Skip to content

chore: sync with upstream google/go-containerregistry - #14

Open
ec-automation[bot] wants to merge 18 commits into
mainfrom
sync/upstream-2026-07-27-62
Open

chore: sync with upstream google/go-containerregistry#14
ec-automation[bot] wants to merge 18 commits into
mainfrom
sync/upstream-2026-07-27-62

Conversation

@ec-automation

@ec-automation ec-automation Bot commented Jul 27, 2026

Copy link
Copy Markdown

Automated weekly sync from google/go-containerregistry.

Merge completed cleanly — no conflicts detected.

amarkdotdev and others added 18 commits June 17, 2026 09:43
@amarkdotdev
internal/gzip: fix goroutine leak in ReadCloserLevel (google#2347)
e963497 
Move defer r.Close() and defer pw.Close() to the top of the goroutine
so they execute regardless of which error path exits the function.
Previously, r.Close() was only called inside the io.Copy error path
and the happy-path end, leaving it unclosed when gw.Close() or
bw.Flush() failed.

When r wraps a limitedReadCloser (used by the pullLimiter introduced
in google#2271), failing to close r permanently leaks the limiter token
slot. Under layout.WriteImage (used by kaniko for build-stage caching),
this eventually deadlocks because all slots are occupied.

Also add defer gw.Close() after gw creation so the gzip writer is
always properly finalized.

Fixes google#2342

Signed-off-by: Aaron <aaroniofjm@gmail.com>
@64johnlee
fix(transport): apply refreshed bearer token after cross-host redirect (
97a8a17 
google#2337)

When an http.Client-level redirect sends a request to a host that
differs from bt.registry, the sendRequest() closure skips setting the
Authorization header (its matchesHost guard returns false). The previous
code called sendRequest() again after bt.refresh(), so the freshly
fetched token was never applied to the retried request and the client
received a second 401 instead of succeeding.

Fix by reading the token directly from bt.bearer after a successful
refresh and setting the Authorization header unconditionally before
retrying, bypassing the matchesHost guard that is only needed to prevent
header forwarding on client-visible redirects.

Closes google#2333
@dependabot
build(deps): bump the go-deps group across 3 directories with 4 updat…
5baa399 
…es (google#2348)

* build(deps): bump the go-deps group across 3 directories with 4 updates

Bumps the go-deps group with 1 update in the / directory: [golang.org/x/tools](https://github.com/golang/tools).
Bumps the go-deps group with 2 updates in the /pkg/authn/k8schain directory: [k8s.io/api](https://github.com/kubernetes/api) and [k8s.io/client-go](https://github.com/kubernetes/client-go).
Bumps the go-deps group with 2 updates in the /pkg/authn/kubernetes directory: [k8s.io/api](https://github.com/kubernetes/api) and [k8s.io/client-go](https://github.com/kubernetes/client-go).


Updates `golang.org/x/tools` from 0.45.0 to 0.46.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.45.0...v0.46.0)

Updates `k8s.io/api` from 0.36.1 to 0.36.2
- [Commits](kubernetes/api@v0.36.1...v0.36.2)

Updates `k8s.io/client-go` from 0.36.1 to 0.36.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.1...v0.36.2)

Updates `k8s.io/api` from 0.36.1 to 0.36.2
- [Commits](kubernetes/api@v0.36.1...v0.36.2)

Updates `k8s.io/client-go` from 0.36.1 to 0.36.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.1...v0.36.2)

Updates `k8s.io/apimachinery` from 0.36.1 to 0.36.2
- [Commits](kubernetes/apimachinery@v0.36.1...v0.36.2)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: k8s.io/api
  dependency-version: 0.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/api
  dependency-version: 0.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@bstoll
fix(tarball): normalize paths when matching files (google#2334)
09fe1e5 
Some tools generate tarballs with ./ prefix in paths (e.g. ./manifest.json).
Use path.Clean on both header name and target path to ensure they match
correctly even if they have different formatting.

