fix(deps): update module github.com/google/go-containerregistry to v0.20.7

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/go-containerregistry	v0.4.0 -> v0.20.7

---

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

v0.20.7

Compare Source

What's Changed

• Fix ArgsEscaped lint directive by @​Subserial in #​2137
• transport: Fix broken links to distribution docs by @​guzalv in #​2136
• fix(remote): using customized retry predicate func if provided by @​derekhjray in #​2135
• Adding docker file by @​HassanJasim in #​2138
• crane: Add timestamp to flatten layer by @​Stephanie0829 in #​2117
• feat(remote): pass retryBackoff option to transport by @​aslafy-z in #​1628
• Expose clobber refusal error by @​pjbgf in #​2146
• Build artifacts for riscv64 by @​ffgan in #​2159
• Update dependencies and deprecate DockerVersion field by @​Subserial in #​2164

New Contributors

• @​guzalv made their first contribution in #​2136
• @​derekhjray made their first contribution in #​2135
• @​HassanJasim made their first contribution in #​2138
• @​Stephanie0829 made their first contribution in #​2117
• @​pjbgf made their first contribution in #​2146
• @​ffgan made their first contribution in #​2159

Full Changelog: google/go-containerregistry@v0.20.6...v0.20.7

v0.20.6

Compare Source

What's Changed

• Ensure that tag name is not empty if name contains colon by @​SaschaSchwarze0 in #​2094
• Bump some deps by @​jonjohnsonjr in #​2110

New Contributors

• @​SaschaSchwarze0 made their first contribution in #​2094

Full Changelog: google/go-containerregistry@v0.20.4...v0.20.6

v0.20.5

Compare Source

What's Changed

• build(deps): bump docker/docker to v28.0.0+incompatible by @​luhring in #​2071
• Migrate linter to v2 by @​Subserial in #​2096
• bump go version + bump deps by @​Subserial in #​2093
• implement TextMarshaler/JSONMarshaler more consistently by @​imjasonh in #​2097
• Update CodeQL permissions by @​Subserial in #​2103
• Update goreleaser permissions by @​Subserial in #​2104
• Update provenance action in release by @​Subserial in #​2105
• Update validator action by @​Subserial in #​2106

New Contributors

• @​luhring made their first contribution in #​2071
• @​Subserial made their first contribution in #​2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.5

v0.20.4: - Not usable as a go module

Compare Source

🚨 This release was published to the Go module proxy and then re-tagged with a different commit. This means it's not usable as a Go module (#​2107) -- please us v0.20.5 instead.

What's Changed

• build(deps): bump docker/docker to v28.0.0+incompatible by @​luhring in #​2071
• Migrate linter to v2 by @​Subserial in #​2096
• bump go version + bump deps by @​Subserial in #​2093
• implement TextMarshaler/JSONMarshaler more consistently by @​imjasonh in #​2097
• Update CodeQL permissions by @​Subserial in #​2103
• Update goreleaser permissions by @​Subserial in #​2104
• Update provenance action in release by @​Subserial in #​2105
• Update validator action by @​Subserial in #​2106

New Contributors

• @​luhring made their first contribution in #​2071
• @​Subserial made their first contribution in #​2096

Full Changelog: google/go-containerregistry@v0.20.3...v0.20.4

v0.20.3

Compare Source

What's Changed

• remote/transport: Make bearer transport go-routine-safe by @​2opremio in #​1806
• Expose compare package by @​jonjohnsonjr in #​2001
• fix: redact.URL uses (*URL).Redacted to omit basic-auth password by @​bmoylan in #​1947
• bump actions to latest by @​ajayk in #​2011
• don't pin chainguard-dev/actions by @​imjasonh in #​2025
• Check for 406 status code when handling referrers API endpoint response by @​malancas in #​2026
• mutate: Create a defensive annotations copy by @​jonjohnsonjr in #​2030
• Detect zstd in crane append by @​jonjohnsonjr in #​2023
• bump deps using hack/bump-deps.sh by @​imjasonh in #​2042

New Contributors

• @​bmoylan made their first contribution in #​1947
• @​ajayk made their first contribution in #​2011
• @​malancas made their first contribution in #​2026

Full Changelog: google/go-containerregistry@v0.20.2...v0.20.3

v0.20.2

Compare Source

What's Changed

• deps: bump docker dep by @​imjasonh in #​1991

Full Changelog: google/go-containerregistry@v0.20.1...v0.20.2

v0.20.1

Compare Source

What's Changed

• Create remote.Push by @​mattmoor in #​1978

Full Changelog: google/go-containerregistry@v0.20.0...v0.20.1

v0.20.0

Compare Source

What's Changed

• Referrer API must return correct Content-Type by @​GregoireW in #​1968
• 🚨 POTENTIALLY BREAKING: Restore blind-write to remote.Put by @​jonjohnsonjr in #​1970

