chore(deps): Bump github.com/google/go-containerregistry from 0.20.2 to 0.21.5 (#9)

Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry)
from 0.20.2 to 0.21.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0 by <a
href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2254">google/go-containerregistry#2254</a></li>
<li>update to Go 1.26.2 by <a
href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2255">google/go-containerregistry#2255</a></li>
<li>Bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in
the actions group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2257">google/go-containerregistry#2257</a></li>
<li>build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the
go-deps group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2260">google/go-containerregistry#2260</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.4...v0.21.5">https://github.com/google/go-containerregistry/compare/v0.21.4...v0.21.5</a></p>
<h2>v0.21.4</h2>
<h2>What's Changed</h2>
<ul>
<li>go.mod: do not make a viral minimum go version by <a
href="https://github.com/howardjohn"><code>@​howardjohn</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2237">google/go-containerregistry#2237</a></li>
<li>Avoid pruning absolute links from extracted and flattened images by
<a href="https://github.com/Subserial"><code>@​Subserial</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2241">google/go-containerregistry#2241</a></li>
<li>Bump the go-deps group across 3 directories with 5 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2245">google/go-containerregistry#2245</a></li>
<li>fix: update to go1.25.8, and use separate .go-version file by <a
href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2246">google/go-containerregistry#2246</a></li>
<li>Bump CI go version to 1.26.1 by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2242">google/go-containerregistry#2242</a></li>
<li>Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2240">google/go-containerregistry#2240</a></li>
<li>fork distribution client v3 auth-challenge as an internal package
(squashed) by <a
href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2248">google/go-containerregistry#2248</a></li>
<li>transport: validate Bearer realm URL to prevent SSRF by <a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2243">google/go-containerregistry#2243</a></li>
<li>revert path traversal and symlink escape from <a
href="https://redirect.github.com/google/go-containerregistry/issues/2227">#2227</a>
by <a href="https://github.com/Subserial"><code>@​Subserial</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2250">google/go-containerregistry#2250</a></li>
<li>Fix pkg/v1/google/auth tests for arm64 by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2085">google/go-containerregistry#2085</a></li>
<li>goreleaser: Update goreleaser config and GH action by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2253">google/go-containerregistry#2253</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2243">google/go-containerregistry#2243</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.3...v0.21.4">https://github.com/google/go-containerregistry/compare/v0.21.3...v0.21.4</a></p>
<h2>v0.21.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Adds local file support to the <code>crane index</code> subcommand
by <a
href="https://github.com/edwardthiele"><code>@​edwardthiele</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2223">google/go-containerregistry#2223</a></li>
<li>migrate to github.com/moby/moby modules by <a
href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2228">google/go-containerregistry#2228</a></li>
<li>Bump the go-deps group across 4 directories with 7 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2233">google/go-containerregistry#2233</a></li>
<li>Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2220">google/go-containerregistry#2220</a></li>
<li>mutate: reject path traversal and symlink escape in Extract by <a
href="https://github.com/KevinZhao"><code>@​KevinZhao</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2227">google/go-containerregistry#2227</a></li>
<li>tarball: detect symlink cycles in extractFileFromTar by <a
href="https://github.com/vnykmshr"><code>@​vnykmshr</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2232">google/go-containerregistry#2232</a></li>
<li>bump golang to 1.25.7 by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2236">google/go-containerregistry#2236</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/edwardthiele"><code>@​edwardthiele</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2223">google/go-containerregistry#2223</a></li>
<li><a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2228">google/go-containerregistry#2228</a></li>
<li><a href="https://github.com/KevinZhao"><code>@​KevinZhao</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2227">google/go-containerregistry#2227</a></li>
<li><a href="https://github.com/vnykmshr"><code>@​vnykmshr</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2232">google/go-containerregistry#2232</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.2...v0.21.3">https://github.com/google/go-containerregistry/compare/v0.21.2...v0.21.3</a></p>
<h2>v0.21.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Better handle redirects to https in ping by <a
href="https://github.com/jonjohnsonjr"><code>@​jonjohnsonjr</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2225">google/go-containerregistry#2225</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/google/go-containerregistry/commit/5b80281da727dae218e1697ab8529b631b9efa64"><code>5b80281</code></a>
build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the
go-deps gro...</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/b99bca24a8df1bd88afc1d299d4c0ebba0555cf8"><code>b99bca2</code></a>
build(deps): bump aws-actions/configure-aws-credentials (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2257">#2257</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/f8be1d442e6fc85c791e4aa50155aa8806ca8312"><code>f8be1d4</code></a>
update to Go 1.26.2 (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2255">#2255</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/87ad88b4a000e418add5c1bb4ae1da908cbc3b85"><code>87ad88b</code></a>
Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0 (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2254">#2254</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/e8813dd0a00e799459cae01d8a4659b9be2fd871"><code>e8813dd</code></a>
goreleaser: Update goreleaser config and GH action for releases (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2253">#2253</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/e90447d319233b94dcdc75a24246ccbee6d1e72a"><code>e90447d</code></a>
replace gcloud in binary calls in pkg/v1/google tests (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2085">#2085</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/0d0368c2a5fa524c4765a6c0b7df4ff6d6951471"><code>0d0368c</code></a>
revert path traversal and symlink escape changes (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2250">#2250</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/a2f47d4202de443f68e8bafa95ddd41407327168"><code>a2f47d4</code></a>
transport: validate Bearer realm URL to prevent SSRF (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2243">#2243</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/19a36cd8c44dd465a84f9d6ffea3009023f73660"><code>19a36cd</code></a>
fork distribution client v3 auth-challenge as an internal package
(squashed) ...</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/c612a9b20a4c533454b7fa8b39a8c8139065f0b1"><code>c612a9b</code></a>
Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2240">#2240</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.20.2...v0.21.5">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

