openSUSE-SU-2026:22227-1

Dashboard / Vulnerabilities / openSUSE-SU-2026:22227-1

openSUSE-SU-2026:22227-1

Summary: Security update for go-containerregistry

Details: This update for go-containerregistry fixes the following issues: Changes in go-containerregistry: - update vendor.tar to address: * bsc#1288488, CVE-2026-116591: github.com/klauspost/compress/zstd: crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic - update to 0.22.1: * Reject non-canonical IP literals in all SSRF guards * daemon: fix stale docker/docker reference in WithClient docs * build(deps): bump the go-deps group across 2 directories with 4 updates * authn: do not overwrite AuthConfig.Auth when username and password are empty * build(deps): bump the actions group across 1 directory with 8 updates * Support pulling images by sha512 digest * Allow empty label and annotation values in crane mutate * fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml * validate: support index attestation manifests and empty configs * name: improve error when parsing a reference with a URL scheme * fix(build): install binaries to /ko-app and add to PATH * fix(release): honor declared Go toolchain * remote: apply checkRedirectSSRF to writer-side HTTP clients * flatten: preserve config and layer media types when flattening * fix(mutate): make Time layer updates lazy * build(deps): bump the go-deps group across 2 directories with 3 updates * remote: copy manifest annotations to referrers fallback tag descriptors - update to 0.22.0: * mutate: let Time and Canonical take tarball.LayerOption * build: add multi-architecture Cloud Build configurations for crane, gcrane, and krane * remote: resolve push-check credentials against the repository * Allow single-character repository paths * fix: add missing substitutions and workspace cleanup to new build files * remote: retry failed Puller and Pusher initialization * build(deps): bump the actions group across 1 directory with 8 updates * build(deps): bump the go-deps group across 1 directory with 3 updates * go.mod: bump Go version + add toolchain directive to replace .go-version file * fix: Fix new build options and provenance * fix(build): unify new build flow into cloudbuild_v2.yaml - update to 0.21.8 (bsc#1283692, CVE-2026-63209): * The artifacts attached to this release are missing SLSA provenance, see #2390. * build(deps): bump the go-deps group across 1 directory with 3 updates * build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane * build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain * build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes * build(deps): bump the go-deps group across 3 directories with 7 updates * build(deps): bump the actions group across 1 directory with 5 updates * Reject unsafe Windows archive paths in Extract * feat(goreleaser): add loong64 build support for crane/gcrane/krane * Document tag and digest reference semantics * remote: release pull limiter slot when body is read to EOF * tarball: bounds-check layer index in uncompressed LayerByDiffID * authn: read Podman auth from XDG config * transport: per-host bearer token exchange on cross-host redirect * mutate: bounds-check layer index when building rebase addendums * fix(daemon): copy ExposedPorts from source config in computeImageConfig * feat(remote): add WithReferrersTagFallback option * mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract * tarball: use correct file extension for zstd/uncompressed * build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory * actions: update actions to be pinned by hash * Bump go version to 1.26.5 - update to 0.21.7: * tarball: return error instead of panicking on missing rootfs.diff_ids * gcrane: honor --platform flag in copy * mutate: verify layer digests in Extract and Time * tarball: close layer readers during Write * build(deps): bump the actions group across 1 directory with 2 updates * build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory * BUGFIX: Fail with error when read exceeds maximum * build(deps): bump the actions group across 1 directory with 2 updates * fix(name): anchor loopback registry detection * Reject symlinks in OCI layout blobs * fix(crane): avoid creating export tar on pull failure * feat(kubernetes): allow ignoring pull secrets * fix(name): preserve localhost registry references * pkg/registry: export ErrNotFound * pkg/registry: export RedirectError * build(deps): bump the go-deps group across 1 directory with 2 updates * build(deps): bump the actions group across 1 directory with 2 updates * fix: prevent SSRF in google.List() pagination * internal/gzip: fix goroutine leak in ReadCloserLevel * fix(transport): apply refreshed bearer token after cross-host redirect * build(deps): bump the go-deps group across 3 directories with 4 updates * fix(tarball): normalize paths when matching files * transport: do not re-attach bearer token after cross-host redirect * Bump CI go version to 1.26.4 - update to 0.21.6: * fix: update dependencies to use new azure sdk components * transport: restore resp.Body in retryError so CheckError can parse it * pkg/registry: return 202 Accepted for PATCH chunk uploads * Follow OCI distribution spec for artifactType and annotations * actions: attach Codecov token to coverage tests on main * remote: use DeleteScope (with "delete" action) for manifest deletion * remote: limit concurrent layer pulls * pkg/registry: reject corrupt disk blobs * mutate: close layer readers during export * crane/flatten: