        "23a60801acf392c88900452e816236ab0336f8be"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 20 21:55:01 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 20 13:55:01 2026 -0700"
      },
      "message": "chore(deps): update golang docker tag to v1.27.0 (#299)"
    },
    {
      "commit": "23a60801acf392c88900452e816236ab0336f8be",
      "tree": "86b46dfb8777b68df030a9ef24020224ebadd516",
      "parents": [
        "c82b43459f638e253090afc946678fac9cd0f266"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 20 03:33:36 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 19:33:36 2026 -0700"
      },
      "message": "chore(deps): update dependency golangci/golangci-lint to v2.13.0 (#297)"
    },
    {
      "commit": "c82b43459f638e253090afc946678fac9cd0f266",
      "tree": "f86e90ca944e17fd4c74de9de06ba7cf06f893a5",
      "parents": [
        "4abf425fe5b0b447048046add31870d57699f6ff"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 20 03:33:05 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 19:33:05 2026 -0700"
      },
      "message": "chore(deps): update golang docker tag to v1.26.7 (#296)"
    },
    {
      "commit": "4abf425fe5b0b447048046add31870d57699f6ff",
      "tree": "cca6b0b9107927479700b5d1a5856e4af9a0eeaf",
      "parents": [
        "d9fcd0bf5623faa9efd04aedede8c175a9076182"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 20 02:45:33 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 18:45:33 2026 -0700"
      },
      "message": "chore(deps): group golang bumps in lockstep, hold at 1.26.6 (#295)\n\n* chore(deps): update golang docker tag to v1.27\n\n* chore(deps): group golang bumps in lockstep, hold at 1.26.6\n\nThe devcontainer golang image is picked up by Renovate\u0027s devcontainer\nmanager, which was absent from the Go-toolchain group and soak-bypass\nrules — so its bump opened a standalone PR to 1.27 while go.mod and the\nDockerfile stayed on 1.26.6.\n\nPin the devcontainer image to the same patch + digest as the Dockerfile\nand add the devcontainer manager to both Go-toolchain packageRules, so\nall three golang pins move together in one grouped PR. Holds the\ntoolchain at 1.26.6; 1.27 will come through later as a grouped bump.\n\n* sync checksums\n\n---------\n\nCo-authored-by: Ville Brofeldt \u003cville.v.brofeldt@gmail.com\u003e"
    },
    {
      "commit": "d9fcd0bf5623faa9efd04aedede8c175a9076182",
      "tree": "52dc3d92c886a5c2f3f8784dc7833398de613161",
      "parents": [
        "2747966e01af6c6ef35165c67e4ba39e36007016"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 20 02:45:07 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 18:45:07 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.58 (#294)\n\n* chore(deps): update dependency rvben/rumdl to v0.2.58\n\n* sync checksums\n\n---------\n\nCo-authored-by: Ville Brofeldt \u003cville.v.brofeldt@gmail.com\u003e"
    },
    {
      "commit": "2747966e01af6c6ef35165c67e4ba39e36007016",
      "tree": "9f7e47355b120b2df1ce0229a263774840395f32",
      "parents": [
        "0bad0f28169266f66f50e89e55c77430b9188582"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 20 01:47:34 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 17:47:34 2026 -0700"
      },
      "message": "chore(deps): update golang docker tag to v1.26.7 (#293)"
    },
    {
      "commit": "0bad0f28169266f66f50e89e55c77430b9188582",
      "tree": "19fd54467d36566a9fa466570e9287664f24fdea",
      "parents": [
        "da0abd9bb4f6466004898a8e5f4979fbbd9d50fe"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Aug 19 20:24:37 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 12:24:37 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.57 (#286)\n\n* chore(deps): update dependency rvben/rumdl to v0.2.57\n\n* run sunc-tool-checksums\n\n---------\n\nCo-authored-by: Ville Brofeldt \u003cville.v.brofeldt@gmail.com\u003e"
    },
    {
      "commit": "da0abd9bb4f6466004898a8e5f4979fbbd9d50fe",
      "tree": "bf2367e007205e8d9b48967885c9f18bab3f7b6d",
      "parents": [
        "fd0683455f0983feab690affd7f33502ae71effc"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Aug 19 19:24:06 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 11:24:06 2026 -0700"
      },
      "message": "chore(deps): update dependency idna to v3.19 (#288)"
    },
    {
      "commit": "fd0683455f0983feab690affd7f33502ae71effc",
      "tree": "a27a8f95862e66284cefe4866f2ac4b5629b3770",
      "parents": [
        "bf54e900f76cbb027ecf4eb6eb6f2bb4c60cf883"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Aug 19 19:23:46 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 11:23:46 2026 -0700"
      },
      "message": "fix(deps): update go dependencies (#287)"
    },
    {
      "commit": "bf54e900f76cbb027ecf4eb6eb6f2bb4c60cf883",
      "tree": "d5f86d17dad180c14c2c225de852057f9e4e6246",
      "parents": [
        "e1dca135349c56e6d6c3b38bd522e92aa5a0dd57"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Aug 19 19:22:53 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 11:22:53 2026 -0700"
      },
      "message": "chore(deps): update dependency mikefarah/yq to v4.53.4 (#285)"
    },
    {
      "commit": "e1dca135349c56e6d6c3b38bd522e92aa5a0dd57",
      "tree": "1f7e24541639ca388dcb3d9b2ccd3fa0629dd194",
      "parents": [
        "673907a34f036e7f8f4a12f09ad115f7bae56e18"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Aug 19 19:22:03 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 11:22:03 2026 -0700"
      },
      "message": "chore(deps): update dependency operator-framework/operator-registry to v1.73.0 (#284)"
    },
    {
      "commit": "673907a34f036e7f8f4a12f09ad115f7bae56e18",
      "tree": "0dbed4dad3f39304432fac8c8218388a164a3524",
      "parents": [
        "e3e2a447f78e65ec58567af1f79228d07f9605c5"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Wed Aug 19 11:21:32 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 11:21:32 2026 -0700"
      },
      "message": "fix(networking): don\u0027t publish unauthenticated Flower in Production by default (#279)\n\n* fix(networking): don\u0027t publish unauthenticated Flower in Production by default\n\nThe Celery Flower default command ships without authentication, and its\ndashboard discloses task names and arguments — for Superset that includes\nother users\u0027 async SQL Lab statements and alert/report payloads. Yet the\noperator unconditionally fanned /flower onto the end-user Ingress/Gateway\nhost whenever celeryFlower was set, and opened Flower\u0027s port to all sources\nin the built-in NetworkPolicy.\n\nPublication is now environment-aware. In Production (the default), Flower is\nexcluded from the external fan-out and the all-sources NetworkPolicy rule\nunless the CR author explicitly sets celeryFlower.service.gatewayPath — their\nassertion that authentication (e.g. FLOWER_BASIC_AUTH from a Secret via\npodTemplate env, or ingress-layer auth) is in front of Flower. Development and\nStaging keep the convenient auto-publish, so existing dev/staging deployments\nand samples are unaffected.\n\nflowerRoutePublished gates both the Ingress/Gateway route (networking.go) and\nthe NetworkPolicy external port (networkpolicy.go). Documents the behavior in\nthe networking user guide (route/NetworkPolicy tables + a hardening warning),\nthe security Design Decisions, and the GatewayPath API doc; regenerates the\nAPI reference. Adds tests for the environment-aware gate and the gated\nNetworkPolicy port.\n\nNote: BREAKING for Production CRs that relied on bare `celeryFlower: {}` plus\nIngress/Gateway to expose /flower — add `celeryFlower.service.gatewayPath` to\nrestore publication (after putting auth in front of Flower).\n\nFound via a Claude security scan.\n\nGenerated-by: Claude\n\n* docs(releases): note the breaking Flower publication change\n\nAdd an Unreleased Security entry for the environment-aware Flower external\npublication change so the next release (breaking, likely 0.3.0) documents the\nrequired celeryFlower.service.gatewayPath opt-in for Production.\n\nGenerated-by: Claude"
