Update all dependencies to v0.21.7

renovate-bot commented

2026-06-17 23:16:43 +00:00

Owner

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/go-containerregistry	`v0.21.6` → `v0.21.7`

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.7`

Compare Source

What's Changed

tarball: return error instead of panicking on missing rootfs.diff_ids by @iahsanGill in #2304
gcrane: honor --platform flag in copy by @iahsanGill in #2307
mutate: verify layer digests in Extract and Time by @momenashrafff in #2303
tarball: close layer readers during Write by @nandbhat in #2308
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2311
build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory by @dependabot[bot] in #2312
BUGFIX: Fail with error when read exceeds maximum by @inteon in #2328
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2327
fix(name): anchor loopback registry detection by @rohan-patnaik in #2314
Reject symlinks in OCI layout blobs by @mosskappa in #2306
fix(crane): avoid creating export tar on pull failure by @Haihan-Jiang in #2318
feat(kubernetes): allow ignoring pull secrets by @rohan-patnaik in #2315
fix(name): preserve localhost registry references by @rohan-patnaik in #2316
pkg/registry: export ErrNotFound by @malt3 in #2176
pkg/registry: export RedirectError by @malt3 in #2177
build(deps): bump the go-deps group across 1 directory with 2 updates by @dependabot[bot] in #2343
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2344
fix: prevent SSRF in google.List() pagination by @tufstraka in #2332
internal/gzip: fix goroutine leak in ReadCloserLevel by @amarkdotdev in #2347
fix(transport): apply refreshed bearer token after cross-host redirect by @64johnlee in #2337
build(deps): bump the go-deps group across 3 directories with 4 updates by @dependabot[bot] in #2348
fix(tarball): normalize paths when matching files by @bstoll in #2334
transport: do not re-attach bearer token after cross-host redirect by @evilgensec in #2349
Bump CI go version to 1.26.4 by @Subserial in #2350

New Contributors

@momenashrafff made their first contribution in #2303
@nandbhat made their first contribution in #2308
@inteon made their first contribution in #2328
@rohan-patnaik made their first contribution in #2314
@mosskappa made their first contribution in #2306
@Haihan-Jiang made their first contribution in #2318
@tufstraka made their first contribution in #2332
@amarkdotdev made their first contribution in #2347
@64johnlee made their first contribution in #2337
@bstoll made their first contribution in #2334

