What's Changed
- ci: replace HELM_PUSH_TOKEN with App token and verified API commits by @andaaron in #4409
- chore(deps): bump the github-actions group with 6 updates by @dependabot[bot] in #4411
- fix: set Strict-Transport-Security header on TLS responses by @ravi-ciroos in #4414
- chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #4415
- fix(authn): avoid session CookieStore panic for anonymous UI clients by @andaaron in #4418
- fix: skip invalid repo dirs like lost+found during storage walks by @andaaron in #4419
- chore: fix dependabot alerts by @rchincha in #4424
- feat(sync): sparse multi-arch indexes with periodic platforms filter by @andaaron in #4410
- feat(auth): allow bearer with API keys and OIDC for humans by @matheuscscp in #4243
- ci: fix nightly by @andaaron in #4425
- chore(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #4426
- fix(zb): create and remove a dedicated temp dir for test blobs by @warisshaikh1 in #4428
- fix(storage): 404 when S3 dedupe stubs resolve to empty content by @andaaron in #4432
- chore: fix dependabot alerts by @rchincha in #4439
- chore: fix dependabot alerts by @rchincha in #4441
- fix(scanner): synchronize trivy scans by @rchincha in #4440
- fix(storage): repair equal-size corrupted manifests on re-upload by @Lcos-000 in #4443
- test(scanner): fix flaky concurrent ScanImage coalescing test by @andaaron in #4446
- fix(gc): validate cosign tag subject digest before use in removeReferrer by @rchincha in #4445
- fix(storage): keep digests pullable after last-tag overwrite (#4444) by @andaaron in #4447
- test: stabilize apikey expiry test by @andaaron in #4450
- fix(api): list tags after a last value that is not a tag by @omlahore in #4448
- chore(deps): bump the go-dependencies group with 12 updates by @dependabot[bot] in #4458
- feat(sync): seed on-demand sync sessions with locally-stored blobs by @kwohlfahrt in #4420
- fix(api): return 404 when deleting a manifest in a missing repo by @omlahore in #4460
- fix(storage): list repositories after a last value that is not a repo by @omlahore in #4455
- fix(meta): avoid DeleteSignature panic when signature type is missing by @andaaron in #4459
- feat(sync): add onDemandInBackground for non-blocking on-demand sync by @andaaron in #4451
- feat: add zot healthcheck for distroless container probes by @andaaron in #4461
- chore(deps): bump github.com/containerd/containerd/v2 from 2.3.5 to 2.3.6 by @dependabot[bot] in #4462
- feat(server): notify systemd when ready by @andaaron in #4464
- fix(meta): update repo info when index manifests are added after the index by @rophy in #4470
- fix(storage): repair remote dedupe origin on manifest re-upload by @Lcos-000 in #4457
- fix(auth): never proxy local api keys to upstream token service by @matheuscscp in #4473
- fix(api): report the whole upload in the Range of a streamed PATCH by @omlahore in #4476
- fix(api): reject manifest pushes with an invalid path tag by @omlahore in #4475
- chore(deps): bump the github-actions group with 5 updates by @dependabot[bot] in #4478
- fix(cve): don't read MetaDB inside the scan generator's FilterTags filter by @rophy in #4483
- test: hash test htpasswd credentials with the minimum bcrypt cost by @rophy in #4481
- fix(api): don't overflow the tags/list page end for a large n by @omlahore in #4489
- fix(storage): return an empty referrers index for a namespace without a repo by @omlahore in #4488
- test(stress): pull alpine from project GHCR instead of ECR Public by @andaaron in #4490
- test(gc): start the scheduler before stopping it in runSchedulerUntil by @rophy in #4494
- bug: treat cosign attestations as referrers, not signatures by @FStelzer in #4492
- test(race): fix race condition when running dynamodb tests by @andaaron in #4496
- fix(storage): keep remote dedupe origins from being emptied on rebuild by @andaaron in #4465
- fix(cli): don't ignore SIGCHLD, so child processes can be waited for by @cbirkhold in #4499
- fix(build): tag the image make docker-image builds by @omlahore in #4501
- chore(deps): bump the go-dependencies group with 10 updates by @dependabot[bot] in #4503
- fix(storage): avoid remote-cache races during concurrent dedupe uploads by @andaaron in #4504
- fix(storage): classify driver errors as missing, transient, or permanent by @andaaron in #4474
- fix(meta): stop storing signature layers in MetaDB, verify from storage by @FStelzer in #4493
- fix: complete GC when repository metadata is absent by @mvanhorn in #4500
- test(metrics): disable dedupe in TestPopulateStorageMetrics by @andaaron in #4509
- fix(zb): treat unexpected EOF as a timeout-class failure by @andaaron in #4510
- fix(sync): surface on-demand upstream errors by @andaaron in #4507
- fix(storage): stop collapsing blob I/O to bare ErrBlobNotFound by @andaaron in #4505
- fix(zb): retry timeout-class errors on seed image uploads by @andaaron in #4511
- fix(api): map storage Transient to 503, not client 404 by @andaaron in #4512
- chore(deps): bump the github-actions group with 7 updates by @dependabot[bot] in #4516
- fix(api): return MANIFEST_BLOB_UNKNOWN for a manifest with a missing blob by @omlahore in #4515
- fix(storage): fail closed on GC, dedupe, and incomplete listings by @andaaron in #4514
- chore: bump zui version by @rchincha in #4519
- fix: improve input validation by @rchincha in #4521
New Contributors
- @ravi-ciroos made their first contribution in #4414
- @warisshaikh1 made their first contribution in #4428
- @omlahore made their first contribution in #4448
- @kwohlfahrt made their first contribution in #4420
- @rophy made their first contribution in #4470
- @FStelzer made their first contribution in #4492
- @cbirkhold made their first contribution in #4499
- @mvanhorn made their first contribution in #4500
Full Changelog: v2.1.21...v2.1.22