    },
    {
      "commit": "e3e2a447f78e65ec58567af1f79228d07f9605c5",
      "tree": "c4876f412b49a0ab641f0e3e7ea9929a87324f1a",
      "parents": [
        "756567a611a98ab0315ff65e4d7fb54864803684"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Wed Aug 19 07:41:57 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 07:41:57 2026 -0700"
      },
      "message": "chore(renovate): track golangci-lint via github-releases (#283)\n\nRenovate\u0027s `go` datasource fails to resolve\ngithub.com/golangci/golangci-lint/v2 (dependency dashboard: \"Failed to look\nup go package ...: no-result\"), so golangci-lint bumps were being missed.\ngolangci-lint is a long-standing problem case for the go-proxy lookup; the\nsame datasource works fine for the repo\u0027s other go-installed tools.\n\nTrack it via the github-releases datasource against golangci/golangci-lint\ninstead — reading the release tags directly, matching how operator-sdk and\nrumdl are already tracked. The `go install\ngithub.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)`\nrecipe is unchanged; only the version-discovery datasource changes.\n\nGenerated-by: Claude"
    },
    {
      "commit": "756567a611a98ab0315ff65e4d7fb54864803684",
      "tree": "9c1dcdd0f499dcb19fda1eb00d605af710040dcf",
      "parents": [
        "5bd25bfbcc49249fe11174c4f4008783140b31c9"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Wed Aug 19 07:41:40 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 07:41:40 2026 -0700"
      },
      "message": "fix(build): pin tool downloads by in-repo SHA-256 (#281)\n\n* fix(build): pin tool downloads by in-repo SHA-256\n\nSeveral build/dev tools were fetched by mutable tag with no in-repo integrity\npin, diverging from the helm/yq/oras/kind standard and leaving CI, the\npre-commit hook, and the release manager\u0027s workstation exposed to a swapped\nupstream artifact.\n\n- Rat jar (check_license.sh): the pinned SHA-256 was checked only at download\n  time, so a jar planted at the fixed world-writable /tmp cache path was\n  executed unverified. It is now verified on every invocation and cached under\n  $XDG_CACHE_HOME/~/.cache instead of /tmp.\n\n- operator-sdk, opm, rumdl (Makefile): operator-sdk/opm had no checksum and\n  rumdl verified against a checksum co-downloaded from the same origin\n  (self-attested). All three now verify against in-repo pins in\n  hack/tool-checksums.txt via scripts/verify-tool-checksum.sh, which fails\n  closed on an unpinned or mismatched artifact. opm\u0027s inline version is lifted\n  to OPM_VERSION. scripts/sync-tool-checksums.sh regenerates the pins.\n\n- helm-unittest (install-helm-unittest.sh): dropped `helm plugin install\n  \u003cgit-url\u003e --verify\u003dfalse` (mutable tag, executes an unverified install hook)\n  in favor of the pinned release archive. Because this script also runs on the\n  release manager\u0027s workstation (macOS/arm64 or Linux) via release-rc.sh, it\n  resolves the host platform and verifies against per-platform pins in\n  hack/tool-checksums.txt (verify-tool-checksum.sh already falls back from\n  sha256sum to shasum), rather than the single-Linux-digest install-yq pattern.\n\nRenovate keeps bumping the versions (Makefile vars and the HELM_UNITTEST_VERSION\nline, via version-only custom managers); a scheduled sync-tool-checksums\nworkflow regenerates the digest pins and opens a PR so the file cannot drift\nsilently.\n\nFound via a Claude security scan.\n\nGenerated-by: Claude\n\n* fix codegen"
    },
    {
      "commit": "5bd25bfbcc49249fe11174c4f4008783140b31c9",
      "tree": "80c88e1410707b488e59a695c12258859a5137f9",
      "parents": [
        "ce1e38b1ab88594d1623c3b34f7d0a8c57f48640"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Wed Aug 19 07:41:19 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 07:41:19 2026 -0700"
      },
      "message": "fix(release): harden release-pipeline integrity (#280)\n\nFour independent release/supply-chain gaps in the build and signing pipeline:\n\n- Helm chart signed by mutable tag (TOCTOU): the sign step reconstructed a\n  tag reference from Chart.yaml after helm push discarded the digest, so cosign\n  signed whatever the registry served at signing time — a window in which a\n  packages:write credential could swap the chart and receive a valid keyless\n  signature. The push step now captures and validates the pushed digest and the\n  chart is signed by digest, mirroring the image step.\n\n- Release image build consumed the GHA BuildKit cache: cache-from/to type\u003dgha\n  fed the cosign-signed, SLSA-attested build, so a poisoned default-branch-scope\n  cache entry could be laundered into a signed release. Cache is now gated on\n  github.ref_type !\u003d \u0027tag\u0027, so tag-triggered release builds are hermetic while\n  dev builds keep the cache.\n\n- Documented cosign-verify commands were unpinned/permissive: security.md used a\n  bare verify with no identity, and downloads.md used an unanchored repo-wide\n  identity regexp that any workflow/ref satisfies. Both now pin the issuer and an\n  anchored release.yml@refs/tags/v* identity, with explicit text that dev builds\n  share the identity and must fail the check.\n\n- Finalize could promote a non-voted RC tarball: release-source.sh globbed\n  -rc*.tar.gz and took head -1 of unsorted find output, ignoring the RC number\n  derived from the tag on HEAD. It now selects the exact voted rc${RC} tarball\n  (validated integer) and errors on ambiguity.\n\nFound via a Claude security scan.\n\nGenerated-by: Claude"
    },
    {
      "commit": "ce1e38b1ab88594d1623c3b34f7d0a8c57f48640",
      "tree": "65d840dfe4fdd5a7d2fb56ad2c23c1a8c00d83e1",
      "parents": [
        "68a9a70a3455e0a12e0a99c290e33d0ddd306dba"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Wed Aug 19 07:40:57 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 07:40:57 2026 -0700"
      },
      "message": "fix(controller): make reserved instance labels unforgeable on pods (#278)\n\n* fix(controller): make reserved instance labels unforgeable on pods\n\nThe operator relies on superset.apache.org/* pod labels for isolation and\nlifecycle-task tracking, but two paths let a user with only `supersets`\nwrite forge them and interfere across instances.\n\nTask-pod health check: taskPodStartupError attributed pod state to a\nlifecycle task purely by the superset.apache.org/instance label, which is\nforced only on task-Job pods (not in podOperatorLabels). A wedged pod\nplanted by another CR (component podTemplate.labels) could inject its\nattacker-chosen kubelet message into the victim CR\u0027s task status,\nLifecycleComplete condition, and Warning Events. State is now attributed\nonly when the pod is controller-owned by that task\u0027s Job\n(metav1.IsControlledBy) — an ownerReference the pod author cannot forge.\n\nReserved-label stripping: MergePodTemplate now drops user-supplied\nsuperset.apache.org/*-prefixed labels before folding in the operator labels,\nso a component podTemplate cannot smuggle discovery/isolation labels onto its\npods. The maintenance-page path builds its pod outside the resolver, so it\ndid not benefit; it now forces podOperatorLabels (including\nsuperset.apache.org/parent) and strips reserved user labels via the shared\nresolution.ForceOperatorPodLabels helper. Without this a maintenance\npodTemplate could carry a forged parent label and land inside another\ninstance\u0027s per-instance NetworkPolicy ingress isolation.\n\nDocuments in docs/reference/security.md that reserved superset.apache.org/*\npod labels are unforgeable, so instance ingress isolation holds against CR\nauthors. Drops the now-dead taskName parameter of handleStuckTaskPod and adds\nregression tests for the foreign-pod filter, reserved-label stripping, and\nthe maintenance-path label forcing.\n\nFound via a Claude security scan.\n\nGenerated-by: Claude\n\n* refactor(resolution): drop redundant inline comment on label merge\n\nThe comment restated what stripReservedLabels already documents; the helper\u0027s\nown doc comment carries the rationale.\n\nGenerated-by: Claude"
