chore(deps): update registry docker tag to v3 by renovate[bot] · Pull Request #127 · hops-ops/hops-cli

renovate · 2026-09-21T20:24:58Z

This PR contains the following updates:

Package	Update	Change
registry (source)	major	`2.8.3` → `3.1.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

distribution/distribution (registry)

`v3.1.2`

Compare Source

Welcome to the v3.1.2 release of registry!

This is a stable release

This patch release includes security fixes, storage and pagination fixes, and dependency updates.

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

Notable Changes

Verify manifest and blob content against the requested digest in the registry client, protecting digest-pinned requests and pull-through caches (CVE-2026-85747 / GHSA-685w-q87j-wqw3).
Update security-sensitive dependencies, including gRPC, OpenTelemetry, and golang.org/x/crypto (#4912, #4963, #4965, #4968). The OTLP gRPC log exporter now honors TLS certificates configured through environment variables.
Fix S3 tag pagination and catalog listing when one name is a prefix of another (#4898, #4904), and return an empty tag array after the final pagination marker (#4931).
Fix Azure blob type migration and a concurrent append-write race (#4871, #4888).
Check the storage backend directly when writing blobs to avoid stale descriptor-cache entries (#4868).
Reject malformed manifest digests and out-of-order final upload chunks correctly (#4945), accept unknown total sizes in Content-Range (#4892), and preserve upstream error codes (#4917).
Stop the upload purger during registry shutdown (#4956).
Validate S3 redirect endpoints at driver initialization (#4870).
Remove the logrus-logstash-hook dependency while retaining the logstash formatter option (#4970).

Build Updates

Building from source now requires Go 1.26 or newer (#4961).
Container images now use Alpine Linux 3.24 (#4966).

See the changelog below for the full list of changes.

What's Changed

build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #4861
build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @dependabot[bot] in #4859
build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in #4865
build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in #4867
chore: smol go fix changes by @milosgajdos in #4876
build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #4877
build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 by @dependabot[bot] in #4874
build(deps): bump docker/bake-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #4879
fix(storage): Fix blob type migration in the azure driver by @DMarby in #4871
fix: report error in DeleteManifest when Delete returns ErrDigestUnsupported by @joonas in #4802
feat(s3): parse and strictly validate redirectendpoint on driver initialization by @DARSHANR007 in #4870
azure: fix race condition in PutContent causing duplicate append writes by @Fricounet in #4888
fix(s3): tags/list drops tags that are a lexical prefix of another tag by @milosgajdos in #4898
fix contentRangeRegexp to accept unknown total size by @alhudz in #4892
fix: check backend directly in blobStore.Put to avoid stale cache by @chenhuiluo in #4868
fix(security): fix CVE-2026-46595 by bumping golang.org/x/crypto by @milosgajdos in #4912
docs: document catalog.maxentries configuration by @tokuhirom in #4911
build(deps): bump actions/labeler from 6.0.1 to 6.1.0 by @dependabot[bot] in #4866
build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 by @dependabot[bot] in #4881
build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 by @dependabot[bot] in #4882
build(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #4880
pass thru upstream error code by @darshanime in #4917
fix(storage): don't drop catalog repos that prefix another name by @mrnicegyu11 in #4904
build(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in #4922
fix(tags): return empty array after final pagination marker by @joonas in #4931
docs: fix CloudFront Origin Path guidance for S3 driver by @VedantMadane in #4936
chore(deps): github.com/docker/go-metrics v0.1.0 by @thaJeztah in #4941
chore: update testify, logrus, and migrate to go.yaml.in/yaml/v2 by @thaJeztah in #4940
test: use ephemeral ports for registry listen tests by @locker95 in #4929
Fix 500s from malformed manifest digests and out-of-order final chunk PUTs by @tianon in #4945
fix(ci): fix broken minio image by @milosgajdos in #4960
fix(s3): use path.Dir instead of filepath.Dir in directoryDiff by @pujitha24 in #4950
docs: fix 'allows to rewrite' grammar in rewrite storage middleware by @mrchatam in #4955
chore(build): Bump Go version to latest 1.26 by @milosgajdos in #4961
fix(handlers): cancel context on Shutdown to stop upload purger goroutine by @Tyagiquamar in #4956
fix(deps): bump grpc dep to fix sec vuln by @milosgajdos in #4963
docs: explain Redis Sentinel configuration by @git-jxj in #4964
fix(deps): update deps to fix security vulns by @milosgajdos in #4965
chore(ci): bump alpine image version by @milosgajdos in #4966
chore(deps): bump oltp version by @milosgajdos in #4968
build(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in #4915
chore(docs): fix build status badge by @milosgajdos in #4969
registry: remove logrus-logstash-hook dependency by @thaJeztah in #4970
ci: dependabot: group CodeQL and Docker action updates by @thaJeztah in #4975
build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 by @dependabot[bot] in #4979
build(deps): bump the codeql-actions group with 4 updates by @dependabot[bot] in #4977
build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 by @dependabot[bot] in #4982
build(deps): bump the docker-actions group across 1 directory with 3 updates by @dependabot[bot] in #4978
chore(release): prepare for v3.1.2 release by @milosgajdos in #4981

