Update module github.com/google/go-containerregistry to v0.21.7 (main) by renovate-rancher[bot] · Pull Request #311 · rancher/system-agent

renovate-rancher · 2026-06-17T08:23:33Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/go-containerregistry	`v0.20.2` → `v0.21.7`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.7`

Compare Source

What's Changed

tarball: return error instead of panicking on missing rootfs.diff_ids by @iahsanGill in #2304
gcrane: honor --platform flag in copy by @iahsanGill in #2307
mutate: verify layer digests in Extract and Time by @momenashrafff in #2303
tarball: close layer readers during Write by @nandbhat in #2308
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2311
build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory by @dependabot[bot] in #2312
BUGFIX: Fail with error when read exceeds maximum by @inteon in #2328
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2327
fix(name): anchor loopback registry detection by @rohan-patnaik in #2314
Reject symlinks in OCI layout blobs by @mosskappa in #2306
fix(crane): avoid creating export tar on pull failure by @Haihan-Jiang in #2318
feat(kubernetes): allow ignoring pull secrets by @rohan-patnaik in #2315
fix(name): preserve localhost registry references by @rohan-patnaik in #2316
pkg/registry: export ErrNotFound by @malt3 in #2176
pkg/registry: export RedirectError by @malt3 in #2177
build(deps): bump the go-deps group across 1 directory with 2 updates by @dependabot[bot] in #2343
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2344
fix: prevent SSRF in google.List() pagination by @tufstraka in #2332
internal/gzip: fix goroutine leak in ReadCloserLevel by @amarkdotdev in #2347
fix(transport): apply refreshed bearer token after cross-host redirect by @64johnlee in #2337
build(deps): bump the go-deps group across 3 directories with 4 updates by @dependabot[bot] in #2348
fix(tarball): normalize paths when matching files by @bstoll in #2334
transport: do not re-attach bearer token after cross-host redirect by @evilgensec in #2349
Bump CI go version to 1.26.4 by @Subserial in #2350

New Contributors

@momenashrafff made their first contribution in #2303
@nandbhat made their first contribution in #2308
@inteon made their first contribution in #2328
@rohan-patnaik made their first contribution in #2314
@mosskappa made their first contribution in #2306
@Haihan-Jiang made their first contribution in #2318
@tufstraka made their first contribution in #2332
@amarkdotdev made their first contribution in #2347
@64johnlee made their first contribution in #2337
@bstoll made their first contribution in #2334

Full Changelog: google/go-containerregistry@v0.21.6...v0.21.7

`v0.21.6`

Compare Source

What's Changed

fix: update dependencies to use new azure sdk components by @gaganhr94 in #2262
transport: restore resp.Body in retryError so CheckError can parse it by @alliasgher in #2264
pkg/registry: return 202 Accepted for PATCH chunk uploads by @alliasgher in #2265
Follow OCI distribution spec for artifactType and annotations by @malt3 in #2269
actions: attach Codecov token to coverage tests on main by @Subserial in #2270
remote: use DeleteScope (with "delete" action) for manifest deletion by @alliasgher in #2266
remote: limit concurrent layer pulls by @gnix0 in #2271
pkg/registry: reject corrupt disk blobs by @gnix0 in #2272
mutate: close layer readers during export by @gnix0 in #2277
crane/flatten: preserve image media type when flattening by @alliasgher in #2267
build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory by @dependabot[bot] in #2273
build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by @dependabot[bot] in #2278
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2280
Replace go-homedir with os.UserHomeDir by @jammie-jelly in #2282
pkg/name: only treat .localhost as non-HTTPS, not .local by @blackwell-systems in #2281
transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL by @marwan9696 in #2285
test(mutate): add Extract round-trip test for filesystem object preservation by @blackwell-systems in #2283
experiments: remove deprecated support for estargz by @thaJeztah in #2288
build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group by @dependabot[bot] in #2289
fix: limit HTTP response body reads to prevent OOM by @evilgensec in #2296
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2297
transport: block redirects from token server to private/link-local addresses (SSRF fix) by @evilgensec in #2292
pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract by @anishesg in #2279
validate: skip non-layer layers by @imjasonh in #2298
remote: validate foreign layer URLs to prevent SSRF (fixes #2259) by @evilgensec in #2293
remote: block SSRF via private-IP Location headers in blob uploads by @adilburaksen in #2295
fix(mutate): preserve config blob and layers for non-Docker OCI artifacts by @blackwell-systems in #2286
fix: preserve per-occurrence layer identity in mutate.Image.Layers() by @iahsanGill in #2299
transport: retry HTTP 429 (Too Many Requests) by @iahsanGill in #2301
transport: allow bearer realm at same host:port as registry by @iahsanGill in #2302
Update go version to 1.26.3 by @Subserial in #2300

