v2.1.20

What's Changed

• chore: bump zui version by @rchincha in #4296
• fix(ci): pin zot release ver to v2.1.18 by @vrajashkr in #4297

Full Changelog: v2.1.19...v2.1.20

v2.1.19

What's Changed

• fix(api): align blob, manifest, and referrers handling with OCI conformance by @andaaron in #4165
• fix: update OCI conformance workflow and improve blob upload handling by @rchincha in #4170
• feat(notation): Add TSA truststore support to notation policy by @flixman in #4168
• feat: expose ArtifactType in ImageSummary GraphQL type by @rchincha in #4177
• fix(sync): enable exponential HTTP retry backoff via maxRetryDelay by @andaaron in #4175
• chore: fix dependabot alerts by @rchincha in #4181
• fix(gc): break orphan cycle when manifest blobs are missing from storage by @andaaron in #4180
• fix(notation): Decouple Signature trust UI processing from scanning by @flixman in #4178
• feat(oidc): support login flow for OIDC tokens by @matheuscscp in #4171
• fix(storage): normalize repository names to '/' separators on Windows by @zaldre in #4188
• feat(retention): add untagged retention configuration by @rchincha in #4191
• chore: fix dependabot alerts by @rchincha in #4192
• test(sync): stabilize file deletion in some of the tests by @andaaron in #4197
• chore: fix dependabot alerts by @rchincha in #4200
• fix(storage): only promote dedupe origin when the deleted blob is the origin (boltdb) by @archy-rock3t-cloud in #4201
• fix(gc): resolve subject digest for cosign .sbom tags, not only .sig by @archy-rock3t-cloud in #4203
• fix(meta): avoid panic on malformed cosign signature tag by @archy-rock3t-cloud in #4204
• fix(imagetrust): bind cosign signature verification to the manifest digest by @archy-rock3t-cloud in #4202
• fix(storage): defer blob deletes for cache-unknown blobs until dedupe rebuild completes by @johnathan-sq in #4195
• fix(zb): record benchmark errors in stats instead of aborting with log.Fatal by @andaaron in #4205
• ci: use more powerful runner to run unit tests by @andaaron in #4207
• chore: fix dependabot alerts by @rchincha in #4208
• ci: raise zb bench HTTP timeouts and wait for zot shutdown by @andaaron in #4219
• test: fix flaky test by @andaaron in #4218
• test: fix flaky server port binding in integration tests by @andaaron in #4216
• fix(meta): guard GetReferrersInfo against a missing referrer entry by @archy-rock3t-cloud in #4213
• feat(sync): add oauth2 credential helper for JWT assertion exchange #4146 by @Nafine in #4147
• fix(sync): predict post-OCI digest for on-demand skip checks by @andaaron in #4185
• fix(storage): verify manifest and config blob digests during scrub by @archy-rock3t-cloud in #4212
• test: migrate extensions and pkg/test from GetFreePort to port "0" by @andaaron in #4220
• fix(search): use index descriptor platform when config platform is empty by @andaaron in #4221
• chore: bump zui version by @rchincha in #4222
• ci(nightly): increase sync timeout by @rchincha in #4230
• test(sync): query zot over kind network in on-demand E2E by @andaaron in #4231
• fix(storage): skip reserved dirs in GetNextRepository walk by @thees in #4227
• ci: relax dco check for dependabot alerts by @rchincha in #4232
• chore(deps): bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #4225
• fix(meta): derive push timestamp from blob mod time on storage parse by @thees in #4234
• chore(deps): bump the go-dependencies group with 8 updates by @dependabot[bot] in #4237
• sync: prime auth before catalog lookup by @ahfoysal in #4186
• fix(api): reject backslash in OIDC callback redirect to prevent open redirect by @andaaron in #4238
• chore(deps): bump the github-actions group with 6 updates by @dependabot[bot] in #4242
• chore(deps): bump oras-go to v2.6.2 by @rchincha in #4247
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 by @dependabot[bot] in #4249
• chore: fix dependabot alerts by @rchincha in #4253
• fix(ci): stabilize blackbox GC and HTTP events tests by @andaaron in #4261
• feat: add ztsd layer support for cve scans by @rchincha in #4258
• fix(storage): check table existence before CreateTable in dynamodb cache by @rchincha in #4260
• feat: send an http event when an image has been scanned by @rchincha in #4257
• chore(deps): bump the github-actions group across 1 directory with 5 updates by @dependabot[bot] in #4264
• fix(ci): stabilize blackbox NATS events subscriber wait by @andaaron in #4265
• fix(sync): guard credential refresh under clientLock by @andaaron in #4272
• fix(gql): fix Vulnerabilities skip key by @vrajashkr in #4273
• fix(api): require update for digest multi-tag overwrites by @andaaron in #4266
• fix(sync): refresh helper credentials on every sync entry point by @frauniki in #4270
• fix: mask event headers when event config is present by @andaaron in #4274
• feat(sync): support RFC 8693 token exchange in oauth2 helper by @frauniki in #4269
• feat: restrict periodic storage GC to a configurable gcTimeWindow by @shcherbak in #4223
• feat(sync): add a Google Artifact Registry credential helper by @frauniki in #4276
• fix(events): apply default HTTP sink timeout when unset by @andaaron in #4277
• test: migrate pkg/api tests from GetFreePort to port "0" by @andaaron in #4278
• test: migrate pkg/cli tests from GetFreePort to port "0" by @andaaron in #4281
• chore(deps): bump the go-dependencies group with 12 updates by @dependabot[bot] in #4282
• test(gql): add more unit tests by @vrajashkr in #4283
• fix: dedupe digests before DynamoDB BatchGetItem by @sfernandez-docline in #4280
• fix(sync): surface the rejected media type in manifest sync failures by @rchincha in #4292
• refactor: CVE models cleanup by @vrajashkr in #4287
• chore(deps): bump the github-actions group with 8 updates by @dependabot[bot] in #4293
• ci: don't double checkout in the nightly job by @andaaron in #4294
• fix(meta): don't 500 a manifest delete once metaDB signature cleanup … by @rchincha in #4289

