Release v0.19.3

What's Changed

• cg auth: fix sometimes by @imjasonh in #1314
• set OCI created annotation by @imjasonh in #1316
• Cache some more expensive operations by @jonjohnsonjr in #1317
• build(deps): bump github/codeql-action from 3.26.8 to 3.26.9 by @dependabot in #1318
• build(deps): bump github.com/klauspost/compress from 1.17.9 to 1.17.10 by @dependabot in #1315
• build(deps): bump actions/checkout from 4.1.7 to 4.2.0 by @dependabot in #1319
• Fail if APKINDEX has single-character lines by @jonjohnsonjr in #1321
• fix(ci): mark GitHub releases as latest from prerelease by @p5 in #1277
• build(deps): bump github/codeql-action from 3.26.9 to 3.26.10 by @dependabot in #1323
• build(deps): bump google.golang.org/api from 0.198.0 to 0.199.0 by @dependabot in #1320
• build(deps): bump go.step.sm/crypto from 0.52.0 to 0.53.0 by @dependabot in #1322
• Drop a period from a command's help by @murraybd in #1312
• use slog default logger for CG auth exchange by @imjasonh in #1324
• cleanup: remove Lima documentation by @luhring in #1325
• don't attempt to discover keys for file path repos by @imjasonh in #1326
• Make etag checks optional by @jonjohnsonjr in #1327
• build(deps): bump sigstore/cosign-installer from 3.6.0 to 3.7.0 by @dependabot in #1333
• build(deps): bump github/codeql-action from 3.26.10 to 3.26.11 by @dependabot in #1332
• build(deps): bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by @dependabot in #1329
• build(deps): bump chainguard.dev/sdk from 0.1.25 to 0.1.26 by @dependabot in #1328
• build(deps): bump github.com/sigstore/cosign/v2 from 2.4.0 to 2.4.1 by @dependabot in #1331
• Update go to 1.23.2 and golangci-lint by @cpanato in #1334
• build(deps): bump golang.org/x/time from 0.6.0 to 0.7.0 by @dependabot in #1336
• build(deps): bump golang.org/x/sys from 0.25.0 to 0.26.0 by @dependabot in #1335
• build(deps): bump go.step.sm/crypto from 0.53.0 to 0.54.0 by @dependabot in #1338
• build(deps): bump github/codeql-action from 3.26.11 to 3.26.12 by @dependabot in #1339
• build(deps): bump actions/checkout from 4.2.0 to 4.2.1 by @dependabot in #1340
• build(deps): bump google.golang.org/api from 0.199.0 to 0.201.0 by @dependabot in #1348
• build(deps): bump chainguard.dev/sdk from 0.1.26 to 0.1.27 by @dependabot in #1347
• build(deps): bump github/codeql-action from 3.26.12 to 3.26.13 by @dependabot in #1344
• build(deps): bump go.opentelemetry.io/otel from 1.30.0 to 1.31.0 by @dependabot in #1346
• build(deps): bump github.com/klauspost/compress from 1.17.10 to 1.17.11 by @dependabot in #1343
• build(deps): bump chainguard.dev/sdk from 0.1.27 to 0.1.28 by @dependabot in #1351
• Preserve APK timestamps when using dirfs by @jonjohnsonjr in #1352
• Work around sendfile bug by @jonjohnsonjr in #1359
• don't attempt to discover chainguard keys for local file paths by @imjasonh in #1360
• SBOM test cleanup by @luhring in #1361
• allow key lookups for http by @ajayk in #1365
• fix(sbom): deduplicate SBOM packages by ID by @luhring in #1366
• Stop using real headers for side channels by @jonjohnsonjr in #1367
• Avoid race when mutating annotations by @jonjohnsonjr in #1368
• build(deps): bump google.golang.org/api from 0.201.0 to 0.203.0 by @dependabot in #1362
• build(deps): bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot in #1355
• build(deps): bump github/codeql-action from 3.26.13 to 3.27.0 by @dependabot in #1356
• build(deps): bump k8s.io/apimachinery from 0.31.1 to 0.31.2 by @dependabot in #1363

New Contributors

• @p5 made their first contribution in #1277
• @murraybd made their first contribution in #1312

Full Changelog: v0.19.2...v0.19.3