fix(deps): update module github.com/google/go-containerregistry to v0.21.5 by renovate[bot] · Pull Request #5759 · SAP/jenkins-library

renovate · 2026-04-28T12:55:54Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/go-containerregistry	`v0.19.0` → `v0.21.5`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.5`

Compare Source

What's Changed

Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0 by @thaJeztah in #2254
update to Go 1.26.2 by @thaJeztah in #2255
Bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in the actions group across 1 directory by @dependabot[bot] in #2257
build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the go-deps group across 1 directory by @dependabot[bot] in #2260

Full Changelog: google/go-containerregistry@v0.21.4...v0.21.5

`v0.21.4`

Compare Source

What's Changed

go.mod: do not make a viral minimum go version by @howardjohn in #2237
Avoid pruning absolute links from extracted and flattened images by @Subserial in #2241
Bump the go-deps group across 3 directories with 5 updates by @dependabot[bot] in #2245
fix: update to go1.25.8, and use separate .go-version file by @thaJeztah in #2246
Bump CI go version to 1.26.1 by @Subserial in #2242
Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group by @dependabot[bot] in #2240
fork distribution client v3 auth-challenge as an internal package (squashed) by @thaJeztah in #2248
transport: validate Bearer realm URL to prevent SSRF by @evilgensec in #2243
revert path traversal and symlink escape from #2227 by @Subserial in #2250
Fix pkg/v1/google/auth tests for arm64 by @Subserial in #2085
goreleaser: Update goreleaser config and GH action by @Subserial in #2253

New Contributors

@evilgensec made their first contribution in #2243

Full Changelog: google/go-containerregistry@v0.21.3...v0.21.4

`v0.21.3`

Compare Source

What's Changed

Adds local file support to the crane index subcommand by @edwardthiele in #2223
migrate to github.com/moby/moby modules by @thaJeztah in #2228
Bump the go-deps group across 4 directories with 7 updates by @dependabot[bot] in #2233
Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group by @dependabot[bot] in #2220
mutate: reject path traversal and symlink escape in Extract by @KevinZhao in #2227
tarball: detect symlink cycles in extractFileFromTar by @vnykmshr in #2232
bump golang to 1.25.7 by @Subserial in #2236

New Contributors

@edwardthiele made their first contribution in #2223
@thaJeztah made their first contribution in #2228
@KevinZhao made their first contribution in #2227
@vnykmshr made their first contribution in #2232

Full Changelog: google/go-containerregistry@v0.21.2...v0.21.3

`v0.21.2`

Compare Source

What's Changed

Better handle redirects to https in ping by @jonjohnsonjr in #2225

Full Changelog: google/go-containerregistry@v0.21.1...v0.21.2

`v0.21.1`

Compare Source

This release fixes a regression in crane introduced in the previous release.

What's Changed

Add WithFileBufferedOpener for file-backed daemon image buffering by @twdamhore in #2214
crane: fix case in auth response json by @aelindeman in #2218

New Contributors

@twdamhore made their first contribution in #2214
@aelindeman made their first contribution in #2218

Full Changelog: google/go-containerregistry@v0.21.0...v0.21.1

`v0.21.0`

Compare Source

This release updates the minimum Go version to 1.25.6.

What's Changed

fix(mutate): don't skip dir replacements via whiteout in export by @r4f4 in #2191
Improve performance of v1.NewHash by @bmoylan in #2194
Bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #2207
Bump the root-deps group across 1 directory with 7 updates by @dependabot[bot] in #2195
Fix error messages in crane_test.go by @jammie-jelly in #2189
Bump go version across packages to 1.25.6 by @Subserial in #2211
Join go.mod dependency updates by @Subserial in #2212
Bump the go-deps group across 3 directories with 3 updates by @dependabot[bot] in #2213
Disable taint gosec lints by @Subserial in #2215
Update go version used in goreleaser by @Subserial in #2216