New Contributors

• @flixman made their first contribution in #4168
• @zaldre made their first contribution in #4188
• @archy-rock3t-cloud made their first contribution in #4201
• @johnathan-sq made their first contribution in #4195
• @Nafine made their first contribution in #4147
• @dependabot[bot] made their first contribution in #4225
• @ahfoysal made their first contribution in #4186
• @frauniki made their first contribution in #4270
• @sfernandez-docline made their first contribution in #4280

Full Changelog: v2.1.18...v2.1.19

v2.1.18

What's Changed

• chore: fix dependabot alerts by @rchincha in #4082
• chore: fix dependabot alerts by @rchincha in #4091
• feat: add trivy-based sbom artifact generation support by @rchincha in #4088
• fix: miscellaneous fixes for ai-reported suggestions by @rchincha in #4101
• docs: fix alongside spelling in search docs by @yosinn1-blip in #4095
• chore: fix dependabot alerts by @rchincha in #4113
• fix(cve): prefer cve.org links for AVD references by @charles-openclaw in #4107
• feat: enhance config sanitization to mask sensitive keys in storage a… by @rchincha in #4119
• fix: skip DynamoDB table creation when tables exist by @andaaron in #4120
• ci: Update GH runner labels by @andaaron in #4121
• metadb: add optional fast restart path that skips storage walk when (version + commit + storage config) matches metaDB stamp by @USA-RedDragon in #4026
• feat(metrics): anonymous access when enabled in accessControl config by @uaggarwa in #4110
• fix(storage): treat dedupe-candidate cache miss as no candidates, not an error by @jankowtf in #4122
• chore: fix dependabot alerts by @rchincha in #4126
• feat: config: validate metrics config by @vrajashkr in #4130
• fix(authz): metrics: deny authenticated users not in ACL even with anonymous read by @vrajashkr in #4131
• fix(storage): release global write lock during blob restore I/O by @shcherbak in #4089
• refactor(test/blackbox): extract shared push/pull helpers by @andaaron in #4132
• feat(storage): redirect blob pulls to backend URLs by @rchincha in #4092
• feat: add authz support for GitHub teams by @rchincha in #4139
• feat(cli): support default config name by @andaaron in #4143
• ci: fix conformance test to before the refactor by @rchincha in #4145
• feat(events): include actor and request metadata in webhook payloads by @cainydev in #3959
• feat: add Azure Blob Storage driver by @datadot in #4142
• chore: fix dependabot alerts by @rchincha in #4157
• ci: pull test images from ghcr mirror by @datadot in #4156
• fix: map HTTP methods to corresponding scope actions in bearer authen… by @rchincha in #4161

