v2.1.19

What's Changed

• fix(api): align blob, manifest, and referrers handling with OCI conformance by @andaaron in #4165
• fix: update OCI conformance workflow and improve blob upload handling by @rchincha in #4170
• feat(notation): Add TSA truststore support to notation policy by @flixman in #4168
• feat: expose ArtifactType in ImageSummary GraphQL type by @rchincha in #4177
• fix(sync): enable exponential HTTP retry backoff via maxRetryDelay by @andaaron in #4175
• chore: fix dependabot alerts by @rchincha in #4181
• fix(gc): break orphan cycle when manifest blobs are missing from storage by @andaaron in #4180
• fix(notation): Decouple Signature trust UI processing from scanning by @flixman in #4178
• feat(oidc): support login flow for OIDC tokens by @matheuscscp in #4171
• fix(storage): normalize repository names to '/' separators on Windows by @zaldre in #4188
• feat(retention): add untagged retention configuration by @rchincha in #4191
• chore: fix dependabot alerts by @rchincha in #4192
• test(sync): stabilize file deletion in some of the tests by @andaaron in #4197
• chore: fix dependabot alerts by @rchincha in #4200
• fix(storage): only promote dedupe origin when the deleted blob is the origin (boltdb) by @archy-rock3t-cloud in #4201
• fix(gc): resolve subject digest for cosign .sbom tags, not only .sig by @archy-rock3t-cloud in #4203
• fix(meta): avoid panic on malformed cosign signature tag by @archy-rock3t-cloud in #4204
• fix(imagetrust): bind cosign signature verification to the manifest digest by @archy-rock3t-cloud in #4202
• fix(storage): defer blob deletes for cache-unknown blobs until dedupe rebuild completes by @johnathan-sq in #4195
• fix(zb): record benchmark errors in stats instead of aborting with log.Fatal by @andaaron in #4205
• ci: use more powerful runner to run unit tests by @andaaron in #4207
• chore: fix dependabot alerts by @rchincha in #4208
• ci: raise zb bench HTTP timeouts and wait for zot shutdown by @andaaron in #4219
• test: fix flaky test by @andaaron in #4218
• test: fix flaky server port binding in integration tests by @andaaron in #4216
• fix(meta): guard GetReferrersInfo against a missing referrer entry by @archy-rock3t-cloud in #4213
• feat(sync): add oauth2 credential helper for JWT assertion exchange #4146 by @Nafine in #4147
• fix(sync): predict post-OCI digest for on-demand skip checks by @andaaron in #4185
• fix(storage): verify manifest and config blob digests during scrub by @archy-rock3t-cloud in #4212
• test: migrate extensions and pkg/test from GetFreePort to port "0" by @andaaron in #4220
• fix(search): use index descriptor platform when config platform is empty by @andaaron in #4221
• chore: bump zui version by @rchincha in #4222
• ci(nightly): increase sync timeout by @rchincha in #4230
• test(sync): query zot over kind network in on-demand E2E by @andaaron in #4231
• fix(storage): skip reserved dirs in GetNextRepository walk by @thees in #4227
• ci: relax dco check for dependabot alerts by @rchincha in #4232
• chore(deps): bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #4225
• fix(meta): derive push timestamp from blob mod time on storage parse by @thees in #4234
• chore(deps): bump the go-dependencies group with 8 updates by @dependabot[bot] in #4237
• sync: prime auth before catalog lookup by @ahfoysal in #4186
• fix(api): reject backslash in OIDC callback redirect to prevent open redirect by @andaaron in #4238
• chore(deps): bump the github-actions group with 6 updates by @dependabot[bot] in #4242
• chore(deps): bump oras-go to v2.6.2 by @rchincha in #4247
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 by @dependabot[bot] in #4249
• chore: fix dependabot alerts by @rchincha in #4253
• fix(ci): stabilize blackbox GC and HTTP events tests by @andaaron in #4261
• feat: add ztsd layer support for cve scans by @rchincha in #4258
• fix(storage): check table existence before CreateTable in dynamodb cache by @rchincha in #4260
• feat: send an http event when an image has been scanned by @rchincha in #4257
• chore(deps): bump the github-actions group across 1 directory with 5 updates by @dependabot[bot] in #4264
• fix(ci): stabilize blackbox NATS events subscriber wait by @andaaron in #4265
• fix(sync): guard credential refresh under clientLock by @andaaron in #4272
• fix(gql): fix Vulnerabilities skip key by @vrajashkr in #4273
• fix(api): require update for digest multi-tag overwrites by @andaaron in #4266
• fix(sync): refresh helper credentials on every sync entry point by @frauniki in #4270
• fix: mask event headers when event config is present by @andaaron in #4274
• feat(sync): support RFC 8693 token exchange in oauth2 helper by @frauniki in #4269
• feat: restrict periodic storage GC to a configurable gcTimeWindow by @shcherbak in #4223
• feat(sync): add a Google Artifact Registry credential helper by @frauniki in #4276
• fix(events): apply default HTTP sink timeout when unset by @andaaron in #4277
• test: migrate pkg/api tests from GetFreePort to port "0" by @andaaron in #4278
• test: migrate pkg/cli tests from GetFreePort to port "0" by @andaaron in #4281
• chore(deps): bump the go-dependencies group with 12 updates by @dependabot[bot] in #4282
• test(gql): add more unit tests by @vrajashkr in #4283
• fix: dedupe digests before DynamoDB BatchGetItem by @sfernandez-docline in #4280
• fix(sync): surface the rejected media type in manifest sync failures by @rchincha in #4292
• refactor: CVE models cleanup by @vrajashkr in #4287
• chore(deps): bump the github-actions group with 8 updates by @dependabot[bot] in #4293
• ci: don't double checkout in the nightly job by @andaaron in #4294
• fix(meta): don't 500 a manifest delete once metaDB signature cleanup … by @rchincha in #4289

New Contributors

• @flixman made their first contribution in #4168
• @zaldre made their first contribution in #4188
• @archy-rock3t-cloud made their first contribution in #4201
• @johnathan-sq made their first contribution in #4195
• @Nafine made their first contribution in #4147
• @dependabot[bot] made their first contribution in #4225
• @ahfoysal made their first contribution in #4186
• @frauniki made their first contribution in #4270
• @sfernandez-docline made their first contribution in #4280

Full Changelog: v2.1.18...v2.1.19