feat(deps): update aqua:google/go-containerregistry ( 0.21.5 ➔ 0.22.0 )

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aqua:google/go-containerregistry	tools	minor	0.21.5 → 0.22.0

---

Release Notes

google/go-containerregistry (aqua:google/go-containerregistry)

v0.22.0

Compare Source

What's Changed

• mutate: let Time and Canonical take tarball.LayerOption by @​mzihlmann in #​2403
• build: add multi-architecture Cloud Build configurations for crane, gcrane, and krane by @​tprussak in #​2412
• remote: resolve push-check credentials against the repository by @​mzihlmann in #​2411
• Allow single-character repository paths by @​semx in #​2407
• fix: add missing substitutions and workspace cleanup to new build files by @​tprussak in #​2413
• remote: retry failed Puller and Pusher initialization by @​iahsanGill in #​2406
• build(deps): bump the actions group across 1 directory with 8 updates by @​dependabot[bot] in #​2405
• build(deps): bump the go-deps group across 1 directory with 3 updates by @​dependabot[bot] in #​2415
• go.mod: bump Go version + add toolchain directive to replace .go-version file by @​Subserial in #​2416
• fix: Fix new build options and provenance by @​tprussak in #​2417
• fix(build): unify new build flow into cloudbuild_v2.yaml by @​tprussak in #​2419

New Contributors

• @​mzihlmann made their first contribution in #​2403
• @​tprussak made their first contribution in #​2412
• @​semx made their first contribution in #​2407

Full Changelog: google/go-containerregistry@v0.21.9...v0.21.10

v0.21.9

Compare Source

What's Changed

• actions: pin slsa generator by version by @​Subserial in #​2395
• fix: prevent data race on scope refreshes within remote.writer by @​Subserial in #​2396
• fix: remove '.' from unsafe path prefixes by @​Subserial in #​2400
• build(deps): bump the actions group with 3 updates by @​dependabot[bot] in #​2398

Full Changelog: google/go-containerregistry@v0.21.8...v0.21.9

v0.21.8

Compare Source

The artifacts attached to this release are missing SLSA provenance, see #​2390.

What's Changed

• build(deps): bump the go-deps group across 1 directory with 3 updates by @​dependabot[bot] in #​2353
• build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane by @​dependabot[bot] in #​2367
• build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain by @​dependabot[bot] in #​2368
• build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes by @​dependabot[bot] in #​2363
• build(deps): bump the go-deps group across 3 directories with 7 updates by @​dependabot[bot] in #​2377
• build(deps): bump the actions group across 1 directory with 5 updates by @​dependabot[bot] in #​2375
• Reject unsafe Windows archive paths in Extract by @​Haihan-Jiang in #​2330
• feat(goreleaser): add loong64 build support for crane/gcrane/krane by @​xuxiaowei-com-cn in #​2358
• Document tag and digest reference semantics by @​Haihan-Jiang in #​2325
• remote: release pull limiter slot when body is read to EOF by @​knQzx in #​2373
• tarball: bounds-check layer index in uncompressed LayerByDiffID by @​arpitjain099 in #​2370
• authn: read Podman auth from XDG config by @​vigneshakaviki in #​2379
• transport: per-host bearer token exchange on cross-host redirect by @​amitzig in #​2360
• mutate: bounds-check layer index when building rebase addendums by @​arpitjain099 in #​2371
• fix(daemon): copy ExposedPorts from source config in computeImageConfig by @​x64vps in #​2356
• feat(remote): add WithReferrersTagFallback option by @​kevinmdavis in #​2366
• mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract by @​sadmanf in #​2372
• tarball: use correct file extension for zstd/uncompressed by @​milas in #​2382
• build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory by @​dependabot[bot] in #​2380
• actions: update actions to be pinned by hash by @​Subserial in #​2384
• Bump go version to 1.26.5 by @​Subserial in #​2388

New Contributors

• @​xuxiaowei-com-cn made their first contribution in #​2358
• @​knQzx made their first contribution in #​2373
• @​arpitjain099 made their first contribution in #​2370
• @​vigneshakaviki made their first contribution in #​2379
• @​amitzig made their first contribution in #​2360
• @​x64vps made their first contribution in #​2356
• @​kevinmdavis made their first contribution in #​2366
• @​sadmanf made their first contribution in #​2372