New Contributors

@r4f4 made their first contribution in #2191
@jammie-jelly made their first contribution in #2189

Full Changelog: google/go-containerregistry@v0.20.7...v0.21.0

`v0.20.8`

Compare Source

`v0.20.7`

Compare Source

What's Changed

Fix ArgsEscaped lint directive by @Subserial in #2137
transport: Fix broken links to distribution docs by @guzalv in #2136
fix(remote): using customized retry predicate func if provided by @derekhjray in #2135
Adding docker file by @HassanJasim in #2138
crane: Add timestamp to flatten layer by @Stephanie0829 in #2117
feat(remote): pass retryBackoff option to transport by @aslafy-z in #1628
Expose clobber refusal error by @pjbgf in #2146
Build artifacts for riscv64 by @ffgan in #2159
Update dependencies and deprecate DockerVersion field by @Subserial in #2164

New Contributors

@guzalv made their first contribution in #2136
@derekhjray made their first contribution in #2135
@HassanJasim made their first contribution in #2138
@Stephanie0829 made their first contribution in #2117
@pjbgf made their first contribution in #2146
@ffgan made their first contribution in #2159

Full Changelog: google/go-containerregistry@v0.20.6...v0.20.7

`v0.20.6`

Compare Source

What's Changed

Ensure that tag name is not empty if name contains colon by @SaschaSchwarze0 in #2094
Bump some deps by @jonjohnsonjr in #2110

New Contributors

@SaschaSchwarze0 made their first contribution in #2094

Full Changelog: google/go-containerregistry@v0.20.4...v0.20.6

`v0.20.5`

Compare Source

What's Changed

build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
Migrate linter to v2 by @Subserial in #2096
bump go version + bump deps by @Subserial in #2093
implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
Update CodeQL permissions by @Subserial in #2103
Update goreleaser permissions by @Subserial in #2104
Update provenance action in release by @Subserial in #2105
Update validator action by @Subserial in #2106

New Contributors

@luhring made their first contribution in #2071
@Subserial made their first contribution in #2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.5

`v0.20.4`: - Not usable as a go module

Compare Source

🚨 This release was published to the Go module proxy and then re-tagged with a different commit. This means it's not usable as a Go module (#2107) -- please us v0.20.5 instead.

What's Changed

build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
Migrate linter to v2 by @Subserial in #2096
bump go version + bump deps by @Subserial in #2093
implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
Update CodeQL permissions by @Subserial in #2103
Update goreleaser permissions by @Subserial in #2104
Update provenance action in release by @Subserial in #2105
Update validator action by @Subserial in #2106

New Contributors

@luhring made their first contribution in #2071
@Subserial made their first contribution in #2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.4

`v0.20.3`

Compare Source

What's Changed

remote/transport: Make bearer transport go-routine-safe by @2opremio in #1806
Expose compare package by @jonjohnsonjr in #2001
fix: redact.URL uses (*URL).Redacted to omit basic-auth password by @bmoylan in #1947
bump actions to latest by @ajayk in #2011
don't pin chainguard-dev/actions by @imjasonh in #2025
Check for 406 status code when handling referrers API endpoint response by @malancas in #2026
mutate: Create a defensive annotations copy by @jonjohnsonjr in #2030
Detect zstd in crane append by @jonjohnsonjr in #2023
bump deps using hack/bump-deps.sh by @imjasonh in #2042

New Contributors

@bmoylan made their first contribution in #1947
@ajayk made their first contribution in #2011
@malancas made their first contribution in #2026

Full Changelog: google/go-containerregistry@v0.20.2...v0.20.3

`v0.20.2`

Compare Source

What's Changed

deps: bump docker dep by @imjasonh in #1991

Full Changelog: google/go-containerregistry@v0.20.1...v0.20.2

`v0.20.1`

Compare Source

What's Changed

Create remote.Push by @mattmoor in #1978

Full Changelog: google/go-containerregistry@v0.20.0...v0.20.1

`v0.20.0`

Compare Source

What's Changed

Referrer API must return correct Content-Type by @GregoireW in #1968
🚨 POTENTIALLY BREAKING: Restore blind-write to remote.Put by @jonjohnsonjr in #1970

