v0.21.5

What's Changed

• Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0 by @thaJeztah in #2254
• update to Go 1.26.2 by @thaJeztah in #2255
• Bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in the actions group across 1 directory by @dependabot[bot] in #2257
• build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the go-deps group across 1 directory by @dependabot[bot] in #2260

Full Changelog: v0.21.4...v0.21.5

v0.21.4

What's Changed

• go.mod: do not make a viral minimum go version by @howardjohn in #2237
• Avoid pruning absolute links from extracted and flattened images by @Subserial in #2241
• Bump the go-deps group across 3 directories with 5 updates by @dependabot[bot] in #2245
• fix: update to go1.25.8, and use separate .go-version file by @thaJeztah in #2246
• Bump CI go version to 1.26.1 by @Subserial in #2242
• Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group by @dependabot[bot] in #2240
• fork distribution client v3 auth-challenge as an internal package (squashed) by @thaJeztah in #2248
• transport: validate Bearer realm URL to prevent SSRF by @evilgensec in #2243
• revert path traversal and symlink escape from #2227 by @Subserial in #2250
• Fix pkg/v1/google/auth tests for arm64 by @Subserial in #2085
• goreleaser: Update goreleaser config and GH action by @Subserial in #2253

New Contributors

• @evilgensec made their first contribution in #2243

Full Changelog: v0.21.3...v0.21.4

v0.21.3

What's Changed

• Adds local file support to the crane index subcommand by @edwardthiele in #2223
• migrate to github.com/moby/moby modules by @thaJeztah in #2228
• Bump the go-deps group across 4 directories with 7 updates by @dependabot[bot] in #2233
• Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group by @dependabot[bot] in #2220
• mutate: reject path traversal and symlink escape in Extract by @KevinZhao in #2227
• tarball: detect symlink cycles in extractFileFromTar by @vnykmshr in #2232
• bump golang to 1.25.7 by @Subserial in #2236

New Contributors

• @edwardthiele made their first contribution in #2223
• @thaJeztah made their first contribution in #2228
• @KevinZhao made their first contribution in #2227
• @vnykmshr made their first contribution in #2232

Full Changelog: v0.21.2...v0.21.3

v0.21.2

What's Changed

• Better handle redirects to https in ping by @jonjohnsonjr in #2225

Full Changelog: v0.21.1...v0.21.2

v0.21.1

This release fixes a regression in crane introduced in the previous release.

What's Changed

• Add WithFileBufferedOpener for file-backed daemon image buffering by @twdamhore in #2214
• crane: fix case in auth response json by @aelindeman in #2218

New Contributors

• @twdamhore made their first contribution in #2214
• @aelindeman made their first contribution in #2218

Full Changelog: v0.21.0...v0.21.1

v0.21.0

This release updates the minimum Go version to 1.25.6.

What's Changed

• fix(mutate): don't skip dir replacements via whiteout in export by @r4f4 in #2191
• Improve performance of v1.NewHash by @bmoylan in #2194
• Bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #2207
• Bump the root-deps group across 1 directory with 7 updates by @dependabot[bot] in #2195
• Fix error messages in crane_test.go by @jammie-jelly in #2189
• Bump go version across packages to 1.25.6 by @Subserial in #2211
• Join go.mod dependency updates by @Subserial in #2212
• Bump the go-deps group across 3 directories with 3 updates by @dependabot[bot] in #2213
• Disable taint gosec lints by @Subserial in #2215
• Update go version used in goreleaser by @Subserial in #2216

New Contributors

• @r4f4 made their first contribution in #2191
• @jammie-jelly made their first contribution in #2189

Full Changelog: v0.20.7...v0.21.0

v0.20.7

What's Changed

• Fix ArgsEscaped lint directive by @Subserial in #2137
• transport: Fix broken links to distribution docs by @guzalv in #2136
• fix(remote): using customized retry predicate func if provided by @derekhjray in #2135
• Adding docker file by @HassanJasim in #2138
• crane: Add timestamp to flatten layer by @Stephanie0829 in #2117
• feat(remote): pass retryBackoff option to transport by @aslafy-z in #1628
• Expose clobber refusal error by @pjbgf in #2146
• Build artifacts for riscv64 by @ffgan in #2159
• Update dependencies and deprecate DockerVersion field by @Subserial in #2164

New Contributors

• @guzalv made their first contribution in #2136
• @derekhjray made their first contribution in #2135
• @HassanJasim made their first contribution in #2138
• @Stephanie0829 made their first contribution in #2117
• @pjbgf made their first contribution in #2146
• @ffgan made their first contribution in #2159

Full Changelog: v0.20.6...v0.20.7

v0.20.6

What's Changed

• Ensure that tag name is not empty if name contains colon by @SaschaSchwarze0 in #2094
• Bump some deps by @jonjohnsonjr in #2110

New Contributors

• @SaschaSchwarze0 made their first contribution in #2094

Full Changelog: v0.20.4...v0.20.6

v0.20.5

What's Changed

• build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
• Migrate linter to v2 by @Subserial in #2096
• bump go version + bump deps by @Subserial in #2093
• implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
• Update CodeQL permissions by @Subserial in #2103
• Update goreleaser permissions by @Subserial in #2104
• Update provenance action in release by @Subserial in #2105
• Update validator action by @Subserial in #2106

New Contributors

• @luhring made their first contribution in #2071
• @Subserial made their first contribution in #2096

Full Changelog: v0.20.3...v0.20.5

v0.20.4 - Not usable as a go module

🚨 This release was published to the Go module proxy and then re-tagged with a different commit. This means it's not usable as a Go module (#2107) -- please us v0.20.5 instead.

What's Changed

• build(deps): bump docker/docker to v28.0.0+incompatible by @luhring in #2071
• Migrate linter to v2 by @Subserial in #2096
• bump go version + bump deps by @Subserial in #2093
• implement TextMarshaler/JSONMarshaler more consistently by @imjasonh in #2097
• Update CodeQL permissions by @Subserial in #2103
• Update goreleaser permissions by @Subserial in #2104
• Update provenance action in release by @Subserial in #2105
• Update validator action by @Subserial in #2106

New Contributors

• @luhring made their first contribution in #2071
• @Subserial made their first contribution in #2096

Full Changelog: v0.20.3...v0.20.4