New Contributors

• @yosinn1-blip made their first contribution in #4095
• @charles-openclaw made their first contribution in #4107
• @USA-RedDragon made their first contribution in #4026
• @uaggarwa made their first contribution in #4110
• @jankowtf made their first contribution in #4122
• @shcherbak made their first contribution in #4089
• @datadot made their first contribution in #4142

Full Changelog: v2.1.17...v2.1.18

v2.1.17

What's Changed

• fix(api): return 416 for bad upload range on PUT; fix GET upload Range at size zero by @andaaron in #3983
• feat(zb): Support for TTFB measurement + on-demand sync tests by @vrajashkr in #3929
• fix(api): recognize Docker Compose/Buildx User-Agent in v2 challenge workaround by @gjed in #3992
• chore: fix dependabot alerts by @rchincha in #3990
• feat(auth): support OIDC RP-Initiated Logout by @krjakbrjak in #3975
• fix(security): enhance timeout configurations and body size limits fo… by @rchincha in #3984
• Improve zli CVE diff output by @AkashKumar7902 in #3994
• chore: fix dependabot alerts by @rchincha in #4020
• Support multipart range blob pulls by @AkashKumar7902 in #3995
• fix(sync): apply tag filters before destination mapping by @AkashKumar7902 in #4003
• Multipart download enhancements by @andaaron in #4021
• docs(config): reference generated config schema by @AkashKumar7902 in #4015
• feat(cosign): add support for cosign bundle by @rchincha in #4023
• feat(auth): map OpenID groups claim by @AkashKumar7902 in #3999
• test: refactor countingReader into partialReaderOpenTracker and partialReaderReadCloser by @andaaron in #4027
• fix(auth): refine OIDC identity handling and claim-mapping logs by @andaaron in #4028
• feat(api): log session/audit subject from UserAccessControl by @andaaron in #4029
• refactor(zli): add typed ~/.zot config layer and strict validation by @andaaron in #4030
• refactor(build): move build metadata to pkg/buildinfo by @andaaron in #4045
• feat(zli): add config list/show/get/set/reset and isolate deprecated syntax by @andaaron in #4037
• fix(zli config): print help for missing args by @andaaron in #4046
• feat(authz): introduce conditional access control via CEL by @matheuscscp in #4040
• ci: sync go 1.26 images to ghcr.io/project-zot/golang by @andaaron in #4049
• ci: fix golangci-lint install URL by @andaaron in #4052
• chore: fix dependabot alerts by @rchincha in #4048
• fix: downgrade expected missing-blob HEAD logging from error to debug by @rchincha in #4056
• chore: fix dependabot alerts by @rchincha in #4059
• fix(lint): silence deprecated gomodguard linter warning by @benoittgt in #4070
• feat(metrics): add Prometheus GC metrics by @benoittgt in #3863
• chore: fix dependabot alerts by @rchincha in #4072
• chore: bump zui version by @rchincha in #4074

New Contributors

• @gjed made their first contribution in #3992
• @krjakbrjak made their first contribution in #3975
• @AkashKumar7902 made their first contribution in #3994