This fixes loading images that have ./ prefixed paths, which was causing
errors like "file manifest.json not found in tar".
@evilgensec
transport: do not re-attach bearer token after cross-host redirect (g…
da61d86 
…oogle#2349)

PR google#2337 made bearerTransport.RoundTrip set the Authorization header
unconditionally on the post-401 retry, bypassing the matchesHost guard.
That guard exists to stop the credential being forwarded across an
http.Client-level redirect to a different host. With it bypassed, a
malicious or compromised registry can 302 a manifest/blob fetch to an
attacker-controlled host, answer the follow-up request with a Bearer
challenge, and harvest the operator's registry token: the client
refreshes the token from the trusted realm and then sends it to the
redirected host.

Gate the re-attach on matchesHost so the refreshed token is only applied
when the request is still talking to the registry we authenticated
against; for a cross-host request fall back to sendRequest(), which omits
the credential. This preserves the google#2333 fix for same-host 401 retries
(e.g. mid-session token expiry) while closing the credential leak.

Add a regression test for the same-host retry and a test asserting the
token is not leaked to a cross-host challenger.
Jared
Bump go version to 1.26.4 (google#2350)
c68d899
@dependabot
build(deps): bump the go-deps group across 1 directory with 3 updates (…
e8b2b9e 
…google#2353)

Bumps the go-deps group with 3 updates in the / directory: [github.com/docker/cli](https://github.com/docker/cli), [github.com/moby/moby/api](https://github.com/moby/moby) and [github.com/moby/moby/client](https://github.com/moby/moby).


Updates `github.com/docker/cli` from 29.5.3+incompatible to 29.6.0+incompatible
- [Commits](docker/cli@v29.5.3...v29.6.0)

Updates `github.com/moby/moby/api` from 1.54.2 to 1.55.0
- [Release notes](https://github.com/moby/moby/releases)
- [Commits](moby/moby@api/v1.54.2...api/v1.55.0)

Updates `github.com/moby/moby/client` from 0.4.1 to 0.5.0
- [Release notes](https://github.com/moby/moby/releases)
- [Changelog](https://github.com/moby/moby/blob/v0.5.0/CHANGELOG.md)
- [Commits](moby/moby@v0.4.1...v0.5.0)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 29.6.0+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/moby/moby/api
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/moby/moby/client
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump golang.org/x/crypto in /cmd/krane (google#2367)
5e6b4d7 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.45.0 to 0.52.0.
- [Commits](golang/crypto@v0.45.0...v0.52.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump golang.org/x/crypto in /pkg/authn/k8schain (google#…
8646f41 
…2368)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.50.0 to 0.52.0.
- [Commits](golang/crypto@v0.50.0...v0.52.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/auth…
0bd62cc 
…n/kubernetes (google#2363)

* build(deps): bump golang.org/x/net in /pkg/authn/kubernetes

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.49.0 to 0.55.0.
- [Commits](golang/net@v0.49.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.55.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump the go-deps group across 3 directories with 7 updat…
bcbbf2a 
…es (google#2377)

* build(deps): bump the go-deps group across 3 directories with 7 updates

Bumps the go-deps group with 4 updates in the / directory: [github.com/docker/cli](https://github.com/docker/cli), [github.com/klauspost/compress](https://github.com/klauspost/compress), [golang.org/x/sync](https://github.com/golang/sync) and [golang.org/x/tools](https://github.com/golang/tools).
Bumps the go-deps group with 2 updates in the /pkg/authn/k8schain directory: [k8s.io/api](https://github.com/kubernetes/api) and [k8s.io/client-go](https://github.com/kubernetes/client-go).
Bumps the go-deps group with 2 updates in the /pkg/authn/kubernetes directory: [k8s.io/api](https://github.com/kubernetes/api) and [k8s.io/client-go](https://github.com/kubernetes/client-go).