New Contributors

@DMarby made their first contribution in #4871
@DARSHANR007 made their first contribution in #4870
@Fricounet made their first contribution in #4888
@alhudz made their first contribution in #4892
@chenhuiluo made their first contribution in #4868
@tokuhirom made their first contribution in #4911
@darshanime made their first contribution in #4917
@mrnicegyu11 made their first contribution in #4904
@VedantMadane made their first contribution in #4936
@locker95 made their first contribution in #4929
@pujitha24 made their first contribution in #4950
@mrchatam made their first contribution in #4955
@Tyagiquamar made their first contribution in #4956
@git-jxj made their first contribution in #4964

Full Changelog: distribution/distribution@v3.1.1...v3.1.2

`v3.1.1`

Compare Source

Welcome to the v3.1.1 release of registry!

This is a stable release

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

Notable Changes

Fixes CVE-2026-41888
Bounds-check the file basename in PurgeUploads Walk callback
Add S3 Express One Zone support to the S3 storage driver (#4858)
Fix tag list endpoint in proxy mode (#4846)
Clamp oversized n query parameter in proxy mode instead of returning 400 (#4856)

See the full changelog below for the full list of changes.

What's Changed

internal/client/auth/challenge: cleanups and minor refactor by @thaJeztah in #4832
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory by @dependabot[bot] in #4843
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory by @dependabot[bot] in #4850
build(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in #4840
chore(build): Bump go version to latest by @milosgajdos in #4851
refactor: use slices.Backward to simplify the code by @chuanshanjida in #4848
fix(proxy): fix tag list endpoint in proxy mode by @njucjc in #4846
Update docker-compose structure in deploying.md by @jdg71nl in #4855
build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #4854
build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 by @dependabot[bot] in #4852
build(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #4847
build(deps): bump docker/bake-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #4853
fix(proxy): clamp oversized n query param instead of returning 400 by @milosgajdos in #4856
feat(s3): add express zone one support to S3 driver by @milosgajdos in #4858
fix(storage): bounds-check the file basename in PurgeUploads Walk callback by @SAY-5 in #4860
chore(release): prepare for v3.1.1 release by @milosgajdos in #4864

New Contributors

@chuanshanjida made their first contribution in #4848
@jdg71nl made their first contribution in #4855
@SAY-5 made their first contribution in #4860

Full Changelog: distribution/distribution@v3.1.0...v3.1.1

`v3.1.0`

Compare Source

Welcome to the v3.1.0 release of registry!

This is a stable release

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

Notable Changes

Fixes CVE-2026-35172
Fixes CVE-2026-33540
Adds support for tag pagination (#4360, #4353)
Fixes default credentials in Azure storage provider (#4619)
Drops support for go1.23 and go1.24 and updates to go1.25

See the full changelog below for the full list of changes.

