From b90f63f52cea2c0476b80f6b8d982b294af7aa7c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 25 May 2026 06:42:13 -0400
Subject: [PATCH] build(deps): bump github.com/google/go-containerregistry from
 0.21.5 to 0.21.6 (#1295)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry)
from 0.21.5 to 0.21.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.6</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: update dependencies to use new azure sdk components by <a
href="https://github.com/gaganhr94"><code>@​gaganhr94</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2262">google/go-containerregistry#2262</a></li>
<li>transport: restore resp.Body in retryError so CheckError can parse
it by <a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2264">google/go-containerregistry#2264</a></li>
<li>pkg/registry: return 202 Accepted for PATCH chunk uploads by <a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2265">google/go-containerregistry#2265</a></li>
<li>Follow OCI distribution spec for artifactType and annotations by <a
href="https://github.com/malt3"><code>@​malt3</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2269">google/go-containerregistry#2269</a></li>
<li>actions: attach Codecov token to coverage tests on main by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2270">google/go-containerregistry#2270</a></li>
<li>remote: use DeleteScope (with &quot;delete&quot; action) for
manifest deletion by <a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2266">google/go-containerregistry#2266</a></li>
<li>remote: limit concurrent layer pulls by <a
href="https://github.com/gnix0"><code>@​gnix0</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2271">google/go-containerregistry#2271</a></li>
<li>pkg/registry: reject corrupt disk blobs by <a
href="https://github.com/gnix0"><code>@​gnix0</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2272">google/go-containerregistry#2272</a></li>
<li>mutate: close layer readers during export by <a
href="https://github.com/gnix0"><code>@​gnix0</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2277">google/go-containerregistry#2277</a></li>
<li>crane/flatten: preserve image media type when flattening by <a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2267">google/go-containerregistry#2267</a></li>
<li>build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1
in the actions group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2273">google/go-containerregistry#2273</a></li>
<li>build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2278">google/go-containerregistry#2278</a></li>
<li>build(deps): bump the go-deps group across 3 directories with 6
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2280">google/go-containerregistry#2280</a></li>
<li>Replace go-homedir with os.UserHomeDir by <a
href="https://github.com/jammie-jelly"><code>@​jammie-jelly</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2282">google/go-containerregistry#2282</a></li>
<li>pkg/name: only treat .localhost as non-HTTPS, not .local by <a
href="https://github.com/blackwell-systems"><code>@​blackwell-systems</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2281">google/go-containerregistry#2281</a></li>
<li>transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL
by <a href="https://github.com/marwan9696"><code>@​marwan9696</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2285">google/go-containerregistry#2285</a></li>
<li>test(mutate): add Extract round-trip test for filesystem object
preservation by <a
href="https://github.com/blackwell-systems"><code>@​blackwell-systems</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2283">google/go-containerregistry#2283</a></li>
<li>experiments: remove deprecated support for estargz by <a
href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2288">google/go-containerregistry#2288</a></li>
<li>build(deps): bump aws-actions/configure-aws-credentials from 6.1.0
to 6.1.1 in the actions group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2289">google/go-containerregistry#2289</a></li>
<li>fix: limit HTTP response body reads to prevent OOM by <a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2296">google/go-containerregistry#2296</a></li>
<li>build(deps): bump the go-deps group across 3 directories with 6
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2297">google/go-containerregistry#2297</a></li>
<li>transport: block redirects from token server to private/link-local
addresses (SSRF fix) by <a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2292">google/go-containerregistry#2292</a></li>
<li>pkg/v1/mutate: preserve relative symlinks that stay within rootfs in
Extract by <a
href="https://github.com/anishesg"><code>@​anishesg</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2279">google/go-containerregistry#2279</a></li>
<li>validate: skip non-layer layers by <a
href="https://github.com/imjasonh"><code>@​imjasonh</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2298">google/go-containerregistry#2298</a></li>
<li>remote: validate foreign layer URLs to prevent SSRF (fixes <a
href="https://redirect.github.com/google/go-containerregistry/issues/2259">#2259</a>)
by <a href="https://github.com/evilgensec"><code>@​evilgensec</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2293">google/go-containerregistry#2293</a></li>
<li>remote: block SSRF via private-IP Location headers in blob uploads
by <a
href="https://github.com/adilburaksen"><code>@​adilburaksen</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2295">google/go-containerregistry#2295</a></li>
<li>fix(mutate): preserve config blob and layers for non-Docker OCI
artifacts by <a
href="https://github.com/blackwell-systems"><code>@​blackwell-systems</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2286">google/go-containerregistry#2286</a></li>
<li>fix: preserve per-occurrence layer identity in mutate.Image.Layers()
by <a href="https://github.com/iahsanGill"><code>@​iahsanGill</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2299">google/go-containerregistry#2299</a></li>
<li>transport: retry HTTP 429 (Too Many Requests) by <a
href="https://github.com/iahsanGill"><code>@​iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2301">google/go-containerregistry#2301</a></li>
<li>transport: allow bearer realm at same host:port as registry by <a
href="https://github.com/iahsanGill"><code>@​iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2302">google/go-containerregistry#2302</a></li>
<li>Update go version to 1.26.3 by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2300">google/go-containerregistry#2300</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/gaganhr94"><code>@​gaganhr94</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2262">google/go-containerregistry#2262</a></li>
<li><a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2264">google/go-containerregistry#2264</a></li>
