Cosign Releases

Great

Activity Score

84%

Great

Recency:83%

Cadence:67%

Completeness:97%

Health:100%

Recent Updates

Updates for August 6, 2026(2 updates)

Aug 6, 2026

Updates for July 17, 2026(2 updates)

Jul 17, 2026

v3.1.1

Jun 9, 2026

v3.1.0

Jun 5, 2026

Updates for April 6, 2026(2 updates)

Apr 6, 2026

v3.0.5

Feb 20, 2026

v3.0.4

Jan 9, 2026

Uniform Changelog API

Access Sigstore changelog updates through our uniform API. Same JSON structure across all sources — no adapter-specific parsing needed.

API Endpoint

GET https://watchchangelog.com/api/v1/entries?source=cosign.releases

Response Sample

{
  "source": "cosign.releases",
  "vendor": "Sigstore",
  "id": "tag:github.com,2008:Repository/335952417/v3.1.3",
  "published_at": "2026-08-06T01:09:23.000Z",
  "title": "v3.1.3",
  "url": "https://github.com/sigstore/cosign/releases/tag/v3.1.3",
  "summary": "What's Changed This release resolves GHSA-fx35-mq7g-6g98 , a verification bypass using an unexpected public key in a legacy bundle. Auto-detect default digest algorithm for public keys in #5019 fix(pkcs11key): return an error instead of panicking when no key pair matches in #5022 Supporting OCI Signing with X.509 Certificate Chain in #4614 test(inspect): replace mock TSA client usage with local timestamp response generator in #5021 fix: prevent shell completions for various options not taking filenames in #5032 fix(blob): compare file checksums case-insensitively in #5036 Verification bypass via public key in legacy bundle ( GHSA-fx35-mq7g-6g98 ) in #5040 Full Changelog : v3.1.2...v3.1.3",
  "tags": [
    "Sigstore",
    "cosign.releases",
    "security",
    "signing",
    "supply-chain"
  ]
}