deps: bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 - #133
Conversation
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.22.0 to 0.22.1. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.22.0...v0.22.1) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.22.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![dap-code-review-by-crunchloop[bot]](https://avatars.githubusercontent.com/u/97309830?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review — 20ecda6 · CLEAN
Clean dependabot patch bump of go-containerregistry 0.22.0 → 0.22.1 touching only go.mod and go.sum; no findings.
What I reviewed
I verified the diff is exactly the version bump with consistent go.sum hashes, checked every use of the dependency in this repository (authn.Keychain in engine.go and feature/disk_store.go, name/remote in feature/oci.go) against the upstream v0.22.0…v0.22.1 changelog, and confirmed the one behavioral change (authn no longer overwriting AuthConfig.Auth on empty credentials) does not touch any call site here. The bump is security-positive: it adds SSRF redirect guards to the remote paths this repo uses for OCI feature pulls.
Coverage notes: I reviewed the diff in full and the consuming code paths by reading; I did not execute a build or type-check (go build ./... would settle compile compatibility, though a patch release with an unchanged go.mod hash makes an API break implausible). No .dap/code-review.yml exists at the directives base, so I reviewed against the core dimensions alone.
CLEAN — this round found nothing. Reply in a finding's own thread to argue it. On the pull request I answer @dap-code-review-by-crunchloop review, pause and resume.
Bumps github.com/google/go-containerregistry from 0.22.0 to 0.22.1.
Release notes
Sourced from github.com/google/go-containerregistry's releases.
Commits
8a72a42remote: copy manifest annotations to referrers fallback tag descriptors (#2441)5765c35build(deps): bump the go-deps group across 2 directories with 3 updates (#2439)969402ffix(mutate): make Time layer updates lazy (#2429)25c682eflatten: preserve config and layer media types when flattening (#2438)79af990remote: add SSRF redirect protection to writer-side HTTP clients (#2432)4b9b3c7fix(release): honor declared Go toolchain (#2435)e033b9cfix(build): install binaries to /ko-app and add to PATH (#2424) (#2436)8bd7902name: return a helpful error when a reference contains a URL scheme (#2431)163134dvalidate: support index attestation manifests and empty configs (#2414)44f7ea3fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml (#2434)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)