    },
    {
      "commit": "68a9a70a3455e0a12e0a99c290e33d0ddd306dba",
      "tree": "b1e80d06e29c6cb81e225f20ffea61dcc8c82197",
      "parents": [
        "f38a4bbd709edfdd6befefe1a06fed8352a25fc7"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Wed Aug 19 07:40:32 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 07:40:32 2026 -0700"
      },
      "message": "fix(controller): gate resource adoption and cleanup on ownership (#277)\n\nA user holding only `supersets` create/update could turn the operator\u0027s\nnamespace-wide RBAC against resources owned by other controllers, in two\nways that both contradict guarantees already documented in\ndocs/reference/security.md (\"controller-owner semantics prevent adopting\nresources already controlled by another controller\" and the cleanup\nsemantics permitting deletion of only unowned same-name or operator-labeled\nresources). This brings the code in line with the documented threat model.\n\nWeb-server Service owner-reference wipe: reconcileWebServerService cleared\nsvc.OwnerReferences before SetControllerReference, defeating the\nAlreadyOwnedError guard. A CR named to collide with a foreign\ncontroller-owned Service `{name}-web-server` would seize it (selector/ports\nrewritten) and garbage-collect it on CR delete. The wipe is now scoped to\nlegacy superset.apache.org-group refs only (the upgrade case) via\nstripLegacySupersetOwnerRefs; foreign controller refs are preserved so\nSetControllerReference surfaces AlreadyOwnedError.\n\nName-derived deletes ignored ownership: several cleanup paths deleted purely\nby CR-derived name with only IgnoreNotFound, so a foreign controller-owned\nresource at a colliding managed name was deleted every reconcile (a\npersistent DoS via the operator\u0027s RBAC). A new deleteIfNotForeignOwned helper\nGets the live object, skips it when controller-owned by a different owner,\nand otherwise deletes with a UID precondition (closing the Get/Delete race).\nAll by-name delete sites route through it; unowned same-name resources are\nstill deleted, matching the documented cleanup semantics.\n\nAdds regression tests covering foreign-owner preservation, legacy-owner\nadoption, and the ownership-gated delete predicate.\n\nFound via a Claude security scan.\n\nGenerated-by: Claude"
    },
    {
      "commit": "f38a4bbd709edfdd6befefe1a06fed8352a25fc7",
      "tree": "7a5f88ff11b2dad1bbe544d6b67ef0a0463432fa",
      "parents": [
        "41c95d76da37110f6d4fa786e1ad1836ac4d0188"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Tue Aug 18 19:52:53 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 18 19:52:53 2026 -0700"
      },
      "message": "chore(asf): require one approving review to merge to main (#282)"
    },
    {
      "commit": "41c95d76da37110f6d4fa786e1ad1836ac4d0188",
      "tree": "18a2a0299268ade51cfefface55f3afa4c9c69e1",
      "parents": [
        "ef9c431c334692897b31b380e2e71a8e64fad4c2"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Mon Aug 17 22:02:22 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 14:02:22 2026 -0700"
      },
      "message": "chore(deps): update dependency charset-normalizer to v3.5.1 (#275)"
    },
    {
      "commit": "ef9c431c334692897b31b380e2e71a8e64fad4c2",
      "tree": "d0161bae6df662f61f6d792122d2844a3aafd411",
      "parents": [
        "61c51e9f81b8a370733f8bfbde806707965dc8b7"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Mon Aug 17 22:02:10 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 14:02:10 2026 -0700"
      },
      "message": "chore(deps): update dependency pygments to v2.21.0 (#276)"
    },
    {
      "commit": "61c51e9f81b8a370733f8bfbde806707965dc8b7",
      "tree": "d8bc5f2741959ba419aa1b6667a41637ed44de29",
      "parents": [
        "ca2c6fac3d0ea75549206bc81484178626dddc46"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Mon Aug 17 21:14:12 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 13:14:12 2026 -0700"
      },
      "message": "chore(deps): update golang:1.26.6 docker digest to 0d1d3a7 (#273)"
    },
    {
      "commit": "ca2c6fac3d0ea75549206bc81484178626dddc46",
      "tree": "c141bce4fd5b6efe0d95bf733165a4e34601d2c8",
      "parents": [
        "6ed6b7346be4ac8c0e48c4645ae301aff02a3a83"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Mon Aug 17 18:19:54 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 10:19:54 2026 -0700"
      },
      "message": "fix(deps): update module github.com/stretchr/testify to v1.12.0 (#274)"
    },
    {
      "commit": "6ed6b7346be4ac8c0e48c4645ae301aff02a3a83",
      "tree": "5bc9243f3764ed29abbc52761eba2108372c7375",
      "parents": [
        "5180a05eaae64e4788943ce197dd7a4158fbd584"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 14 19:45:31 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 11:45:31 2026 -0700"
      },
      "message": "chore(deps): update dependency helm/helm to v4.2.4 (#270)\n\n* chore(deps): update dependency helm/helm to v4.2.4\n\n* bump sha\n\n---------\n\nCo-authored-by: Ville Brofeldt \u003cville.v.brofeldt@gmail.com\u003e"
    },
    {
      "commit": "5180a05eaae64e4788943ce197dd7a4158fbd584",
      "tree": "35184ae8dcf70996f1f066a8ae3e225dfab8b087",
      "parents": [
        "dbe5d1495fd22383dc9da42233a72bd02a3ceff0"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 14 19:21:22 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 11:21:22 2026 -0700"
      },
      "message": "chore(deps): update module golang.org/x/vuln to v1.7.0 (#272)"
    },
    {
      "commit": "dbe5d1495fd22383dc9da42233a72bd02a3ceff0",
      "tree": "138da7051d1a18d2c47d25655040d0110055eb60",
      "parents": [
        "cc6a335ca823064235c00c9cdf8d8d04a9229b39"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 14 19:21:09 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 11:21:09 2026 -0700"
      },
      "message": "chore(deps): update dependency platformdirs to v4.11.3 (#271)"
    },
    {
      "commit": "cc6a335ca823064235c00c9cdf8d8d04a9229b39",
      "tree": "c8655574e5f5afb4523d8588a6de769565f4e5be",
      "parents": [
        "4f6a6296fb6e093e34d37450c18c0229b3bb254e"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 14 19:20:57 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 11:20:57 2026 -0700"
      },
      "message": "chore(deps): update github/codeql-action digest to ff2f1c6 (#269)"
    },
    {
      "commit": "4f6a6296fb6e093e34d37450c18c0229b3bb254e",
      "tree": "5f5d7a8ef095a3c409891d23eb46f8f6404f3f57",
      "parents": [
        "688af9bdbcfdbb585b7c6bdcc5cdec898c8ad3da"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 14 17:01:34 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 09:01:34 2026 -0700"
      },
      "message": "chore(deps): update golang docker tag to v1.26.6 (#268)\n\n* chore(deps): update golang docker tag to v1.26.6\n\n* bump go.mod to 1.26.6\n\n* group go.mod and dockerfile bumps\n\n---------\n\nCo-authored-by: Ville Brofeldt \u003cville.v.brofeldt@gmail.com\u003e"
