This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Summary
AI summaryFixes for OCI manifest handling and adds attestation download support for both old and bundle formats.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds support for downloading attestations with both old and bundle Cosign signature formats. Adds support for downloading attestations with both old and bundle Cosign signature formats. Source: llm_adapter@2026-07-17 Confidence: high |
— |
| Bugfix | Medium |
Fixes OCI 1.1 signature referrer manifest by including artifactType. Fixes OCI 1.1 signature referrer manifest by including artifactType. Source: llm_adapter@2026-07-17 Confidence: high |
— |
Full changelog
This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using a mix of old Cosign signatures with the more recent bundle format.
We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.
Changelog
- 26261f05411d5552949ee1d97df1f8e55ec0e13d Allow attestation download to handle both bundle types (#4996) (#5017)
- d49a0c151125448fc247bb8c367518f46e1c0487 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick PR-4997 to release-2.6) (#5002)
Thanks to all contributors!
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]