Update module github.com/google/go-containerregistry to v0.21.5 by renovate-bot · Pull Request #1061 · bazelbuild/bazel-toolchains

renovate-bot · 2026-04-14T09:42:11Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/go-containerregistry	`v0.4.0` → `v0.21.5`

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.5`

Compare Source

What's Changed

Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0 by @thaJeztah in #2254
update to Go 1.26.2 by @thaJeztah in #2255
Bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in the actions group across 1 directory by @dependabot[bot] in #2257
build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the go-deps group across 1 directory by @dependabot[bot] in #2260

Full Changelog: google/go-containerregistry@v0.21.4...v0.21.5

`v0.21.4`

Compare Source

What's Changed

go.mod: do not make a viral minimum go version by @howardjohn in #2237
Avoid pruning absolute links from extracted and flattened images by @Subserial in #2241
Bump the go-deps group across 3 directories with 5 updates by @dependabot[bot] in #2245
fix: update to go1.25.8, and use separate .go-version file by @thaJeztah in #2246
Bump CI go version to 1.26.1 by @Subserial in #2242
Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group by @dependabot[bot] in #2240
fork distribution client v3 auth-challenge as an internal package (squashed) by @thaJeztah in #2248
transport: validate Bearer realm URL to prevent SSRF by @evilgensec in #2243
revert path traversal and symlink escape from #2227 by @Subserial in #2250
Fix pkg/v1/google/auth tests for arm64 by @Subserial in #2085
goreleaser: Update goreleaser config and GH action by @Subserial in #2253

New Contributors

@evilgensec made their first contribution in #2243

Full Changelog: google/go-containerregistry@v0.21.3...v0.21.4

`v0.21.3`

Compare Source

What's Changed

Adds local file support to the crane index subcommand by @edwardthiele in #2223
migrate to github.com/moby/moby modules by @thaJeztah in #2228
Bump the go-deps group across 4 directories with 7 updates by @dependabot[bot] in #2233
Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group by @dependabot[bot] in #2220
mutate: reject path traversal and symlink escape in Extract by @KevinZhao in #2227
tarball: detect symlink cycles in extractFileFromTar by @vnykmshr in #2232
bump golang to 1.25.7 by @Subserial in #2236

New Contributors

@edwardthiele made their first contribution in #2223
@thaJeztah made their first contribution in #2228
@KevinZhao made their first contribution in #2227
@vnykmshr made their first contribution in #2232

Full Changelog: google/go-containerregistry@v0.21.2...v0.21.3

`v0.21.2`

Compare Source

What's Changed

Better handle redirects to https in ping by @jonjohnsonjr in #2225

Full Changelog: google/go-containerregistry@v0.21.1...v0.21.2

`v0.21.1`

Compare Source

This release fixes a regression in crane introduced in the previous release.

What's Changed

Add WithFileBufferedOpener for file-backed daemon image buffering by @twdamhore in #2214
crane: fix case in auth response json by @aelindeman in #2218

New Contributors

@twdamhore made their first contribution in #2214
@aelindeman made their first contribution in #2218

Full Changelog: google/go-containerregistry@v0.21.0...v0.21.1

`v0.21.0`

Compare Source

This release updates the minimum Go version to 1.25.6.

What's Changed

fix(mutate): don't skip dir replacements via whiteout in export by @r4f4 in #2191
Improve performance of v1.NewHash by @bmoylan in #2194
Bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #2207
Bump the root-deps group across 1 directory with 7 updates by @dependabot[bot] in #2195
Fix error messages in crane_test.go by @jammie-jelly in #2189
Bump go version across packages to 1.25.6 by @Subserial in #2211
Join go.mod dependency updates by @Subserial in #2212
Bump the go-deps group across 3 directories with 3 updates by @dependabot[bot] in #2213
Disable taint gosec lints by @Subserial in #2215
Update go version used in goreleaser by @Subserial in #2216

New Contributors

@r4f4 made their first contribution in #2191
@jammie-jelly made their first contribution in #2189