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `v0.21.6` → `v0.21.7` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgoogle%2fgo-containerregistry/v0.21.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgoogle%2fgo-containerregistry/v0.21.6/v0.21.7?slim=true) | --- ### Release Notes <details> <summary>google/go-containerregistry (github.com/google/go-containerregistry)</summary> ### [`v0.21.7`](https://github.com/google/go-containerregistry/releases/tag/v0.21.7) [Compare Source](https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7) #### What's Changed - tarball: return error instead of panicking on missing rootfs.diff\_ids by [@iahsanGill](https://github.com/iahsanGill) in [#2304](https://github.com/google/go-containerregistry/pull/2304) - gcrane: honor --platform flag in copy by [@iahsanGill](https://github.com/iahsanGill) in [#2307](https://github.com/google/go-containerregistry/pull/2307) - mutate: verify layer digests in Extract and Time by [@momenashrafff](https://github.com/momenashrafff) in [#2303](https://github.com/google/go-containerregistry/pull/2303) - tarball: close layer readers during Write by [@nandbhat](https://github.com/nandbhat) in [#2308](https://github.com/google/go-containerregistry/pull/2308) - build(deps): bump the actions group across 1 directory with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2311](https://github.com/google/go-containerregistry/pull/2311) - build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2312](https://github.com/google/go-containerregistry/pull/2312) - BUGFIX: Fail with error when read exceeds maximum by [@inteon](https://github.com/inteon) in [#2328](https://github.com/google/go-containerregistry/pull/2328) - build(deps): bump the actions group across 1 directory with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2327](https://github.com/google/go-containerregistry/pull/2327) - fix(name): anchor loopback registry detection by [@rohan-patnaik](https://github.com/rohan-patnaik) in [#2314](https://github.com/google/go-containerregistry/pull/2314) - Reject symlinks in OCI layout blobs by [@mosskappa](https://github.com/mosskappa) in [#2306](https://github.com/google/go-containerregistry/pull/2306) - fix(crane): avoid creating export tar on pull failure by [@Haihan-Jiang](https://github.com/Haihan-Jiang) in [#2318](https://github.com/google/go-containerregistry/pull/2318) - feat(kubernetes): allow ignoring pull secrets by [@rohan-patnaik](https://github.com/rohan-patnaik) in [#2315](https://github.com/google/go-containerregistry/pull/2315) - fix(name): preserve localhost registry references by [@rohan-patnaik](https://github.com/rohan-patnaik) in [#2316](https://github.com/google/go-containerregistry/pull/2316) - pkg/registry: export ErrNotFound by [@malt3](https://github.com/malt3) in [#2176](https://github.com/google/go-containerregistry/pull/2176) - pkg/registry: export RedirectError by [@malt3](https://github.com/malt3) in [#2177](https://github.com/google/go-containerregistry/pull/2177) - build(deps): bump the go-deps group across 1 directory with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2343](https://github.com/google/go-containerregistry/pull/2343) - build(deps): bump the actions group across 1 directory with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2344](https://github.com/google/go-containerregistry/pull/2344) - fix: prevent SSRF in google.List() pagination by [@tufstraka](https://github.com/tufstraka) in [#2332](https://github.com/google/go-containerregistry/pull/2332) - internal/gzip: fix goroutine leak in ReadCloserLevel by [@amarkdotdev](https://github.com/amarkdotdev) in [#2347](https://github.com/google/go-containerregistry/pull/2347) - fix(transport): apply refreshed bearer token after cross-host redirect by [@64johnlee](https://github.com/64johnlee) in [#2337](https://github.com/google/go-containerregistry/pull/2337) - build(deps): bump the go-deps group across 3 directories with 4 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2348](https://github.com/google/go-containerregistry/pull/2348) - fix(tarball): normalize paths when matching files by [@bstoll](https://github.com/bstoll) in [#2334](https://github.com/google/go-containerregistry/pull/2334) - transport: do not re-attach bearer token after cross-host redirect by [@evilgensec](https://github.com/evilgensec) in [#2349](https://github.com/google/go-containerregistry/pull/2349) - Bump CI go version to 1.26.4 by [@Subserial](https://github.com/Subserial) in [#2350](https://github.com/google/go-containerregistry/pull/2350) #### New Contributors - [@momenashrafff](https://github.com/momenashrafff) made their first contribution in [#2303](https://github.com/google/go-containerregistry/pull/2303) - [@nandbhat](https://github.com/nandbhat) made their first contribution in [#2308](https://github.com/google/go-containerregistry/pull/2308) - [@inteon](https://github.com/inteon) made their first contribution in [#2328](https://github.com/google/go-containerregistry/pull/2328) - [@rohan-patnaik](https://github.com/rohan-patnaik) made their first contribution in [#2314](https://github.com/google/go-containerregistry/pull/2314) - [@mosskappa](https://github.com/mosskappa) made their first contribution in [#2306](https://github.com/google/go-containerregistry/pull/2306) - [@Haihan-Jiang](https://github.com/Haihan-Jiang) made their first contribution in [#2318](https://github.com/google/go-containerregistry/pull/2318) - [@tufstraka](https://github.com/tufstraka) made their first contribution in [#2332](https://github.com/google/go-containerregistry/pull/2332) - [@amarkdotdev](https://github.com/amarkdotdev) made their first contribution in [#2347](https://github.com/google/go-containerregistry/pull/2347) - [@64johnlee](https://github.com/64johnlee) made their first contribution in [#2337](https://github.com/google/go-containerregistry/pull/2337) - [@bstoll](https://github.com/bstoll) made their first contribution in [#2334](https://github.com/google/go-containerregistry/pull/2334) **Full Changelog**: <https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-06-17 23:16:43 +00:00

Update all dependencies to v0.21.7

ci/woodpecker/pr/ci Pipeline was successful

Details

ac400ba8b9

renovate-bot commented

2026-06-17 23:16:43 +00:00

Author

Owner

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

3 additional dependencies were updated

Details:

Package	Change
`github.com/docker/cli`	`v29.4.3+incompatible` -> `v29.5.3+incompatible`
`golang.org/x/sync`	`v0.20.0` -> `v0.21.0`
`golang.org/x/sys`	`v0.44.0` -> `v0.46.0`

### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 3 additional dependencies were updated Details: | **Package** | **Change** | | :---------------------- | :----------------------------------------------- | | `github.com/docker/cli` | `v29.4.3+incompatible` -> `v29.5.3+incompatible` | | `golang.org/x/sync` | `v0.20.0` -> `v0.21.0` | | `golang.org/x/sys` | `v0.44.0` -> `v0.46.0` |

bot-ci merged commit 754a6b97a0 into main

2026-06-18 03:08:25 +00:00

bot-ci deleted branch renovate/all-dependencies

2026-06-18 03:08:25 +00:00

bot-ci referenced this pull request from a commit

2026-06-18 03:08:25 +00:00

Update all dependencies to v0.21.7 #15

Rows
Columns