v2026.7.2

What's Changed

• fix(gke): run cloudsql-proxy as a native sidecar to end the startup race by @Cre-eD in #347

Full Changelog: 2026.7.1...2026.7.2

v2026.7.1

What's Changed

• ci(semgrep): disable flaky p/ci gha-curl-pipe-shell rule by @Cre-eD in #356

Full Changelog: 2026.6.19...2026.7.1

v2026.6.19

What's Changed

• feat(actions): add skip-refresh input to provision-parent-stack by @universe-ops in #355

Full Changelog: 2026.6.18...2026.6.19

v2026.6.18

What's Changed

• fix(aws): skip STS pre-validation for ambient (OIDC) providers; don't bake creds by @Cre-eD in #354

Full Changelog: 2026.6.17...2026.6.18

v2026.6.17

What's Changed

• feat(aws): use ambient AWS credentials when static keys are empty by @Cre-eD in #349

Full Changelog: 2026.6.16...2026.6.17

v2026.6.16

What's Changed

• feat(secrets): keyless-secrets RFC + Phase-1 store version guard by @Cre-eD in #346

Full Changelog: 2026.6.15...2026.6.16

v2026.6.15

What's Changed

• fix(git): open absolute-path files via osfs root "/" (fixes "public key is not configured") by @universe-ops in #348

Full Changelog: 2026.6.14...2026.6.15

v2026.6.14

What's Changed

• fix(secrets): seal ed25519 recipients with X25519 ECDH by @Cre-eD in #345

Full Changelog: 2026.6.13...2026.6.14

v2026.6.13

What's Changed

• fix: sc upgrade crashes with syntax error for existing installs by @Cre-eD in #342

Full Changelog: 2026.6.12...2026.6.13

v2026.6.12

What's Changed

• feat(k8s): per-container VPA policies (exclude sidecars from the app's minAllowed floor) by @Cre-eD in #340

Full Changelog: 2026.6.11...2026.6.12