What's Changed

docs: Update to refer to new image tag v3 by @schanzel in #4373
Fix default_credentials in azure storage provider by @switchboardOp in #4619
chore: make function comment match function name by @closeobserve in #4622
build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory by @dependabot[bot] in #4625
fix: implement JWK thumbprint for Ed25519 public keys by @zhangyoufu in #4626
fix: Annotate code block from validation.indexes configuration docs by @anzoman in #4629
feat: extract redis config to separate struct by @shanduur in #4620
Fix: resolve issue #4478 by using a temporary file for non-append writes by @onporat in #4624
build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in #4645
docs: Add note about OTEL_TRACES_EXPORTER by @jcpunk in #4669
fix: set OTEL traces to disabled by default by @jcpunk in #4671
Fix markdown syntax for OTEL traces link in docs by @shantanoo-desai in #4676
Switch UUIDs to UUIDv7 by @binaryfire in #4666
refactor: replace map iteration with maps.Copy/Clone by @whosehang in #4632
s3-aws: fix build for 386 by @ChenQi1989 in #4642
docs: Add OpenTelemetry links to quickstart docs (#4270) by @dpw13 in #4640
Fix S3 driver loglevel param by @milosgajdos in #4617
Fixed data race in TestSchedule test by @horoshev in #4647
Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys by @gpgenaiz in #4684
build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #4687
Fix broken link to Docker Hub fair use policy by @Klikini in #4688
fix(registry/handlers/app): redis CAs by @ChandonPierre in #4668
build(deps): bump actions/labeler from 5 to 6 by @dependabot[bot] in #4694
build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #4693
build(deps): bump actions/upload-pages-artifact from 3 to 4 by @dependabot[bot] in #4691
build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #4706
build(deps): bump github/codeql-action from 3.26.5 to 4.30.7 by @dependabot[bot] in #4710
build(deps): bump github/codeql-action from 4.30.7 to 4.30.8 by @dependabot[bot] in #4714
chore: labeler: add area/client mapping for internal/client/** by @artem-tkachuk in #4716
client: add Accept headers to Exists() HEAD by @artem-tkachuk in #4715
feat(registry): Make graceful shutdown test robust by @Sumedhvats in #4720
fix(registry): Correct log formatting for upstream challenge by @Sumedhvats in #4721
build(deps): bump github/codeql-action from 4.30.8 to 4.30.9 by @dependabot[bot] in #4722
build(deps): bump github/codeql-action from 4.30.9 to 4.31.3 by @dependabot[bot] in #4735
refactor: remove redundant variable declarations in for loops by @efcking in #4741
"should" -> "must" regarding redis eviction policy by @dpedu in #4742
build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #4744
Incorrect warning hint by @nkaaf in #4708
Add return error when list object by @tranthang2404 in #4753
build(deps): bump actions/checkout from 5.0.1 to 6.0.0 by @dependabot[bot] in #4745
build(deps): bump peter-evans/dockerhub-description from 4 to 5 by @dependabot[bot] in #4707
fix: Logging regression for manifest HEAD requests by @tcuthbert in #4756
Add boolean parsing util by @1raghavmahajan in #4763
Expose useFIPSEndpoint for S3 by @1raghavmahajan in #4764
Add Cloudfleet Container Registry to adopters by @cloudfleet-tech in #4765
fix(ci): Fix broken Azure e2e storage tests by @milosgajdos in #4767
BUG: Fix notification filtering to work with actions when mediatypes is empty by @acallejaszu in #4730
build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #4761
build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0 by @dependabot[bot] in #4760
build(deps): bump github/codeql-action from 4.31.3 to 4.31.10 by @dependabot[bot] in #4766
build(deps): bump github/codeql-action from 4.31.10 to 4.32.2 by @dependabot[bot] in #4778
build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #4768
update golangci-lint to v2.9 and fix linting issues by @thaJeztah in #4780
update to go1.25.7, alpine 3.23, xx v1.9.0 by @thaJeztah in #4781
vendor: github.com/sirupsen/logrus v1.9.4 by @thaJeztah in #4783
vendor: update golang.org/x/* dependencies by @thaJeztah in #4782
vendor: github.com/docker/docker-credential-helpers v0.9.5 by @thaJeztah in #4785
vendor: github.com/opencontainers/image-spec v1.1.1 by @thaJeztah in #4786
vendor: github.com/klauspost/compress v1.18.4 by @thaJeztah in #4787
fix: prefer otel variables over hard coded service name by @kub3let in #4771
vendor: github.com/spf13/cobra v1.10.2 by @thaJeztah in #4789
vendor: github.com/bshuster-repo/logrus-logstash-hook v1.1.0 by @thaJeztah in #4788
fix: sync parent dir to ensure data is reliably stored by @ningmingxiao in #4774
modernize code by @thaJeztah in #4784
vendor: github.com/docker/go-events 6053543 by @thaJeztah in #4791
vendor: github.com/go-jose/go-jose/v4 v4.1.3 by @thaJeztah in #4790
build(deps): bump github/codeql-action from 4.32.2 to 4.32.5 by @dependabot[bot] in #4806
build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #4807
build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #4800
build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #4811
build(deps): bump docker/bake-action from 6 to 7 by @dependabot[bot] in #4809
build(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #4810
fix: nil-check scheduler in proxyingRegistry.Close() by @joonas in #4805
fix: set MD5 on GCS writer before first Write call in putContent by @joonas in #4803
docs: pull through cache will pull from remote multiple times by @yiyun-sj in #4664
Update s3.md regionendpoint option by @Alexsandr-Random in #4534
chore(deps): Bump Go to latest 1.25 in CI workflows and go.mod by @milosgajdos in #4819
fix: correct Ed25519 JWK thumbprint kty from "OTP" to "OKP" by @joonas in #4801
Update vacuum.go by @wutongjie23hao in #4610
Opt: refector tag list pagination support (stage 1) by @njucjc in #4360
Correctly match environment variables to YAML-inlined structs in configuration by @evanebb in #4639
Enable Redis TLS without client certificates by @omartrigui in #4770
build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #4826
build(deps): bump github/codeql-action from 4.32.5 to 4.34.1 by @dependabot[bot] in #4823
fix(registry/proxy): use detached context when flushing write buffer by @ChandonPierre in #4793
ci: pin actions and apply zizmor auto-fixes by @thaJeztah in #4831
build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #4833
build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in the go_modules group across 1 directory by @dependabot[bot] in #4837
chore(app): warn when partial TLS config is used in Redis by @milosgajdos in #4838
feat(registry): enhance authentication checks in htpasswd implementation by @mnixry in #4758
Opt: refactor tag list pagination support by @njucjc in #4353
build(deps): bump codecov/codecov-action from 5.5.4 to 6.0.0 by @dependabot[bot] in #4836
build(deps): bump actions/configure-pages from 5.0.0 to 6.0.0 by @dependabot[bot] in #4834
fix(vendor): fix broke vendor validation by @milosgajdos in #4839
chore(ci): Prep for v3.1 release by @milosgajdos in #4841