    },
    {
      "commit": "688af9bdbcfdbb585b7c6bdcc5cdec898c8ad3da",
      "tree": "33b14dedf3280169c90501b59bdedf6a9fb86754",
      "parents": [
        "5ead4dd8949b514d29952698a3faa3c53ab51fe3"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 13 06:00:49 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 12 22:00:49 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.55 (#265)"
    },
    {
      "commit": "5ead4dd8949b514d29952698a3faa3c53ab51fe3",
      "tree": "5ad0c19f71c7ad4ce47b36fd32843bcef36b0e7c",
      "parents": [
        "304aeee5629ddcda819c30172535dd06497c2441"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 13 06:00:22 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 12 22:00:22 2026 -0700"
      },
      "message": "chore(deps): update golang:1.26.5 docker digest to 5822931 (#264)"
    },
    {
      "commit": "304aeee5629ddcda819c30172535dd06497c2441",
      "tree": "e755aaa3000f9bee9b755a68d5cf9a4508fbf5ed",
      "parents": [
        "84aed6aef3849a280c1f0295bf26743c2d70716a"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 13 01:50:05 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 12 17:50:05 2026 -0700"
      },
      "message": "chore(deps): update dependency charset-normalizer to v3.5.0 (#263)"
    },
    {
      "commit": "84aed6aef3849a280c1f0295bf26743c2d70716a",
      "tree": "70b53beaf6f14beb09315f627ebd96419c56158f",
      "parents": [
        "7e0c1eec935edf915ee5689792f2347fa6062969"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Aug 12 21:29:09 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 12 13:29:09 2026 -0700"
      },
      "message": "fix(deps): update module github.com/onsi/ginkgo/v2 to v2.32.1 (#262)"
    },
    {
      "commit": "7e0c1eec935edf915ee5689792f2347fa6062969",
      "tree": "f6139987aa75ceb8263de4ff40e1a1bf2e7e5dbb",
      "parents": [
        "af2917244244b8ab7cd87cb8a519688bce7ca045"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Aug 12 21:28:56 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 12 13:28:56 2026 -0700"
      },
      "message": "chore(deps): update golang:1.26.5 docker digest to 7caba52 (#260)"
    },
    {
      "commit": "af2917244244b8ab7cd87cb8a519688bce7ca045",
      "tree": "d64c7afb29fbc915a2b1911cd46691d20eaacef6",
      "parents": [
        "303942a42d735e9791d26125125cd3b0aa10e507"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Aug 12 21:28:43 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 12 13:28:43 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.54 (#261)"
    },
    {
      "commit": "303942a42d735e9791d26125125cd3b0aa10e507",
      "tree": "a3fb7831ca3cef7e72accccba9614bfc200f5e80",
      "parents": [
        "bf365443d2344508ca61a5dd774bf262179ff432"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Tue Aug 11 12:14:47 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 11 12:14:47 2026 -0700"
      },
      "message": "docs: add 0.2.0 changelog (#259)\n\n* docs: prepare 0.2.0 changelog heading\n\n* add release date"
    },
    {
      "commit": "bf365443d2344508ca61a5dd774bf262179ff432",
      "tree": "9a7c1e6942eec60b9767892ffa9ddcee973e3b59",
      "parents": [
        "3ebafaeb26960d4245c4ffb8d217e1cb8714ec0d"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Tue Aug 11 20:08:41 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 11 12:08:41 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.53 (#258)"
    },
    {
      "commit": "3ebafaeb26960d4245c4ffb8d217e1cb8714ec0d",
      "tree": "76b33b0ad315db34335ea524c4567437a59836b6",
      "parents": [
        "936f101a4b8d4e5cb2a7211aa015d12609f1d16b"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Tue Aug 11 20:08:27 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 11 12:08:27 2026 -0700"
      },
      "message": "chore(deps): update dependency platformdirs to v4.11.2 (#257)"
    },
    {
      "commit": "936f101a4b8d4e5cb2a7211aa015d12609f1d16b",
      "tree": "b3d472164b8611376b6decbbf521b860068a8103",
      "parents": [
        "6a672f0e35461bd0f1c49ec2fec9210d5e7a87e0"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Mon Aug 10 05:57:01 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 09 21:57:01 2026 -0700"
      },
      "message": "chore(deps): update dependency platformdirs to v4.11.1 (#256)"
    },
    {
      "commit": "6a672f0e35461bd0f1c49ec2fec9210d5e7a87e0",
      "tree": "ed1c24fb3d8fc32cae8774165172fb1510e1764c",
      "parents": [
        "7515d80070aaa2cab34fc785e6cb1c8702d99d57"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Mon Aug 10 05:44:56 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 09 21:44:56 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.49 (#255)"
    },
    {
      "commit": "7515d80070aaa2cab34fc785e6cb1c8702d99d57",
      "tree": "7050320504aec0c08e61e521190ff567107b6440",
      "parents": [
        "6523c04a3298c0e4abb259fe039625a322820b73"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Aug 07 18:19:38 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 10:19:38 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.47 (#253)"
    },
    {
      "commit": "6523c04a3298c0e4abb259fe039625a322820b73",
      "tree": "de4c04e3f7051fb2387b40e0cfd6df4d38a43dde",
      "parents": [
        "13a816af3ace3c3826633735ae05d20f7ea25f5f"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Fri Aug 07 02:28:18 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 02:28:18 2026 -0700"
      },
      "message": "docs: add artifact hub link (#254)"
    },
    {
      "commit": "13a816af3ace3c3826633735ae05d20f7ea25f5f",
      "tree": "eada00d1178ed3481f9821e84b08655ecabe1ab2",
      "parents": [
        "2fda9f1dc1cd346657d480f85b3c0e688eb5c1ec"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 06 00:39:18 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 05 16:39:18 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.46 (#251)"
    },
    {
      "commit": "2fda9f1dc1cd346657d480f85b3c0e688eb5c1ec",
      "tree": "4c89e88dd2f1b9d241e102a8f0df1c1b38f97598",
      "parents": [
        "4ed841b1ae8aaffdb39ab270f2ac7947e1b8818b"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 06 00:05:38 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 05 16:05:38 2026 -0700"
      },
      "message": "chore(deps): update golang:1.26.5 docker digest to 2005724 (#250)"
    },
    {
      "commit": "4ed841b1ae8aaffdb39ab270f2ac7947e1b8818b",
      "tree": "e5df3177697de8edfbcd68f8b6be0e43c8282560",
      "parents": [
        "90433d20610bff53dc77399600eb37ee332d3c30"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Aug 06 00:05:14 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 05 16:05:14 2026 -0700"
      },
      "message": "fix(deps): update module github.com/adhocore/gronx to v1.20.1 (#252)"
    },
    {
      "commit": "90433d20610bff53dc77399600eb37ee332d3c30",
      "tree": "0bac3e13e3d918190cbfef9821dc754c9bbe586b",
      "parents": [
        "04c5be1405d93292bbd1bb38aaac19f05ead13b1"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Aug 05 17:39:55 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 05 09:39:55 2026 -0700"
      },
      "message": "chore(deps): update docker/login-action action to v4.6.0 (#249)"
    },
    {
      "commit": "04c5be1405d93292bbd1bb38aaac19f05ead13b1",
      "tree": "f768bc994eaf7ee1209fb6d0df7ee9658cffce70",
      "parents": [
        "294594a322a77812db66cbf5ebc06db78ec2ee76"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Aug 05 17:39:40 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 05 09:39:40 2026 -0700"
      },
      "message": "chore(deps): update dependency packaging to v26.3 (#248)"
    },
    {
      "commit": "294594a322a77812db66cbf5ebc06db78ec2ee76",
