release

Author: mzihlmann

CHANGELOG.md

@@ -0,0 +1,40 @@
+# v0.8.0 Release 2026-08-13
+
+## Community Update
+Many thanks to @chrismellard for maintaining [`docker-credential-acr-env`](https://github.com/chrismellard/docker-credential-acr-env) over all those years. We are happy to continue his work and will honour his contributions. This helper is used inside the [kaniko](https://github.com/osscontainertools/kaniko) executor image, so it is maintained along with it.
+
+## What's Changed
+### Security
+* the ACR host pattern was unanchored, so any hostname that contained `azurecr.io` was treated as ACR and handed an Azure access token: https://github.com/osscontainertools/docker-credential-acr/commit/5ce8219311b6db99855036fbf27bedd35f38d250
+* golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa: CVE-2023-48795 CVE-2024-45337 CVE-2025-22869 CVE-2025-47913 CVE-2025-47914 CVE-2025-58181 CVE-2026-39827 CVE-2026-39828 CVE-2026-39829 CVE-2026-39830 CVE-2026-39831 CVE-2026-39832 CVE-2026-39833 CVE-2026-39834 CVE-2026-39835 CVE-2026-42508 CVE-2026-46595 CVE-2026-46597 CVE-2026-46598
+* golang.org/x/text v0.3.6: CVE-2021-38561 CVE-2022-32149 CVE-2026-56852
+* golang.org/x/sys v0.0.0-20220325203850-36772127a21f: CVE-2022-29526 CVE-2026-39824
+* github.com/golang-jwt/jwt/v4 v4.2.0: CVE-2024-51744 CVE-2025-30204
+* the toolchain is pinned to go1.26.5, so released binaries carry a current standard library
+
+### Usability
+* Add `--version`: https://github.com/osscontainertools/docker-credential-acr/commit/93ea027980dd6b785b6217dae866a09c9a99bdc5
+
+### Maintenance
+* bump go from 1.18 to 1.26
+* bump github.com/Azure/azure-sdk-for-go from v46.4.0 to v68.0.0
+* bump github.com/Azure/go-autorest/autorest from v0.11.28 to v0.11.30
+* bump github.com/Azure/go-autorest/autorest/adal from v0.9.21 to v0.9.24
+* bump github.com/Azure/go-autorest/autorest/azure/auth from v0.5.11 to v0.5.13
+* bump github.com/docker/docker-credential-helpers from v0.6.3 to v0.9.8
+* bump github.com/golang-jwt/jwt/v4 from v4.2.0 to v4.5.2
+* bump github.com/spf13/cobra from v1.2.0 to v1.10.2
+* bump github.com/google/go-containerregistry to v0.21.9
+
+### Fork Related
+* Rename the module and the binary to `docker-credential-acr`: https://github.com/osscontainertools/docker-credential-acr/commit/5164fb52536071cafb629a7487899291807ad46e
+* Add integration tests against a live ACR, covering the federated and the managed identity route: https://github.com/osscontainertools/docker-credential-acr/commit/5cf9c6fafd9265d7dd5b15379b3f04eaf1003b6d https://github.com/osscontainertools/docker-credential-acr/commit/dc685b2c672eedef7f7053fbd4e4443e6fc6a1ad
+* Drop viper and the config file parsers it pulled in: https://github.com/osscontainertools/docker-credential-acr/commit/7f1ea5845809990e0af6ac06ccbbce57f7146224
+* Vendor the dependencies: https://github.com/osscontainertools/docker-credential-acr/commit/ca08f865237ebf2764e6863bab0c35d4c5f7082d
+* Harden the CI, add a nightly vulnerability scan, publish releases as drafts: https://github.com/osscontainertools/docker-credential-acr/commit/c2658c8e1c343423c8297a31b93fba5ff1f0d9d7 https://github.com/osscontainertools/docker-credential-acr/commit/a515e18141395948516b6b44e21df4bac20c332a
+* Add a security policy: https://github.com/osscontainertools/docker-credential-acr/commit/37f465e7c17e225295616886499ec8dd4e1f8413
+* Clean up the repo tooling: https://github.com/osscontainertools/docker-credential-acr/commit/40029769205903b13b6de20e6af1e1ed34b6a05f https://github.com/osscontainertools/docker-credential-acr/commit/f3bd06692ddc84f8c45759b0f4d67ed0040032ea
+
+### Refactorings
+* adal: NewServicePrincipalTokenFromFederatedToken is deprecated: https://github.com/osscontainertools/docker-credential-acr/commit/698a07d4ad4309f7b16af88a148eef05435ecbfd
+* Linter pass: https://github.com/osscontainertools/docker-credential-acr/commit/236ca560acc5e0d24376c35477fd18aa8fe07cc1

go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.13
 	github.com/docker/docker-credential-helpers v0.9.8
 	github.com/golang-jwt/jwt/v4 v4.5.2
-	github.com/google/go-containerregistry v0.21.8
+	github.com/google/go-containerregistry v0.21.9
 	github.com/spf13/cobra v1.10.2
 )
 

go.sum

@@ -43,8 +43,8 @@ github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXe
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.21.8 h1:Ig/zIsnztdCUNaiNNczE+MoP5xcyUMfvpvfOr1xyMLE=
-github.com/google/go-containerregistry v0.21.8/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo=
+github.com/google/go-containerregistry v0.21.9 h1:F+D4uZ3iA3DLMJLfhaqMdHJbzeqm/216WGQq2dokuLs=
+github.com/google/go-containerregistry v0.21.9/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=

vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.go

@@ -44,7 +44,7 @@ github.com/docker/docker-credential-helpers/credentials
 # github.com/golang-jwt/jwt/v4 v4.5.2
 ## explicit; go 1.16
 github.com/golang-jwt/jwt/v4
-# github.com/google/go-containerregistry v0.21.8
+# github.com/google/go-containerregistry v0.21.9
 ## explicit; go 1.25.0
 github.com/google/go-containerregistry/internal/and
 github.com/google/go-containerregistry/internal/compression