openSUSE-SU-2026:22227-1

This update for go-containerregistry fixes the following issues:

Changes in go-containerregistry:

• update vendor.tar to address:

  • bsc#1288488, CVE-2026-116591: github.com/klauspost/compress/zstd: crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic

• update to 0.22.1:

  • Reject non-canonical IP literals in all SSRF guards
  • daemon: fix stale docker/docker reference in WithClient docs
  • build(deps): bump the go-deps group across 2 directories with 4 updates
  • authn: do not overwrite AuthConfig.Auth when username and password are empty
  • build(deps): bump the actions group across 1 directory with 8 updates
  • Support pulling images by sha512 digest
  • Allow empty label and annotation values in crane mutate
  • fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml
  • validate: support index attestation manifests and empty configs
  • name: improve error when parsing a reference with a URL scheme
  • fix(build): install binaries to /ko-app and add to PATH
  • fix(release): honor declared Go toolchain
  • remote: apply checkRedirectSSRF to writer-side HTTP clients
  • flatten: preserve config and layer media types when flattening
  • fix(mutate): make Time layer updates lazy
  • build(deps): bump the go-deps group across 2 directories with 3 updates
  • remote: copy manifest annotations to referrers fallback tag descriptors

• update to 0.22.0:

  • mutate: let Time and Canonical take tarball.LayerOption
  • build: add multi-architecture Cloud Build configurations for crane, gcrane, and krane
  • remote: resolve push-check credentials against the repository
  • Allow single-character repository paths
  • fix: add missing substitutions and workspace cleanup to new build files
  • remote: retry failed Puller and Pusher initialization
  • build(deps): bump the actions group across 1 directory with 8 updates
  • build(deps): bump the go-deps group across 1 directory with 3 updates
  • go.mod: bump Go version + add toolchain directive to replace .go-version file
  • fix: Fix new build options and provenance
  • fix(build): unify new build flow into cloudbuild_v2.yaml

• update to 0.21.8 (bsc#1283692, CVE-2026-63209):

  • The artifacts attached to this release are missing SLSA provenance, see #2390.
  • build(deps): bump the go-deps group across 1 directory with 3 updates
  • build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane
  • build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain
  • build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes
  • build(deps): bump the go-deps group across 3 directories with 7 updates
  • build(deps): bump the actions group across 1 directory with 5 updates
  • Reject unsafe Windows archive paths in Extract
  • feat(goreleaser): add loong64 build support for crane/gcrane/krane
  • Document tag and digest reference semantics
  • remote: release pull limiter slot when body is read to EOF
  • tarball: bounds-check layer index in uncompressed LayerByDiffID
  • authn: read Podman auth from XDG config
  • transport: per-host bearer token exchange on cross-host redirect
  • mutate: bounds-check layer index when building rebase addendums
  • fix(daemon): copy ExposedPorts from source config in computeImageConfig
  • feat(remote): add WithReferrersTagFallback option
  • mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract
  • tarball: use correct file extension for zstd/uncompressed
  • build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory
  • actions: update actions to be pinned by hash
  • Bump go version to 1.26.5

• update to 0.21.7:

  • tarball: return error instead of panicking on missing rootfs.diff_ids
  • gcrane: honor --platform flag in copy
  • mutate: verify layer digests in Extract and Time
  • tarball: close layer readers during Write
  • build(deps): bump the actions group across 1 directory with 2 updates
  • build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory
  • BUGFIX: Fail with error when read exceeds maximum
  • build(deps): bump the actions group across 1 directory with 2 updates
  • fix(name): anchor loopback registry detection
  • Reject symlinks in OCI layout blobs
  • fix(crane): avoid creating export tar on pull failure
  • feat(kubernetes): allow ignoring pull secrets
  • fix(name): preserve localhost registry references
  • pkg/registry: export ErrNotFound
  • pkg/registry: export RedirectError
  • build(deps): bump the go-deps group across 1 directory with 2 updates
  • build(deps): bump the actions group across 1 directory with 2 updates
  • fix: prevent SSRF in google.List() pagination
  • internal/gzip: fix goroutine leak in ReadCloserLevel
  • fix(transport): apply refreshed bearer token after cross-host redirect
  • build(deps): bump the go-deps group across 3 directories with 4 updates
  • fix(tarball): normalize paths when matching files
  • transport: do not re-attach bearer token after cross-host redirect
  • Bump CI go version to 1.26.4

• update to 0.21.6:

