v1.0.1

What's Changed

Security

• golang.org/x/net v0.61.0: CVE-2026-78661 CVE-2026-97045
• 🔗 stricter acr host check: by @8none1 in #56

Maintenance

• build(deps): bump golang.org/x/net from 0.61.0 to 0.62.0: #55
• build(deps): bump step-security/harden-runner from 2.22.2 to 2.22.4: #54 #60
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.3 to 1.24.0: #57
• build(deps): bump github.com/docker/cli from 29.9.2 to 29.9.3: #59
• build(deps): bump github.com/spf13/pflag from 1.0.10 to 1.1.0: #61

Fork Related

• lower the go directive to 1.26.0: #58

v1.0.0

Update Notice

In this Release we activated this feature-flag:

• FF_DOCKER_ACR_AZIDENTITY

FF_DOCKER_ACR_AZIDENTITY acquires the token through azidentity instead of go-autorest, which Microsoft retired. The credential sources are the same, environment variables, workload identity and managed identity, so no migration is needed.

You can roll-back this change by overriding it in the environment ie.

job:
  variables:
    FF_DOCKER_ACR_AZIDENTITY: "0"

Please also notify us by filing a new issue.

We further removed this feature-flag:

• FF_DOCKER_ACR_REGISTRY_SCOPED_TOKEN

The access token is now always requested for the registry instead of Azure Resource Manager, so a token that reaches the wrong host is useless outside ACR. The flag has no effect and can be removed.

What's Changed

Security

• go stdlib v1.26.9: CVE-2026-111943 (eMudhra)

Usability

• graduate feature flags for v1.0.0 release: #42

Maintenance

• build(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0: #40
• build(deps): bump github.com/docker/cli from 29.8.2 to 29.9.2: #39 #43 #46
• build(deps): bump go from 1.26.9 to 1.27.3: #13 #47
• build(deps): bump github.com/docker/docker-credential-helpers from 0.9.9 to 0.9.12: #43 #46
• build(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3: #43
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.1 to 1.15.0: #44
• build(deps): bump step-security/harden-runner from 2.22.1 to 2.22.2: #45
• build(deps): bump github.com/dimchansky/utfbom from 1.1.1 to 1.2.0: #49
• build(deps): bump the runner image from ubuntu-24.04 to ubuntu-26.04: #51
• build(deps): bump golang.org/x/vuln/cmd/govulncheck from 1.6.0 to 1.9.0: #50

Fork Related

• stop dependabot from holding back updates with a cooldown: #48

v0.9.2

What's Changed

Security

• go stdlib v1.26.8: CVE-2026-56866 CVE-2026-78659 CVE-2026-78660 CVE-2026-78663 CVE-2026-78669 CVE-2026-94439 CVE-2026-94440 CVE-2026-97031 CVE-2026-97032
• golang.org/x/net v0.58.0: CVE-2026-78659 CVE-2026-78660 CVE-2026-78663 CVE-2026-78669 CVE-2026-97032
• golang.org/x/crypto v0.55.0: CVE-2026-56855 CVE-2026-78662

Maintenance

• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.1 to 1.23.3: #20 #22
• build(deps): bump step-security/harden-runner from 2.21.1 to 2.22.1: #21 #23
• build(deps): bump go from 1.26.8 to 1.26.9: #24
• build(deps): bump golang.org/x/sync from 0.22.0 to 0.24.0: #27
• build(deps): bump github.com/docker/cli from 29.7.2 to 29.8.2: #28
• build(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.1: #29
• build(deps): bump golang.org/x/net from 0.58.0 to 0.61.0: #35 #37
• build(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2: #34
• build(deps): bump github.com/AzureAD/microsoft-authentication-library-for-go from 1.8.0 to 1.10.1: #36
• build(deps): bump golang.org/x/sys from 0.47.0 to 0.49.0: #30

Fork Related

• let dependabot bump indirect dependencies: #26
• lower the go directive to 1.26.0 and pin the toolchain to go 1.26.9: #32

v0.9.1

What's Changed

Usability

• release binaries for riscv64, ppc64le, s390x and 32 bit arm: #15

Maintenance

• build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1: #16
• build(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1: #17
• build(deps): bump go from 1.26.7 to 1.26.8: #18

v0.9.0

Update Notice

In this Release we activated these feature-flags:

• FF_DOCKER_ACR_REGISTRY_SCOPED_TOKEN

⚠️ AZURE_AD_RESOURCE no longer has any effect while this flag is on. It only ever widened the audience, which is the opposite of what the flag is for.