New Contributors

@GregoireW made their first contribution in #1968

Full Changelog: google/go-containerregistry@v0.19.2...v0.20.0

`v0.19.2`

Compare Source

What's Changed

Add JSON marshalling funcs for Digest. by @wlynch in #1915
registry: Implement Range requests for blobs by @jonjohnsonjr in #1917
Support podman auth file REGISTRY_AUTH_FILE. by @zhaoyonghe in #1914
feat: crane mutate platform by @joshwlewis in #1919
Add Context support to auth methods by @jonjohnsonjr in #1949
Fix windows race condition when writing image with duplicate layers by @dgannon991 in #1921
Add -O shorthand for --omit-digest-tags to crane. by @smoser in #1958

New Contributors

@wlynch made their first contribution in #1915
@zhaoyonghe made their first contribution in #1914
@joshwlewis made their first contribution in #1919
@dgannon991 made their first contribution in #1921
@smoser made their first contribution in #1958

Full Changelog: google/go-containerregistry@v0.19.1...v0.19.2

`v0.19.1`

Compare Source

What's Changed

Bump golang.org/x/net from 0.10.0 to 0.17.0 in /pkg/authn/k8schain by @dependabot in #1815
Bump golang.org/x/ packages by @jonjohnsonjr in #1892

Full Changelog: google/go-containerregistry@v0.19.0...v0.19.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-04-28T12:55:57Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

10 additional dependencies were updated

Details:

Package	Change
`github.com/docker/cli`	`v29.3.0+incompatible` -> `v29.4.0+incompatible`
`github.com/sirupsen/logrus`	`v1.9.3` -> `v1.9.4`
`golang.org/x/mod`	`v0.33.0` -> `v0.35.0`
`github.com/containerd/errdefs`	`v0.3.0` -> `v1.0.0`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.15.1` -> `v0.18.2`
`github.com/docker/docker-credential-helpers`	`v0.8.2` -> `v0.9.3`
`github.com/docker/go-connections`	`v0.5.0` -> `v0.6.0`
`github.com/klauspost/compress`	`v1.18.2` -> `v1.18.5`
`github.com/vbatts/tar-split`	`v0.11.5` -> `v0.12.2`
`golang.org/x/sys`	`v0.42.0` -> `v0.43.0`

github-actions · 2026-04-28T12:56:03Z

/it-go

github-actions · 2026-04-29T08:03:47Z

/it-go

….21.5

github-actions · 2026-04-29T08:46:06Z

/it-go

renovate Bot requested a review from a team as a code owner April 28, 2026 12:55

renovate Bot added the dependencies Pull requests that update a dependency file label Apr 28, 2026

renovate Bot force-pushed the renovate/github.com-google-go-containerregistry-0.x branch from e3c9d91 to 819d81c Compare April 29, 2026 08:03

fix(deps): update module github.com/google/go-containerregistry to v0…

7c74588

….21.5

renovate Bot force-pushed the renovate/github.com-google-go-containerregistry-0.x branch from 819d81c to 7c74588 Compare April 29, 2026 08:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update module github.com/google/go-containerregistry to v0.21.5#5759

fix(deps): update module github.com/google/go-containerregistry to v0.21.5#5759
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/github.com-google-go-containerregistry-0.x

renovate Bot commented Apr 28, 2026

Uh oh!

renovate Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 29, 2026

Uh oh!

github-actions Bot commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 28, 2026

Release Notes

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

v0.20.4: - Not usable as a go module

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Configuration

Uh oh!

renovate Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented Apr 29, 2026

Uh oh!

github-actions Bot commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v0.20.4`: - Not usable as a go module

renovate Bot commented Apr 28, 2026 •

edited

Loading