New Contributors

• @​GregoireW made their first contribution in #​1968

Full Changelog: google/go-containerregistry@v0.19.2...v0.20.0

v0.19.2

Compare Source

What's Changed

• Add JSON marshalling funcs for Digest. by @​wlynch in #​1915
• registry: Implement Range requests for blobs by @​jonjohnsonjr in #​1917
• Support podman auth file REGISTRY_AUTH_FILE. by @​zhaoyonghe in #​1914
• feat: crane mutate platform by @​joshwlewis in #​1919
• Add Context support to auth methods by @​jonjohnsonjr in #​1949
• Fix windows race condition when writing image with duplicate layers by @​dgannon991 in #​1921
• Add -O shorthand for --omit-digest-tags to crane. by @​smoser in #​1958

New Contributors

• @​wlynch made their first contribution in #​1915
• @​zhaoyonghe made their first contribution in #​1914
• @​joshwlewis made their first contribution in #​1919
• @​dgannon991 made their first contribution in #​1921
• @​smoser made their first contribution in #​1958

Full Changelog: google/go-containerregistry@v0.19.1...v0.19.2

v0.19.1

Compare Source

What's Changed

• Bump golang.org/x/net from 0.10.0 to 0.17.0 in /pkg/authn/k8schain by @​dependabot in #​1815
• Bump golang.org/x/ packages by @​jonjohnsonjr in #​1892

Full Changelog: google/go-containerregistry@v0.19.0...v0.19.1

v0.19.0

Compare Source

What's Changed

• Work around docker v25 tarballs by @​jonjohnsonjr in #​1872

Full Changelog: google/go-containerregistry@v0.18.0...v0.19.0

v0.18.0

Compare Source

What's Changed

• fix: goreleaser config by @​caarlos0 in #​1764
• Always print pushed digest in crane push by @​aw185176 in #​1860

New Contributors

• @​caarlos0 made their first contribution in #​1764

Full Changelog: google/go-containerregistry@v0.17.0...v0.18.0

v0.17.0

Compare Source

What's Changed

• 🦅 Validate index architectures match children 🦅 by @​jonjohnsonjr in #​1776
• Set Content-Length for blob uploads by @​jonjohnsonjr in #​1781
• Don't wrap DefaultKeychain with refreshes by @​jonjohnsonjr in #​1791
• Build releases with Go 1.21 by @​imjasonh in #​1840
• fix: mimic oci-layout in diskblobhandler by @​thesayyn in #​1810
• tag: add command explanation to the long help by @​abitrolly in #​1843
• feat: implement gc command by @​thesayyn in #​1811
• feat: allow port and disk path to be overriden by @​thesayyn in #​1848

Full Changelog: google/go-containerregistry@v0.16.1...v0.17.0

v0.16.1

Compare Source

Release is broken due to goreleaser error, 0.16.1 has the fix

What's Changed

• bump deps using ./hack/bump-deps.sh by @​imjasonh in #​1702
• Allow crane to export schema 1 images by @​jonjohnsonjr in #​1704
• fixed a goroutine leak by @​ktarplee in #​1705
• retry HTTP 522 errors by default by @​imjasonh in #​1707
• Limit size of manifest by @​AdamKorcz in #​1711
• Add crane auth token by @​jonjohnsonjr in #​1709
• Bump codecov/codecov-action from 3.1.3 to 3.1.4 by @​dependabot in #​1710
• Pass scopes through crane auth token by @​jonjohnsonjr in #​1713
• fix: add bounds checking to addendum layer mutations to prevent panic by @​aaron-prindle in #​1715
• Surface better error messages in crane index by @​jonjohnsonjr in #​1722
• crane: add missing name option in crane index commands by @​HubertZhang in #​1723
• crane: Respect cmd.OutOrStdout by @​kyleconroy in #​1728
• Make ErrSchema1 checkable via errors.Is() by @​Laitr0n in #​1721
• Don't load into daemon if the image already exists by @​jonjohnsonjr in #​1724
• add --blobs-to-disk to 'crane registry serve' by @​imjasonh in #​1731
• Correct crane registry help text by @​jonjohnsonjr in #​1732
• Allow concurrent blob Sets, use RWMutex by @​mattmoor in #​1733
• Use RWLock, limit scope of locking, write digest first by @​mattmoor in #​1734
• Let the filesystem handle atomicity by @​mattmoor in #​1735
• Don't try cross-origin mounting against dockerhub by @​jonjohnsonjr in #​1743
• Drop localhost to support crane registry serve in a container by @​mattmoor in #​1746
• Return OCI Index content-type for referrers response by @​jdolitsky in #​1762