go.mod

@@ -5,7 +5,7 @@ go 1.26
 require (
 	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/gobwas/glob v0.2.3
-	github.com/google/go-containerregistry v0.20.2
+	github.com/google/go-containerregistry v0.21.5
 	github.com/onsi/ginkgo/v2 v2.17.1
 	github.com/onsi/gomega v1.32.0
 	github.com/prometheus/client_golang v1.16.0
@@ -24,17 +24,16 @@ require (
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/cli v27.1.1+incompatible // indirect
-	github.com/docker/distribution v2.8.2+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.7.0 // indirect
+	github.com/docker/cli v29.4.0+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
-	github.com/felixge/httpsnoop v1.0.3 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
@@ -46,60 +45,61 @@ require (
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/cel-go v0.17.8 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
-	github.com/google/uuid v1.3.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
 	github.com/imdario/mergo v0.3.6 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.16.5 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.4.0 // indirect
 	github.com/prometheus/common v0.44.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
-	github.com/sirupsen/logrus v1.9.1 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/stoewer/go-strcase v1.2.0 // indirect
-	github.com/vbatts/tar-split v0.11.3 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0 // indirect
-	go.opentelemetry.io/otel v1.19.0 // indirect
+	github.com/vbatts/tar-split v0.12.2 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.36.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.19.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.19.0 // indirect
-	go.opentelemetry.io/otel/trace v1.19.0 // indirect
+	go.opentelemetry.io/otel/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
+	go.opentelemetry.io/otel/trace v1.36.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
 	golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
-	golang.org/x/net v0.23.0 // indirect
-	golang.org/x/oauth2 v0.12.0 // indirect
-	golang.org/x/sync v0.6.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	golang.org/x/term v0.18.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/term v0.42.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.18.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
 	google.golang.org/grpc v1.58.3 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gotest.tools/v3 v3.5.2 // indirect
 	k8s.io/apiserver v0.30.1 // indirect
 	k8s.io/component-base v0.30.1 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect