maint: Update module github.com/google/go-containerregistry to v0.21.8

renovate-bot commented

2026-07-31 20:37:11 +00:00

Owner

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/go-containerregistry	`v0.21.7` → `v0.21.8`

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.8`

Compare Source

The artifacts attached to this release are missing SLSA provenance, see #2390.

What's Changed

build(deps): bump the go-deps group across 1 directory with 3 updates by @dependabot[bot] in #2353
build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane by @dependabot[bot] in #2367
build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain by @dependabot[bot] in #2368
build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes by @dependabot[bot] in #2363
build(deps): bump the go-deps group across 3 directories with 7 updates by @dependabot[bot] in #2377
build(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #2375
Reject unsafe Windows archive paths in Extract by @Haihan-Jiang in #2330
feat(goreleaser): add loong64 build support for crane/gcrane/krane by @xuxiaowei-com-cn in #2358
Document tag and digest reference semantics by @Haihan-Jiang in #2325
remote: release pull limiter slot when body is read to EOF by @knQzx in #2373
tarball: bounds-check layer index in uncompressed LayerByDiffID by @arpitjain099 in #2370
authn: read Podman auth from XDG config by @vigneshakaviki in #2379
transport: per-host bearer token exchange on cross-host redirect by @amitzig in #2360
mutate: bounds-check layer index when building rebase addendums by @arpitjain099 in #2371
fix(daemon): copy ExposedPorts from source config in computeImageConfig by @x64vps in #2356
feat(remote): add WithReferrersTagFallback option by @kevinmdavis in #2366
mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract by @sadmanf in #2372
tarball: use correct file extension for zstd/uncompressed by @milas in #2382
build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory by @dependabot[bot] in #2380
actions: update actions to be pinned by hash by @Subserial in #2384
Bump go version to 1.26.5 by @Subserial in #2388

New Contributors

@xuxiaowei-com-cn made their first contribution in #2358
@knQzx made their first contribution in #2373
@arpitjain099 made their first contribution in #2370
@vigneshakaviki made their first contribution in #2379
@amitzig made their first contribution in #2360
@x64vps made their first contribution in #2356
@kevinmdavis made their first contribution in #2366
@sadmanf made their first contribution in #2372