      "tree": "00c75749928096f18d25895ff2f4dc318f5fc6f0",
      "parents": [
        "5c1cb62f824cc9becc51cf83dac7f4c541d2c80f"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Tue Aug 04 22:05:03 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 14:05:03 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.45 (#247)"
    },
    {
      "commit": "5c1cb62f824cc9becc51cf83dac7f4c541d2c80f",
      "tree": "31aa8c7c2b42e82d5bbcebf2d4abe2797cd1a176",
      "parents": [
        "744bc0fa9b44452fb27dbbf07b1eb18d727b8207"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Tue Aug 04 21:25:02 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 13:25:02 2026 -0700"
      },
      "message": "chore(deps): update actions/setup-java action to v5.7.0 (#246)"
    },
    {
      "commit": "744bc0fa9b44452fb27dbbf07b1eb18d727b8207",
      "tree": "3997b302c993f69184867dcd2f091e76662062a7",
      "parents": [
        "91e2d494f4a2f3ef15fc82d2783f514b3029e470"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Tue Aug 04 21:24:47 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 13:24:47 2026 -0700"
      },
      "message": "chore(deps): update dependency markdown to v3.10.3 (#245)"
    },
    {
      "commit": "91e2d494f4a2f3ef15fc82d2783f514b3029e470",
      "tree": "e7dc38b4001f64686bda7904e4ce3f89b8e8a66c",
      "parents": [
        "98ff192dbf58c4eaa9fa61dfbb1e54b2ef216bad"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Tue Aug 04 19:28:49 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 11:28:49 2026 -0700"
      },
      "message": "chore(deps): update github/codeql-action digest to 5595cca (#244)"
    },
    {
      "commit": "98ff192dbf58c4eaa9fa61dfbb1e54b2ef216bad",
      "tree": "96d4dfc633f6c324c0ad0521fca5c82e2628502b",
      "parents": [
        "4fa0b1f099493c7f8cf76ca7b6755a81236a89b1"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Tue Aug 04 19:28:35 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 11:28:35 2026 -0700"
      },
      "message": "chore(deps): update docker/login-action action to v4.5.2 (#243)"
    },
    {
      "commit": "4fa0b1f099493c7f8cf76ca7b6755a81236a89b1",
      "tree": "717635a4845fd7415ead335db26236f9e3720208",
      "parents": [
        "afcea789d64dc50f5ebe161d9b3b6b64948a64e3"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Tue Aug 04 19:28:23 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 04 11:28:23 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.44 (#242)"
    },
    {
      "commit": "afcea789d64dc50f5ebe161d9b3b6b64948a64e3",
      "tree": "72ca4918a272042c3ff7388705578db5844c2dd1",
      "parents": [
        "6c24cae8e9271b33cd30f1aee0849ff65c5c71e5"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Fri Jul 31 17:30:46 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 31 09:30:46 2026 -0700"
      },
      "message": "chore(deps): update github/codeql-action digest to f205ea1 (#241)"
    },
    {
      "commit": "6c24cae8e9271b33cd30f1aee0849ff65c5c71e5",
      "tree": "906005732ce238ade19b3a6cb419276d4aa9253f",
      "parents": [
        "180bfd67168b7ea7c6a455958ca733c721a772dc"
      ],
      "author": {
        "name": "Younsung Lee",
        "email": "cysl@kakao.com",
        "time": "Tue Jul 28 14:56:30 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 27 22:56:30 2026 -0700"
      },
      "message": "feat(helm): add imagePullSecrets value for operator Deployment (#240)\n\n* feat(helm): add imagePullSecrets value for operator Deployment\n\nAdd an optional imagePullSecrets value to the operator Helm chart so users can pull the manager image from a private registry. The chart already exposes image.repository and image.tag, but there was no way to attach pull credentials, forcing users to patch the Deployment out-of-band or attach the Secret to the ServiceAccount manually.\n\nThe value defaults to an empty list, so the imagePullSecrets field is omitted from the rendered Deployment unless set, preserving existing behavior. The referenced Secrets must already exist in the release namespace; the chart does not create them. The values.schema.json entry, helm-docs README, and the comprehensive chart test values and snapshot are updated to match.\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e\n\n* docs: note Helm imagePullSecrets in releases\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e\n\n* fix(helm): require non-empty name in imagePullSecrets schema\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e\n\n---------\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e"
    },
    {
      "commit": "180bfd67168b7ea7c6a455958ca733c721a772dc",
      "tree": "f1598bd72ea2c4d8b1b0b3e6493e8b9dc276eaee",
      "parents": [
        "eb78759f894effa733e1129eac5affbf78b161e4"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Sun Jul 26 22:48:40 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Jul 26 14:48:40 2026 -0700"
      },
      "message": "chore(deps): update dependency backrefs to v8 (#239)"
    },
    {
      "commit": "eb78759f894effa733e1129eac5affbf78b161e4",
      "tree": "59804f6cbfda0106f24bb56a0bdf76bc92a4c272",
      "parents": [
        "8fb153e9adf8a170ae2fb2fe72142458acb75534"
      ],
      "author": {
        "name": "Younsung Lee",
        "email": "cysl@kakao.com",
        "time": "Mon Jul 27 06:11:51 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Jul 26 14:11:51 2026 -0700"
      },
      "message": "fix(controller): redact credentials in task failure messages (#233)\n\n* fix(controller): redact credentials in task failure messages\n\nLifecycle task failure output is persisted to the parent Superset\nstatus and Kubernetes Events, and could leak credential fragments\n(documented as a known limitation). Apply best-effort pattern-based\nredaction before truncation: passwords in connection URI userinfo,\nHTTP Authorization header and bearer token values, and common\ncredential assignments (password\u003d, PGPASSWORD:, token\u003d, etc.).\n\nThe operator never reads Secret values, so redaction is by pattern\nrather than exact value; fully keyless standalone secrets remain\nout of reach and the security docs say so. Redaction runs before\ntruncation so a credential split mid-pattern cannot leak.\n\nAdds a FuzzRedactCredentials target (no-panic + idempotence) wired\ninto make fuzz.\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e\n\n* docs(changelog): move Security section after Changed\n\nKeep a Changelog orders sections Added, Changed, Deprecated, Removed,\nFixed, Security. The Unreleased Security entry was inserted between\nAdded and Changed; move it to the canonical last position.\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e\n\n---------\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e"
    },
    {
      "commit": "8fb153e9adf8a170ae2fb2fe72142458acb75534",
      "tree": "1db8f9c9828db838f1faeb746f5402ba0f7519c0",
      "parents": [
        "158105e393fee33aa793a8df468801c446724e78"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Sat Jul 25 14:34:35 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 25 14:34:35 2026 -0700"
      },
      "message": "chore(deps): replace robfig/cron with adhocore/gronx (#238)\n\n* chore(deps): replace robfig/cron with adhocore/gronx\n\nRenovate flags github.com/robfig/cron/v3 as stale (last commit 2021, no\nreleases since). Replace it with the actively-maintained\ngithub.com/adhocore/gronx, which also natively supports 5-7 field cron\nexpressions (optional leading seconds and trailing year).\n\ngronx\u0027s native PrevTickBefore/NextTickAfter let us delete the hand-rolled\nfindPrevTick geometric-doubling loop. The CRD cronSchedule pattern is\nrelaxed from exactly 5 fields to 5-7, and the field doc updated\naccordingly. Existing 5-field schedules compute identical ticks, so this\nis additive, not breaking.\n\n* docs(changelog): add PR reference to cronSchedule entry"