New Contributors

• @​AdamKorcz made their first contribution in #​1711
• @​HubertZhang made their first contribution in #​1723
• @​kyleconroy made their first contribution in #​1728
• @​Laitr0n made their first contribution in #​1721

Full Changelog: google/go-containerregistry@v0.15.2...v0.16.1

Container Images

https://gcr.io/go-containerregistry/crane:v0.16.1
https://gcr.io/go-containerregistry/gcrane:v0.16.1

For example:

docker pull gcr.io/go-containerregistry/crane:v0.16.1
docker pull gcr.io/go-containerregistry/gcrane:v0.16.1

v0.16.0

Compare Source

Release is broken due to goreleaser error, 0.16.1 has the fix

v0.15.2

Compare Source

What's Changed

• Make 403 non-fatal for manifest existence checks by @​jonjohnsonjr in #​1691
• Do not reuse pushers for pullers by @​jonjohnsonjr in #​1701

Full Changelog: google/go-containerregistry@v0.15.1...v0.15.2

v0.15.1

Compare Source

Changelog

• e2620e5 Actually retry retryable status codes (#​1618)
• afd15f1 Add --all-tags flag to crane cp (#​1682)
• 69d1a19 Add mutate --ports option to set the exposed ports (#​1677)
• 65e78dc Add partial.Manifests for lazy index access (#​1631)
• 3228a60 Add ppc64le to .goreleaser.yml (#​1680)
• 0b12f56 Add ppc64le to all binaries (#​1688)
• d958444 Add remote.Descriptor.Schema1() (#​1626)
• 07c767c Add remote.Puller (#​1644)
• 005bb71 Add remote.Reuse for Pusher/Puller (#​1672)
• 21ac1b2 Adding mutate --workdir option to set the working directory (#​1615)
• 0962e29 Allow remote config layers to be lazy fetched (#​1634)
• 53189d3 Bump actions/setup-go from 3 to 4 (#​1602)
• 54e3f49 Bump actions/stale from 7 to 8 (#​1616)
• 07eb440 Bump codecov/codecov-action from 3.1.1 to 3.1.2 (#​1650)
• 58bd35b Bump codecov/codecov-action from 3.1.2 to 3.1.3 (#​1668)
• e055961 Bump peter-evans/create-pull-request from 4 to 5 (#​1642)
• b8d1c0a Bump slsa-framework/slsa-verifier from 2.0.1 to 2.1.0 (#​1621)
• 375fb61 Bump slsa-framework/slsa-verifier from 2.1.0 to 2.2.0 (#​1649)
• 9aa45a1 Change return type of remote.Referrers (#​1652)
• 2ccd41c Cleanup: Switch the debug image to cgr.dev/chainguard/busybox (#​1638)
• 93be9c4 Don't export whiteouts for single layers (#​1629)
• b7c6e9d Fall back to puller if reusing pusher fails (#​1676)
• 370e8a5 Fix a few lint issues (#​1684)
• bc990d6 Fix fetching referrers error handling (#​1648)
• aee00b1 Fix race in mutate (#​1627)
• 4a79e94 Fix race in stream (#​1632)
• 6743ec9 Implement remote.Pusher (#​1633)
• 3120ba5 Keep order of env in crane mutate (#​1683)
• 6ac92e8 Refactor fetcher, writer, and progress (#​1625)
• 249d7e1 Refresh authn.DefaultKeychain creds every 5 min (#​1624)
• ad695c0 Replace deprecated command with environment file (#​1667)
• ed5c185 Retry net.ErrClosed (#​1637)
• 43710a9 Retry without mount if auth fails (#​1681)
• 2435320 Revert "Cleanup: Switch the debug image to cgr.dev/chainguard/busybox (#​1638)" (#​1641)
• 27a6ad6 Revert "authn: Add NewConfigKeychain to load a config from explicit path (#​1603)" (#​1664)
• a34235c Support Warning header aggregation and reporting in crane (#​1604)
• 01bbd53 Update release.yml (#​1601)
• df518f9 add crane auth logout (#​1589)
• 5438948 add registry.Repo("foo") (#​1671)
• 3706061 allow pkg/v1/random to accept a RNG source (#​1675)
• 1cb7e13 authn: Add NewConfigKeychain to load a config from explicit path (#​1603)
• 348cd86 bump deps using ./hack/bump-deps.sh (#​1659)
• 691004b bump deps using ./hack/bump-deps.sh (#​1685)
• df72a9a crane push: print pushed ref@​digest to stdout (#​1663)
• 0577676 crane: ignore buildx attestations in flatten (#​1630)
• 217318c deprecate estargz (#​1660)
• 9f68710 feat(daemon): generate config file from Docker Engine API (#​1130)
• 52d59d1 feat(remote): make retryStatusCodes configurable (#​1635)
• 6f96bba gcrane: Use page size of 10,000 for googley things (#​1645)
• 0f2db49 release: use ko 0.13.0 to build images (#​1607)
• d64f9e0 remove time from random.Image history (#​1678)
• 46488f7 retry HTTP 499 errors by default (#​1612)
• ace7be7 update GCR quotas (#​1619)
• d1c4e9f verify provenance (#​1611)

