deps: Bump github.com/google/go-containerregistry from 0.21.7 to 0.21.9 - #113
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.7 to 0.21.9. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.21.7...v0.21.9) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.21.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
bilby91
added a commit
that referenced
this pull request
Sep 1, 2026
* deps: bump the pending Go module updates Folds the six open dependabot module bumps into one change, taking the latest release of each rather than the version each PR was cut against: - compose-spec/compose-go/v2 2.11.0 -> 2.14.0 (#112) - google/go-containerregistry 0.21.7 -> 0.22.0 (#113 asked for 0.21.9) - moby/moby/api 1.54.2 -> 1.55.0, moby/moby/client 0.4.1 -> 0.5.1 (#100) - golang.org/x/term 0.43.0 -> 0.45.0 (#110) - google.golang.org/protobuf 1.36.11 -> 1.36.12 (#114) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * ci: bump the pending GitHub Actions updates All four are majors whose breaking changes are the Node 24 runtime default and an ESM migration; the workflows pass no inputs that the majors removed, and no workflow uses pull_request_target or workflow_run, which is the trigger pair actions/checkout v7 newly refuses to check out fork PRs for. - actions/checkout v6 (ci.yml) and v4 (devcontainer-*.yml) -> v7 (#99) - actions/setup-go v6 -> v7 (#111) - docker/login-action v3 -> v4 (#96) - docker/setup-buildx-action v3 -> v4 (#95) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(compose): refuse the compose lifecycle hooks on the native path compose-go 2.14 adds ServiceConfig.PreStart, so `pre_start` — which 2.11 rejected at schema validation — now loads cleanly. The native orchestrator creates the service container directly and has no ephemeral init-container step, so it dropped the hook silently; and because the hooks are part of the ServiceConfig that ConfigHash covers, editing a hook that never ran read as a config change and stopped and removed the running container, destroying its writable layer. Refused in Plan.Validate via the existing §2.2 unsupported-field mechanism, before any infrastructure side effect. stripForHash drops the three fields as well: the refusal already makes them unreachable there, but a recreation is unrecoverable, so no field the orchestrator does not execute should be able to trigger one if the refusal moves or a caller reaches ConfigHash directly. post_start and pre_stop parsed cleanly under 2.11 and had the same defect, so all three are refused rather than just the one the bump introduced. The shell-out backend is untouched — it delegates to `docker compose`, which implements the hooks. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(compose): refuse unsupported fields before building anything The §2.2 refusal ran only inside Orchestrator.Up, which the engine reaches after prepareComposeServiceImage, layerFeatures and buildComposeSidecarImages. A native project using a refused field therefore paid for the primary image and every sidecar build, and left those images tagged, before being told the engine will not run it. Plan.Validate already documents itself as side-effect-free and safe to call before any backend interaction, so the fix is to call it where that matters: straight after compose.Load. The orchestrator's own validation stays as the authoritative one. Native backend only. The shell-out path hands the project to `docker compose`, which implements hooks and other fields the native orchestrator refuses, so validating there would reject projects that work today. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: bilby91 <2201079+bilby91@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Contributor
Author
|
Looks like github.com/google/go-containerregistry is up-to-date now, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/go_modules/github.com/google/go-containerregistry-0.21.9
branch
September 1, 2026 15:59
Member
|
Superseded by #129, which folded every open dependency bump into one change. This PR was cut against a
@dependabot close |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github.com/google/go-containerregistry from 0.21.7 to 0.21.9.
Release notes
Sourced from github.com/google/go-containerregistry's releases.
Commits
7b32099build(deps): bump the actions group with 3 updates (#2398)2a4447dfix: remove '.' from unsafe path prefixes (#2400)43cc3e8fix: prevent data race on scope refreshes within remote.writer (#2396)7775aabactions: pin slsa generator version following linter exception (#2395)2ea098fBump go version to 1.26.5 (#2388)ec2e586actions: reformat ALL actions (#2386)ab819b6actions: fix unformatted action (#2385)eed9a20actions: update actions to be pinned by hash (#2384)8a97709build(deps): bump github.com/moby/moby/client (#2380)d04bf7dtarball: use correct file extension for zstd/uncompressed (#2382)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)