Full Changelog: v2.1.16...v2.1.17

v2.1.16

What's Changed

• chore: fix dependabot alerts by @rchincha in #3860
• fix(search): expose LastPullTimestamp and PushedBy on index ImageSummary by @cainydev in #3865
• chore: fix dependabot alerts by @rchincha in #3880
• feat(zb): list tests, test regex filter, docs update by @vrajashkr in #3884
• ci: use zot localstack image and consolidate on using the setup localstack GH action by @andaaron in #3899
• chore: fix dependabot alerts by @rchincha in #3896
• chore: pin trivy-action to safe version by @andaaron in #3897
• feat(schema): add schema command to dump JSON Schema for zot config by @rchincha in #3905
• feat: support pushing multiple tags for a single manifest by @andaaron in #3885
• fix(storage/gcs): fix double-prefixed rootdirectory and EOF handling in Walk for GCS by @thees in #3903
• test(blackbox): harden zot restart + reachability checks by @andaaron in #3907
• chore: fix dependabot alerts by @rchincha in #3921
• test: add tests for pushing manifests with non-canonical digests together with tags by @andaaron in #3920
• chore: fix dependabot alerts by @rchincha in #3931
• build: bump zui version to commit-1c8e5ef by @rchincha in #3932
• chore: fix dependabot alerts by @rchincha in #3940
• fix: address code review comments by @andaaron in #3942
• feat: Add TrivyConfig.VulnSeveritySources (Trivy's --vuln-severity-source) by @andaaron in #3943
• chore: fix dependabot alerts by @rchincha in #3947
• ci: fix nightly test by @rchincha in #3948
• chore: fix dependabot alerts by @rchincha in #3953
• Pin actions and tighten workflow permissions by @benoittgt in #3954
• fix(ci): pass GITHUB_TOKEN explicitly to oras login in sync-trivy step by @rchincha in #3961
• chore: fix dependabot alerts by @rchincha in #3964
• feat(api): add repository quota enforcement middleware by @Aluchir in #3923
• fix: Updating a repository should not result in a corrupted index.json file if disk is full by @andaaron in #3963
• chore: fix dependabot alerts by @rchincha in #3968
• fix(auth): add workaround for Docker client auth with mixed anonymous policies by @andaaron in #3868
• chore: fix dependabot alerts by @rchincha in #3971
• fix(security): limit manifest PUT body to 4 MiB (INPUT-1) by @rchincha in #3977
• fix(security): limit API key creation body to 4 KiB (INPUT-2) by @rchincha in #3978
• security: suppress Allow-Credentials on wildcard CORS origin (CORS-1) by @rchincha in #3980
• fix(security): remove InsecureSkipVerify from metrics client (TLS-1) by @rchincha in #3982

New Contributors

• @cainydev made their first contribution in #3865
• @thees made their first contribution in #3903
• @benoittgt made their first contribution in #3954
• @Aluchir made their first contribution in #3923

Full Changelog: v2.1.15...v2.1.16

v2.1.15

What's Changed

• fix(fips): flaky fips blackbox test and add missing curves by @andaaron in #3732
• feat: add TaggedTimestamp to ImageSummary returned by graphql API by @andaaron in #3731
• chore: fix dependabot alerts by @rchincha in #3751
• feat(oidc): support per-issuer CA by @matheuscscp in #3760
• ci: improvements for the Ecosystem tools job by @andaaron in #3762
• feat(jwt-exp): exp claim at the access entry level by @matheuscscp in #3761
• feat(zui): add Last Tagged timestamp to tag details view by @andaaron in #3772
• feat(jwt-asm): support AWS Secrets Manager for JWT verification by @matheuscscp in #3763
• chore: fix dependabot alerts by @rchincha in #3774
• fix(meta): fixes for LastUpdated and TaggedTimestamp by @andaaron in #3754
• fix(imagestore): normalize paths to prevent panic on Windows by @codyray2015 in #3775
• fix: correct typo var name mirroHostConfig by @rchincha in #3777
• chore: fix dependabot alerts by @rchincha in #3788
• chore: update github.com/sigstore/cosign/v3 from 3.0.2 to 3.0.4 by @andaaron in #3789
• fix(build): upgrade zot runtime base image to distroless debian13 by @muscariello in #3791
• chore: update golang version to 1.25.7 by @rchincha in #3790
• chore: fix dependabot alerts by @rchincha in #3794
• feat(tls): implement dynamic TLS certificate reloading with file watching by @rchincha in #3792
• chore: fix dependabot alerts by @rchincha in #3802
• chore: update zui version by @rchincha in #3803
• GCS storage support by @andaaron in #3798
• chore: bump zui version by @andaaron in #3809
• chore: fix dependabot alerts by @rchincha in #3820
• Skip OCI conversion for already-synced images by @utafrali in #3824
• chore: fix dependabot alerts by @rchincha in #3841
• feat(sync): add SyncLegacyCosignTags config to skip syncing legacy cosign/SBOM tags when disabled by @andaaron in #3842
• fix(auth): prevent open redirect via callback_ui by @andaaron in #3844
• fix: don't skip "latest" tag authz check for update by @rchincha in #3847