New Contributors

@switchboardOp made their first contribution in #4619
@closeobserve made their first contribution in #4622
@zhangyoufu made their first contribution in #4626
@anzoman made their first contribution in #4629
@onporat made their first contribution in #4624
@jcpunk made their first contribution in #4669
@shantanoo-desai made their first contribution in #4676
@binaryfire made their first contribution in #4666
@whosehang made their first contribution in #4632
@ChenQi1989 made their first contribution in #4642
@dpw13 made their first contribution in #4640
@horoshev made their first contribution in #4647
@gpgenaiz made their first contribution in #4684
@Klikini made their first contribution in #4688
@ChandonPierre made their first contribution in #4668
@artem-tkachuk made their first contribution in #4716
@Sumedhvats made their first contribution in #4720
@efcking made their first contribution in #4741
@dpedu made their first contribution in #4742
@nkaaf made their first contribution in #4708
@tranthang2404 made their first contribution in #4753
@tcuthbert made their first contribution in #4756
@1raghavmahajan made their first contribution in #4763
@cloudfleet-tech made their first contribution in #4765
@acallejaszu made their first contribution in #4730
@kub3let made their first contribution in #4771
@ningmingxiao made their first contribution in #4774
@joonas made their first contribution in #4805
@yiyun-sj made their first contribution in #4664
@Alexsandr-Random made their first contribution in #4534
@wutongjie23hao made their first contribution in #4610
@njucjc made their first contribution in #4360
@omartrigui made their first contribution in #4770
@mnixry made their first contribution in #4758