preserve image media type when flattening * build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory * build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 * build(deps): bump the go-deps group across 3 directories with 6 updates * Replace go-homedir with os.UserHomeDir * pkg/name: only treat .localhost as non-HTTPS, not .local * transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL * test(mutate): add Extract round-trip test for filesystem object preservation * experiments: remove deprecated support for estargz * build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group * fix: limit HTTP response body reads to prevent OOM * build(deps): bump the go-deps group across 3 directories with 6 updates * transport: block redirects from token server to private/link- local addresses (SSRF fix) * pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract * validate: skip non-layer layers * remote: validate foreign layer URLs to prevent SSRF (fixes #2259) * remote: block SSRF via private-IP Location headers in blob uploads * fix(mutate): preserve config blob and layers for non-Docker OCI artifacts * fix: preserve per-occurrence layer identity in mutate.Image.Layers() * transport: retry HTTP 429 (Too Many Requests) * transport: allow bearer realm at same host:port as registry * Update go version to 1.26.3 - update to 0.21.5: * Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0 * update to Go 1.26.2 * Bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in the actions group across 1 directory * build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the go-deps group across 1 directory * **Full Changelog**: https://github.com/google/go- containerregistry/compare/v0.21.4...v0.21.5 - update to 0.21.4: * go.mod: do not make a viral minimum go version * Avoid pruning absolute links from extracted and flattened images * Bump the go-deps group across 3 directories with 5 updates * fix: update to go1.25.8, and use separate .go-version file * Bump CI go version to 1.26.1 * Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group * fork distribution client v3 auth-challenge as an internal package (squashed) * transport: validate Bearer realm URL to prevent SSRF * revert path traversal and symlink escape from #2227 * Fix pkg/v1/google/auth tests for arm64 * goreleaser: Update goreleaser config and GH action - update to 0.21.3: * Adds local file support to the `crane index` subcommand * migrate to github.com/moby/moby modules * Bump the go-deps group across 4 directories with 7 updates * Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group * mutate: reject path traversal and symlink escape in Extract * tarball: detect symlink cycles in extractFileFromTar * bump golang to 1.25.7 - update to 0.21.2: * Better handle redirects to https in ping * **Full Changelog**: https://github.com/google/go- containerregistry/compare/v0.21.1...v0.21.2 - update to 0.21.1: * Add WithFileBufferedOpener for file-backed daemon image buffering * crane: fix case in auth response json - update to 0.21.0: * fix(mutate): don't skip dir replacements via whiteout in export * Improve performance of v1.NewHash * Bump the actions group across 1 directory with 4 updates * Bump the root-deps group across 1 directory with 7 updates * Fix error messages in crane_test.go * Bump go version across packages to 1.25.6 * Join go.mod dependency updates * Bump the go-deps group across 3 directories with 3 updates * Disable taint gosec lints * Update go version used in goreleaser - update to 0.20.7: * Fix ArgsEscaped lint directive * transport: Fix broken links to distribution docs * fix(remote): using customized retry predicate func if provided * Adding docker file * crane: Add timestamp to flatten layer * feat(remote): pass retryBackoff option to transport * Expose clobber refusal error * Build artifacts for riscv64 * Update dependencies and deprecate DockerVersion field - update to 0.20.7: * Fix ArgsEscaped lint directive * transport: Fix broken links to distribution docs * fix(remote): using customized retry predicate func if provided * Adding docker file * crane: Add timestamp to flatten layer * feat(remote): pass retryBackoff option to transport * Expose clobber refusal error * Build artifacts for riscv64 * Update dependencies and deprecate DockerVersion field - update to 0.20.6: * Ensure that tag name is not empty if name contains colon * Bump some deps - update to 0.20.5: * build(deps): bump docker/docker to v28.0.0+incompatible * Migrate linter to v2 * bump go version + bump deps * implement TextMarshaler/JSONMarshaler more consistently * Update CodeQL permissions * Update goreleaser permissions * Update provenance action in release * Update validator action - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239277) - update to 0.20.3: * remote/transport: Make bearer transport go-routine-safe * Expose compare package * fix: redact.URL uses (*URL).Redacted to omit basic-auth password * bump actions to latest * don't pin chainguard-dev/actions * Check for 406 status code when handling referrers API endpoint response * mutate: Create a defensive annotations copy * Detect zstd in crane append * bump deps using hack/bump-deps.sh - update to 0.20.2: * deps: bump docker dep

References: , https://bugzilla.suse.com/1239277, https://bugzilla.suse.com/1283692, https://bugzilla.suse.com/1288488, https://www.suse.com/security/cve/CVE-2025-22868, https://www.suse.com/security/cve/CVE-2026-116591, https://www.suse.com/security/cve/CVE-2026-63209