New Contributors

@gaganhr94 made their first contribution in #2262
@alliasgher made their first contribution in #2264
@malt3 made their first contribution in #2269
@gnix0 made their first contribution in #2271
@blackwell-systems made their first contribution in #2281
@marwan9696 made their first contribution in #2285
@anishesg made their first contribution in #2279
@adilburaksen made their first contribution in #2295
@iahsanGill made their first contribution in #2299

Full Changelog: google/go-containerregistry@v0.21.5...v0.21.6

`v0.21.5`

Compare Source

What's Changed

Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0 by @thaJeztah in #2254
update to Go 1.26.2 by @thaJeztah in #2255
Bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in the actions group across 1 directory by @dependabot[bot] in #2257
build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the go-deps group across 1 directory by @dependabot[bot] in #2260

Full Changelog: google/go-containerregistry@v0.21.4...v0.21.5

`v0.21.4`

Compare Source

What's Changed

go.mod: do not make a viral minimum go version by @howardjohn in #2237
Avoid pruning absolute links from extracted and flattened images by @Subserial in #2241
Bump the go-deps group across 3 directories with 5 updates by @dependabot[bot] in #2245
fix: update to go1.25.8, and use separate .go-version file by @thaJeztah in #2246
Bump CI go version to 1.26.1 by @Subserial in #2242
Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group by @dependabot[bot] in #2240
fork distribution client v3 auth-challenge as an internal package (squashed) by @thaJeztah in #2248
transport: validate Bearer realm URL to prevent SSRF by @evilgensec in #2243
revert path traversal and symlink escape from #2227 by @Subserial in #2250
Fix pkg/v1/google/auth tests for arm64 by @Subserial in #2085
goreleaser: Update goreleaser config and GH action by @Subserial in #2253

New Contributors

@evilgensec made their first contribution in #2243

Full Changelog: google/go-containerregistry@v0.21.3...v0.21.4

`v0.21.3`

Compare Source

What's Changed

Adds local file support to the crane index subcommand by @edwardthiele in #2223
migrate to github.com/moby/moby modules by @thaJeztah in #2228
Bump the go-deps group across 4 directories with 7 updates by @dependabot[bot] in #2233
Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group by @dependabot[bot] in #2220
mutate: reject path traversal and symlink escape in Extract by @KevinZhao in #2227
tarball: detect symlink cycles in extractFileFromTar by @vnykmshr in #2232
bump golang to 1.25.7 by @Subserial in #2236

New Contributors

@edwardthiele made their first contribution in #2223
@thaJeztah made their first contribution in #2228
@KevinZhao made their first contribution in #2227
@vnykmshr made their first contribution in #2232

Full Changelog: google/go-containerregistry@v0.21.2...v0.21.3

`v0.21.2`

Compare Source

What's Changed

Better handle redirects to https in ping by @jonjohnsonjr in #2225

Full Changelog: google/go-containerregistry@v0.21.1...v0.21.2

`v0.21.1`

Compare Source

This release fixes a regression in crane introduced in the previous release.

What's Changed

Add WithFileBufferedOpener for file-backed daemon image buffering by @twdamhore in #2214
crane: fix case in auth response json by @aelindeman in #2218

New Contributors

@twdamhore made their first contribution in #2214
@aelindeman made their first contribution in #2218

Full Changelog: google/go-containerregistry@v0.21.0...v0.21.1

`v0.21.0`

Compare Source

This release updates the minimum Go version to 1.25.6.

What's Changed

fix(mutate): don't skip dir replacements via whiteout in export by @r4f4 in #2191
Improve performance of v1.NewHash by @bmoylan in #2194
Bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #2207
Bump the root-deps group across 1 directory with 7 updates by @dependabot[bot] in #2195
Fix error messages in crane_test.go by @jammie-jelly in #2189
Bump go version across packages to 1.25.6 by @Subserial in #2211
Join go.mod dependency updates by @Subserial in #2212
Bump the go-deps group across 3 directories with 3 updates by @dependabot[bot] in #2213
Disable taint gosec lints by @Subserial in #2215
Update go version used in goreleaser by @Subserial in #2216

New Contributors

@r4f4 made their first contribution in #2191
@jammie-jelly made their first contribution in #2189

Full Changelog: google/go-containerregistry@v0.20.7...v0.21.0

`v0.20.8`

Compare Source

`v0.20.7`

Compare Source

What's Changed

Fix ArgsEscaped lint directive by @Subserial in #2137
transport: Fix broken links to distribution docs by @guzalv in #2136
fix(remote): using customized retry predicate func if provided by @derekhjray in #2135
Adding docker file by @HassanJasim in #2138
crane: Add timestamp to flatten layer by @Stephanie0829 in #2117
feat(remote): pass retryBackoff option to transport by @aslafy-z in #1628
Expose clobber refusal error by @pjbgf in #2146
Build artifacts for riscv64 by @ffgan in #2159
Update dependencies and deprecate DockerVersion field by @Subserial in #2164

