chore(deps): update dependency distribution/distribution to v3 by renovate[bot] · Pull Request #59 · owncloud-ops/registry

renovate · 2025-04-02T06:25:55Z

This PR contains the following updates:

Package	Update	Change
distribution/distribution	major	`v2.8.3` → `v3.1.1`

Release Notes

distribution/distribution (distribution/distribution)

`v3.1.1`

Compare Source

Welcome to the v3.1.1 release of registry!

This is a stable release

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

Notable Changes

Fixes CVE-2026-41888
Bounds-check the file basename in PurgeUploads Walk callback
Add S3 Express One Zone support to the S3 storage driver (#4858)
Fix tag list endpoint in proxy mode (#4846)
Clamp oversized n query parameter in proxy mode instead of returning 400 (#4856)

See the full changelog below for the full list of changes.

What's Changed

internal/client/auth/challenge: cleanups and minor refactor by @thaJeztah in #4832
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory by @dependabot[bot] in #4843
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory by @dependabot[bot] in #4850
build(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in #4840
chore(build): Bump go version to latest by @milosgajdos in #4851
refactor: use slices.Backward to simplify the code by @chuanshanjida in #4848
fix(proxy): fix tag list endpoint in proxy mode by @njucjc in #4846
Update docker-compose structure in deploying.md by @jdg71nl in #4855
build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #4854
build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 by @dependabot[bot] in #4852
build(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #4847
build(deps): bump docker/bake-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #4853
fix(proxy): clamp oversized n query param instead of returning 400 by @milosgajdos in #4856
feat(s3): add express zone one support to S3 driver by @milosgajdos in #4858
fix(storage): bounds-check the file basename in PurgeUploads Walk callback by @SAY-5 in #4860
chore(release): prepare for v3.1.1 release by @milosgajdos in #4864

New Contributors

@chuanshanjida made their first contribution in #4848
@jdg71nl made their first contribution in #4855
@SAY-5 made their first contribution in #4860

Full Changelog: distribution/distribution@v3.1.0...v3.1.1

`v3.1.0`

Compare Source

Welcome to the v3.1.0 release of registry!

This is a stable release

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

Notable Changes

Fixes CVE-2026-35172
Fixes CVE-2026-33540
Adds support for tag pagination (#4360, #4353)
Fixes default credentials in Azure storage provider (#4619)
Drops support for go1.23 and go1.24 and updates to go1.25

See the full changelog below for the full list of changes.

