From dda760f0a9105d6dfe7b05e7e2c202ce1059f28b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 25 Jun 2026 02:43:06 -0400
Subject: [PATCH] build(deps): bump github.com/google/go-containerregistry from
 0.21.6 to 0.21.7 (#1373)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry)
from 0.21.6 to 0.21.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.7</h2>
<h2>What's Changed</h2>
<ul>
<li>tarball: return error instead of panicking on missing
rootfs.diff_ids by <a
href="https://github.com/iahsanGill"><code>@​iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2304">google/go-containerregistry#2304</a></li>
<li>gcrane: honor --platform flag in copy by <a
href="https://github.com/iahsanGill"><code>@​iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2307">google/go-containerregistry#2307</a></li>
<li>mutate: verify layer digests in Extract and Time by <a
href="https://github.com/momenashrafff"><code>@​momenashrafff</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2303">google/go-containerregistry#2303</a></li>
<li>tarball: close layer readers during Write by <a
href="https://github.com/nandbhat"><code>@​nandbhat</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2308">google/go-containerregistry#2308</a></li>
<li>build(deps): bump the actions group across 1 directory with 2
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2311">google/go-containerregistry#2311</a></li>
<li>build(deps): bump github.com/docker/cli from 29.4.3+incompatible to
29.5.2+incompatible in the go-deps group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2312">google/go-containerregistry#2312</a></li>
<li>BUGFIX: Fail with error when read exceeds maximum by <a
href="https://github.com/inteon"><code>@​inteon</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2328">google/go-containerregistry#2328</a></li>
<li>build(deps): bump the actions group across 1 directory with 2
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2327">google/go-containerregistry#2327</a></li>
<li>fix(name): anchor loopback registry detection by <a
href="https://github.com/rohan-patnaik"><code>@​rohan-patnaik</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2314">google/go-containerregistry#2314</a></li>
<li>Reject symlinks in OCI layout blobs by <a
href="https://github.com/mosskappa"><code>@​mosskappa</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2306">google/go-containerregistry#2306</a></li>
<li>fix(crane): avoid creating export tar on pull failure by <a
href="https://github.com/Haihan-Jiang"><code>@​Haihan-Jiang</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2318">google/go-containerregistry#2318</a></li>
<li>feat(kubernetes): allow ignoring pull secrets by <a
href="https://github.com/rohan-patnaik"><code>@​rohan-patnaik</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2315">google/go-containerregistry#2315</a></li>
<li>fix(name): preserve localhost registry references by <a
href="https://github.com/rohan-patnaik"><code>@​rohan-patnaik</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2316">google/go-containerregistry#2316</a></li>
<li>pkg/registry: export ErrNotFound by <a
href="https://github.com/malt3"><code>@​malt3</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2176">google/go-containerregistry#2176</a></li>
<li>pkg/registry: export RedirectError by <a
href="https://github.com/malt3"><code>@​malt3</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2177">google/go-containerregistry#2177</a></li>
<li>build(deps): bump the go-deps group across 1 directory with 2
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2343">google/go-containerregistry#2343</a></li>
<li>build(deps): bump the actions group across 1 directory with 2
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2344">google/go-containerregistry#2344</a></li>
<li>fix: prevent SSRF in google.List() pagination by <a
href="https://github.com/tufstraka"><code>@​tufstraka</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2332">google/go-containerregistry#2332</a></li>
<li>internal/gzip: fix goroutine leak in ReadCloserLevel by <a
href="https://github.com/amarkdotdev"><code>@​amarkdotdev</code></a> in
<a
href="https://redirect.github.com/google/go-containerregistry/pull/2347">google/go-containerregistry#2347</a></li>
<li>fix(transport): apply refreshed bearer token after cross-host
redirect by <a
href="https://github.com/64johnlee"><code>@​64johnlee</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2337">google/go-containerregistry#2337</a></li>
<li>build(deps): bump the go-deps group across 3 directories with 4
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2348">google/go-containerregistry#2348</a></li>
<li>fix(tarball): normalize paths when matching files by <a
href="https://github.com/bstoll"><code>@​bstoll</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2334">google/go-containerregistry#2334</a></li>
<li>transport: do not re-attach bearer token after cross-host redirect
by <a href="https://github.com/evilgensec"><code>@​evilgensec</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2349">google/go-containerregistry#2349</a></li>
<li>Bump CI go version to 1.26.4 by <a
href="https://github.com/Subserial"><code>@​Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2350">google/go-containerregistry#2350</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/momenashrafff"><code>@​momenashrafff</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2303">google/go-containerregistry#2303</a></li>
<li><a href="https://github.com/nandbhat"><code>@​nandbhat</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2308">google/go-containerregistry#2308</a></li>
<li><a href="https://github.com/inteon"><code>@​inteon</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2328">google/go-containerregistry#2328</a></li>
<li><a
href="https://github.com/rohan-patnaik"><code>@​rohan-patnaik</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2314">google/go-containerregistry#2314</a></li>
