fix(deps): update module github.com/google/go-containerregistry to v0.21.4 (main)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
github.com/google/go-containerregistry	require	minor	v0.20.7 -> v0.21.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

google/go-containerregistry (github.com/google/go-containerregistry)

v0.21.4

Compare Source

What's Changed

• go.mod: do not make a viral minimum go version by @​howardjohn in https://github.com/google/go-containerregistry/pull/2237
• Avoid pruning absolute links from extracted and flattened images by @​Subserial in https://github.com/google/go-containerregistry/pull/2241
• Bump the go-deps group across 3 directories with 5 updates by @​dependabot[bot] inhttps://github.com/google/go-containerregistry/pull/22455
• fix: update to go1.25.8, and use separate .go-version file by @​thaJeztah in https://github.com/google/go-containerregistry/pull/2246
• Bump CI go version to 1.26.1 by @​Subserial in https://github.com/google/go-containerregistry/pull/2242
• Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group by @​dependabot[bot] inhttps://github.com/google/go-containerregistry/pull/22400
• fork distribution client v3 auth-challenge as an internal package (squashed) by @​thaJeztah in https://github.com/google/go-containerregistry/pull/2248
• transport: validate Bearer realm URL to prevent SSRF by @​evilgensec in https://github.com/google/go-containerregistry/pull/2243
• revert path traversal and symlink escape from #​2227 by @​Subserial in https://github.com/google/go-containerregistry/pull/2250
• Fix pkg/v1/google/auth tests for arm64 by @​Subserial in https://github.com/google/go-containerregistry/pull/2085
• goreleaser: Update goreleaser config and GH action by @​Subserial in https://github.com/google/go-containerregistry/pull/2253

New Contributors

• @​evilgensec made their first contribution in https://github.com/google/go-containerregistry/pull/2243

Full Changelog: google/go-containerregistry@v0.21.3...v0.21.4

v0.21.3

Compare Source

What's Changed

• Adds local file support to the crane index subcommand by @​edwardthiele in https://github.com/google/go-containerregistry/pull/2223
• migrate to github.com/moby/moby modules by @​thaJeztah in https://github.com/google/go-containerregistry/pull/2228
• Bump the go-deps group across 4 directories with 7 updates by @​dependabot[bot] inhttps://github.com/google/go-containerregistry/pull/22333
• Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group by @​dependabot[bot] inhttps://github.com/google/go-containerregistry/pull/22200
• mutate: reject path traversal and symlink escape in Extract by @​KevinZhao in https://github.com/google/go-containerregistry/pull/2227
• tarball: detect symlink cycles in extractFileFromTar by @​vnykmshr in https://github.com/google/go-containerregistry/pull/2232
• bump golang to 1.25.7 by @​Subserial in https://github.com/google/go-containerregistry/pull/2236

New Contributors

• @​edwardthiele made their first contribution in https://github.com/google/go-containerregistry/pull/2223
• @​thaJeztah made their first contribution in https://github.com/google/go-containerregistry/pull/2228
• @​KevinZhao made their first contribution in https://github.com/google/go-containerregistry/pull/2227
• @​vnykmshr made their first contribution in https://github.com/google/go-containerregistry/pull/2232

Full Changelog: google/go-containerregistry@v0.21.2...v0.21.3

v0.21.2

Compare Source

What's Changed

• Better handle redirects to https in ping by @​jonjohnsonjr in https://github.com/google/go-containerregistry/pull/2225

Full Changelog: google/go-containerregistry@v0.21.1...v0.21.2

v0.21.1

Compare Source

This release fixes a regression in crane introduced in the previous release.

What's Changed

• Add WithFileBufferedOpener for file-backed daemon image buffering by @​twdamhore in https://github.com/google/go-containerregistry/pull/2214
• crane: fix case in auth response json by @​aelindeman in https://github.com/google/go-containerregistry/pull/2218

New Contributors

• @​twdamhore made their first contribution in https://github.com/google/go-containerregistry/pull/2214
• @​aelindeman made their first contribution in https://github.com/google/go-containerregistry/pull/2218

Full Changelog: google/go-containerregistry@v0.21.0...v0.21.1

v0.21.0

Compare Source

This release updates the minimum Go version to 1.25.6.

What's Changed

• fix(mutate): don't skip dir replacements via whiteout in export by @​r4f4 in https://github.com/google/go-containerregistry/pull/2191
• Improve performance of v1.NewHash by @​bmoylan in https://github.com/google/go-containerregistry/pull/2194
• Bump the actions group across 1 directory with 4 updates by @​dependabot[bot] inhttps://github.com/google/go-containerregistry/pull/22077
• Bump the root-deps group across 1 directory with 7 updates by @​dependabot[bot] inhttps://github.com/google/go-containerregistry/pull/21955
• Fix error messages in crane_test.go by @​jammie-jelly in https://github.com/google/go-containerregistry/pull/2189
• Bump go version across packages to 1.25.6 by @​Subserial in https://github.com/google/go-containerregistry/pull/2211
• Join go.mod dependency updates by @​Subserial in https://github.com/google/go-containerregistry/pull/2212
• Bump the go-deps group across 3 directories with 3 updates by @​dependabot[bot] inhttps://github.com/google/go-containerregistry/pull/22133
• Disable taint gosec lints by @​Subserial in https://github.com/google/go-containerregistry/pull/2215
• Update go version used in goreleaser by @​Subserial in https://github.com/google/go-containerregistry/pull/2216

New Contributors

• @​r4f4 made their first contribution in https://github.com/google/go-containerregistry/pull/2191
• @​jammie-jelly made their first contribution in https://github.com/google/go-containerregistry/pull/2189

Full Changelog: google/go-containerregistry@v0.20.7...v0.21.0

v0.20.8

Compare Source

---

Configuration

📅 Schedule: Branch creation - "* 1 * * 1-5" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[elastic-renovate-prod]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 11 additional dependencies were updated

Details:

Package	Change
golang.org/x/oauth2	v0.35.0 -> v0.36.0
github.com/moby/moby/api	v1.53.0 -> v1.54.0
github.com/moby/moby/client	v0.2.2 -> v0.3.0
golang.org/x/tools	v0.42.0 -> v0.43.0
github.com/docker/cli	v29.2.0+incompatible -> v29.3.1+incompatible
github.com/klauspost/compress	v1.18.4 -> v1.18.5
golang.org/x/crypto	v0.48.0 -> v0.49.0
golang.org/x/mod	v0.33.0 -> v0.34.0
golang.org/x/net	v0.51.0 -> v0.52.0
golang.org/x/term	v0.40.0 -> v0.41.0
golang.org/x/text	v0.34.0 -> v0.35.0

[elastic-renovate-prod]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v0.21.4). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.