What's Changed

docs: Update to refer to new image tag v3 by @schanzel in #4373
Fix default_credentials in azure storage provider by @switchboardOp in #4619
chore: make function comment match function name by @closeobserve in #4622
build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory by @dependabot[bot] in #4625
fix: implement JWK thumbprint for Ed25519 public keys by @zhangyoufu in #4626
fix: Annotate code block from validation.indexes configuration docs by @anzoman in #4629
feat: extract redis config to separate struct by @shanduur in #4620
Fix: resolve issue #4478 by using a temporary file for non-append writes by @onporat in #4624
build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in #4645
docs: Add note about OTEL_TRACES_EXPORTER by @jcpunk in #4669
fix: set OTEL traces to disabled by default by @jcpunk in #4671
Fix markdown syntax for OTEL traces link in docs by @shantanoo-desai in #4676
Switch UUIDs to UUIDv7 by @binaryfire in #4666
refactor: replace map iteration with maps.Copy/Clone by @whosehang in #4632
s3-aws: fix build for 386 by @ChenQi1989 in #4642
docs: Add OpenTelemetry links to quickstart docs (#4270) by @dpw13 in #4640
Fix S3 driver loglevel param by @milosgajdos in #4617
Fixed data race in TestSchedule test by @horoshev in #4647
Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys by @gpgenaiz in #4684
build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #4687
Fix broken link to Docker Hub fair use policy by @Klikini in #4688
fix(registry/handlers/app): redis CAs by @ChandonPierre in #4668
build(deps): bump actions/labeler from 5 to 6 by @dependabot[bot] in #4694
build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #4693
build(deps): bump actions/upload-pages-artifact from 3 to 4 by @dependabot[bot] in #4691
build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #4706
build(deps): bump github/codeql-action from 3.26.5 to 4.30.7 by @dependabot[bot] in #4710
build(deps): bump github/codeql-action from 4.30.7 to 4.30.8 by @dependabot[bot] in #4714
chore: labeler: add area/client mapping for internal/client/** by @artem-tkachuk in #4716
client: add Accept headers to Exists() HEAD by @artem-tkachuk in #4715
feat(registry): Make graceful shutdown test robust by @Sumedhvats in #4720
fix(registry): Correct log formatting for upstream challenge by @Sumedhvats in #4721
build(deps): bump github/codeql-action from 4.30.8 to 4.30.9 by @dependabot[bot] in #4722
build(deps): bump github/codeql-action from 4.30.9 to 4.31.3 by @dependabot[bot] in #4735
refactor: remove redundant variable declarations in for loops by @efcking in #4741
"should" -> "must" regarding redis eviction policy by @dpedu in #4742
build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #4744
Incorrect warning hint by @nkaaf in #4708
Add return error when list object by @tranthang2404 in #4753
build(deps): bump actions/checkout from 5.0.1 to 6.0.0 by @dependabot[bot] in #4745
build(deps): bump peter-evans/dockerhub-description from 4 to 5 by @dependabot[bot] in #4707
fix: Logging regression for manifest HEAD requests by @tcuthbert in #4756
Add boolean parsing util by @1raghavmahajan in #4763
Expose useFIPSEndpoint for S3 by @1raghavmahajan in #4764
Add Cloudfleet Container Registry to adopters by @cloudfleet-tech in #4765
fix(ci): Fix broken Azure e2e storage tests by @milosgajdos in #4767
BUG: Fix notification filtering to work with actions when mediatypes is empty by @acallejaszu in #4730
build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #4761
build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0 by @dependabot[bot] in #4760
build(deps): bump github/codeql-action from 4.31.3 to 4.31.10 by @dependabot[bot] in #4766
build(deps): bump github/codeql-action from 4.31.10 to 4.32.2 by @dependabot[bot] in #4778
build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #4768
update golangci-lint to v2.9 and fix linting issues by @thaJeztah in #4780
update to go1.25.7, alpine 3.23, xx v1.9.0 by @thaJeztah in #4781
vendor: github.com/sirupsen/logrus v1.9.4 by @thaJeztah in #4783
vendor: update golang.org/x/* dependencies by @thaJeztah in #4782
vendor: github.com/docker/docker-credential-helpers v0.9.5 by @thaJeztah in #4785
vendor: github.com/opencontainers/image-spec v1.1.1 by @thaJeztah in #4786
vendor: github.com/klauspost/compress v1.18.4 by @thaJeztah in #4787
fix: prefer otel variables over hard coded service name by @kub3let in #4771
vendor: github.com/spf13/cobra v1.10.2 by @thaJeztah in #4789
vendor: github.com/bshuster-repo/logrus-logstash-hook v1.1.0 by @thaJeztah in #4788
fix: sync parent dir to ensure data is reliably stored by @ningmingxiao in #4774
modernize code by @thaJeztah in #4784
vendor: github.com/docker/go-events 6053543 by @thaJeztah in #4791
vendor: github.com/go-jose/go-jose/v4 v4.1.3 by @thaJeztah in #4790
build(deps): bump github/codeql-action from 4.32.2 to 4.32.5 by @dependabot[bot] in #4806
build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #4807
build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #4800
build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #4811
build(deps): bump docker/bake-action from 6 to 7 by @dependabot[bot] in #4809
build(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #4810
fix: nil-check scheduler in proxyingRegistry.Close() by @joonas in #4805
fix: set MD5 on GCS writer before first Write call in putContent by @joonas in #4803
docs: pull through cache will pull from remote multiple times by @yiyun-sj in #4664
Update s3.md regionendpoint option by @Alexsandr-Random in #4534
chore(deps): Bump Go to latest 1.25 in CI workflows and go.mod by @milosgajdos in #4819
fix: correct Ed25519 JWK thumbprint kty from "OTP" to "OKP" by @joonas in #4801
Update vacuum.go by @wutongjie23hao in #4610
Opt: refector tag list pagination support (stage 1) by @njucjc in #4360
Correctly match environment variables to YAML-inlined structs in configuration by @evanebb in #4639
Enable Redis TLS without client certificates by @omartrigui in #4770
build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #4826
build(deps): bump github/codeql-action from 4.32.5 to 4.34.1 by @dependabot[bot] in #4823
fix(registry/proxy): use detached context when flushing write buffer by @ChandonPierre in #4793
ci: pin actions and apply zizmor auto-fixes by @thaJeztah in #4831
build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #4833
build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in the go_modules group across 1 directory by @dependabot[bot] in #4837
chore(app): warn when partial TLS config is used in Redis by @milosgajdos in #4838
feat(registry): enhance authentication checks in htpasswd implementation by @mnixry in #4758
Opt: refactor tag list pagination support by @njucjc in #4353
build(deps): bump codecov/codecov-action from 5.5.4 to 6.0.0 by @dependabot[bot] in #4836
build(deps): bump actions/configure-pages from 5.0.0 to 6.0.0 by @dependabot[bot] in #4834
fix(vendor): fix broke vendor validation by @milosgajdos in #4839
chore(ci): Prep for v3.1 release by @milosgajdos in #4841