Container Images

https://gcr.io/go-containerregistry/crane:v0.15.1
https://gcr.io/go-containerregistry/gcrane:v0.15.1

For example:

docker pull gcr.io/go-containerregistry/crane:v0.15.1
docker pull gcr.io/go-containerregistry/gcrane:v0.15.1

v0.15.0

Compare Source

v0.14.0

Compare Source

Changelog

• 9306eba Allow crane edit to generate non-image artifacts (#​1545)
• de35f0f Allow setting Content-Type in crane edit manifest (#​1551)
• 4b081f8 Avoid v1.Manifest in crane edit config (#​1583)
• 1cfe1fc Bump aws-actions/configure-aws-credentials from 1.7.0 to 2.0.0 (#​1593)
• da1008f Bump golangci/golangci-lint-action from 3.3.1 to 3.4.0 (#​1548)
• 86be45f Bump goreleaser/goreleaser-action from 4.1.0 to 4.1.1 (#​1547)
• 62f183e Bump goreleaser/goreleaser-action from 4.1.1 to 4.2.0 (#​1556)
• 1b8dc2b Bump slsa-framework/slsa-github-generator from 1.2.2 to 1.5.0 (#​1580)
• 11843ba Enforce proper sha256 usage (#​1544)
• 2ceebaa Implement crane index subcommand (#​1561)
• 9f42e02 Set mediaType for empty.ImageIndex in RawManifest (#​1562)
• 759b19f Support artifactType, for images whose config.mediaType is not a config (#​1541)
• b3c23b4 Support for OCI 1.1+ referrers via API (#​1546)
• 061ee6b Support for OCI 1.1+ referrers via fallback tag (#​1543)
• 6770304 Update descriptor "data" field (when valid) during "crane edit config" (#​1584)
• 76bac93 Update release.yml (#​1540)
• eb7d746 authn: also read mount secrets (#​1560)
• e94d408 bump deps using ./hack/bump-deps.sh (#​1592)
• 4e95ae2 crane: add --flatten for index append (#​1566)
• ff810c1 crane: add serve subcommand (#​1586)
• 8ea5e0e crane: support --omit-digest-tags in crane ls (#​1528)
• 824efc7 fix(mutate): also set timestamps only present in some formats (#​1550)
• e04520b fix: Fix the crane release url and add more steps (#​1532)
• d872232 hash: use generic instantiation (#​1538)
• 57f010d replace manual slsa-verifier installation with action (#​1585)
• 9cd098e skip tls verification if default transport is used with insecure option (#​1559)
• 3624968 tarball: pass imageToTags (#​1563)

Container Images

https://gcr.io/go-containerregistry/crane:v0.14.0
https://gcr.io/go-containerregistry/gcrane:v0.14.0

For example:

docker pull gcr.io/go-containerregistry/crane:v0.14.0
docker pull gcr.io/go-containerregistry/gcrane:v0.14.0