<li><a href="https://github.com/mosskappa"><code>@​mosskappa</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2306">google/go-containerregistry#2306</a></li>
<li><a
href="https://github.com/Haihan-Jiang"><code>@​Haihan-Jiang</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2318">google/go-containerregistry#2318</a></li>
<li><a href="https://github.com/tufstraka"><code>@​tufstraka</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2332">google/go-containerregistry#2332</a></li>
<li><a
href="https://github.com/amarkdotdev"><code>@​amarkdotdev</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2347">google/go-containerregistry#2347</a></li>
<li><a href="https://github.com/64johnlee"><code>@​64johnlee</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2337">google/go-containerregistry#2337</a></li>
<li><a href="https://github.com/bstoll"><code>@​bstoll</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2334">google/go-containerregistry#2334</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7">https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/google/go-containerregistry/commit/c68d899782693b63b7549166812aa996f17a660c"><code>c68d899</code></a>
Bump go version to 1.26.4 (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2350">#2350</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/da61d865f872bdc93fdf24e54a4fb6e2a47cb3b6"><code>da61d86</code></a>
transport: do not re-attach bearer token after cross-host redirect (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2349">#2349</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/09fe1e55280ac9a76c18c30e39d849c80fe391ce"><code>09fe1e5</code></a>
fix(tarball): normalize paths when matching files (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2334">#2334</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/5baa399d0908f17dffe74212377f133b1bca793a"><code>5baa399</code></a>
build(deps): bump the go-deps group across 3 directories with 4 updates
(<a
href="https://redirect.github.com/google/go-containerregistry/issues/2348">#2348</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/97a8a17e27250ba893bed9eeeec525d1119c8f27"><code>97a8a17</code></a>
fix(transport): apply refreshed bearer token after cross-host redirect
(<a
href="https://redirect.github.com/google/go-containerregistry/issues/2337">#2337</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/e9634975f4ac2a144391092b10d756ee53c20303"><code>e963497</code></a>
internal/gzip: fix goroutine leak in ReadCloserLevel (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2347">#2347</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/02649eab0d52601b1a082ef2c574c195a5e147fc"><code>02649ea</code></a>
fix: prevent SSRF in google.List() pagination (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2332">#2332</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/7204b401d376fe336fd00e2a4a0c03edc1d40d56"><code>7204b40</code></a>
build(deps): bump the actions group across 1 directory with 2 updates
(<a
href="https://redirect.github.com/google/go-containerregistry/issues/2344">#2344</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/4cfaa93eb4440240c3ed453eae4f328babd7ccfc"><code>4cfaa93</code></a>
build(deps): bump the go-deps group across 1 directory with 2 updates
(<a
href="https://redirect.github.com/google/go-containerregistry/issues/2343">#2343</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/6849394e8a65e2da1177d5b5b00e903551ada1c9"><code>6849394</code></a>
pkg/registry: export RedirectError (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2177">#2177</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.6&new-version=0.21.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 10 +++++-----
 go.sum | 20 ++++++++++----------
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/go.mod b/go.mod
index ec720a0..c0a9a45 100644
--- a/go.mod
+++ b/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/coreos/go-oidc/v3 v3.19.0
 	github.com/danielgtaylor/huma/v2 v2.38.0
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-containerregistry v0.21.6
+	github.com/google/go-containerregistry v0.21.7
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/rs/cors v1.11.1
@@ -22,7 +22,7 @@ require (
 	go.opentelemetry.io/otel/metric v1.44.0
 	go.opentelemetry.io/otel/sdk v1.44.0
 	go.opentelemetry.io/otel/sdk/metric v1.44.0
-	golang.org/x/mod v0.36.0
+	golang.org/x/mod v0.37.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -40,7 +40,7 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/cli v29.4.3+incompatible // indirect
+	github.com/docker/cli v29.5.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
@@ -73,8 +73,8 @@ require (
 	golang.org/x/crypto v0.51.0 // indirect
 	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/api v0.274.0 // indirect
diff --git a/go.sum b/go.sum
index fb9aa28..f7a0590 100644
--- a/go.sum
+++ b/go.sum
@@ -43,8 +43,8 @@ github.com/danielgtaylor/huma/v2 v2.38.0/go.mod h1:k9hwjlgWFt1t2jsmQGlsgXAG2FBTZ
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docker/cli v29.4.3+incompatible h1:u+UliYm2J/rYrIh2FqHQg32neRG8GjbvNuwQRTzGspU=
-github.com/docker/cli v29.4.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.5.3+incompatible h1:nbEFfz774vBwQ5KRYv7c/AghjReqnGISvrRhzjV0evs=
+github.com/docker/cli v29.5.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
 github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
@@ -69,8 +69,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-containerregistry v0.21.6 h1:T+yqQIlJXKrM98Om4DlW3GoWQAmhZuLMwoDOvVrtiUM=
-github.com/google/go-containerregistry v0.21.6/go.mod h1:U7MMSBIJynke2MVQrQk19NP9k/uQsGz/h0amIFSHMbo=
+github.com/google/go-containerregistry v0.21.7 h1:/vPFuVXDjtFREsVArW+0h1CIl5urnOhzei4X2DMW9IU=
+github.com/google/go-containerregistry v0.21.7/go.mod h1:kjSbt7/zMsKLWfnHrIvKvhXHUw91jbe9DNjPPJ32gXE=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -162,17 +162,17 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
 golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
 golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=