Skip to content

chore(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 - #14377

Merged
williammartin merged 1 commit into
trunkfrom
dependabot/go_modules/github.com/google/go-containerregistry-0.22.1
Sep 10, 2026
Merged

chore(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1#14377
williammartin merged 1 commit into
trunkfrom
dependabot/go_modules/github.com/google/go-containerregistry-0.22.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/google/go-containerregistry from 0.22.0 to 0.22.1.

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.22.1

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.22.0...v0.22.1

Commits
  • 8a72a42 remote: copy manifest annotations to referrers fallback tag descriptors (#2441)
  • 5765c35 build(deps): bump the go-deps group across 2 directories with 3 updates (#2439)
  • 969402f fix(mutate): make Time layer updates lazy (#2429)
  • 25c682e flatten: preserve config and layer media types when flattening (#2438)
  • 79af990 remote: add SSRF redirect protection to writer-side HTTP clients (#2432)
  • 4b9b3c7 fix(release): honor declared Go toolchain (#2435)
  • e033b9c fix(build): install binaries to /ko-app and add to PATH (#2424) (#2436)
  • 8bd7902 name: return a helpful error when a reference contains a URL scheme (#2431)
  • 163134d validate: support index attestation manifests and empty configs (#2414)
  • 44f7ea3 fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml (#2434)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump github.com/google/go-containerregistry
123c1e7 
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.22.0 to 0.22.1.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.22.0...v0.22.1)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 7, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 7, 2026 14:03
@dependabot
dependabot Bot requested a review from sergiou87 September 7, 2026 14:03
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 7, 2026
@cli-triage

cli-triage Bot commented Sep 7, 2026

Copy link
Copy Markdown

Recommendation: Merge, Confidence: Medium

go-containerregistry is a direct dependency and several of its packages (pkg/authn, pkg/v1/remote, pkg/v1/remote/transport, etc.) are compiled into the shipped gh binary. The v0.22.1 release bundles many upstream PRs, most notably SSRF-guard hardening for redirects (79af990, google/go-containerregistry#2432) and stricter IP-literal rejection (google/go-containerregistry#2426), which are additive security fixes rather than behavior changes this repo's usage would regress on. Given the release spans many commits touching remote, mutate, and name packages that this repo's reachable surface overlaps with, I did not walk every commit individually, so I'm capping confidence at Medium rather than exhaustively verifying each change against this repo's specific call patterns.

Assessed at head commit 123c1e72cca4dbb06702e3dc5c2f44bcef6f96fb.

Generated by Dependabot PR Triage (skills-driven) · copilot · auto · 41.1 AIC · ⌖ 2.58 AIC · ⊞ 8.7K · ◷

@williammartin
williammartin merged commit abd3967 into trunk Sep 10, 2026
42 checks passed
@williammartin
williammartin deleted the dependabot/go_modules/github.com/google/go-containerregistry-0.22.1 branch September 10, 2026 13:55
@BrewTestBot BrewTestBot mentioned this pull request Sep 15, 2026
Merged
@scottames-github-bot scottames-github-bot Bot mentioned this pull request Sep 20, 2026
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@williammartin williammartin williammartin approved these changes
@sergiou87 sergiou87 Awaiting requested review from sergiou87 sergiou87 is a code owner automatically assigned from cli/code-reviewers

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@williammartin