v4.15.1

Changelog

• 3be8f9e Managed by Terraform
• 93e16c3 fix goreleaser signing on release

You can verify the signatures of both the checksums.txt file and the published docker images using cosign.

cosign verify-blob checksums.txt --bundle=checksums.txt.sigstore.json --key https://artifacts.fairwinds.com/cosign-p256.pub

cosign verify us-docker.pkg.dev/fairwinds-ops/oss/goldilocks:v4.15.1 --key https://artifacts.fairwinds.com/cosign-p256.pub

v4.15.0

Changelog

• d668d78 INS-2242: Fix goldilocks vulnerabilities (#849)
• 41c6607 Managed by Terraform
• 6e94e03 Managed by Terraform
• 86aaec6 Managed by Terraform
• ab42299 add notice to include registry change and immutable images notice on the readme (#851)
• b4d579c fix: honor -stderrthreshold when -logtostderr is set (#850)

You can verify the signatures of both the checksums.txt file and the published docker images using cosign.

cosign verify-blob checksums.txt --signature=checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign-p256.pub

cosign verify us-docker.pkg.dev/fairwinds-ops/oss/goldilocks:v4.15.0 --key https://artifacts.fairwinds.com/cosign-p256.pub

v4.14.18

Changelog

• 2a4b04e Fixed user on deployment (#844)

You can verify the signatures of both the checksums.txt file and the published docker images using cosign.

sha256sum -c goldilocks_v4.14.18_checksums.txt --ignore-missing
cosign verify-blob goldilocks_v4.14.18_checksums.txt --signature=goldilocks_v4.14.18_checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub

cosign verify us-docker.pkg.dev/fairwinds-ops/oss/goldilocks:v4 --key https://artifacts.fairwinds.com/cosign.pub

v4.14.10

Changelog

• b7efe33 INS-1938: Upgrade goldilocks with go 1.26 (#831)

You can verify the signatures of both the checksums.txt file and the published docker images using cosign.

sha256sum -c goldilocks_v4.14.10_checksums.txt --ignore-missing
cosign verify-blob goldilocks_v4.14.10_checksums.txt --signature=goldilocks_v4.14.10_checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub

cosign verify us-docker.pkg.dev/fairwinds-ops/oss/goldilocks:v4 --key https://artifacts.fairwinds.com/cosign.pub

v4.14.9

Changelog

• 4108c88 fix: correct memory unit formatting in dashboard (#821)

You can verify the signatures of both the checksums.txt file and the published docker images using cosign.

sha256sum -c goldilocks_v4.14.9_checksums.txt --ignore-missing
cosign verify-blob goldilocks_v4.14.9_checksums.txt --signature=goldilocks_v4.14.9_checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub

cosign verify us-docker.pkg.dev/fairwinds-ops/oss/goldilocks:v4 --key https://artifacts.fairwinds.com/cosign.pub

v4.14.8

Changelog

• ddf3750 INS-1682: goldilocks: Bump go to 1.25.5 for fixing vulnerability (#813)

You can verify the signatures of both the checksums.txt file and the published docker images using cosign.

sha256sum -c goldilocks_v4.14.8_checksums.txt --ignore-missing
cosign verify-blob goldilocks_v4.14.8_checksums.txt --signature=goldilocks_v4.14.8_checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub

cosign verify us-docker.pkg.dev/fairwinds-ops/oss/goldilocks:v4 --key https://artifacts.fairwinds.com/cosign.pub

v4.14.7

Changelog

• 37bafdd INS-1565: Fix goldilocks vulnerabilities (#805)
• ea8d0e6 Update link to VPA Recommender documentation (#804)
• 789ce65 fix: update deps in CI and go (#803)

You can verify the signatures of both the checksums.txt file and the published docker images using cosign.

sha256sum -c goldilocks_v4.14.7_checksums.txt --ignore-missing
cosign verify-blob goldilocks_v4.14.7_checksums.txt --signature=goldilocks_v4.14.7_checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub

cosign verify us-docker.pkg.dev/fairwinds-ops/oss/goldilocks:v4 --key https://artifacts.fairwinds.com/cosign.pub

v4.14.6

Changelog

• f50c8b9 fix: match user-supplied UpdateMode with typed values (#781)

You can verify the signatures of both the checksums.txt file and the published docker images using cosign.

sha256sum -c goldilocks_v4.14.6_checksums.txt --ignore-missing
cosign verify-blob goldilocks_v4.14.6_checksums.txt --signature=goldilocks_v4.14.6_checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub

cosign verify us-docker.pkg.dev/fairwinds-ops/oss/goldilocks:v4 --key https://artifacts.fairwinds.com/cosign.pub

v4.14.5

Changelog

• fd725f8 Change default onDelete and onUpdate log level to debug (#800)

You can verify the signatures of both the checksums.txt file and the published docker images using cosign.

sha256sum -c goldilocks_v4.14.5_checksums.txt --ignore-missing
cosign verify-blob goldilocks_v4.14.5_checksums.txt --signature=goldilocks_v4.14.5_checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub

cosign verify us-docker.pkg.dev/fairwinds-ops/oss/goldilocks:v4 --key https://artifacts.fairwinds.com/cosign.pub

v4.14.4

Changelog

• d28372d INS-1305: fix CVE-2025-47907 (#785)

You can verify the signatures of both the checksums.txt file and the published docker images using cosign.

sha256sum -c goldilocks_v4.14.4_checksums.txt --ignore-missing
cosign verify-blob goldilocks_v4.14.4_checksums.txt --signature=goldilocks_v4.14.4_checksums.txt.sig  --key https://artifacts.fairwinds.com/cosign.pub

cosign verify us-docker.pkg.dev/fairwinds-ops/oss/goldilocks:v4 --key https://artifacts.fairwinds.com/cosign.pub