Full Changelog: google/go-containerregistry@v0.20.7...v0.21.0

`v0.20.8`

Compare Source

`v0.20.7`

Compare Source

What's Changed

Fix ArgsEscaped lint directive by @Subserial in #2137
transport: Fix broken links to distribution docs by @guzalv in #2136
fix(remote): using customized retry predicate func if provided by @derekhjray in #2135
Adding docker file by @HassanJasim in #2138
crane: Add timestamp to flatten layer by @Stephanie0829 in #2117
feat(remote): pass retryBackoff option to transport by @aslafy-z in #1628
Expose clobber refusal error by @pjbgf in #2146
Build artifacts for riscv64 by @ffgan in #2159
Update dependencies and deprecate DockerVersion field by @Subserial in #2164

New Contributors

@guzalv made their first contribution in #2136
@derekhjray made their first contribution in #2135
@HassanJasim made their first contribution in #2138
@Stephanie0829 made their first contribution in #2117
@pjbgf made their first contribution in #2146
@ffgan made their first contribution in #2159

Full Changelog: google/go-containerregistry@v0.20.6...v0.20.7

`v0.20.6`

Compare Source

What's Changed

Ensure that tag name is not empty if name contains colon by @SaschaSchwarze0 in #2094
Bump some deps by @jonjohnsonjr in #2110

New Contributors

@SaschaSchwarze0 made their first contribution in #2094

Full Changelog: google/go-containerregistry@v0.20.4...v0.20.6

`v0.20.5`

Compare Source

What's Changed

build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
Migrate linter to v2 by @Subserial in #2096
bump go version + bump deps by @Subserial in #2093
implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
Update CodeQL permissions by @Subserial in #2103
Update goreleaser permissions by @Subserial in #2104
Update provenance action in release by @Subserial in #2105
Update validator action by @Subserial in #2106

New Contributors

@luhring made their first contribution in #2071
@Subserial made their first contribution in #2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.5

`v0.20.4`: - Not usable as a go module

Compare Source

🚨 This release was published to the Go module proxy and then re-tagged with a different commit. This means it's not usable as a Go module (#2107) -- please us v0.20.5 instead.

What's Changed

build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
Migrate linter to v2 by @Subserial in #2096
bump go version + bump deps by @Subserial in #2093
implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
Update CodeQL permissions by @Subserial in #2103
Update goreleaser permissions by @Subserial in #2104
Update provenance action in release by @Subserial in #2105
Update validator action by @Subserial in #2106

New Contributors

@luhring made their first contribution in #2071
@Subserial made their first contribution in #2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.4

`v0.20.3`

Compare Source

What's Changed

remote/transport: Make bearer transport go-routine-safe by @2opremio in #1806
Expose compare package by @jonjohnsonjr in #2001
fix: redact.URL uses (*URL).Redacted to omit basic-auth password by @bmoylan in #1947
bump actions to latest by @ajayk in #2011
don't pin chainguard-dev/actions by @imjasonh in #2025
Check for 406 status code when handling referrers API endpoint response by @malancas in #2026
mutate: Create a defensive annotations copy by @jonjohnsonjr in #2030
Detect zstd in crane append by @jonjohnsonjr in #2023
bump deps using hack/bump-deps.sh by @imjasonh in #2042

New Contributors

@bmoylan made their first contribution in #1947
@ajayk made their first contribution in #2011
@malancas made their first contribution in #2026

Full Changelog: google/go-containerregistry@v0.20.2...v0.20.3

`v0.20.2`

Compare Source

What's Changed

deps: bump docker dep by @imjasonh in #1991

Full Changelog: google/go-containerregistry@v0.20.1...v0.20.2

`v0.20.1`

Compare Source

What's Changed

Create remote.Push by @mattmoor in #1978

Full Changelog: google/go-containerregistry@v0.20.0...v0.20.1

`v0.20.0`

Compare Source

What's Changed

Referrer API must return correct Content-Type by @GregoireW in #1968
🚨 POTENTIALLY BREAKING: Restore blind-write to remote.Put by @jonjohnsonjr in #1970

New Contributors

@GregoireW made their first contribution in #1968

Full Changelog: google/go-containerregistry@v0.19.2...v0.20.0

`v0.19.2`

Compare Source

What's Changed

Add JSON marshalling funcs for Digest. by @wlynch in #1915
registry: Implement Range requests for blobs by @jonjohnsonjr in #1917
Support podman auth file REGISTRY_AUTH_FILE. by @zhaoyonghe in #1914
feat: crane mutate platform by @joshwlewis in #1919
Add Context support to auth methods by @jonjohnsonjr in #1949
Fix windows race condition when writing image with duplicate layers by @dgannon991 in #1921
Add -O shorthand for --omit-digest-tags to crane. by @smoser in #1958

