Update module github.com/google/go-containerregistry to v0.21.6

renovate-bot commented

2026-05-19 02:05:12 +00:00

Owner

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/go-containerregistry	`v0.21.5` → `v0.21.6`

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.6`

Compare Source

What's Changed

fix: update dependencies to use new azure sdk components by @gaganhr94 in #2262
transport: restore resp.Body in retryError so CheckError can parse it by @alliasgher in #2264
pkg/registry: return 202 Accepted for PATCH chunk uploads by @alliasgher in #2265
Follow OCI distribution spec for artifactType and annotations by @malt3 in #2269
actions: attach Codecov token to coverage tests on main by @Subserial in #2270
remote: use DeleteScope (with "delete" action) for manifest deletion by @alliasgher in #2266
remote: limit concurrent layer pulls by @gnix0 in #2271
pkg/registry: reject corrupt disk blobs by @gnix0 in #2272
mutate: close layer readers during export by @gnix0 in #2277
crane/flatten: preserve image media type when flattening by @alliasgher in #2267
build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory by @dependabot[bot] in #2273
build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by @dependabot[bot] in #2278
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2280
Replace go-homedir with os.UserHomeDir by @jammie-jelly in #2282
pkg/name: only treat .localhost as non-HTTPS, not .local by @blackwell-systems in #2281
transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL by @marwan9696 in #2285
test(mutate): add Extract round-trip test for filesystem object preservation by @blackwell-systems in #2283
experiments: remove deprecated support for estargz by @thaJeztah in #2288
build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group by @dependabot[bot] in #2289
fix: limit HTTP response body reads to prevent OOM by @evilgensec in #2296
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2297
transport: block redirects from token server to private/link-local addresses (SSRF fix) by @evilgensec in #2292
pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract by @anishesg in #2279
validate: skip non-layer layers by @imjasonh in #2298
remote: validate foreign layer URLs to prevent SSRF (fixes #2259) by @evilgensec in #2293
remote: block SSRF via private-IP Location headers in blob uploads by @adilburaksen in #2295
fix(mutate): preserve config blob and layers for non-Docker OCI artifacts by @blackwell-systems in #2286
fix: preserve per-occurrence layer identity in mutate.Image.Layers() by @iahsanGill in #2299
transport: retry HTTP 429 (Too Many Requests) by @iahsanGill in #2301
transport: allow bearer realm at same host:port as registry by @iahsanGill in #2302
Update go version to 1.26.3 by @Subserial in #2300

New Contributors

@gaganhr94 made their first contribution in #2262
@alliasgher made their first contribution in #2264
@malt3 made their first contribution in #2269
@gnix0 made their first contribution in #2271
@blackwell-systems made their first contribution in #2281
@marwan9696 made their first contribution in #2285
@anishesg made their first contribution in #2279
@adilburaksen made their first contribution in #2295
@iahsanGill made their first contribution in #2299