New Contributors

@switchboardOp made their first contribution in #4619
@closeobserve made their first contribution in #4622
@zhangyoufu made their first contribution in #4626
@anzoman made their first contribution in #4629
@onporat made their first contribution in #4624
@jcpunk made their first contribution in #4669
@shantanoo-desai made their first contribution in #4676
@binaryfire made their first contribution in #4666
@whosehang made their first contribution in #4632
@ChenQi1989 made their first contribution in #4642
@dpw13 made their first contribution in #4640
@horoshev made their first contribution in #4647
@gpgenaiz made their first contribution in #4684
@Klikini made their first contribution in #4688
@ChandonPierre made their first contribution in #4668
@artem-tkachuk made their first contribution in #4716
@Sumedhvats made their first contribution in #4720
@efcking made their first contribution in #4741
@dpedu made their first contribution in #4742
@nkaaf made their first contribution in #4708
@tranthang2404 made their first contribution in #4753
@tcuthbert made their first contribution in #4756
@1raghavmahajan made their first contribution in #4763
@cloudfleet-tech made their first contribution in #4765
@acallejaszu made their first contribution in #4730
@kub3let made their first contribution in #4771
@ningmingxiao made their first contribution in #4774
@joonas made their first contribution in #4805
@yiyun-sj made their first contribution in #4664
@Alexsandr-Random made their first contribution in #4534
@wutongjie23hao made their first contribution in #4610
@njucjc made their first contribution in #4360
@omartrigui made their first contribution in #4770
@mnixry made their first contribution in #4758

Full Changelog: distribution/distribution@v3.0.0...v3.1.0

`v3.0.0`

Compare Source

Welcome to the v3.0.0 release of registry!

This is the first v3 stable release since v2.8.3 which is a culmination of years of hard work of the container community and registry maintainers!

If you are upgrading from v2.x and have never used any of the release candidates, please familiarise yourselves with the v2.x deprecations properly.

Deprecations

oss and swift storage drivers are no longer supported
docker/libtrust has been replaced with go-jose/go-jose in #4096
client is no longer supported as a standalone package in #4126
the default configuration path has changed to /etc/distribution/config.yml
ManifestBuilder interface in 3886
manifest.Versioned has been deprecated in favor of oci.Versioned in 3887
reference package has been moved to github.com/distribution/reference in #4063

Changes since the last release candidate

Changes

7 commits

* [`2e63da99`](https://redirect.github.com/distribution/distribution/commit/2e63da99776be71a17be3f79f60e4c3f485b87e1) Fix golangci-lint config (#4612) * [`fd14cf19`](https://redirect.github.com/distribution/distribution/commit/fd14cf193339eb2300828363560884f4ccbadba3) Vrify the linter config first before running it * [`3a33ba12`](https://redirect.github.com/distribution/distribution/commit/3a33ba12ad9a436792c1e89a3732f8600940f6e6) Fix golangci-lint config * [`75f32197`](https://redirect.github.com/distribution/distribution/commit/75f32197b6f180518d17210195ae0d3eb3885ce5) Bump Azure deps (#4611) * [`52f0f6c4`](https://redirect.github.com/distribution/distribution/commit/52f0f6c45d5397ebff48778b7c5c8b1dec89e572) Bump Azure deps * [`ef21149b`](https://redirect.github.com/distribution/distribution/commit/ef21149b4999ac0be22fe292640491b55cac9d9b) build(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 in the go_modules group across 1 directory (#4608) * [`05b308bc`](https://redirect.github.com/distribution/distribution/commit/05b308bc42519068f6157747301f5e68ef01b9af) build(deps): bump github.com/golang-jwt/jwt/v5

Previous release can be found at v3.0.0-rc.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/distribution-distribution-3.x branch from e70a4fe to 56ef7f0 Compare April 6, 2026 17:57

chore(deps): update dependency distribution/distribution to v3

9764e67

renovate Bot force-pushed the renovate/distribution-distribution-3.x branch from 56ef7f0 to 9764e67 Compare May 1, 2026 18:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency distribution/distribution to v3#59

chore(deps): update dependency distribution/distribution to v3#59
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/distribution-distribution-3.x

renovate Bot commented Apr 2, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.1.1

Notable Changes

What's Changed

New Contributors

v3.1.0

Notable Changes

What's Changed

New Contributors

v3.0.0

Deprecations

Changes since the last release candidate

Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 2, 2025 •

edited

Loading

`v3.1.1`

`v3.1.0`

`v3.0.0`