New Contributors

@wlynch made their first contribution in #1915
@zhaoyonghe made their first contribution in #1914
@joshwlewis made their first contribution in #1919
@dgannon991 made their first contribution in #1921
@smoser made their first contribution in #1958

Full Changelog: google/go-containerregistry@v0.19.1...v0.19.2

`v0.19.1`

Compare Source

What's Changed

Bump golang.org/x/net from 0.10.0 to 0.17.0 in /pkg/authn/k8schain by @dependabot in #1815
Bump golang.org/x/ packages by @jonjohnsonjr in #1892

Full Changelog: google/go-containerregistry@v0.19.0...v0.19.1

`v0.19.0`

Compare Source

What's Changed

Work around docker v25 tarballs by @jonjohnsonjr in #1872

Full Changelog: google/go-containerregistry@v0.18.0...v0.19.0

`v0.18.0`

Compare Source

What's Changed

fix: goreleaser config by @caarlos0 in #1764
Always print pushed digest in crane push by @aw185176 in #1860

New Contributors

@caarlos0 made their first contribution in #1764

Full Changelog: google/go-containerregistry@v0.17.0...v0.18.0

`v0.17.0`

Compare Source

What's Changed

🦅 Validate index architectures match children 🦅 by @jonjohnsonjr in #1776
Set Content-Length for blob uploads by @jonjohnsonjr in #1781
Don't wrap DefaultKeychain with refreshes by @jonjohnsonjr in #1791
Build releases with Go 1.21 by @imjasonh in #1840
fix: mimic oci-layout in diskblobhandler by @thesayyn in #1810
tag: add command explanation to the long help by @abitrolly in #1843
feat: implement gc command by @thesayyn in #1811
feat: allow port and disk path to be overriden by @thesayyn in #1848

Full Changelog: google/go-containerregistry@v0.16.1...v0.17.0

`v0.16.1`

Compare Source

Release is broken due to goreleaser error, 0.16.1 has the fix

What's Changed

bump deps using ./hack/bump-deps.sh by @imjasonh in #1702
Allow crane to export schema 1 images by @jonjohnsonjr in #1704
fixed a goroutine leak by @ktarplee in #1705
retry HTTP 522 errors by default by @imjasonh in #1707
Limit size of manifest by @AdamKorcz in #1711
Add crane auth token by @jonjohnsonjr in #1709
Bump codecov/codecov-action from 3.1.3 to 3.1.4 by @dependabot in #1710
Pass scopes through crane auth token by @jonjohnsonjr in #1713
fix: add bounds checking to addendum layer mutations to prevent panic by @aaron-prindle in #1715
Surface better error messages in crane index by @jonjohnsonjr in #1722
crane: add missing name option in crane index commands by @HubertZhang in #1723
crane: Respect cmd.OutOrStdout by @kyleconroy in #1728
Make ErrSchema1 checkable via errors.Is() by @Laitr0n in #1721
Don't load into daemon if the image already exists by @jonjohnsonjr in #1724
add --blobs-to-disk to 'crane registry serve' by @imjasonh in #1731
Correct crane registry help text by @jonjohnsonjr in #1732
Allow concurrent blob Sets, use RWMutex by @mattmoor in #1733
Use RWLock, limit scope of locking, write digest first by @mattmoor in #1734
Let the filesystem handle atomicity by @mattmoor in #1735
Don't try cross-origin mounting against dockerhub by @jonjohnsonjr in #1743
Drop localhost to support crane registry serve in a container by @mattmoor in #1746
Return OCI Index content-type for referrers response by @jdolitsky in #1762

New Contributors

@AdamKorcz made their first contribution in #1711
@HubertZhang made their first contribution in #1723
@kyleconroy made their first contribution in #1728
@Laitr0n made their first contribution in #1721

Full Changelog: google/go-containerregistry@v0.15.2...v0.16.1

Container Images

https://gcr.io/go-containerregistry/crane:v0.16.1
https://gcr.io/go-containerregistry/gcrane:v0.16.1

For example:

docker pull gcr.io/go-containerregistry/crane:v0.16.1
docker pull gcr.io/go-containerregistry/gcrane:v0.16.1

