Release v0.11.5 Security: Prevent https to non-https downgrades and localhost redirects. (PR 1093) Forbid sending auth on redirects. (PR 1095) Features: Add regbot manifest.descriptor to the sandbox. (PR 1091) Contributors: @GimmyDatBeeR @sudo-bmitch
Release v0.11.4 Security: Validate server URL in token auth. (PR 1075) Upgrading Go fixes CVE-2026-33814 and CVE-2026-39836, other vulnerabilities fixed in 1.26.3 were not called by this project. (PR 1084) Features: Support scanning OCI Layout for referrers. (PR 1074) Add created timestamp in OCI Layout entries. (PR 1081) tag.ls now accepts the same pagination parameters as repo.ls. (PR 1086) Fixe…
Release v0.11.3 Security: Go 1.26.2 release fixes CVE-2026-32280 (PR 1072) Go 1.26.2 release fixes CVE-2026-32281 (PR 1072) Go 1.26.2 release fixes CVE-2026-32283 (PR 1072) Go 1.26.2 release fixes CVE-2026-32288 (PR 1072) Go 1.26.2 release fixes CVE-2026-33810 (PR 1072) Features: Add support for pushing digest with tags. (PR 1062) Handle OCI-Tag headers with comma separators. (PR 1070) Contributor…
Release v0.11.2 Features: Add support for regctl config in XDG and APPDATA. (PR 1038) Add ImageWithBlobReaderHook for callbacks per layer when copying an image. (PR 1046) Fixes: Do not sign released images multiple times. (PR 1027) regctl/action update for path fix. (PR 1031) Remove default values from regctl config. (PR 1039) Apply Go modernizations with go fix from 1.26.0. (PR 1053) Adjust test…
Release v0.11.1 Security: Go 1.25.5 fixes CVE-2025-61729 (PR 1025) Go 1.25.5 fixes CVE-2025-61727 (PR 1025) Fixes: Correct selection of previous tag for releases. (PR 1023) Make sure ContentLength is correctly set in the request. (PR 1024) Contributors: @sudo-bmitch
Release v0.11.0 Features: Build artifacts for riscv64. (PR 1011) Generate FreeBSD amd64 binaries. (PR 1013) Add support for cosign v3 bundles. (PR 1018) Fixes: Fix ECR Helper version pin. (PR 1017) Fix the cosign use-signing-config flag. (PR 1019) Improve reproducibility in Dockerfiles. (PR 1020) Other Changes: Add a policy for LLM generated contributions. (PR 1016) Contributors: @ffgan @sudo-bmit…
Release v0.10.0 Features: Feat: Support DOCKER_AUTH_CONFIG variable. (PR 996) Feat: Add regctl repo copy. (PR 997) Feat: regsync support for semantic versioning(semver) for matching tags (PR 1005) Feat: Add tagSets to regsync. (PR 1008) Changes: Chore: Add go:fix lines to deprecated code. (PR 994) Chore: Add gofumpt to the build. (PR 995) Chore: Remove the unused bps field. (PR 998) Fix: Handle se…
Release v0.9.2 Security: xz upgrade fixes CVE-2025-58058 (PR 989) Miscellaneous: Fix CLI lint errors. (PR 983) Cleanup version output. (PR 985) Dockerfile cleanup. (PR 986) Contributors: @sudo-bmitch
Release v0.9.1 Features: Allow relative urls in bearer auth. (PR 963) Add "ns" query param to registry mirror requests. (PR 976) Miscellaneous: Update to SLSA v1 provenance. (PR 968) Add a "make clean" command. (PR 969) Contributors: @sudo-bmitch @wjordan
Release v0.9.0 Breaking: Drop support for 3rd Go release because of upstream forced upgrades (see golang/go#69095). (PR 948) Features: Add a script to reproduce regclient images. (PR 940) Support IPv6 hosts. (PR 956) Fixes: Convert docker attestations built with oci-artifact=true. (PR 949) Allow duplicate keys in yaml config. (PR 952) Miscellaneous: Migrate yaml library. (PR 947) Convert the build…