    },
    {
      "commit": "158105e393fee33aa793a8df468801c446724e78",
      "tree": "735432451222fdd4cf7eb8f6a7004967a2e6690b",
      "parents": [
        "87ef1d57dceba1ec795bcad642b1892220408e6b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Jul 25 12:53:28 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 25 12:53:28 2026 -0700"
      },
      "message": "build(deps): bump github.com/google/cel-go from 0.26.0 to 0.29.0 (#237)\n\nBumps [github.com/google/cel-go](https://github.com/google/cel-go) from 0.26.0 to 0.29.0.\n- [Release notes](https://github.com/google/cel-go/releases)\n- [Commits](https://github.com/google/cel-go/compare/v0.26.0...v0.29.0)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/google/cel-go\n  dependency-version: 0.29.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "87ef1d57dceba1ec795bcad642b1892220408e6b",
      "tree": "51563c95f45a3280a396bc298a63e3ede6e1a1db",
      "parents": [
        "891980ccb2e92556f252fd030c5337235cfb2755"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Sat Jul 25 20:35:11 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 25 12:35:11 2026 -0700"
      },
      "message": "chore(deps): update dependency helm-unittest/helm-unittest to v1.1.2 (#234)"
    },
    {
      "commit": "891980ccb2e92556f252fd030c5337235cfb2755",
      "tree": "6ea479447dac4078222c342805b9d22cc4810f12",
      "parents": [
        "bbb325023bcaa8e76848c04bd9602779ef065dc4"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Sat Jul 25 20:34:44 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 25 12:34:44 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.43 (#235)"
    },
    {
      "commit": "bbb325023bcaa8e76848c04bd9602779ef065dc4",
      "tree": "b6f198094d87379568058da2985a1a9be9c21fec",
      "parents": [
        "d673122ce11388d11b479d28874785209e357b58"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Sat Jul 25 20:34:22 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 25 12:34:22 2026 -0700"
      },
      "message": "chore(deps): update docker/login-action action to v4.5.1 (#236)"
    },
    {
      "commit": "d673122ce11388d11b479d28874785209e357b58",
      "tree": "53bdaa96916650d8ad04f2add0ac30e61742d126",
      "parents": [
        "3328309cd912cf9846a97ef25f46d1da8d5af8c1"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Thu Jul 23 19:31:48 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 19:31:48 2026 -0700"
      },
      "message": "test(helm): cover opt-out and template-helper branches (#232)\n\n* test(helm): cover opt-out and template-helper branches\n\nAdds targeted helm-unittest coverage for the chart render branches the\ntwo golden-snapshot suites (minimal, full-options) never exercised, plus\nsmall documentation and CI-hygiene fixes surfaced while reviewing the\nchanges accumulated since 0.1.1 ahead of the 0.2.0 release branch.\n\n- charts/superset-operator/tests/optout_and_helpers_test.yaml: new\n  targeted-assertion suite covering the serviceAccountName helper\n  branches, metrics-disabled wiring, and the leader-election toggle,\n  varying one knob at a time.\n- docs/contributing/development-guidelines.md: correct the Helm chart\n  tests description — the two existing suites are snapshot-only; the new\n  suite is what provides targeted assertions — and name all three.\n- docs/user-guide/lifecycle.md: clarify that migrate triggers on the\n  resolved repository:tag string, so mutable tags or a digest repoint at\n  the same tag do not re-run \"superset db upgrade\".\n- renovate.json: fix the helm-checksum prBodyNote to reference the\n  actual CI check name (\"Verify Helm checksum pin\").\n- scripts/verify-release-ci.sh: document that E2E is intentionally not a\n  release-publish gate (dynamic matrix job names).\n\n* docs: recommend pinning explicit image tags; drop latest from examples\n\nAdds an Image section to the configuration reference recommending\nexplicit release tags over mutable ones such as `latest`, and pins the\nSuperset image to the canonical 6.1.0 across all examples. Beyond the\nusual reproducibility argument, the operator keys the migrate task off\nthe resolved repository:tag string, so a mutable tag repointed at a new\nbuild never re-runs `superset db upgrade` and the schema silently drifts\nfrom the running code.\n\n- docs/user-guide/configuration.md: new \"## Image\" section documenting\n  the field and the pin-your-tags recommendation, cross-linked to\n  Lifecycle \u003e Changing the image tag.\n- Replace `latest` with 6.1.0 in every Superset-image example: index,\n  README, architecture overview/internals (spec and status), lifecycle\n  status samples, the dev-guide test snippet, and the dev sample CR.\n- Leave the experimental websocket community image\n  (oneacrefund/superset-websocket) on `latest` — that is the only tag it\n  publishes."
    },
    {
      "commit": "3328309cd912cf9846a97ef25f46d1da8d5af8c1",
      "tree": "c9125863caeb5fc12994b0fa170231980a28be17",
      "parents": [
        "ddd13384084fb51acf075a324ac438e24543730c"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 23:18:17 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 15:18:17 2026 -0700"
      },
      "message": "chore(deps): update ossf/scorecard-action action to v2.4.4 (#231)"
    },
    {
      "commit": "ddd13384084fb51acf075a324ac438e24543730c",
      "tree": "3e9b2d37ceb734eddadfc0617d5f5f4553a88116",
      "parents": [
        "e6b56a83ca93bc3142f4041967a93c446950a173"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 22:29:58 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 14:29:58 2026 -0700"
      },
      "message": "chore(deps): update actions/checkout action to v7.0.1 (#219)"
    },
    {
      "commit": "e6b56a83ca93bc3142f4041967a93c446950a173",
      "tree": "243f62b7e9fe18e97b0f6cd54942e7494a64189e",
      "parents": [
        "f1868329a5867dfe39e3a5b4026dd54790a9604b"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Thu Jul 23 14:29:48 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 14:29:48 2026 -0700"
      },
      "message": "fix(ci): stop Renovate corrupting helm/yq tool checksums (#230)\n\nThe install-script custom manager captured the `_SHA256\u003d` value as\n`currentDigest`. For the `github-releases` datasource a \"digest\" is the\ngit commit SHA of the release tag (40 hex chars), not the release asset\u0027s\nSHA-256 (64 hex chars), so Renovate rewrote the real checksums into git\ncommit SHAs (PRs #228, #229), breaking `sha256sum -c` in the Helm CI job.\n\nFix, per asset location:\n\n- yq attaches the downloaded asset (`yq_linux_amd64`) to its GitHub\n  release, so switch its `# renovate:` comment to the\n  `github-release-attachments` datasource — the same one `install-oras.sh`\n  already uses — which downloads-and-hashes the attachment. The manager\n  passes `datasource` through, so no other change is needed and the\n  committed SHA is already correct.\n\n- helm does not attach tarballs to GitHub (only detached signatures);\n  the tarballs and checksums live on get.helm.sh. Track only the version\n  in Renovate (split the install-script manager into an attachment-digest\n  manager for yq/oras and a version-only manager for helm), and keep\n  HELM_SHA256 in sync via a new `scripts/sync-helm-checksum.sh` wired to\n  `make sync-helm-checksum` / `verify-helm-checksum`, mirroring the\n  supported-versions sync. A `Verify Helm checksum pin` CI step makes\n  drift a hard failure, and a helm/helm packageRule note steers reviewers\n  to run the sync after a version bump."