`v0.16.0`

Compare Source

Release is broken due to goreleaser error, 0.16.1 has the fix

`v0.15.2`

Compare Source

What's Changed

Make 403 non-fatal for manifest existence checks by @jonjohnsonjr in #1691
Do not reuse pushers for pullers by @jonjohnsonjr in #1701

Full Changelog: google/go-containerregistry@v0.15.1...v0.15.2

`v0.15.1`

Compare Source

Changelog

e2620e5 Actually retry retryable status codes (#1618)
afd15f1 Add --all-tags flag to crane cp (#1682)
69d1a19 Add mutate --ports option to set the exposed ports (#1677)
65e78dc Add partial.Manifests for lazy index access (#1631)
3228a60 Add ppc64le to .goreleaser.yml (#1680)
0b12f56 Add ppc64le to all binaries (#1688)
d958444 Add remote.Descriptor.Schema1() (#1626)
07c767c Add remote.Puller (#1644)
005bb71 Add remote.Reuse for Pusher/Puller (#1672)
21ac1b2 Adding mutate --workdir option to set the working directory (#1615)
0962e29 Allow remote config layers to be lazy fetched (#1634)
53189d3 Bump actions/setup-go from 3 to 4 (#1602)
54e3f49 Bump actions/stale from 7 to 8 (#1616)
07eb440 Bump codecov/codecov-action from 3.1.1 to 3.1.2 (#1650)
58bd35b Bump codecov/codecov-action from 3.1.2 to 3.1.3 (#1668)
e055961 Bump peter-evans/create-pull-request from 4 to 5 (#1642)
b8d1c0a Bump slsa-framework/slsa-verifier from 2.0.1 to 2.1.0 (#1621)
375fb61 Bump slsa-framework/slsa-verifier from 2.1.0 to 2.2.0 (#1649)
9aa45a1 Change return type of remote.Referrers (#1652)
2ccd41c Cleanup: Switch the debug image to cgr.dev/chainguard/busybox (#1638)
93be9c4 Don't export whiteouts for single layers (#1629)
b7c6e9d Fall back to puller if reusing pusher fails (#1676)
370e8a5 Fix a few lint issues (#1684)
bc990d6 Fix fetching referrers error handling (#1648)
aee00b1 Fix race in mutate (#1627)
4a79e94 Fix race in stream (#1632)
6743ec9 Implement remote.Pusher (#1633)
3120ba5 Keep order of env in crane mutate (#1683)
6ac92e8 Refactor fetcher, writer, and progress (#1625)
249d7e1 Refresh authn.DefaultKeychain creds every 5 min (#1624)
ad695c0 Replace deprecated command with environment file (#1667)
ed5c185 Retry net.ErrClosed (#1637)
43710a9 Retry without mount if auth fails (#1681)
2435320 Revert "Cleanup: Switch the debug image to cgr.dev/chainguard/busybox (#1638)" (#1641)
27a6ad6 Revert "authn: Add NewConfigKeychain to load a config from explicit path (#1603)" (#1664)
a34235c Support Warning header aggregation and reporting in crane (#1604)
01bbd53 Update release.yml (#1601)
df518f9 add crane auth logout (#1589)
5438948 add registry.Repo("foo") (#1671)
3706061 allow pkg/v1/random to accept a RNG source (#1675)
1cb7e13 authn: Add NewConfigKeychain to load a config from explicit path (#1603)
348cd86 bump deps using ./hack/bump-deps.sh (#1659)
691004b bump deps using ./hack/bump-deps.sh (#1685)
df72a9a crane push: print pushed ref@digest to stdout (#1663)
0577676 crane: ignore buildx attestations in flatten (#1630)
217318c deprecate estargz (#1660)
9f68710 feat(daemon): generate config file from Docker Engine API (#1130)
52d59d1 feat(remote): make retryStatusCodes configurable (#1635)
6f96bba gcrane: Use page size of 10,000 for googley things (#1645)
0f2db49 release: use ko 0.13.0 to build images (#1607)
d64f9e0 remove time from random.Image history (#1678)
46488f7 retry HTTP 499 errors by default (#1612)
ace7be7 update GCR quotas (#1619)
d1c4e9f verify provenance (#1611)

