fix(deps): update module github.com/google/go-containerregistry to v0.21.7 by renovate[bot] · Pull Request #131 · crossplane-contrib/xp-testing

renovate · 2026-05-18T20:11:50Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/go-containerregistry	`v0.21.5` → `v0.21.7`

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.7`

Compare Source

What's Changed

tarball: return error instead of panicking on missing rootfs.diff_ids by @iahsanGill in #2304
gcrane: honor --platform flag in copy by @iahsanGill in #2307
mutate: verify layer digests in Extract and Time by @momenashrafff in #2303
tarball: close layer readers during Write by @nandbhat in #2308
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2311
build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory by @dependabot[bot] in #2312
BUGFIX: Fail with error when read exceeds maximum by @inteon in #2328
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2327
fix(name): anchor loopback registry detection by @rohan-patnaik in #2314
Reject symlinks in OCI layout blobs by @mosskappa in #2306
fix(crane): avoid creating export tar on pull failure by @Haihan-Jiang in #2318
feat(kubernetes): allow ignoring pull secrets by @rohan-patnaik in #2315
fix(name): preserve localhost registry references by @rohan-patnaik in #2316
pkg/registry: export ErrNotFound by @malt3 in #2176
pkg/registry: export RedirectError by @malt3 in #2177
build(deps): bump the go-deps group across 1 directory with 2 updates by @dependabot[bot] in #2343
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2344
fix: prevent SSRF in google.List() pagination by @tufstraka in #2332
internal/gzip: fix goroutine leak in ReadCloserLevel by @amarkdotdev in #2347
fix(transport): apply refreshed bearer token after cross-host redirect by @64johnlee in #2337
build(deps): bump the go-deps group across 3 directories with 4 updates by @dependabot[bot] in #2348
fix(tarball): normalize paths when matching files by @bstoll in #2334
transport: do not re-attach bearer token after cross-host redirect by @evilgensec in #2349
Bump CI go version to 1.26.4 by @Subserial in #2350

New Contributors

@momenashrafff made their first contribution in #2303
@nandbhat made their first contribution in #2308
@inteon made their first contribution in #2328
@rohan-patnaik made their first contribution in #2314
@mosskappa made their first contribution in #2306
@Haihan-Jiang made their first contribution in #2318
@tufstraka made their first contribution in #2332
@amarkdotdev made their first contribution in #2347
@64johnlee made their first contribution in #2337
@bstoll made their first contribution in #2334

Full Changelog: google/go-containerregistry@v0.21.6...v0.21.7

`v0.21.6`

Compare Source

What's Changed

fix: update dependencies to use new azure sdk components by @gaganhr94 in #2262
transport: restore resp.Body in retryError so CheckError can parse it by @alliasgher in #2264
pkg/registry: return 202 Accepted for PATCH chunk uploads by @alliasgher in #2265
Follow OCI distribution spec for artifactType and annotations by @malt3 in #2269
actions: attach Codecov token to coverage tests on main by @Subserial in #2270
remote: use DeleteScope (with "delete" action) for manifest deletion by @alliasgher in #2266
remote: limit concurrent layer pulls by @gnix0 in #2271
pkg/registry: reject corrupt disk blobs by @gnix0 in #2272
mutate: close layer readers during export by @gnix0 in #2277
crane/flatten: preserve image media type when flattening by @alliasgher in #2267
build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory by @dependabot[bot] in #2273
build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by @dependabot[bot] in #2278
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2280
Replace go-homedir with os.UserHomeDir by @jammie-jelly in #2282
pkg/name: only treat .localhost as non-HTTPS, not .local by @blackwell-systems in #2281
transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL by @marwan9696 in #2285
test(mutate): add Extract round-trip test for filesystem object preservation by @blackwell-systems in #2283
experiments: remove deprecated support for estargz by @thaJeztah in #2288
build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group by @dependabot[bot] in #2289
fix: limit HTTP response body reads to prevent OOM by @evilgensec in #2296
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2297
transport: block redirects from token server to private/link-local addresses (SSRF fix) by @evilgensec in #2292
pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract by @anishesg in #2279
validate: skip non-layer layers by @imjasonh in #2298
remote: validate foreign layer URLs to prevent SSRF (fixes #2259) by @evilgensec in #2293
remote: block SSRF via private-IP Location headers in blob uploads by @adilburaksen in #2295
fix(mutate): preserve config blob and layers for non-Docker OCI artifacts by @blackwell-systems in #2286
fix: preserve per-occurrence layer identity in mutate.Image.Layers() by @iahsanGill in #2299
transport: retry HTTP 429 (Too Many Requests) by @iahsanGill in #2301
transport: allow bearer realm at same host:port as registry by @iahsanGill in #2302
Update go version to 1.26.3 by @Subserial in #2300