Full Changelog: distribution/distribution@v3.0.0...v3.1.0

`v3.0.0`

Compare Source

Welcome to the v3.0.0 release of registry!

This is the first v3 stable release since v2.8.3 which is a culmination of years of hard work of the container community and registry maintainers!

If you are upgrading from v2.x and have never used any of the release candidates, please familiarise yourselves with the v2.x deprecations properly.

Deprecations

oss and swift storage drivers are no longer supported
docker/libtrust has been replaced with go-jose/go-jose in #4096
client is no longer supported as a standalone package in #4126
the default configuration path has changed to /etc/distribution/config.yml
ManifestBuilder interface in 3886
manifest.Versioned has been deprecated in favor of oci.Versioned in 3887
reference package has been moved to github.com/distribution/reference in #4063

Changes since the last release candidate

Changes

7 commits

* [`2e63da99`](https://redirect.github.com/distribution/distribution/commit/2e63da99776be71a17be3f79f60e4c3f485b87e1) Fix golangci-lint config (#4612) * [`fd14cf19`](https://redirect.github.com/distribution/distribution/commit/fd14cf193339eb2300828363560884f4ccbadba3) Vrify the linter config first before running it * [`3a33ba12`](https://redirect.github.com/distribution/distribution/commit/3a33ba12ad9a436792c1e89a3732f8600940f6e6) Fix golangci-lint config * [`75f32197`](https://redirect.github.com/distribution/distribution/commit/75f32197b6f180518d17210195ae0d3eb3885ce5) Bump Azure deps (#4611) * [`52f0f6c4`](https://redirect.github.com/distribution/distribution/commit/52f0f6c45d5397ebff48778b7c5c8b1dec89e572) Bump Azure deps * [`ef21149b`](https://redirect.github.com/distribution/distribution/commit/ef21149b4999ac0be22fe292640491b55cac9d9b) build(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 in the go_modules group across 1 directory (#4608) * [`05b308bc`](https://redirect.github.com/distribution/distribution/commit/05b308bc42519068f6157747301f5e68ef01b9af) build(deps): bump github.com/golang-jwt/jwt/v5

Previous release can be found at v3.0.0-rc.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-09-21T20:25:03Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f3caeb4f-b99b-4089-9de3-ae292de003e3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

renovate Bot added the dependencies label Sep 21, 2026

chore(deps): update registry docker tag to v3

a2f32fc

renovate Bot force-pushed the renovate/registry-3.x branch from 2e5486b to a2f32fc Compare September 25, 2026 03:35

Navigation Menu

chore(deps): update registry docker tag to v3 - #127

chore(deps): update registry docker tag to v3#127
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/registry-3.x

renovate Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 21, 2026 •

edited

Loading

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.1.2

Notable Changes

Build Updates

What's Changed

New Contributors

v3.1.1

Notable Changes

What's Changed

New Contributors

v3.1.0

Notable Changes

What's Changed

New Contributors

v3.0.0

Deprecations

Changes since the last release candidate

Changes

Configuration

Uh oh!

coderabbitai Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Sep 21, 2026 •

edited

Loading

`v3.1.2`

`v3.1.1`

`v3.1.0`

`v3.0.0`

coderabbitai Bot commented Sep 21, 2026 •

edited

Loading