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `v0.21.5` → `v0.21.6` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgoogle%2fgo-containerregistry/v0.21.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgoogle%2fgo-containerregistry/v0.21.5/v0.21.6?slim=true) | --- ### Release Notes <details> <summary>google/go-containerregistry (github.com/google/go-containerregistry)</summary> ### [`v0.21.6`](https://github.com/google/go-containerregistry/releases/tag/v0.21.6) [Compare Source](https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6) #### What's Changed - fix: update dependencies to use new azure sdk components by [@gaganhr94](https://github.com/gaganhr94) in [#2262](https://github.com/google/go-containerregistry/pull/2262) - transport: restore resp.Body in retryError so CheckError can parse it by [@alliasgher](https://github.com/alliasgher) in [#2264](https://github.com/google/go-containerregistry/pull/2264) - pkg/registry: return 202 Accepted for PATCH chunk uploads by [@alliasgher](https://github.com/alliasgher) in [#2265](https://github.com/google/go-containerregistry/pull/2265) - Follow OCI distribution spec for artifactType and annotations by [@malt3](https://github.com/malt3) in [#2269](https://github.com/google/go-containerregistry/pull/2269) - actions: attach Codecov token to coverage tests on main by [@Subserial](https://github.com/Subserial) in [#2270](https://github.com/google/go-containerregistry/pull/2270) - remote: use DeleteScope (with "delete" action) for manifest deletion by [@alliasgher](https://github.com/alliasgher) in [#2266](https://github.com/google/go-containerregistry/pull/2266) - remote: limit concurrent layer pulls by [@gnix0](https://github.com/gnix0) in [#2271](https://github.com/google/go-containerregistry/pull/2271) - pkg/registry: reject corrupt disk blobs by [@gnix0](https://github.com/gnix0) in [#2272](https://github.com/google/go-containerregistry/pull/2272) - mutate: close layer readers during export by [@gnix0](https://github.com/gnix0) in [#2277](https://github.com/google/go-containerregistry/pull/2277) - crane/flatten: preserve image media type when flattening by [@alliasgher](https://github.com/alliasgher) in [#2267](https://github.com/google/go-containerregistry/pull/2267) - build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2273](https://github.com/google/go-containerregistry/pull/2273) - build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2278](https://github.com/google/go-containerregistry/pull/2278) - build(deps): bump the go-deps group across 3 directories with 6 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2280](https://github.com/google/go-containerregistry/pull/2280) - Replace go-homedir with os.UserHomeDir by [@jammie-jelly](https://github.com/jammie-jelly) in [#2282](https://github.com/google/go-containerregistry/pull/2282) - pkg/name: only treat .localhost as non-HTTPS, not .local by [@blackwell-systems](https://github.com/blackwell-systems) in [#2281](https://github.com/google/go-containerregistry/pull/2281) - transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL by [@marwan9696](https://github.com/marwan9696) in [#2285](https://github.com/google/go-containerregistry/pull/2285) - test(mutate): add Extract round-trip test for filesystem object preservation by [@blackwell-systems](https://github.com/blackwell-systems) in [#2283](https://github.com/google/go-containerregistry/pull/2283) - experiments: remove deprecated support for estargz by [@thaJeztah](https://github.com/thaJeztah) in [#2288](https://github.com/google/go-containerregistry/pull/2288) - build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group by [@dependabot](https://github.com/dependabot)\[bot] in [#2289](https://github.com/google/go-containerregistry/pull/2289) - fix: limit HTTP response body reads to prevent OOM by [@evilgensec](https://github.com/evilgensec) in [#2296](https://github.com/google/go-containerregistry/pull/2296) - build(deps): bump the go-deps group across 3 directories with 6 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2297](https://github.com/google/go-containerregistry/pull/2297) - transport: block redirects from token server to private/link-local addresses (SSRF fix) by [@evilgensec](https://github.com/evilgensec) in [#2292](https://github.com/google/go-containerregistry/pull/2292) - pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract by [@anishesg](https://github.com/anishesg) in [#2279](https://github.com/google/go-containerregistry/pull/2279) - validate: skip non-layer layers by [@imjasonh](https://github.com/imjasonh) in [#2298](https://github.com/google/go-containerregistry/pull/2298) - remote: validate foreign layer URLs to prevent SSRF (fixes [#2259](https://github.com/google/go-containerregistry/issues/2259)) by [@evilgensec](https://github.com/evilgensec) in [#2293](https://github.com/google/go-containerregistry/pull/2293) - remote: block SSRF via private-IP Location headers in blob uploads by [@adilburaksen](https://github.com/adilburaksen) in [#2295](https://github.com/google/go-containerregistry/pull/2295) - fix(mutate): preserve config blob and layers for non-Docker OCI artifacts by [@blackwell-systems](https://github.com/blackwell-systems) in [#2286](https://github.com/google/go-containerregistry/pull/2286) - fix: preserve per-occurrence layer identity in mutate.Image.Layers() by [@iahsanGill](https://github.com/iahsanGill) in [#2299](https://github.com/google/go-containerregistry/pull/2299) - transport: retry HTTP 429 (Too Many Requests) by [@iahsanGill](https://github.com/iahsanGill) in [#2301](https://github.com/google/go-containerregistry/pull/2301) - transport: allow bearer realm at same host:port as registry by [@iahsanGill](https://github.com/iahsanGill) in [#2302](https://github.com/google/go-containerregistry/pull/2302) - Update go version to 1.26.3 by [@Subserial](https://github.com/Subserial) in [#2300](https://github.com/google/go-containerregistry/pull/2300) #### New Contributors - [@gaganhr94](https://github.com/gaganhr94) made their first contribution in [#2262](https://github.com/google/go-containerregistry/pull/2262) - [@alliasgher](https://github.com/alliasgher) made their first contribution in [#2264](https://github.com/google/go-containerregistry/pull/2264) - [@malt3](https://github.com/malt3) made their first contribution in [#2269](https://github.com/google/go-containerregistry/pull/2269) - [@gnix0](https://github.com/gnix0) made their first contribution in [#2271](https://github.com/google/go-containerregistry/pull/2271) - [@blackwell-systems](https://github.com/blackwell-systems) made their first contribution in [#2281](https://github.com/google/go-containerregistry/pull/2281) - [@marwan9696](https://github.com/marwan9696) made their first contribution in [#2285](https://github.com/google/go-containerregistry/pull/2285) - [@anishesg](https://github.com/anishesg) made their first contribution in [#2279](https://github.com/google/go-containerregistry/pull/2279) - [@adilburaksen](https://github.com/adilburaksen) made their first contribution in [#2295](https://github.com/google/go-containerregistry/pull/2295) - [@iahsanGill](https://github.com/iahsanGill) made their first contribution in [#2299](https://github.com/google/go-containerregistry/pull/2299) **Full Changelog**: <https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-05-19 02:05:12 +00:00

Update module github.com/google/go-containerregistry to v0.21.6

ci/woodpecker/pr/ci Pipeline was successful

Details

b604017fd2

renovate-bot commented

2026-05-19 02:05:13 +00:00

Author

Owner

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

3 additional dependencies were updated

Details:

Package	Change
`github.com/docker/cli`	`v29.4.0+incompatible` -> `v29.4.3+incompatible`
`github.com/klauspost/compress`	`v1.18.5` -> `v1.18.6`
`golang.org/x/sys`	`v0.43.0` -> `v0.44.0`

### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 3 additional dependencies were updated Details: | **Package** | **Change** | | :------------------------------ | :----------------------------------------------- | | `github.com/docker/cli` | `v29.4.0+incompatible` -> `v29.4.3+incompatible` | | `github.com/klauspost/compress` | `v1.18.5` -> `v1.18.6` | | `golang.org/x/sys` | `v0.43.0` -> `v0.44.0` |

bot-ci merged commit 177028f253 into main

2026-05-19 07:41:52 +00:00

bot-ci deleted branch renovate/all-dependencies

2026-05-19 07:41:52 +00:00

bot-ci referenced this pull request from a commit

2026-05-19 07:41:53 +00:00

Update module github.com/google/go-containerregistry to v0.21.6 #7

Rows
Columns