v2.1.2

Release Overview for Hauler v2.1.2

v2.1.2 is a patch release. Please give it a try today!!

It fixes credential and presigned url leaks, local chart handling, haul formats from --filename, and hauler store copy with image-type files and cosign bundles. It adds hauler, hauler-dev, and hauler@<version> homebrew casks, and it is the first release published through them. It also bumps go to 1.27.2.

---

⚠️ Breaking Changes

• N/A

---

✨ New Features

PR	Summary	Details
#889	Homebrew casks	brew install hauler installs the latest release, brew install hauler-dev installs the latest release, release candidate, or dev build, and brew install hauler@<version> installs a specific release.

---

🐛 Bug Fixes

PR	Summary	Details
#858	Remote files with query strings	hauler store add fileo longer fail for remote urls with a query string or fragment (i.e.presigned S3/GCS urls)... the file name comes from the url path, and the full url is still used to download.
#892	Local charts without a repo	hauler store add chart my-er store sync no longer fail with path "/my-chart-1.0.0.tgz" not foundwhen no --repo or repoURL is set.
#893	Local charts with absolute paths	hauler store add char no longer fail with could not find protocol handler for: ... when--repoorrepoURL` is an absolute path.
#894	Haul format follows --filename	hauler store save --frites a gzip archive instead of a zstdarchive with a.tar.gzname, the same for.tgz, .tar.xz, .tar.bz2, .tar.lz4, and .tar.br`.
#898	Image-type files in hauler store copy	hauler store core serve fileserver no longer skip files shipped with an image config and titled layers (i.e. rke2 release artifacts), matching hauler store extract.
#897	Cosign bundles in hauler store copy	New format cosign registries without the referrers api (i.e. hauler, ghcr.io,distribution), so signatures verify against the copy.
#895	Conflicts on versioned casks	hauler@<version> casks chauler-dev instead of failing with It seems there is already a Binary at '/opt/homebrew/bin/hauler'.
#856	Typos in hauler store serve flags	Fixed typos in the help text.
#879	hauler store serve registry --directory flag text	Updated the --directory flag help text for hauler store serve registry.

---

🔒 Security Fixes

PR	Summary	Details
#857	Credential leaks with files and charts	hauler store add file and hauler store add chart with a credentialed url (i.e. https://user:token@...) no longer store the credentials in the store's index.json and config blobs they no longer end up in saved hauls.
#863	Presigned url leaks with files and hauls	hauler store add file and hauler store add chart with a presigned url (i.e. ?X-Amz-Signature=...) no longer store the signature in the store's index.json and config blobs, and haur store sync with remote hauls and manifests no longer print it in logs or errors.

---

🔧 Maintenance & Tooling

• Release: homebrew updates open a pull request to homebrew-tap instead of pushing to main (#889).
• Tooling: fixed the vex url for make vulns (#896), added bump-outdated, and grouped dependabot updates (#899).
• Docs: updated the readme and added the hauler logos (#904).

---

📦 Dependency Updates

Dependency	From	To	PR
go	1.27.0	1.27.2	#886, #908
k8s.io/apimachinery	0.37.0	0.37.1	#871, #886
github.com/containerd/containerd/v2	2.3.5	2.4.1	#849, #873
github.com/distribution/distribution/v3	3.1.1	3.1.2	#872
github.com/sigstore/sigstore	1.10.10	1.11.0	#852
github.com/dustin/go-humanize	1.0.1	1.1.0	#850
github.com/olekukonko/tablewriter	1.1.4	1.1.5	#843
golang.org/x/crypto	0.57.0	0.58.0	#902
golang.org/x/sync	0.23.0	0.24.0	#902
golang.org/x/term	0.46.0	0.47.0	#902
golang.org/x/mod	0.41.0	0.42.0	#906

---

📒 Full Changelog

• v2.1.1...v2.1.2

👥 Contributors

@zackbradys
@dependabot[bot]