  • fix: update dependencies to use new azure sdk components
  • transport: restore resp.Body in retryError so CheckError can parse it
  • pkg/registry: return 202 Accepted for PATCH chunk uploads
  • Follow OCI distribution spec for artifactType and annotations
  • actions: attach Codecov token to coverage tests on main
  • remote: use DeleteScope (with "delete" action) for manifest deletion
  • remote: limit concurrent layer pulls
  • pkg/registry: reject corrupt disk blobs
  • mutate: close layer readers during export
  • crane/flatten: preserve image media type when flattening
  • build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory
  • build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0
  • build(deps): bump the go-deps group across 3 directories with 6 updates
  • Replace go-homedir with os.UserHomeDir
  • pkg/name: only treat .localhost as non-HTTPS, not .local
  • transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL
  • test(mutate): add Extract round-trip test for filesystem object preservation
  • experiments: remove deprecated support for estargz
  • build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group
  • fix: limit HTTP response body reads to prevent OOM
  • build(deps): bump the go-deps group across 3 directories with 6 updates
  • transport: block redirects from token server to private/link- local addresses (SSRF fix)
  • pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract
  • validate: skip non-layer layers
  • remote: validate foreign layer URLs to prevent SSRF (fixes #2259)
  • remote: block SSRF via private-IP Location headers in blob uploads
  • fix(mutate): preserve config blob and layers for non-Docker OCI artifacts
  • fix: preserve per-occurrence layer identity in mutate.Image.Layers()
  • transport: retry HTTP 429 (Too Many Requests)
  • transport: allow bearer realm at same host:port as registry
  • Update go version to 1.26.3

• update to 0.21.5:

  • Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0
  • update to Go 1.26.2
  • Bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in the actions group across 1 directory
  • build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the go-deps group across 1 directory
  • Full Changelog: https://github.com/google/go- containerregistry/compare/v0.21.4...v0.21.5

• update to 0.21.4:

  • go.mod: do not make a viral minimum go version
  • Avoid pruning absolute links from extracted and flattened images
  • Bump the go-deps group across 3 directories with 5 updates
  • fix: update to go1.25.8, and use separate .go-version file
  • Bump CI go version to 1.26.1
  • Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group
  • fork distribution client v3 auth-challenge as an internal package (squashed)
  • transport: validate Bearer realm URL to prevent SSRF
  • revert path traversal and symlink escape from #2227
  • Fix pkg/v1/google/auth tests for arm64
  • goreleaser: Update goreleaser config and GH action

• update to 0.21.3:

  • Adds local file support to the crane index subcommand
  • migrate to github.com/moby/moby modules
  • Bump the go-deps group across 4 directories with 7 updates
  • Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group
  • mutate: reject path traversal and symlink escape in Extract
  • tarball: detect symlink cycles in extractFileFromTar
  • bump golang to 1.25.7

• update to 0.21.2:

  • Better handle redirects to https in ping
  • Full Changelog: https://github.com/google/go- containerregistry/compare/v0.21.1...v0.21.2

• update to 0.21.1:

  • Add WithFileBufferedOpener for file-backed daemon image buffering
  • crane: fix case in auth response json

• update to 0.21.0:

  • fix(mutate): don't skip dir replacements via whiteout in export
  • Improve performance of v1.NewHash
  • Bump the actions group across 1 directory with 4 updates
  • Bump the root-deps group across 1 directory with 7 updates
  • Fix error messages in crane_test.go
  • Bump go version across packages to 1.25.6
  • Join go.mod dependency updates
  • Bump the go-deps group across 3 directories with 3 updates
  • Disable taint gosec lints
  • Update go version used in goreleaser

• update to 0.20.7:

  • Fix ArgsEscaped lint directive
  • transport: Fix broken links to distribution docs
  • fix(remote): using customized retry predicate func if provided
  • Adding docker file
  • crane: Add timestamp to flatten layer
  • feat(remote): pass retryBackoff option to transport
  • Expose clobber refusal error
  • Build artifacts for riscv64
  • Update dependencies and deprecate DockerVersion field

• update to 0.20.7:

  • Fix ArgsEscaped lint directive
  • transport: Fix broken links to distribution docs
  • fix(remote): using customized retry predicate func if provided
  • Adding docker file
  • crane: Add timestamp to flatten layer
  • feat(remote): pass retryBackoff option to transport
  • Expose clobber refusal error
  • Build artifacts for riscv64
  • Update dependencies and deprecate DockerVersion field

• update to 0.20.6:

  • Ensure that tag name is not empty if name contains colon
  • Bump some deps

• update to 0.20.5:

  • build(deps): bump docker/docker to v28.0.0+incompatible
  • Migrate linter to v2
  • bump go version + bump deps
  • implement TextMarshaler/JSONMarshaler more consistently
  • Update CodeQL permissions
  • Update goreleaser permissions
  • Update provenance action in release
  • Update validator action

• CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239277)

• update to 0.20.3:

  • remote/transport: Make bearer transport go-routine-safe
  • Expose compare package
  • fix: redact.URL uses (*URL).Redacted to omit basic-auth password
  • bump actions to latest
  • don't pin chainguard-dev/actions
  • Check for 406 status code when handling referrers API endpoint response
  • mutate: Create a defensive annotations copy
  • Detect zstd in crane append
  • bump deps using hack/bump-deps.sh

• update to 0.20.2:

  • deps: bump docker dep