    },
    {
      "commit": "f1868329a5867dfe39e3a5b4026dd54790a9604b",
      "tree": "91646d0124d156f66365c60f8ad67e85b0871e74",
      "parents": [
        "7279b6876b62a1a7159448574feff39d39cb2960"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 22:18:05 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 14:18:05 2026 -0700"
      },
      "message": "chore(deps): update dependency mkdocs-material to v9.7.7 (#220)"
    },
    {
      "commit": "7279b6876b62a1a7159448574feff39d39cb2960",
      "tree": "9be4dfac5d300a648c98cf593bfa9463ca6f763d",
      "parents": [
        "d8afd040cd68e76f341e3dbbfacfae59267a3028"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 22:16:53 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 14:16:53 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.41 (#221)"
    },
    {
      "commit": "d8afd040cd68e76f341e3dbbfacfae59267a3028",
      "tree": "ad52499ea3d0b45efea9608879432db86ef9309b",
      "parents": [
        "1b2df95010df2db5681f5a0ae2153bdeda8d8f75"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 21:58:42 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 13:58:42 2026 -0700"
      },
      "message": "fix(deps): update go dependencies to v0.36.3 (#222)"
    },
    {
      "commit": "1b2df95010df2db5681f5a0ae2153bdeda8d8f75",
      "tree": "54ae2a4726de471e4acbc9e8ee765a247c20bd57",
      "parents": [
        "3ad057dcb842a2b5cbdc44ee4b24be39d9ec6c04"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 21:58:33 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 13:58:33 2026 -0700"
      },
      "message": "chore(deps): update dependency certifi to v2026.7.22 (#223)"
    },
    {
      "commit": "3ad057dcb842a2b5cbdc44ee4b24be39d9ec6c04",
      "tree": "e691584e7ce171cc6ebfeefdcbf934498da6d1dd",
      "parents": [
        "5a40d9cd135a4cdb903e04b989aae65ebc15d3e3"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 21:58:22 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 13:58:22 2026 -0700"
      },
      "message": "chore(deps): update dependency platformdirs to v4.11.0 (#224)"
    },
    {
      "commit": "5a40d9cd135a4cdb903e04b989aae65ebc15d3e3",
      "tree": "d00cd935fcc1139cd7082984fb7b82617fb1763c",
      "parents": [
        "1c44b34cbb4d0acc8350f3fe5b58a9bc8ebf6d0b"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 21:50:59 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 13:50:59 2026 -0700"
      },
      "message": "chore(deps): update actions/setup-python action to v7 (#226)"
    },
    {
      "commit": "1c44b34cbb4d0acc8350f3fe5b58a9bc8ebf6d0b",
      "tree": "65620d6c6d093833877baf9aa49d571b19400be6",
      "parents": [
        "02640b4598d1b16cdceca1f8f9ad826f8f137d20"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Thu Jul 23 13:50:41 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 13:50:41 2026 -0700"
      },
      "message": "ci: run CI on release branches and gate release publishing on it (#227)\n\n* ci: run CI on release branches\n\nCI, Test, and License workflows only triggered on main, so `\u003cmajor\u003e.\u003cminor\u003e`\nrelease branches (e.g. 0.2) — where RCs are cut — got no CI at all: no unit /\nintegration / e2e tests, and no govulncheck or Trivy vulnerability scans. A\nrelease could be tagged from a branch that nothing had scanned.\n\nExtend the push and pull_request branch filters to also match release branches\n(`[0-9]+.[0-9]+`) so they run the same gate as main. docs.yml is intentionally\nleft out (its gh-deploy must stay main-only); scorecard/fuzz/sync run on their\nown schedules.\n\nNote: this gives release branches CI visibility. Blocking a bad publish is a\nseparate step — release.yml is tag-triggered and still runs independently of\nbranch CI.\n\n* ci: gate release publishing on required checks passing\n\nPart two of running CI on release branches: `release.yml` is tag-triggered and\npreviously published (image + chart, signed) regardless of whether the tagged\ncommit\u0027s CI was green. Add a `preflight` job that the publish job depends on; it\nwaits for the branch-protection required status checks — read from `.asf.yaml`,\nso the gate follows whatever `main` requires — to pass on the tagged commit, and\nfails the release if any didn\u0027t. Release branches now run that same CI, so the\ntagged commit already carries the check runs.\n\nOnly release tags are gated; pushes to `main` and workflow_dispatch (throwaway\ndev images) proceed unchanged. Docs updated to push the release branch and let\nCI go green before pushing the tag."
    },
    {
      "commit": "02640b4598d1b16cdceca1f8f9ad826f8f137d20",
      "tree": "eca32eae86120ecbd2580ad132e1c1a643787783",
      "parents": [
        "ef65e79548febed8422fbeb0e3ab458b117fa40b"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Thu Jul 23 13:27:26 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 13:27:26 2026 -0700"
      },
      "message": "test(helm): add chart unit tests with value-coverage gate (#217)\n\n* test(helm): add chart unit tests with value-coverage gat\n\n* bump to Helm 4\n\n* split releasing helm commands\n\n* test(helm): slim suites to defaults + comprehensive, cover new knobs\n\nConsolidate the chart unit tests into two broad suites — a stripped-down\ndefaults render and a comprehensive full-options render — per the testing\nguideline favoring broad happy-path tests over many granular ones. Start\nslim and add targeted tests later if regressions surface. Drops the\nseparate helpers suite.\n\nCover the new revisionHistoryLimit and topologySpreadConstraints knobs in\nthe comprehensive values file, and fix the Rat license exclude to match\nthe generated .snap files by basename (.*\\.snap).\n\n* refactor(make): make `lint` aggregate all linters\n\nMirror the codegen/test aggregator pattern so a single command covers a\nwhole category. `make lint` now runs the Go, Markdown, and Helm-chart\nlinters; `make lint-fix` runs every auto-fixer. Rename the granular\ntargets for symmetry: lint-go / lint-go-fix / lint-go-config (were\nlint / lint-fix / lint-config) and lint-md-fix (was format-md).\n\nCI and the pre-commit hook call the granular lint-go (Markdown and Helm\nrun in their own CI steps/jobs); release-rc.sh and the release checklist\ndrop the now-redundant helm-lint. Helm is documented as a dev\nprerequisite since the lint aggregator shells out to `helm lint`.\n\n* ci: match .asf.yaml required check to renamed Helm job\n\nThe Helm CI job is now \"Helm lint \u0026 test\"; update the branch-protection\nrequired_status_checks context to match so the check is satisfied once\nthis lands on main.\n\n* test(helm): snapshot the full render, not a hand-picked subset\n\nDrop the per-template matchSnapshot picking (and the redundant granular\nasserts) in favour of a single full-chart snapshot per suite. With no\n`templates:` restriction the whole chart renders, so each snapshot mirrors\nexactly what that values file deploys — the minimal suite now captures the\nmanager ClusterRole, leader-election RBAC, and metrics RBAC that a default\ninstall creates, and templates added to the chart later are covered\nautomatically. A regression in any rendered resource (e.g. default\nClusterRole rendering) now surfaces as a snapshot diff."