New Contributors

• @codyray2015 made their first contribution in #3775
• @utafrali made their first contribution in #3824

Full Changelog: v2.1.14...v2.1.15

v2.1.14

What's Changed

• test: fix some coverage issues, refactored some of the pagination logic to accomplish this by @andaaron in #3674
• chore: fix dependabot alerts by @rchincha in #3677
• Fix typos in documentation by @oglok in #3678
• ci: fix nightly due to outdated kind by @rchincha in #3676
• fix: pre-existing dynamodb versions table should be populated with version if it doesn't contain it already by @andaaron in #3699
• fix: CVE-2025-30204 - golang-jwt DoS vulnerability via excessive memory allocation by @asgeirn in #3687
• fix: remove usage of deprecated function aws.EndpointResolverWithOptionsFunc by @andaaron in #3700
• fix: now attempt to bind to the zot server socket to check if the server is running by @andaaron in #3703
• chore: fix dependabot alerts by @rchincha in #3707
• chore: remove direct usage of the github.com/aws/aws-sdk-go package (aws sdk v1) by @andaaron in #3701
• fix: graphql playground documentation was hardcoded to an unrelated example by @andaaron in #3721
• chore: fix dependabot alerts by @rchincha in #3726
• chore: fix dependabot alerts by @rchincha in #3730
• ci: add a upgrade bats test by @rchincha in #3621
• Introduce support for OIDC workload identity federation by @matheuscscp in #3711

New Contributors

• @oglok made their first contribution in #3678
• @matheuscscp made their first contribution in #3711

Full Changelog: v2.1.13...v2.1.14

v2.1.13

What's Changed

• fix: do not reject requests having an Authorization header if basic auth is disabled by @andaaron in #3673

Full Changelog: v2.1.12...v2.1.13

v2.1.12

What's Changed

• docs: update examples with the sync config example by @andaaron in #3573
• fix: Add HTTP client timeouts to prevent indefinite hangs in sync operations by @andaaron in #3574
• chore: update golangci-lint and fix all issues by @andaaron in #3575
• refactor: optimize code with modern Go patterns and pre-allocation by @andaaron in #3576
• fix: handle zero time values in LastUpdated sorting functions by @andaaron in #3580
• ci: use minio==7.2.18 by @andaaron in #3581
• fix: sync should be disabled when enable is false by @mottetm in #3579
• fix: multiple fixes based on recent test failures by @andaaron in #3582
• chore: sync golang 1.25 by @rchincha in #3596
• fix(storage): enforce standard OCI blob path structure in GetNextDigestWithBlobPaths by @andaaron in #3594
• chore: fix dependabot alerts by @rchincha in #3595
• chore: Enable Go jsonv2 experiment and update the trivy dependency (v0.67.2) by @andaaron in #3572
• feat: explicitly log if each authentication method is enabled by @andaaron in #3599
• fix(meta): handle cases when substores are nested by @andaaron in #3598
• Fix error handling: return nil explicitly on successful completion by @andaaron in #3603
• feat(config): validate storage root directories for path conflicts by @andaaron in #3602
• fix(trivy): cleanup Trivy temporary directory by @andaaron in #3618
• chore: Fix deps by @rchincha in #3620
• refactor(test): new apis for creating temporary files by @andaaron in #3605
• ci: split needsprivileges tests from devmode tests by @andaaron in #3625
• ci: save unified coverage as build artifact by @andaaron in #3626
• fix: remove misleading error messages on successful syncs by @andaaron in #3619
• chore: fix dependabot alerts by @rchincha in #3636
• feat: support mTLS-only authn/authz with AccessControl and allow combining mTLS with other auth mechanisms by @andaaron in #3624
• fix: accept log levels supported by older zot versions, validate configured log level by @andaaron in #3639
• refactor: enhance TLS cert generation and refactor HTTP client architecture by @andaaron in #3638
• docs: fix deadlink and typo by @andaaron in #3641
• fix: more logging for sync extension by @andaaron in #3656
• chore: fix dependabot alerts by @rchincha in #3657
• fix: prevent nil pointer dereference in RemoveImageFromRepoMeta by @M0Rf30 in #3658
• feat: add configurable mTLS identity extraction with fallback chain by @andaaron in #3640
• fix: make sure the function and caller information are added to log messages emitted by 3rd party libraries using slog directly. by @andaaron in #3659
• chore: fix dependabot alerts by @rchincha in #3660