New Contributors

@gaganhr94 made their first contribution in #2262
@alliasgher made their first contribution in #2264
@malt3 made their first contribution in #2269
@gnix0 made their first contribution in #2271
@blackwell-systems made their first contribution in #2281
@marwan9696 made their first contribution in #2285
@anishesg made their first contribution in #2279
@adilburaksen made their first contribution in #2295
@iahsanGill made their first contribution in #2299

Full Changelog: google/go-containerregistry@v0.21.5...v0.21.6

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-05-18T20:11:51Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

7 additional dependencies were updated

Details:

Package	Change
`golang.org/x/mod`	`v0.35.0` -> `v0.37.0`
`github.com/docker/go-connections`	`v0.6.0` -> `v0.7.0`
`github.com/klauspost/compress`	`v1.18.5` -> `v1.18.6`
`github.com/moby/moby/api`	`v1.54.1` -> `v1.54.2`
`github.com/moby/moby/client`	`v0.4.0` -> `v0.4.1`
`golang.org/x/sync`	`v0.20.0` -> `v0.21.0`
`golang.org/x/sys`	`v0.43.0` -> `v0.46.0`

….21.7

renovate Bot force-pushed the renovate/github.com-google-go-containerregistry-0.x branch 2 times, most recently from 4c5f096 to f99f75a Compare May 28, 2026 20:42

renovate Bot force-pushed the renovate/github.com-google-go-containerregistry-0.x branch from f99f75a to 2cc81cd Compare June 15, 2026 13:26

renovate Bot changed the title ~~fix(deps): update module github.com/google/go-containerregistry to v0.21.6~~ fix(deps): update module github.com/google/go-containerregistry to v0.21.7 Jun 18, 2026

renovate Bot force-pushed the renovate/github.com-google-go-containerregistry-0.x branch from 2cc81cd to e443b99 Compare June 18, 2026 02:44

renovate Bot changed the title ~~fix(deps): update module github.com/google/go-containerregistry to v0.21.7~~ fix(deps): update module github.com/google/go-containerregistry to v0.21.7 - autoclosed Jul 7, 2026

renovate Bot closed this Jul 7, 2026

renovate Bot deleted the renovate/github.com-google-go-containerregistry-0.x branch July 7, 2026 15:15

fix(deps): update module github.com/google/go-containerregistry to v0…

9273804

….21.7

renovate Bot changed the title ~~fix(deps): update module github.com/google/go-containerregistry to v0.21.7 - autoclosed~~ fix(deps): update module github.com/google/go-containerregistry to v0.21.7 Jul 7, 2026

renovate Bot reopened this Jul 7, 2026

renovate Bot force-pushed the renovate/github.com-google-go-containerregistry-0.x branch from e443b99 to 9273804 Compare July 7, 2026 20:02

christophrj approved these changes Jul 15, 2026

View reviewed changes

christophrj merged commit 67c0950 into main Jul 15, 2026
6 checks passed

Navigation Menu

Repository navigation

fix(deps): update module github.com/google/go-containerregistry to v0.21.7 - #131

fix(deps): update module github.com/google/go-containerregistry to v0.21.7#131
christophrj merged 1 commit into
mainfrom
renovate/github.com-google-go-containerregistry-0.x

renovate Bot commented May 18, 2026 •

edited

Loading

Uh oh!

renovate Bot commented May 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.21.7

What's Changed

New Contributors

v0.21.6

What's Changed

New Contributors

Configuration

Uh oh!

renovate Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented May 18, 2026 •

edited

Loading

`v0.21.7`

`v0.21.6`

renovate Bot commented May 18, 2026 •

edited

Loading