fix(deps): update go dependencies by renovate[bot] · Pull Request #4 · canonical/olav

renovate · 2026-07-13T08:15:25Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/charmbracelet/x/ansi	`v0.10.1` → `v0.11.7`
github.com/google/go-containerregistry	`v0.21.1` → `v0.21.9`
github.com/klauspost/compress	`v1.18.6` → `v1.19.2`
github.com/moby/moby/api	`v1.54.2` → `v1.55.0`
github.com/moby/moby/client	`v0.4.1` → `v0.5.1`

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

`v0.21.9`

Compare Source

What's Changed

actions: pin slsa generator by version by @Subserial in #2395
fix: prevent data race on scope refreshes within remote.writer by @Subserial in #2396
fix: remove '.' from unsafe path prefixes by @Subserial in #2400
build(deps): bump the actions group with 3 updates by @dependabot[bot] in #2398

Full Changelog: google/go-containerregistry@v0.21.8...v0.21.9

`v0.21.8`

Compare Source

The artifacts attached to this release are missing SLSA provenance, see #2390.

What's Changed

build(deps): bump the go-deps group across 1 directory with 3 updates by @dependabot[bot] in #2353
build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane by @dependabot[bot] in #2367
build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain by @dependabot[bot] in #2368
build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes by @dependabot[bot] in #2363
build(deps): bump the go-deps group across 3 directories with 7 updates by @dependabot[bot] in #2377
build(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #2375
Reject unsafe Windows archive paths in Extract by @Haihan-Jiang in #2330
feat(goreleaser): add loong64 build support for crane/gcrane/krane by @xuxiaowei-com-cn in #2358
Document tag and digest reference semantics by @Haihan-Jiang in #2325
remote: release pull limiter slot when body is read to EOF by @knQzx in #2373
tarball: bounds-check layer index in uncompressed LayerByDiffID by @arpitjain099 in #2370
authn: read Podman auth from XDG config by @vigneshakaviki in #2379
transport: per-host bearer token exchange on cross-host redirect by @amitzig in #2360
mutate: bounds-check layer index when building rebase addendums by @arpitjain099 in #2371
fix(daemon): copy ExposedPorts from source config in computeImageConfig by @x64vps in #2356
feat(remote): add WithReferrersTagFallback option by @kevinmdavis in #2366
mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract by @sadmanf in #2372
tarball: use correct file extension for zstd/uncompressed by @milas in #2382
build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory by @dependabot[bot] in #2380
actions: update actions to be pinned by hash by @Subserial in #2384
Bump go version to 1.26.5 by @Subserial in #2388

New Contributors

@xuxiaowei-com-cn made their first contribution in #2358
@knQzx made their first contribution in #2373
@arpitjain099 made their first contribution in #2370
@vigneshakaviki made their first contribution in #2379
@amitzig made their first contribution in #2360
@x64vps made their first contribution in #2356
@kevinmdavis made their first contribution in #2366
@sadmanf made their first contribution in #2372

Full Changelog: google/go-containerregistry@v0.21.7...v0.21.8

`v0.21.7`

Compare Source

What's Changed

tarball: return error instead of panicking on missing rootfs.diff_ids by @iahsanGill in #2304
gcrane: honor --platform flag in copy by @iahsanGill in #2307
mutate: verify layer digests in Extract and Time by @momenashrafff in #2303
tarball: close layer readers during Write by @nandbhat in #2308
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2311
build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory by @dependabot[bot] in #2312
BUGFIX: Fail with error when read exceeds maximum by @inteon in #2328
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2327
fix(name): anchor loopback registry detection by @rohan-patnaik in #2314
Reject symlinks in OCI layout blobs by @mosskappa in #2306
fix(crane): avoid creating export tar on pull failure by @Haihan-Jiang in #2318
feat(kubernetes): allow ignoring pull secrets by @rohan-patnaik in #2315
fix(name): preserve localhost registry references by @rohan-patnaik in #2316
pkg/registry: export ErrNotFound by @malt3 in #2176
pkg/registry: export RedirectError by @malt3 in #2177
build(deps): bump the go-deps group across 1 directory with 2 updates by @dependabot[bot] in #2343
build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #2344
fix: prevent SSRF in google.List() pagination by @tufstraka in #2332
internal/gzip: fix goroutine leak in ReadCloserLevel by @amarkdotdev in #2347
fix(transport): apply refreshed bearer token after cross-host redirect by @64johnlee in #2337
build(deps): bump the go-deps group across 3 directories with 4 updates by @dependabot[bot] in #2348
fix(tarball): normalize paths when matching files by @bstoll in #2334
transport: do not re-attach bearer token after cross-host redirect by @evilgensec in #2349
Bump CI go version to 1.26.4 by @Subserial in #2350