New Contributors

• @M0Rf30 made their first contribution in #3658

Full Changelog: v2.1.11...v2.1.12

v2.1.11

What's Changed

• fix: minor fixes based on intermittent test failures by @andaaron in #3465
• chore: fix dependabot alerts by @rchincha in #3477
• chore: stabilize coverage in specific sync test by @andaaron in #3480
• fix: zot version broken after switching to /v2 by @andaaron in #3479
• refactor: remove usage of goto in the image store by @andaaron in #2969
• fix: configure cookie Secure flag based on TLS configuration by @andaaron in #3482
• feat: add zot subcommand to enable testing retention policy settings by @andaaron in #3449
• chore: fix dependabot alerts by @rchincha in #3496
• chore: fix monitoring goroutine leak in tests by @andaaron in #3500
• docs: update maintainers and codeowners info by @rchincha in #3502
• fix: close file handle before moving file in FullBlobUpload by @andaaron in #3499
• fix(log): ensure func record is correct by @rchamarthy in #3501
• fix: support custom OAuth2 URLs for GitHub Enterprise and self-hosted providers by @analytically in #3513
• chore: fix dependabot alerts by @rchincha in #3514
• chore: fix dependabot alerts by @rchincha in #3517
• fix: re-introduce pagination by @ljakimczuk in #3521
• fix: add support for sha256 and sha512 in htpasswd by @rchincha in #3497
• fix: deduplicate entries in referrers responses by @andaaron in #3524
• fix: separate cipher suites and curve preferences into FIPS and non FIPS, and use them accordingly by @andaaron in #3523
• chore: fix dependabot alerts by @rchincha in #3534
• fix: gracefully handle manifests missing from storage (prepare for sparse indexes) by @andaaron in #3503
• Fix Dockerfiles by moving the BASE_IMAGE arg into the global scope by @lfrancke in #3536
• fix: img-src annotation changes with zui move to vite by @rchincha in #3539
• fix: show relevant error messages in case of images which cannot be scanned by Trivy by @andaaron in #3554
• chore: fix dependabot alerts by @rchincha in #3555
• fix (metadb): make sure metadb statistics are initialized on image download, and minor metadb fixes for Docker v2 manifest compatibility by @andaaron in #3545
• chore: update github.com/olekukonko/tablewriter to v1.1.1 by @andaaron in #3559
• chore: update cosign from v2 to v3 by @andaaron in #3561
• fix(ui): update zui version by @rchincha in #3564
• chore: fix dependabot alerts by @rchincha in #3566
• Sync images with a background context by @lfrancke in #3537
• feat: allow claim mapping for user name with oidc by @rchincha in #3540
• fix(sync): properly handle CommitAll errors in syncImage and skip failed temp sync dirs by @andaaron in #3567

New Contributors

• @analytically made their first contribution in #3513
• @lfrancke made their first contribution in #3536

Full Changelog: v2.1.10...v2.1.11