v0.8.0

Community Update

Many thanks to @chrismellard for maintaining docker-credential-acr-env over all those years. We are happy to continue his work and will honour his contributions. This helper is used inside our kaniko executor image, and we promise to maintain it to the same standard.

What's Changed

Security

• the ACR host pattern was unanchored, so any hostname that contained azurecr.io was treated as ACR and handed an Azure access token: 5ce8219
• golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa: CVE-2023-48795 CVE-2024-45337 CVE-2025-22869 CVE-2025-47913 CVE-2025-47914 CVE-2025-58181 CVE-2026-39827 CVE-2026-39828 CVE-2026-39829 CVE-2026-39830 CVE-2026-39831 CVE-2026-39832 CVE-2026-39833 CVE-2026-39834 CVE-2026-39835 CVE-2026-42508 CVE-2026-46595 CVE-2026-46597 CVE-2026-46598
• golang.org/x/text v0.3.6: CVE-2021-38561 CVE-2022-32149 CVE-2026-56852
• golang.org/x/sys v0.0.0-20220325203850-36772127a21f: CVE-2022-29526 CVE-2026-39824
• github.com/golang-jwt/jwt/v4 v4.2.0: CVE-2024-51744 CVE-2025-30204
• the toolchain is pinned to go1.26.5, so released binaries carry a current standard library

Usability

• Add --version: 93ea027

Maintenance

• bump go from 1.18 to 1.26
• bump github.com/Azure/azure-sdk-for-go from v46.4.0 to v68.0.0
• bump github.com/Azure/go-autorest/autorest from v0.11.28 to v0.11.30
• bump github.com/Azure/go-autorest/autorest/adal from v0.9.21 to v0.9.24
• bump github.com/Azure/go-autorest/autorest/azure/auth from v0.5.11 to v0.5.13
• bump github.com/docker/docker-credential-helpers from v0.6.3 to v0.9.8
• bump github.com/golang-jwt/jwt/v4 from v4.2.0 to v4.5.2
• bump github.com/spf13/cobra from v1.2.0 to v1.10.2
• bump github.com/google/go-containerregistry to v0.21.9: #3

Fork Related

• Rename the module and the binary to docker-credential-acr: 5164fb5
• Add integration tests against a live ACR, covering the federated and the managed identity route: 5cf9c6f dc685b2
• Drop viper and the config file parsers it pulled in: 7f1ea58
• Vendor the dependencies: ca08f86
• Harden the CI, add a nightly vulnerability scan, publish releases as drafts: c2658c8 a515e18
• Add a security policy: 37f465e
• Clean up the repo tooling: 4002976 f3bd066

Refactorings

• adal: NewServicePrincipalTokenFromFederatedToken is deprecated: 698a07d
• Linter pass: 236ca56