New Contributors

@momenashrafff made their first contribution in #2303
@nandbhat made their first contribution in #2308
@inteon made their first contribution in #2328
@rohan-patnaik made their first contribution in #2314
@mosskappa made their first contribution in #2306
@Haihan-Jiang made their first contribution in #2318
@tufstraka made their first contribution in #2332
@amarkdotdev made their first contribution in #2347
@64johnlee made their first contribution in #2337
@bstoll made their first contribution in #2334

Full Changelog: google/go-containerregistry@v0.21.6...v0.21.7

`v0.21.6`

Compare Source

What's Changed

fix: update dependencies to use new azure sdk components by @gaganhr94 in #2262
transport: restore resp.Body in retryError so CheckError can parse it by @alliasgher in #2264
pkg/registry: return 202 Accepted for PATCH chunk uploads by @alliasgher in #2265
Follow OCI distribution spec for artifactType and annotations by @malt3 in #2269
actions: attach Codecov token to coverage tests on main by @Subserial in #2270
remote: use DeleteScope (with "delete" action) for manifest deletion by @alliasgher in #2266
remote: limit concurrent layer pulls by @gnix0 in #2271
pkg/registry: reject corrupt disk blobs by @gnix0 in #2272
mutate: close layer readers during export by @gnix0 in #2277
crane/flatten: preserve image media type when flattening by @alliasgher in #2267
build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory by @dependabot[bot] in #2273
build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by @dependabot[bot] in #2278
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2280
Replace go-homedir with os.UserHomeDir by @jammie-jelly in #2282
pkg/name: only treat .localhost as non-HTTPS, not .local by @blackwell-systems in #2281
transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL by @marwan9696 in #2285
test(mutate): add Extract round-trip test for filesystem object preservation by @blackwell-systems in #2283
experiments: remove deprecated support for estargz by @thaJeztah in #2288
build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group by @dependabot[bot] in #2289
fix: limit HTTP response body reads to prevent OOM by @evilgensec in #2296
build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in #2297
transport: block redirects from token server to private/link-local addresses (SSRF fix) by @evilgensec in #2292
pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract by @anishesg in #2279
validate: skip non-layer layers by @imjasonh in #2298
remote: validate foreign layer URLs to prevent SSRF (fixes #2259) by @evilgensec in #2293
remote: block SSRF via private-IP Location headers in blob uploads by @adilburaksen in #2295
fix(mutate): preserve config blob and layers for non-Docker OCI artifacts by @blackwell-systems in #2286
fix: preserve per-occurrence layer identity in mutate.Image.Layers() by @iahsanGill in #2299
transport: retry HTTP 429 (Too Many Requests) by @iahsanGill in #2301
transport: allow bearer realm at same host:port as registry by @iahsanGill in #2302
Update go version to 1.26.3 by @Subserial in #2300

New Contributors

@gaganhr94 made their first contribution in #2262
@alliasgher made their first contribution in #2264
@malt3 made their first contribution in #2269
@gnix0 made their first contribution in #2271
@blackwell-systems made their first contribution in #2281
@marwan9696 made their first contribution in #2285
@anishesg made their first contribution in #2279
@adilburaksen made their first contribution in #2295
@iahsanGill made their first contribution in #2299

Full Changelog: google/go-containerregistry@v0.21.5...v0.21.6

`v0.21.5`

Compare Source

What's Changed

Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0 by @thaJeztah in #2254
update to Go 1.26.2 by @thaJeztah in #2255
Bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in the actions group across 1 directory by @dependabot[bot] in #2257
build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the go-deps group across 1 directory by @dependabot[bot] in #2260

Full Changelog: google/go-containerregistry@v0.21.4...v0.21.5

`v0.21.4`

Compare Source

What's Changed

go.mod: do not make a viral minimum go version by @howardjohn in #2237
Avoid pruning absolute links from extracted and flattened images by @Subserial in #2241
Bump the go-deps group across 3 directories with 5 updates by @dependabot[bot] in #2245
fix: update to go1.25.8, and use separate .go-version file by @thaJeztah in #2246
Bump CI go version to 1.26.1 by @Subserial in #2242
Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group by @dependabot[bot] in #2240
fork distribution client v3 auth-challenge as an internal package (squashed) by @thaJeztah in #2248
transport: validate Bearer realm URL to prevent SSRF by @evilgensec in #2243
revert path traversal and symlink escape from #2227 by @Subserial in #2250
Fix pkg/v1/google/auth tests for arm64 by @Subserial in #2085
goreleaser: Update goreleaser config and GH action by @Subserial in #2253