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `v0.21.7` → `v0.21.8` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgoogle%2fgo-containerregistry/v0.21.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgoogle%2fgo-containerregistry/v0.21.7/v0.21.8?slim=true) | --- ### Release Notes <details> <summary>google/go-containerregistry (github.com/google/go-containerregistry)</summary> ### [`v0.21.8`](https://github.com/google/go-containerregistry/releases/tag/v0.21.8) [Compare Source](https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8) The artifacts attached to this release are missing SLSA provenance, see [#2390](https://github.com/google/go-containerregistry/issues/2390). #### What's Changed - build(deps): bump the go-deps group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2353](https://github.com/google/go-containerregistry/pull/2353) - build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane by [@dependabot](https://github.com/dependabot)\[bot] in [#2367](https://github.com/google/go-containerregistry/pull/2367) - build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain by [@dependabot](https://github.com/dependabot)\[bot] in [#2368](https://github.com/google/go-containerregistry/pull/2368) - build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes by [@dependabot](https://github.com/dependabot)\[bot] in [#2363](https://github.com/google/go-containerregistry/pull/2363) - build(deps): bump the go-deps group across 3 directories with 7 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2377](https://github.com/google/go-containerregistry/pull/2377) - build(deps): bump the actions group across 1 directory with 5 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#2375](https://github.com/google/go-containerregistry/pull/2375) - Reject unsafe Windows archive paths in Extract by [@Haihan-Jiang](https://github.com/Haihan-Jiang) in [#2330](https://github.com/google/go-containerregistry/pull/2330) - feat(goreleaser): add loong64 build support for crane/gcrane/krane by [@xuxiaowei-com-cn](https://github.com/xuxiaowei-com-cn) in [#2358](https://github.com/google/go-containerregistry/pull/2358) - Document tag and digest reference semantics by [@Haihan-Jiang](https://github.com/Haihan-Jiang) in [#2325](https://github.com/google/go-containerregistry/pull/2325) - remote: release pull limiter slot when body is read to EOF by [@knQzx](https://github.com/knQzx) in [#2373](https://github.com/google/go-containerregistry/pull/2373) - tarball: bounds-check layer index in uncompressed LayerByDiffID by [@arpitjain099](https://github.com/arpitjain099) in [#2370](https://github.com/google/go-containerregistry/pull/2370) - authn: read Podman auth from XDG config by [@vigneshakaviki](https://github.com/vigneshakaviki) in [#2379](https://github.com/google/go-containerregistry/pull/2379) - transport: per-host bearer token exchange on cross-host redirect by [@amitzig](https://github.com/amitzig) in [#2360](https://github.com/google/go-containerregistry/pull/2360) - mutate: bounds-check layer index when building rebase addendums by [@arpitjain099](https://github.com/arpitjain099) in [#2371](https://github.com/google/go-containerregistry/pull/2371) - fix(daemon): copy ExposedPorts from source config in computeImageConfig by [@x64vps](https://github.com/x64vps) in [#2356](https://github.com/google/go-containerregistry/pull/2356) - feat(remote): add WithReferrersTagFallback option by [@kevinmdavis](https://github.com/kevinmdavis) in [#2366](https://github.com/google/go-containerregistry/pull/2366) - mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract by [@sadmanf](https://github.com/sadmanf) in [#2372](https://github.com/google/go-containerregistry/pull/2372) - tarball: use correct file extension for zstd/uncompressed by [@milas](https://github.com/milas) in [#2382](https://github.com/google/go-containerregistry/pull/2382) - build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory by [@dependabot](https://github.com/dependabot)\[bot] in [#2380](https://github.com/google/go-containerregistry/pull/2380) - actions: update actions to be pinned by hash by [@Subserial](https://github.com/Subserial) in [#2384](https://github.com/google/go-containerregistry/pull/2384) - Bump go version to 1.26.5 by [@Subserial](https://github.com/Subserial) in [#2388](https://github.com/google/go-containerregistry/pull/2388) #### New Contributors - [@xuxiaowei-com-cn](https://github.com/xuxiaowei-com-cn) made their first contribution in [#2358](https://github.com/google/go-containerregistry/pull/2358) - [@knQzx](https://github.com/knQzx) made their first contribution in [#2373](https://github.com/google/go-containerregistry/pull/2373) - [@arpitjain099](https://github.com/arpitjain099) made their first contribution in [#2370](https://github.com/google/go-containerregistry/pull/2370) - [@vigneshakaviki](https://github.com/vigneshakaviki) made their first contribution in [#2379](https://github.com/google/go-containerregistry/pull/2379) - [@amitzig](https://github.com/amitzig) made their first contribution in [#2360](https://github.com/google/go-containerregistry/pull/2360) - [@x64vps](https://github.com/x64vps) made their first contribution in [#2356](https://github.com/google/go-containerregistry/pull/2356) - [@kevinmdavis](https://github.com/kevinmdavis) made their first contribution in [#2366](https://github.com/google/go-containerregistry/pull/2366) - [@sadmanf](https://github.com/sadmanf) made their first contribution in [#2372](https://github.com/google/go-containerregistry/pull/2372) **Full Changelog**: <https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-07-31 20:37:11 +00:00

maint: Update module github.com/google/go-containerregistry to v0.21.8

ci/woodpecker/pr/pr_check Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

c57923ec86

renovate-bot commented

2026-07-31 20:37:11 +00:00

Author

Owner

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`github.com/docker/cli`	`v29.5.3+incompatible` -> `v29.6.2+incompatible`
`github.com/klauspost/compress`	`v1.18.6` -> `v1.19.1`
`golang.org/x/sync`	`v0.21.0` -> `v0.22.0`
`golang.org/x/sys`	`v0.46.0` -> `v0.47.0`

### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 4 additional dependencies were updated Details: | **Package** | **Change** | | :------------------------------ | :----------------------------------------------- | | `github.com/docker/cli` | `v29.5.3+incompatible` -> `v29.6.2+incompatible` | | `github.com/klauspost/compress` | `v1.18.6` -> `v1.19.1` | | `golang.org/x/sync` | `v0.21.0` -> `v0.22.0` | | `golang.org/x/sys` | `v0.46.0` -> `v0.47.0` |

bot-ci merged commit 167cb2876a into main

2026-07-31 21:29:53 +00:00

bot-ci deleted branch renovate/go-dependencies

2026-07-31 21:29:53 +00:00

bot-ci referenced this pull request from a commit

2026-07-31 21:29:53 +00:00

maint: Update module github.com/google/go-containerregistry to v0.21.8 #23

bot-ci referenced this pull request

2026-07-31 21:29:56 +00:00

vnext: Change log 1.2.4 release #21

Rows
Columns