Full Changelog: google/go-containerregistry@v0.21.7...v0.21.8

v0.21.7

Compare Source

What's Changed

• tarball: return error instead of panicking on missing rootfs.diff_ids by @​iahsanGill in #​2304
• gcrane: honor --platform flag in copy by @​iahsanGill in #​2307
• mutate: verify layer digests in Extract and Time by @​momenashrafff in #​2303
• tarball: close layer readers during Write by @​nandbhat in #​2308
• build(deps): bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in #​2311
• build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory by @​dependabot[bot] in #​2312
• BUGFIX: Fail with error when read exceeds maximum by @​inteon in #​2328
• build(deps): bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in #​2327
• fix(name): anchor loopback registry detection by @​rohan-patnaik in #​2314
• Reject symlinks in OCI layout blobs by @​mosskappa in #​2306
• fix(crane): avoid creating export tar on pull failure by @​Haihan-Jiang in #​2318
• feat(kubernetes): allow ignoring pull secrets by @​rohan-patnaik in #​2315
• fix(name): preserve localhost registry references by @​rohan-patnaik in #​2316
• pkg/registry: export ErrNotFound by @​malt3 in #​2176
• pkg/registry: export RedirectError by @​malt3 in #​2177
• build(deps): bump the go-deps group across 1 directory with 2 updates by @​dependabot[bot] in #​2343
• build(deps): bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in #​2344
• fix: prevent SSRF in google.List() pagination by @​tufstraka in #​2332
• internal/gzip: fix goroutine leak in ReadCloserLevel by @​amarkdotdev in #​2347
• fix(transport): apply refreshed bearer token after cross-host redirect by @​64johnlee in #​2337
• build(deps): bump the go-deps group across 3 directories with 4 updates by @​dependabot[bot] in #​2348
• fix(tarball): normalize paths when matching files by @​bstoll in #​2334
• transport: do not re-attach bearer token after cross-host redirect by @​evilgensec in #​2349
• Bump CI go version to 1.26.4 by @​Subserial in #​2350

New Contributors

• @​momenashrafff made their first contribution in #​2303
• @​nandbhat made their first contribution in #​2308
• @​inteon made their first contribution in #​2328
• @​rohan-patnaik made their first contribution in #​2314
• @​mosskappa made their first contribution in #​2306
• @​Haihan-Jiang made their first contribution in #​2318
• @​tufstraka made their first contribution in #​2332
• @​amarkdotdev made their first contribution in #​2347
• @​64johnlee made their first contribution in #​2337
• @​bstoll made their first contribution in #​2334

Full Changelog: google/go-containerregistry@v0.21.6...v0.21.7

v0.21.6

Compare Source

What's Changed

• fix: update dependencies to use new azure sdk components by @​gaganhr94 in #​2262
• transport: restore resp.Body in retryError so CheckError can parse it by @​alliasgher in #​2264
• pkg/registry: return 202 Accepted for PATCH chunk uploads by @​alliasgher in #​2265
• Follow OCI distribution spec for artifactType and annotations by @​malt3 in #​2269
• actions: attach Codecov token to coverage tests on main by @​Subserial in #​2270
• remote: use DeleteScope (with "delete" action) for manifest deletion by @​alliasgher in #​2266
• remote: limit concurrent layer pulls by @​gnix0 in #​2271
• pkg/registry: reject corrupt disk blobs by @​gnix0 in #​2272
• mutate: close layer readers during export by @​gnix0 in #​2277
• crane/flatten: preserve image media type when flattening by @​alliasgher in #​2267
• build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory by @​dependabot[bot] in #​2273
• build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by @​dependabot[bot] in #​2278
• build(deps): bump the go-deps group across 3 directories with 6 updates by @​dependabot[bot] in #​2280
• Replace go-homedir with os.UserHomeDir by @​jammie-jelly in #​2282
• pkg/name: only treat .localhost as non-HTTPS, not .local by @​blackwell-systems in #​2281
• transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL by @​marwan9696 in #​2285
• test(mutate): add Extract round-trip test for filesystem object preservation by @​blackwell-systems in #​2283
• experiments: remove deprecated support for estargz by @​thaJeztah in #​2288
• build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group by @​dependabot[bot] in #​2289
• fix: limit HTTP response body reads to prevent OOM by @​evilgensec in #​2296
• build(deps): bump the go-deps group across 3 directories with 6 updates by @​dependabot[bot] in #​2297
• transport: block redirects from token server to private/link-local addresses (SSRF fix) by @​evilgensec in #​2292
• pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract by @​anishesg in #​2279
• validate: skip non-layer layers by @​imjasonh in #​2298
• remote: validate foreign layer URLs to prevent SSRF (fixes #​2259) by @​evilgensec in #​2293
• remote: block SSRF via private-IP Location headers in blob uploads by @​adilburaksen in #​2295
• fix(mutate): preserve config blob and layers for non-Docker OCI artifacts by @​blackwell-systems in #​2286
• fix: preserve per-occurrence layer identity in mutate.Image.Layers() by @​iahsanGill in #​2299
• transport: retry HTTP 429 (Too Many Requests) by @​iahsanGill in #​2301
• transport: allow bearer realm at same host:port as registry by @​iahsanGill in #​2302
• Update go version to 1.26.3 by @​Subserial in #​2300

New Contributors

• @​gaganhr94 made their first contribution in #​2262
• @​alliasgher made their first contribution in #​2264
• @​malt3 made their first contribution in #​2269
• @​gnix0 made their first contribution in #​2271
• @​blackwell-systems made their first contribution in #​2281
• @​marwan9696 made their first contribution in #​2285
• @​anishesg made their first contribution in #​2279
• @​adilburaksen made their first contribution in #​2295
• @​iahsanGill made their first contribution in #​2299

Full Changelog: google/go-containerregistry@v0.21.5...v0.21.6

---

Configuration

📅 Schedule: (in timezone Asia/Jerusalem)

• Branch creation
  • "after 2am and before 7am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.