<li><a href="https://github.com/malt3"><code>@​malt3</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2269">google/go-containerregistry#2269</a></li>
<li><a href="https://github.com/gnix0"><code>@​gnix0</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2271">google/go-containerregistry#2271</a></li>
<li><a
href="https://github.com/blackwell-systems"><code>@​blackwell-systems</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2281">google/go-containerregistry#2281</a></li>
<li><a
href="https://github.com/marwan9696"><code>@​marwan9696</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2285">google/go-containerregistry#2285</a></li>
<li><a href="https://github.com/anishesg"><code>@​anishesg</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2279">google/go-containerregistry#2279</a></li>
<li><a
href="https://github.com/adilburaksen"><code>@​adilburaksen</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2295">google/go-containerregistry#2295</a></li>
<li><a
href="https://github.com/iahsanGill"><code>@​iahsanGill</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2299">google/go-containerregistry#2299</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6">https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/google/go-containerregistry/commit/53f7e39e15bfd6aeea6a5f733ee1a8fcf54c15cf"><code>53f7e39</code></a>
Update go version to 1.26.3 (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2300">#2300</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/bf87c3bfe4cc3218ac0baa364545d72729d2906d"><code>bf87c3b</code></a>
transport: allow bearer realm at same host:port as registry (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2302">#2302</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/c55facddfbd7fc3d648c6fdda9860b350b013a76"><code>c55facd</code></a>
transport: retry HTTP 429 (Too Many Requests) (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2301">#2301</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/68a569e4a0eb927d36ccb0fcdf4578425c03b5a2"><code>68a569e</code></a>
fix: preserve per-occurrence layer identity in Layers() (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2299">#2299</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/35b354b436879457221028f05a580fe1c0deccbc"><code>35b354b</code></a>
fix(mutate): preserve config blob and layers for non-Docker OCI
artifacts (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2">#2</a>...</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/e5983f2a67ec46b76984ce6de85de08a44eee955"><code>e5983f2</code></a>
remote: block SSRF via private-IP Location headers in blob uploads (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2295">#2295</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/6dad820da7de0d619f1127c46914f2eaf58e3b46"><code>6dad820</code></a>
remote: validate foreign layer URLs to prevent SSRF (fixes <a
href="https://redirect.github.com/google/go-containerregistry/issues/2259">#2259</a>)
(<a
href="https://redirect.github.com/google/go-containerregistry/issues/2293">#2293</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/78bdf1b7e2105cdfcd8f23509992c78357ce16ed"><code>78bdf1b</code></a>
validate: skip non-layer layers (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2298">#2298</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/c29d91cdc394cb288270f4dd04a31f81054946f4"><code>c29d91c</code></a>
pkg/v1/mutate: preserve relative symlinks that stay within rootfs in
Extract ...</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/a70d75a6915ed3137792206dac4bca21d1924959"><code>a70d75a</code></a>
transport: block redirects from token server to private/link-local
addresses ...</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.5&new-version=0.21.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 11 ++++-------
 go.sum | 22 ++++++++--------------
 2 files changed, 12 insertions(+), 21 deletions(-)

diff --git a/go.mod b/go.mod
index 247ffc7..6a54948 100644
--- a/go.mod
+++ b/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/coreos/go-oidc/v3 v3.18.0
 	github.com/danielgtaylor/huma/v2 v2.37.3
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-containerregistry v0.21.5
+	github.com/google/go-containerregistry v0.21.6
 	github.com/jackc/pgx/v5 v5.9.2
 	github.com/prometheus/client_golang v1.23.2
 	github.com/rs/cors v1.11.1
@@ -39,9 +39,8 @@ require (
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/cli v29.4.0+incompatible // indirect
+	github.com/docker/cli v29.4.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
@@ -54,9 +53,8 @@ require (
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/klauspost/compress v1.18.6 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
@@ -67,7 +65,6 @@ require (
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
-	github.com/vbatts/tar-split v0.12.2 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
@@ -77,7 +74,7 @@ require (
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/sys v0.44.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/api v0.274.0 // indirect
diff --git a/go.sum b/go.sum
index 1a65b0f..ebf0ad1 100644
--- a/go.sum
+++ b/go.sum
@@ -36,8 +36,6 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
 github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
-github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw=
-github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY=
 github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=
 github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/danielgtaylor/huma/v2 v2.37.3 h1:6Av0Vj45Vk5lDxRVfoO2iPlEdvCvwLc7pl5nbqGOkYM=
@@ -45,8 +43,8 @@ github.com/danielgtaylor/huma/v2 v2.37.3/go.mod h1:OeHHtCEAaNiuVbAVdYu4IQ0UOmnb4
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docker/cli v29.4.0+incompatible h1:+IjXULMetlvWJiuSI0Nbor36lcJ5BTcVpUmB21KBoVM=
-github.com/docker/cli v29.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.4.3+incompatible h1:u+UliYm2J/rYrIh2FqHQg32neRG8GjbvNuwQRTzGspU=
+github.com/docker/cli v29.4.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
 github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
@@ -71,8 +69,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.21.5 h1:KTJG9Pn/jC0VdZR6ctV3/jcN+q6/Iqlx0sTVz3ywZlM=
-github.com/google/go-containerregistry v0.21.5/go.mod h1:ySvMuiWg+dOsRW0Hw8GYwfMwBlNRTmpYBFJPlkco5zU=
+github.com/google/go-containerregistry v0.21.6 h1:T+yqQIlJXKrM98Om4DlW3GoWQAmhZuLMwoDOvVrtiUM=
+github.com/google/go-containerregistry v0.21.6/go.mod h1:U7MMSBIJynke2MVQrQk19NP9k/uQsGz/h0amIFSHMbo=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -91,16 +89,14 @@ github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
 github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
+github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -136,8 +132,6 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=
-github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
@@ -175,8 +169,8 @@ golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=