What's Changed
- chore(deps): bump the go-dependencies group with 15 updates by @dependabot[bot] in #4526
- chore: bump golangci-lint by @andaaron in #4529
- fix(sync): trust every CA in certDir, not just the last .crt by @omlahore in #4530
- fix(storage): free leftover uploads after full-disk push failures by @andaaron in #4527
- fix(sync): follow Link header when paginating the remote catalog by @sagrawal-byte in #4528
- feat(authz): support per-user repository namespaces by @laurivosandi in #4502
- feat(sync): stream image blobs to clients during on-demand sync by @rchincha in #4407
- ci: nail minimum coverage requirement at 94% by @andaaron in #4532
- chore: bump zui version by @andaaron in #4534
- fix: miscellaneous test fixes by @rchincha in #4536
- refactor(storage): lock image stores through repo-scoped wrappers by @rchincha in #4538
- refactor(storage): name the repo at every repo-scoped lock site in th… by @rchincha in #4539
- chore(deps): bump the github-actions group with 7 updates by @dependabot[bot] in #4540
- fix(cache): miscellaneous cache fixes by @rchincha in #4541
- feat(authz): add option to disable anonymous catalog listing by @ravi-ciroos in #4537
- refactor(storage): lock wrappers for shared content, and a blob lifecycle for local vs remote storage by @rchincha in #4542
- fix(search): don't report unscannable manifests as scan errors by @omlahore in #4546
- fix(storage): use per-repo blob mtime for GC delay checks by @andaaron in #4551
- ci(nightly): fix long-running zb benchmark job reliability by @andaaron in #4553
- fix(storage): miscellaneous storage fixes before the common blobstore refactor by @rchincha in #4547
- ci(nightly): harden long-running zb and dedupe index fixture by @andaaron in #4554
- chore: fix dependabot alerts by @rchincha in #4556
- chore(deps): bump the go-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #4557
- fix: isolate bearer OIDC issuer failures and preserve cached verifica… by @rchincha in #4535
- test(blackbox): verify ModelPack model artifacts round-trip through zot by @rchincha in #4558
- ci: run lighter jobs on GitHub-hosted runners by @andaaron in #4562
- perf(storage): memoize and prefetch manifests once per repository walk by @andaaron in #4518
- test(sync): make the singleflight dedup test deterministic by @rchincha in #4565
- fix(auth): accept ID token signing algs from OIDC discovery by @WilliamJonasson in #4567
- fix(storage): fsync the directory after a committed rename by @paoValle in #4570
- feat(api): enforce per-repository logical byte quotas by @Lcos-000 in #4513
- feat(cli): support CA and client certificates per zli config by @cvas22 in #4572
- chore(deps): bump the go-dependencies group with 15 updates by @dependabot[bot] in #4579
- fix(api): consume final blob PUT bodies without length headers by @Lcos-000 in #4577
- docs(auth): document passphrase and OIDC token-exchange limits by @andaaron in #4593
- fix(storage): serialize blob upload finalization by @Lcos-000 in #4581
- chore(deps): bump the github-actions group with 8 updates by @dependabot[bot] in #4596
- chore(deps): bump github.com/go-chi/chi/v5 from 5.3.2 to 5.4.0 by @dependabot[bot] in #4597
- fix(ci): build skopeo without host gpgme libraries by @andaaron in #4600
- feat(api): accept digest-algorithm on blob upload POST by @andaaron in #4594
- test(trivy): share one Trivy database download per test process by @andaaron in #4618
- fix(auth): apply accessControl group membership to OpenID users by @NopeCharon in #4620
- fix(meta): keep untagged-retention statistics until the manifest is pruned by @andaaron in #4622
- fix(search): return multi-arch images from ImageListForCVE by @NopeCharon in #4621
- test(scrub): give TestScrubExtension a real interval by @andaaron in #4625
- fix(api): serialize manifest updates when MetaDB is enabled by @andaaron in #4626
- perf(meta): parse repos in parallel during the storage walk by @NopeCharon in #4631
- feat(api): add discoveryurl option for OpenID providers by @KimNorgaard in #4605
- chore: fix dependabot alerts by @rchincha in #4632
- fix(api): set up OpenID providers on first login so an unreachable is… by @rchincha in #4629
- fix(api): don't send a next Link when the catalog page ends on the last repo by @omlahore in #4633
- fix(retention): order equal-timestamp candidates and guard the regex cache by @mcaulifn in #4608
- test(redis): dial port 0 for unreachable Redis clients by @andaaron in #4635
- fix(api): deny repositories to bearer tokens without repository grant… by @rchincha in #4639
- fix(gc): keep a new sparse index whose manifests are not synced yet by @rophy in #4641
- fix(common): fail when the root CA file has no PEM certificate by @sarankumar1325 in #4642
- fix(cli): drain requests on shutdown, and fail when the server can't start by @rophy in #4638
- fix(sync): stop streaming a blob to a client that has disconnected by @mcaulifn in #4615
- test: cover eMudhra CA distrust in outbound requests by @rchincha in #4647
- fix(storage): keep a repository while its blob upload is unlisted by @andaaron in #4643
New Contributors
- @sagrawal-byte made their first contribution in #4528
- @laurivosandi made their first contribution in #4502
- @WilliamJonasson made their first contribution in #4567
- @paoValle made their first contribution in #4570
- @cvas22 made their first contribution in #4572
- @NopeCharon made their first contribution in #4620
- @KimNorgaard made their first contribution in #4605
- @mcaulifn made their first contribution in #4608
- @sarankumar1325 made their first contribution in #4642
Full Changelog: v2.1.22...v2.1.23