Container Images

https://gcr.io/go-containerregistry/crane:v0.15.1
https://gcr.io/go-containerregistry/gcrane:v0.15.1

For example:

docker pull gcr.io/go-containerregistry/crane:v0.15.1
docker pull gcr.io/go-containerregistry/gcrane:v0.15.1

`v0.15.0`

Compare Source

`v0.14.0`

Compare Source

Changelog

9306eba Allow crane edit to generate non-image artifacts (#1545)
de35f0f Allow setting Content-Type in crane edit manifest (#1551)
4b081f8 Avoid v1.Manifest in crane edit config (#1583)
1cfe1fc Bump aws-actions/configure-aws-credentials from 1.7.0 to 2.0.0 (#1593)
da1008f Bump golangci/golangci-lint-action from 3.3.1 to 3.4.0 (#1548)
86be45f Bump goreleaser/goreleaser-action from 4.1.0 to 4.1.1 (#1547)
62f183e Bump goreleaser/goreleaser-action from 4.1.1 to 4.2.0 (#1556)
1b8dc2b Bump slsa-framework/slsa-github-generator from 1.2.2 to 1.5.0 (#1580)
11843ba Enforce proper sha256 usage (#1544)
2ceebaa Implement crane index subcommand (#1561)
9f42e02 Set mediaType for empty.ImageIndex in RawManifest (#1562)
759b19f Support artifactType, for images whose config.mediaType is not a config (#1541)
b3c23b4 Support for OCI 1.1+ referrers via API (#1546)
061ee6b Support for OCI 1.1+ referrers via fallback tag (#1543)
6770304 Update descriptor "data" field (when valid) during "crane edit config" (#1584)
76bac93 Update release.yml (#1540)
eb7d746 authn: also read mount secrets (#1560)
e94d408 bump deps using ./hack/bump-deps.sh (#1592)
4e95ae2 crane: add --flatten for index append (#1566)
ff810c1 crane: add serve subcommand (#1586)
8ea5e0e crane: support --omit-digest-tags in crane ls (#1528)
824efc7 fix(mutate): also set timestamps only present in some formats (#1550)
e04520b fix: Fix the crane release url and add more steps (#1532)
d872232 hash: use generic instantiation (#1538)
57f010d replace manual slsa-verifier installation with action (#1585)
9cd098e skip tls verification if default transport is used with insecure option (#1559)
3624968 tarball: pass imageToTags (#1563)

Container Images

https://gcr.io/go-containerregistry/crane:v0.14.0
https://gcr.io/go-containerregistry/gcrane:v0.14.0

For example:

docker pull gcr.io/go-containerregistry/crane:v0.14.0
docker pull gcr.io/go-containerregistry/gcrane:v0.14.0

`v0.13.0`

Compare Source

What's Changed

Bump slsa-framework/slsa-github-generator to 1.2.2 by @jonjohnsonjr in [#1489](https://redirect.github.com/google/go-contai

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

forking-renovate · 2026-04-14T09:42:13Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.16` -> `1.25.0`
`cloud.google.com/go`	`v0.57.0` -> `v0.112.1`
`github.com/golang/protobuf`	`v1.4.1` -> `v1.5.4`
`github.com/googleapis/gax-go/v2`	`v2.0.5` -> `v2.12.2`
`google.golang.org/genproto`	`v0.0.0-20200527145253-8367513e4ece` -> `v0.0.0-20240213162025-012b6fc9bca9`

Update module github.com/google/go-containerregistry to v0.21.5

7058e8e

renovate-bot requested review from DaveGay, rbe-toolchains-pr-bot and smukherj1 as code owners April 14, 2026 09:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update module github.com/google/go-containerregistry to v0.21.5#1061

Update module github.com/google/go-containerregistry to v0.21.5#1061
renovate-bot wants to merge 1 commit intobazelbuild:masterfrom
renovate-bot:renovate/github.com-google-go-containerregistry-0.x

renovate-bot commented Apr 14, 2026 •

edited

Loading

Uh oh!

forking-renovate bot commented Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate-bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

v0.20.4: - Not usable as a go module

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Container Images

What's Changed

Changelog

Container Images

Changelog

Container Images

What's Changed

Configuration

Uh oh!

forking-renovate bot commented Apr 14, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate-bot commented Apr 14, 2026 •

edited

Loading

`v0.20.4`: - Not usable as a go module