New Contributors

@evilgensec made their first contribution in #2243

Full Changelog: google/go-containerregistry@v0.21.3...v0.21.4

`v0.21.3`

Compare Source

What's Changed

Adds local file support to the crane index subcommand by @edwardthiele in #2223
migrate to github.com/moby/moby modules by @thaJeztah in #2228
Bump the go-deps group across 4 directories with 7 updates by @dependabot[bot] in #2233
Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group by @dependabot[bot] in #2220
mutate: reject path traversal and symlink escape in Extract by @KevinZhao in #2227
tarball: detect symlink cycles in extractFileFromTar by @vnykmshr in #2232
bump golang to 1.25.7 by @Subserial in #2236

New Contributors

@edwardthiele made their first contribution in #2223
@thaJeztah made their first contribution in #2228
@KevinZhao made their first contribution in #2227
@vnykmshr made their first contribution in #2232

Full Changelog: google/go-containerregistry@v0.21.2...v0.21.3

`v0.21.2`

Compare Source

What's Changed

Better handle redirects to https in ping by @jonjohnsonjr in #2225

Full Changelog: google/go-containerregistry@v0.21.1...v0.21.2

klauspost/compress (github.com/klauspost/compress)

`v1.19.2`

Compare Source

What's Changed

huff0: add arm64 assembly for Decompress4X/1X via avo lowering by @lizthegrey in #1172
zstd: Re-enable unsafe decodeSync memory copies (#1168) by @lizthegrey in #1171
zstd: fix arm64 asm frame offsets placing locals on the saved LR slot by @lizthegrey in #1176
zstd: avoid racing MaxDecodedSize write on shared dict litEnc by @zanarellidev in #1182
zstd: keep BuildDict recent-offsets positive and loadable by @zanarellidev in #1184
zstd: handle zero-literal BuildDict corpus by @cyphercodes in #1178
zstd: don't clear the registered dictionary when decoding past the window by @sueun-dev in #1177

New Contributors

@zanarellidev made their first contribution in #1183
@cyphercodes made their first contribution in #1178
@sueun-dev made their first contribution in #1177

Full Changelog: klauspost/compress@v1.19.1...v1.19.2

`v1.19.1`

Compare Source

What's Changed

zstd: Validate SnappyConverter literal copies by @klauspost in #1170
flate: use Peek instead of ReadByte for the bufio.Reader decode path by @joechenrh in #1169
zstd: bump avo pin, regenerate arm64 asm by @lizthegrey in #1167

New Contributors

@joechenrh made their first contribution in #1169

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

`v1.19.0`

Compare Source

What's Changed

zstd: Add true concurrent stream encoding by @klauspost in #1136
zstd: arm64 decoder asm by @lizthegrey in #1160
zstd: avoid unused BuildDict encoder allocation by @snissn in #1147
flate: Add inflate checkpoints by @klauspost in #1154
snappy/s2: Limit length of varint in decodedLen by @eustas in #1148
gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @z9z in #1149
zip: add NameDecoder callback for legacy encoding rewrite by @SAY-5 in #1150
huff0: Allow building tables from histogram. by @klauspost in #1155
huff0: Allow building table from oversized histogram. by @klauspost in #1156
s2sx: Clean symlink targets by @klauspost in #1163

New Contributors

@snissn made their first contribution in #1147
@eustas made their first contribution in #1148
@z9z made their first contribution in #1149
@SAY-5 made their first contribution in #1150
@HNO3Miracle made their first contribution in #1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

`v1.18.7`

Compare Source

Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

moby/moby (github.com/moby/moby/client)

`v0.5.1`

Compare Source

`v0.5.0`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-13T08:15:26Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`github.com/docker/cli`	`v29.5.1+incompatible` -> `v29.6.2+incompatible`
`github.com/lucasb-eyer/go-colorful`	`v1.2.0` -> `v1.4.0`
`golang.org/x/sync`	`v0.20.0` -> `v0.22.0`
`golang.org/x/sys`	`v0.45.0` -> `v0.47.0`

renovate Bot force-pushed the renovate/go-dependencies branch from 7d1ba01 to 62059b1 Compare July 20, 2026 13:07

renovate Bot force-pushed the renovate/go-dependencies branch 2 times, most recently from 0ab6ef3 to 00e2a71 Compare July 31, 2026 19:55

renovate Bot force-pushed the renovate/go-dependencies branch from 00e2a71 to c914e62 Compare August 6, 2026 01:05

fix(deps): update go dependencies

506724e

renovate Bot force-pushed the renovate/go-dependencies branch from c914e62 to 506724e Compare August 6, 2026 17:01

Navigation Menu

Uh oh!

fix(deps): update go dependencies - #4

fix(deps): update go dependencies#4
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-dependencies

renovate Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

renovate Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 13, 2026 •

edited

Loading

renovate Bot commented Jul 13, 2026 •

edited

Loading