Updates `github.com/docker/cli` from 29.6.0+incompatible to 29.6.2+incompatible
- [Commits](docker/cli@v29.6.0...v29.6.2)

Updates `github.com/klauspost/compress` from 1.18.6 to 1.19.1
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](klauspost/compress@v1.18.6...v1.19.1)

Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](golang/sync@v0.21.0...v0.22.0)

Updates `golang.org/x/tools` from 0.46.0 to 0.48.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.46.0...v0.48.0)

Updates `k8s.io/api` from 0.36.2 to 0.36.3
- [Commits](kubernetes/api@v0.36.2...v0.36.3)

Updates `k8s.io/client-go` from 0.36.2 to 0.36.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.2...v0.36.3)

Updates `k8s.io/api` from 0.36.2 to 0.36.3
- [Commits](kubernetes/api@v0.36.2...v0.36.3)

Updates `k8s.io/client-go` from 0.36.2 to 0.36.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.2...v0.36.3)

Updates `k8s.io/api` from 0.36.2 to 0.36.3
- [Commits](kubernetes/api@v0.36.2...v0.36.3)

Updates `k8s.io/client-go` from 0.36.2 to 0.36.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.2...v0.36.3)

Updates `k8s.io/api` from 0.36.2 to 0.36.3
- [Commits](kubernetes/api@v0.36.2...v0.36.3)

Updates `k8s.io/apimachinery` from 0.36.2 to 0.36.3
- [Commits](kubernetes/apimachinery@v0.36.2...v0.36.3)

Updates `k8s.io/client-go` from 0.36.2 to 0.36.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.36.2...v0.36.3)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 29.6.2+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/sync
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/tools
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: k8s.io/api
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/api
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/api
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/api
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: k8s.io/client-go
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump the actions group across 1 directory with 5 updates (…
76d3597 
…google#2375)

Bumps the actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6` | `7` |
| [actions/setup-go](https://github.com/actions/setup-go) | `6` | `7` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.0` | `6.2.3` |
| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.2.2` | `7.2.3` |
| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.1` | `9.3.0` |



Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

Updates `actions/setup-go` from 6 to 7
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v6...v7)

Updates `aws-actions/configure-aws-credentials` from 6.2.0 to 6.2.3
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@v6.2.0...v6.2.3)

Updates `goreleaser/goreleaser-action` from 7.2.2 to 7.2.3
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@v7.2.2...v7.2.3)

Updates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@v9.2.1...v9.3.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-go
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: golangci/golangci-lint-action
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 7.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Haihan-Jiang
Reject unsafe Windows archive paths in Extract (google#2330)
84412cd
@xuxiaowei-com-cn
feat(goreleaser): add loong64 build support for crane/gcrane/krane (g…
9cd572f 
…oogle#2358)

Add the loong64 (LoongArch 64-bit) architecture as a build target
in .goreleaser.yml for all three binaries to ensure consistent binary
counts across platforms.

Go has supported linux/loong64 since Go 1.21.
@Haihan-Jiang
Document tag and digest reference semantics (google#2325)
0f89719
@knQzx
remote: release pull limiter slot when body is read to EOF (google#2373)
b3a7149
@arpitjain099
tarball: bounds-check layer index in uncompressed LayerByDiffID (goog…
afc8f33 
…le#2370)

The compressed side got this guard in google#2304. LayerByDiffID walks the
config's rootfs.diff_ids and indexes imgDescriptor.Layers with the same
index, so a config declaring more diff_ids than manifest.json lists
layers panics with an index out of range instead of returning an error.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
@ec-automation
Merge remote-tracking branch 'upstream/main' into sync/upstream-2026-…
226dfea 
…07-27-62
@codecov

codecov Bot commented Jul 27, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 95.83333% with 2 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
pkg/v1/mutate/mutate.go 93.33% 1 Missing and 1 partial ⚠️
Files with missing lines Coverage Δ
internal/gzip/zip.go 89.47% <100.00%> (-0.27%) ⬇️
pkg/name/ref.go 100.00% <ø> (ø)
pkg/v1/remote/limiter.go 90.00% <100.00%> (+3.33%) ⬆️
pkg/v1/remote/transport/bearer.go 73.79% <100.00%> (+0.70%) ⬆️
pkg/v1/tarball/image.go 82.07% <100.00%> (+0.17%) ⬆️
pkg/v1/mutate/mutate.go 76.17% <93.33%> (+1.17%) ⬆️
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

size: XXL

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@amarkdotdev @64johnlee @bstoll @evilgensec @Haihan-Jiang @xuxiaowei-com-cn @knQzx @arpitjain099