v0.13.0

Compare Source

What's Changed

• Bump slsa-framework/slsa-github-generator to 1.2.2 by @​jonjohnsonjr in #​1489
• Features: Allow eliding serviceaccount lookups. by @​mattmoor in #​1490
• Bump golangci/golangci-lint-action from 3.3.0 to 3.3.1 by @​dependabot in #​1491
• add source archive checksum into the checksums.txt by @​developer-guy in #​1492
• Fix calculating tarball size when duplicated layers exist by @​tydra-wang in #​1495
• Add support for zstd compression by @​LFrobeen in #​1487
• docs: pull latest instead of debug by @​AndrewCharlesHay in #​1497
• Make credential warning slightly more accurate by @​jonjohnsonjr in #​1499
• Make unit tests substantially faster by @​jonjohnsonjr in #​1498
• Use the default retry predicate in transport by @​jonjohnsonjr in #​1502
• Revert "docs: pull latest instead of debug (#​1497)" by @​jonjohnsonjr in #​1504
• Update Arch Linux install instructions by @​kpcyrd in #​1508
• Fix various lints by @​jonjohnsonjr in #​1507
• Fix missing doc comment by @​jonjohnsonjr in #​1509
• Treat empty registry config as anonymous by @​lcarva in #​1512
• Bump goreleaser/goreleaser-action from 3.2.0 to 4.1.0 by @​dependabot in #​1511
• Bump actions/stale from 6 to 7 by @​dependabot in #​1519
• Race http fallback ping by @​jonjohnsonjr in #​1521
• FIX mutate.Time not respecting history by @​miguelvalerio in #​1520
• test: use T.TempDir to create temporary test directory by @​Juneezee in #​1522
• crane: add digest --full by @​imjasonh in #​1524
• Hack around DockerHub plugin scope handling by @​jonjohnsonjr in #​1527
• crane: support --full-ref for crane ls by @​imjasonh in #​1525
• Revert plugin scope hack by @​jonjohnsonjr in #​1531
• clarify crane download readme by @​dtanner in #​1533

New Contributors

• @​LFrobeen made their first contribution in #​1487
• @​AndrewCharlesHay made their first contribution in #​1497
• @​kpcyrd made their first contribution in #​1508
• @​miguelvalerio made their first contribution in #​1520
• @​Juneezee made their first contribution in #​1522
• @​dtanner made their first contribution in #​1533

Full Changelog: google/go-containerregistry@v0.12.1...v0.13.0

v0.12.1

Compare Source

Changelog

• 426de7d Bump golangci/golangci-lint-action from 3.2.0 to 3.3.0 (#​1475)
• 6442b02 Bump goreleaser/goreleaser-action from 3.1.0 to 3.2.0 (#​1476)
• 76ae819 Fix context.DeadlineExceeded comparison (#​1488)
• 1711cef Fix missing body.Close() in bearer auth (#​1482)
• 02f47e1 bump version of slsa generator (#​1468)
• 353a117 crane: add catalog argument use annotation (#​1473)
• a0cca8a k8schain: Log and proceed if secret or SA are not found (#​1472)

Container Images

https://gcr.io/go-containerregistry/crane:v0.12.1
https://gcr.io/go-containerregistry/gcrane:v0.12.1

For example:

docker pull gcr.io/go-containerregistry/crane:v0.12.1
docker pull gcr.io/go-containerregistry/gcrane:v0.12.1

v0.12.0

Compare Source

Changelog

• 9b4fdd5 Bump actions/setup-go from 2 to 3 (#​1463)
• 7268da0 Bump actions/stale from 5 to 6 (#​1452)
• 7196cf3 Bump aws-actions/configure-aws-credentials from 1.6.1 to 1.7.0 (#​1424)
• 8eae069 Bump codecov/codecov-action from 3.1.0 to 3.1.1 (#​1453)
• 969699e Bump deps using ./hack/bump-deps.sh (#​1467)
• c1f9836 Bump opencontainers/image-spec (#​1423)
• 49cdb8b Correct usage of authn.NewKeychainFromHelper in docs (#​1419)
• 3ba4c51 Fix tar PAX format handling (#​1414)
• 24a1c33 Ignore docker config if it's a directory (#​1420)
• a0f6687 Make ErrBadName checkable via errors.Is() (#​1462)
• 19e3eff Retry ECONNRESET errors (#​1415)
• 5749ee6 Support the platform specific authentication of krane in "auth get" command (#​1413)
• e3b94c7 allow remote.DefaultTransport to be overridden by an http.RoundTripper (#​1449)
• f981b4c deps: update goreleaser-action for bug (#​1444)
• [771a9b4](https://redirect.github.com/google/go-containerregistry/commit/771a

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.16 -> 1.24.0
cloud.google.com/go	v0.57.0 -> v0.112.1
github.com/golang/protobuf	v1.4.1 -> v1.5.4
github.com/googleapis/gax-go/v2	v2.0.5 -> v2.12.2
google.golang.org/genproto	v0.0.0-20200527145253-8367513e4ece -> v0.0.0-20240213162025-012b6fc9bca9