New Contributors

@guzalv made their first contribution in #2136
@derekhjray made their first contribution in #2135
@HassanJasim made their first contribution in #2138
@Stephanie0829 made their first contribution in #2117
@pjbgf made their first contribution in #2146
@ffgan made their first contribution in #2159

Full Changelog: google/go-containerregistry@v0.20.6...v0.20.7

`v0.20.6`

Compare Source

What's Changed

Ensure that tag name is not empty if name contains colon by @SaschaSchwarze0 in #2094
Bump some deps by @jonjohnsonjr in #2110

New Contributors

@SaschaSchwarze0 made their first contribution in #2094

Full Changelog: google/go-containerregistry@v0.20.4...v0.20.6

`v0.20.5`

Compare Source

What's Changed

build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
Migrate linter to v2 by @Subserial in #2096
bump go version + bump deps by @Subserial in #2093
implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
Update CodeQL permissions by @Subserial in #2103
Update goreleaser permissions by @Subserial in #2104
Update provenance action in release by @Subserial in #2105
Update validator action by @Subserial in #2106

New Contributors

@luhring made their first contribution in #2071
@Subserial made their first contribution in #2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.5

`v0.20.4`: - Not usable as a go module

Compare Source

🚨 This release was published to the Go module proxy and then re-tagged with a different commit. This means it's not usable as a Go module (#2107) -- please us v0.20.5 instead.

What's Changed

build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
Migrate linter to v2 by @Subserial in #2096
bump go version + bump deps by @Subserial in #2093
implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
Update CodeQL permissions by @Subserial in #2103
Update goreleaser permissions by @Subserial in #2104
Update provenance action in release by @Subserial in #2105
Update validator action by @Subserial in #2106

New Contributors

@luhring made their first contribution in #2071
@Subserial made their first contribution in #2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.4

`v0.20.3`

Compare Source

What's Changed

remote/transport: Make bearer transport go-routine-safe by @2opremio in #1806
Expose compare package by @jonjohnsonjr in #2001
fix: redact.URL uses (*URL).Redacted to omit basic-auth password by @bmoylan in #1947
bump actions to latest by @ajayk in #2011
don't pin chainguard-dev/actions by @imjasonh in #2025
Check for 406 status code when handling referrers API endpoint response by @malancas in #2026
mutate: Create a defensive annotations copy by @jonjohnsonjr in #2030
Detect zstd in crane append by @jonjohnsonjr in #2023
bump deps using hack/bump-deps.sh by @imjasonh in #2042

New Contributors

@bmoylan made their first contribution in #1947
@ajayk made their first contribution in #2011
@malancas made their first contribution in #2026

Full Changelog: google/go-containerregistry@v0.20.2...v0.20.3

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

renovate-rancher · 2026-06-17T08:23:36Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

8 additional dependencies were updated

Details:

Package	Change
`golang.org/x/sync`	`v0.20.0` -> `v0.21.0`
`github.com/cpuguy83/go-md2man/v2`	`v2.0.6` -> `v2.0.7`
`github.com/docker/cli`	`v29.2.0+incompatible` -> `v29.5.3+incompatible`
`github.com/docker/docker-credential-helpers`	`v0.7.0` -> `v0.9.3`
`github.com/klauspost/compress`	`v1.18.0` -> `v1.18.6`
`github.com/spf13/pflag`	`v1.0.9` -> `v1.0.10`
`golang.org/x/oauth2`	`v0.35.0` -> `v0.36.0`
`golang.org/x/sys`	`v0.43.0` -> `v0.46.0`

renovate-rancher Bot requested review from HarrisonWAffel and jakefhyde as code owners June 17, 2026 08:23

renovate-rancher Bot added the dependencies label Jun 17, 2026

renovate-rancher Bot requested a review from a team as a code owner June 17, 2026 08:23

renovate-rancher Bot added the dependencies label Jun 17, 2026

Update module github.com/google/go-containerregistry to v0.21.7

cbdff72

renovate-rancher Bot force-pushed the renovate/main-github.com-google-go-containerregistry-0.x branch from f80d0db to cbdff72 Compare June 25, 2026 05:56

renovate-rancher Bot changed the title ~~Update module github.com/google/go-containerregistry to v0.21.6 (main)~~ Update module github.com/google/go-containerregistry to v0.21.7 (main) Jun 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update module github.com/google/go-containerregistry to v0.21.7 (main)#311

Update module github.com/google/go-containerregistry to v0.21.7 (main)#311
renovate-rancher[bot] wants to merge 1 commit into
mainfrom
renovate/main-github.com-google-go-containerregistry-0.x

renovate-rancher Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

renovate-rancher Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate-rancher Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

v0.20.4: - Not usable as a go module

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

renovate-rancher Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate-rancher Bot commented Jun 17, 2026 •

edited

Loading

`v0.20.4`: - Not usable as a go module

renovate-rancher Bot commented Jun 17, 2026 •

edited

Loading