FF_DOCKER_ACR_REGISTRY_SCOPED_TOKEN asks AAD for a token scoped to https://containerregistry.azure.net instead of https://management.azure.com/. The token is handed to whatever host came out of the image reference, as a Bearer header and as an access_token form field, so until now a host that got the token by mistake held one good for the whole subscription. It is now good for ACR and nothing else. No migration needed, the service principal or managed identity needs no extra role, the exchange the helper performs is the same one.

You can roll-back this change by overriding it in the environment ie.

job:
  variables:
    FF_DOCKER_ACR_REGISTRY_SCOPED_TOKEN: "0"

Please also notify us by filing a new issue.

What's Changed

Security

• FF_DOCKER_ACR_REGISTRY_SCOPED_TOKEN=true an ARM scoped token good for the whole subscription is handed to a host that came out of an image reference: #12
• go stdlib v1.26.5: CVE-2026-33818 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862
• golang.org/x/crypto v0.54.0: CVE-2026-56854

Maintenance

• build(deps): bump step-security/harden-runner from 2.20.0 to 2.21.0: #5 #8
• build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0: #10
• build(deps): bump go from 1.26.5 to 1.26.7: #9
• build(deps): bump github.com/docker/docker-credential-helpers from 0.9.8 to 0.9.9: #11

Fork Related

• add a dependabot config: #4
• add a funding config: #6
• the nightly vulnerability scan swallows its exit code: #7

Refactorings

• FF_DOCKER_ACR_AZIDENTITY=false acquire the token and exchange it through azidentity and azcontainerregistry instead of the retired go-autorest stack: #1

v0.8.0

Community Update

Many thanks to @chrismellard for maintaining docker-credential-acr-env over all those years. We are happy to continue his work and will honour his contributions. This helper is used inside our kaniko executor image, and we promise to maintain it to the same standard.

What's Changed

Security

• the ACR host pattern was unanchored, so any hostname that contained azurecr.io was treated as ACR and handed an Azure access token: 5ce8219
• golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa: CVE-2023-48795 CVE-2024-45337 CVE-2025-22869 CVE-2025-47913 CVE-2025-47914 CVE-2025-58181 CVE-2026-39827 CVE-2026-39828 CVE-2026-39829 CVE-2026-39830 CVE-2026-39831 CVE-2026-39832 CVE-2026-39833 CVE-2026-39834 CVE-2026-39835 CVE-2026-42508 CVE-2026-46595 CVE-2026-46597 CVE-2026-46598
• golang.org/x/text v0.3.6: CVE-2021-38561 CVE-2022-32149 CVE-2026-56852
• golang.org/x/sys v0.0.0-20220325203850-36772127a21f: CVE-2022-29526 CVE-2026-39824
• github.com/golang-jwt/jwt/v4 v4.2.0: CVE-2024-51744 CVE-2025-30204
• the toolchain is pinned to go1.26.5, so released binaries carry a current standard library

Usability

• Add --version: 93ea027

Maintenance

• bump go from 1.18 to 1.26
• bump github.com/Azure/azure-sdk-for-go from v46.4.0 to v68.0.0
• bump github.com/Azure/go-autorest/autorest from v0.11.28 to v0.11.30
• bump github.com/Azure/go-autorest/autorest/adal from v0.9.21 to v0.9.24
• bump github.com/Azure/go-autorest/autorest/azure/auth from v0.5.11 to v0.5.13
• bump github.com/docker/docker-credential-helpers from v0.6.3 to v0.9.8
• bump github.com/golang-jwt/jwt/v4 from v4.2.0 to v4.5.2
• bump github.com/spf13/cobra from v1.2.0 to v1.10.2
• bump github.com/google/go-containerregistry to v0.21.9: #3

Fork Related

• Rename the module and the binary to docker-credential-acr: 5164fb5
• Add integration tests against a live ACR, covering the federated and the managed identity route: 5cf9c6f dc685b2
• Drop viper and the config file parsers it pulled in: 7f1ea58
• Vendor the dependencies: ca08f86
• Harden the CI, add a nightly vulnerability scan, publish releases as drafts: c2658c8 a515e18
• Add a security policy: 37f465e
• Clean up the repo tooling: 4002976 f3bd066

Refactorings

• adal: NewServicePrincipalTokenFromFederatedToken is deprecated: 698a07d
• Linter pass: 236ca56