FosterStack Cache changelog: v0.1.0 to v0.2.1
+The release notes from GitHub, quoted as published. Newest first. For anything else, the releases page is the source.
+ +v0.2.1
+Release name: fscache v0.2.1. Published 2026-09-21.
+See release-manifest.json for the full evidence bundle: image digests (GHCR canonical, Docker Hub mirror — identical digests), archive checksums, requirements baseline, per-AC acceptance results, and the Rekor log index of every verified statement in the release chain.+ + +
v0.2.0
+No release was published for v0.2.0: the tag exists, but its release run failed. Use v0.2.1.
+ +v0.1.0
+Published 2026-08-22.
+++ +The v0.1.0 notes begin with a list of the nine commits in the release. That list is on the GitHub release page. The rest of the notes follow here, unedited.
+Note on this release's evidence (added Sep 2026). v0.1.0 was built and published by the pre-remediation release pipeline: a snapshot build was scanned, and a separate build of the same commit was published, so these published images were not scanned before publication. They have been rescanned since at every severity with the published VEX applied — see the rescan runs for verdicts against the exact published digests. The signatures and provenance on this release are accurate about what they say — which CI run produced which digest — and say nothing about scanning. The next release is the first to carry the full evidence chain: one build, scanned and tested by digest, promoted without a rebuild.
+
What changed since: the v0.2.1 release notes point to its release-manifest.json evidence bundle. The release process, as RELEASING.md describes it, is "One build, one set of digests, promoted without a rebuild", with every scanner run "against the exact candidate digests".
Related: how releases are built and signed and security policy.
+ +