What's Changed
- go.mod: do not make a viral minimum go version by @howardjohn in #2237
- Avoid pruning absolute links from extracted and flattened images by @Subserial in #2241
- Bump the go-deps group across 3 directories with 5 updates by @dependabot[bot] in #2245
- fix: update to go1.25.8, and use separate .go-version file by @thaJeztah in #2246
- Bump CI go version to 1.26.1 by @Subserial in #2242
- Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group by @dependabot[bot] in #2240
- fork distribution client v3 auth-challenge as an internal package (squashed) by @thaJeztah in #2248
- transport: validate Bearer realm URL to prevent SSRF by @evilgensec in #2243
- revert path traversal and symlink escape from #2227 by @Subserial in #2250
- Fix pkg/v1/google/auth tests for arm64 by @Subserial in #2085
- goreleaser: Update goreleaser config and GH action by @Subserial in #2253
New Contributors
- @evilgensec made their first contribution in #2243
Full Changelog: v0.21.3...v0.21.4