Skip to content

chore(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 - #14267

Merged
williammartin merged 1 commit into
trunkfrom
dependabot/go_modules/github.com/google/go-containerregistry-0.22.0
Aug 28, 2026
Merged

chore(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0#14267
williammartin merged 1 commit into
trunkfrom
dependabot/go_modules/github.com/google/go-containerregistry-0.22.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 26, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/google/go-containerregistry from 0.21.9 to 0.22.0.

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.22.0

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.9...v0.21.10

Commits
  • 3f4ff3c fix(build): unify new build flow into cloudbuild_v2.yaml (#2419)
  • c6b5acd fix(build): correct Cloud Build schema options and source provenance hash (#2...
  • 8f4a85d go.mod: bump Go version + add toolchain directive to replace .go-version file...
  • 5481560 build(deps): bump the go-deps group across 1 directory with 3 updates (#2415)
  • 5b5c272 build(deps): bump the actions group across 1 directory with 8 updates (#2405)
  • 66dd454 remote: retry failed Puller and Pusher initialization (#2406)
  • 3f47f91 fix: add missing substitutions and workspace cleanup to new build files (#2413)
  • 4cb3583 Allow single-character repository paths (#2407)
  • 82cc428 remote: resolve push-check credentials against the repository (#2411)
  • 97815aa build: add multi-architecture Cloud Build configurations for crane, gcrane, a...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump github.com/google/go-containerregistry
3f5ef1f 
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.9 to 0.22.0.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.9...v0.22.0)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 26, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 26, 2026 14:03
@dependabot
dependabot Bot requested a review from tidy-dev August 26, 2026 14:03
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 26, 2026
@cli-triage

cli-triage Bot commented Aug 26, 2026

Copy link
Copy Markdown

Recommendation: Merge, Confidence: High

go.mod/go.sum are the only files touched and match the claimed bump exactly, no unrelated edits. This module is a direct, non-indirect requirement, and its packages (pkg/authn, pkg/name, pkg/v1, pkg/v1/remote, pkg/v1/remote/transport, etc.) are compiled into the shipped binary, backing gh attestation's OCI artifact fetch/verify path in pkg/cmd/attestation/artifact/oci/client.go. The upstream commits between v0.21.9 and v0.22.0 are additive/internal (extending mutate.Time/Canonical to accept tarball.LayerOption, a credential-resolution fix and retry logic in remote, plus CI/build tooling changes) with no removed or renamed exported APIs affecting the packages this repo imports.

Assessed at head commit 3f5ef1f55df0ae2e7bf88f8f366de8da55d7fd2e.

Generated by Dependabot PR Triage (skills-driven) · auto · 62.4 AIC · ⌖ 0.852 AIC · ⊞ 8.7K · ◷

@williammartin
williammartin merged commit 9b323de into trunk Aug 28, 2026
42 checks passed
@williammartin
williammartin deleted the dependabot/go_modules/github.com/google/go-containerregistry-0.22.0 branch August 28, 2026 09:29
@BrewTestBot BrewTestBot mentioned this pull request Sep 1, 2026
Merged
@scottames-github-bot scottames-github-bot Bot mentioned this pull request Sep 6, 2026
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@williammartin williammartin williammartin approved these changes
@tidy-dev tidy-dev Awaiting requested review from tidy-dev tidy-dev is a code owner automatically assigned from cli/code-reviewers

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@williammartin