    },
    {
      "commit": "ef65e79548febed8422fbeb0e3ab458b117fa40b",
      "tree": "52ca7c6ba78c8a06f09c759af832176775f7a690",
      "parents": [
        "82dad133df723c61e6e6e4e7c27976e2d84656d8"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Thu Jul 23 11:48:58 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 11:48:58 2026 -0700"
      },
      "message": "chore: temporarily disable Helm lint requirement (#218)"
    },
    {
      "commit": "82dad133df723c61e6e6e4e7c27976e2d84656d8",
      "tree": "96947af89bbc86dd3876eaa3066826626602bff5",
      "parents": [
        "fce2342520313d9ca9068b28aa98aea71ce70fb1"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 19:05:24 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 11:05:24 2026 -0700"
      },
      "message": "chore(deps): update actions/setup-java action to v5.6.0 (#216)"
    },
    {
      "commit": "fce2342520313d9ca9068b28aa98aea71ce70fb1",
      "tree": "01942ff364095c6f12f439d80ec5a15414bc0e77",
      "parents": [
        "fe43a84ccfc37db8519eaa7dad62e4c91e6e54bc"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Thu Jul 23 09:51:22 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 09:51:22 2026 -0700"
      },
      "message": "ci: relax PR title scopes (#215)"
    },
    {
      "commit": "fe43a84ccfc37db8519eaa7dad62e4c91e6e54bc",
      "tree": "22b96c7b51d0b754eb56434e43dc77e24da0f108",
      "parents": [
        "5c5d727318e8b147b3427f71fd8dca288971ed5f"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 15:20:36 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 07:20:36 2026 -0700"
      },
      "message": "chore(deps): update actions/setup-go action to v7 (#214)"
    },
    {
      "commit": "5c5d727318e8b147b3427f71fd8dca288971ed5f",
      "tree": "080b3b38e1e9daddf7f57a855d7a5785cc460e98",
      "parents": [
        "140c86b1b2bb48f144ea7b89d015ebba64837347"
      ],
      "author": {
        "name": "Younsung Lee",
        "email": "cysl@kakao.com",
        "time": "Thu Jul 23 08:48:17 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 16:48:17 2026 -0700"
      },
      "message": "feat(helm): add topologySpreadConstraints value for operator Deployment (#213)\n\n* feat(helm): add topologySpreadConstraints value for operator Deployment\n\nAdd an optional topologySpreadConstraints value to the operator Helm chart so users can control how manager pods are distributed across failure domains (nodes, zones). Previously the chart exposed nodeSelector, affinity, and tolerations but had no first-class way to configure topology spread, forcing users to fall back on affinity rules for a use case Kubernetes models natively.\n\nThe value defaults to an empty list, so the topologySpreadConstraints field is omitted from the rendered Deployment unless set, preserving existing behavior. The values.schema.json entry and helm-docs README are updated to match.\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e\n\n* docs: note Helm topologySpreadConstraints in releases\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e\n\n---------\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e"
    },
    {
      "commit": "140c86b1b2bb48f144ea7b89d015ebba64837347",
      "tree": "2250d7ee093dca97c92167baba841ff10105c3f8",
      "parents": [
        "b49cdeaace07c552b02af1b0edb68b6fa4013ee1"
      ],
      "author": {
        "name": "Younsung Lee",
        "email": "cysl@kakao.com",
        "time": "Thu Jul 23 08:21:33 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 16:21:33 2026 -0700"
      },
      "message": "feat(helm): add revisionHistoryLimit value for operator Deployment (#207)\n\n* feat(helm): add revisionHistoryLimit value for operator Deployment\n\nThe chart hardcoded no revisionHistoryLimit, so the operator Deployment kept the Kubernetes default of 10 ReplicaSets with no way to tune it. Expose a revisionHistoryLimit value (default 10) wired to spec.revisionHistoryLimit, with a matching values.schema.json entry and a releases.md note.\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e\n\n* feat(helm): make revisionHistoryLimit optional, drop echoed default\n\nAddress PR review from @villebro:\n- Render spec.revisionHistoryLimit only when the value is set, so an\n  unset value falls back to the Kubernetes default instead of forcing 10.\n- Accept null in values.schema.json.\n- Default the value to unset (~) and stop repeating the upstream default\n  in values.yaml and release notes.\n- Add a developer-guidelines rule against echoing upstream defaults in\n  Helm values or docs.\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e\n\n---------\n\nSigned-off-by: younsl \u003ccysl@kakao.com\u003e"
    },
    {
      "commit": "b49cdeaace07c552b02af1b0edb68b6fa4013ee1",
      "tree": "9741b578a04834bb06a0b07818ba6bfcd3800658",
      "parents": [
        "929461100156b671cd7a55afc6097023604253cf"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Wed Jul 22 16:20:36 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 16:20:36 2026 -0700"
      },
      "message": "chore(helm): add Artifact Hub repository ID (#212)"
    },
    {
      "commit": "929461100156b671cd7a55afc6097023604253cf",
      "tree": "64215be915732069994f52473248091ec9c6f607",
      "parents": [
        "3c58948c8bc8bedf139a6d5c1302f4bd9804e45b"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 00:14:57 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 16:14:57 2026 -0700"
      },
      "message": "chore(deps): update dependency rvben/rumdl to v0.2.40 (#210)"
    },
    {
      "commit": "3c58948c8bc8bedf139a6d5c1302f4bd9804e45b",
      "tree": "61f1045f7afeab497c78069e901c3aa5282d467c",
      "parents": [
        "35a9dcbfc5fe8d106ace7998ce20b718ded00f9c"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Thu Jul 23 00:14:33 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 16:14:33 2026 -0700"
      },
      "message": "fix(deps): update module sigs.k8s.io/gateway-api to v1.6.1 (#211)"
    },
    {
      "commit": "35a9dcbfc5fe8d106ace7998ce20b718ded00f9c",
      "tree": "0e91056a7a85326a2362ca663a25f2112dea6483",
      "parents": [
        "1fbb994365f1bea0abcf6926f67d1b646cc21d4a"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Wed Jul 22 12:16:37 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 12:16:37 2026 -0700"
      },
      "message": "ci(release): publish Artifact Hub metadata (#209)"
    },
    {
      "commit": "1fbb994365f1bea0abcf6926f67d1b646cc21d4a",
      "tree": "d758bccc2d860b71ab24432ca5ece0cd91484d10",
      "parents": [
        "7315c4ff90b2e5d95c62203f71824f4528598bcd"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Wed Jul 22 09:50:20 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 09:50:20 2026 -0700"
      },
      "message": "ci(release): annotate image index metadata (#208)"
    },
    {
      "commit": "7315c4ff90b2e5d95c62203f71824f4528598bcd",
      "tree": "5aeebe21d70fa453d6fd6f0c599f649233dacd0c",
      "parents": [
        "af77aa6b9465f0c36c8c2cccff62d5d8d8567a68"
      ],
      "author": {
        "name": "Mend Renovate",
        "email": "bot@renovateapp.com",
        "time": "Wed Jul 22 17:45:05 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 09:45:05 2026 -0700"
      },
      "message": "chore(deps): update github/codeql-action digest to e4fba86 (#206)"
    },
    {
      "commit": "af77aa6b9465f0c36c8c2cccff62d5d8d8567a68",
      "tree": "fb43a4a7df4b3153b64bf3d4c754c2f626b8fd9a",
      "parents": [
        "5094ef19733d7918a99bfbe82db1941a6fe4a98c"
      ],
      "author": {
        "name": "Ville Brofeldt",
        "email": "33317356+villebro@users.noreply.github.com",
        "time": "Tue Jul 21 17:33:10 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 17:33:10 2026 -0700"
      },
      "message": "feat(helm): generate chart README with helm-docs (#205)"
    }
  ],
  "next": "5094ef19733d7918a99bfbe82db1941a6fe4a98c"
}