FosterStack Cache changelog: v0.1.0 to v0.2.2
The release notes from GitHub, quoted as published. Newest first. For anything else, the releases page is the source.
v0.2.2
Release name: fscache v0.2.2. Published 2026-10-09.
v0.2.2: security patch
This release is rebuilt with Go 1.27.2. It fixes GO-2026-6617 (CVE-2026-97032) in Go's standard library: an HTTP/2 server could crash when a malicious client repeatedly sent requests while changing the HPACK header table size, because the server's HPACK encoder was modified from two goroutines without synchronization. Go 1.27.2 also contains the other fixes Go published on October 8, 2026.
There is no change to how Cache behaves. Upgrade by pulling
:0.2.2(or:latest); the image digests are inrelease-manifest.json.See release-manifest.json for the full evidence bundle: image digests (GHCR canonical, Docker Hub mirror — identical digests), archive checksums, requirements baseline, per-AC acceptance results, and the Rekor log index of every verified statement in the release chain.
v0.2.1
Release name: fscache v0.2.1. Published 2026-09-21.
See release-manifest.json for the full evidence bundle: image digests (GHCR canonical, Docker Hub mirror — identical digests), archive checksums, requirements baseline, per-AC acceptance results, and the Rekor log index of every verified statement in the release chain.
v0.2.0
No release was published for v0.2.0: the tag exists, but its release run failed. Use v0.2.2, the latest release.
v0.1.0
Published 2026-08-22.
The v0.1.0 notes begin with a list of the nine commits in the release. That list is on the GitHub release page. The rest of the notes follow here, unedited.
Note on this release's evidence (added Sep 2026). v0.1.0 was built and published by the pre-remediation release pipeline: a snapshot build was scanned, and a separate build of the same commit was published, so these published images were not scanned before publication. They have been rescanned since at every severity with the published VEX applied — see the rescan runs for verdicts against the exact published digests. The signatures and provenance on this release are accurate about what they say — which CI run produced which digest — and say nothing about scanning. The next release is the first to carry the full evidence chain: one build, scanned and tested by digest, promoted without a rebuild.
What changed since: the v0.2.1 and v0.2.2 release notes point to their release-manifest.json evidence bundle. The release process, as RELEASING.md describes it, is "One build, one set of digests, promoted without a rebuild", with every scanner run "against the exact candidate digests".
Related: how releases are built and signed and security policy.