Welcome to the v3.0.0-rc.3 release of registry!

This is the third stable release candidate!

See the changelog below for a full list of changes.

Notable changes

• Fixes CVE-2025-24976, thanks @evanebb for reporting!

What's Changed

• build(deps): bump actions/upload-artifact from 4.3.6 to 4.5.0 by @dependabot in #4538
• ci: update bake-action to v6 by @crazy-max in #4554
• build(deps): bump actions/upload-artifact from 4.5.0 to 4.6.0 by @dependabot in #4553
• (security): Bump golang.org/x/net module by @milosgajdos in #4542
• (security): fix registry Token authentication bug by @milosgajdos in f4a500c
• ci: fix bake build by @crazy-max in #4555
• Bump Go version by @milosgajdos in #4566
• Prep for v3-rc.3 release by @milosgajdos in #4568

Full Changelog: v3.0.0-rc.2...v3.0.0-rc.3

Welcome to the v3.0.0-rc.2 release of registry!

This is the second release candidate of registry!

See the changelog below for a full list of changes.

Notable changes

• Upgrade Go OpenTelemetry #4508
• Add support for mTLS auth #4537
• Update Go runtime and Alpine image #4532

What's Changed

• build(deps): bump codecov/codecov-action from 4 to 5 by @dependabot in #4508
• Upgrade go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp by @krynju in #4507
• docs: Explain how to configure a list through env variables by @barbu110 in #4522
• build(deps): bump golang.org/x/crypto from 0.28.0 to 0.31.0 by @dependabot in #4531
• update xx to v1.6.1 for compatibility with alpine 3.21 and file 5.46+ by @thaJeztah in #4527
• chore: Bump alpine image version by @milosgajdos in #4532
• Update squizzi maintainer email by @squizzi in #4530
• feat(configuration): support mtls auth mod by @vitshev in #4537
• Prepare for rc2 release by @milosgajdos in #4539

New Contributors

• @krynju made their first contribution in #4507
• @barbu110 made their first contribution in #4522
• @squizzi made their first contribution in #4530
• @vitshev made their first contribution in #4537

Full Changelog: v3.0.0-rc.1...v3.0.0-rc.2

Welcome to the v3.0.0-rc.1 release of registry!

This is the the first release candidate of registry!

See the changelog below for full list of changes.

Deprecated

• ManifestBuilder interface 3886
• Versioned in favor of oci.Versioned 3887

Notable Changes

• Attempt HeadObject on Stat call first before failing over to List in S3 driver 4401
• Use a consistent multipart chunk size in S3 driver 4424
• Build artifacts and images for linux/riscv64 4444
• Fix token verification chain in auth 4415
• Support custom exec-based credential helper in proxy mode #4438

What's Changed

• vendor: github.com/opencontainers/image-spec v1.1.0 by @thaJeztah in #3889
• Descriptor: do not implement Describable interface by @thaJeztah in #3886
• S3 driver: Attempt HeadObject on Stat first, fail over to List by @milosgajdos in #4401
• manifest: slight cleanup of init / registration by @thaJeztah in #4403
• ci:bump Go version by @milosgajdos in #4402
• deprecate Versioned in favor of oci.Versioned by @thaJeztah in #3887
• fix logic for handling regionEndpoint by @Ankurk99 in #4341
• fix nil pointer in s3 list api by @jkroepke in #4412
• build(deps): bump softprops/action-gh-release from 1 to 2 by @dependabot in #4407
• build(deps): bump docker/bake-action from 4 to 5 by @dependabot in #4410
• build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @dependabot in #4416
• chore: fix typos returned in some errors by @milosgajdos in #4414
• auth: fix token verification chain by @milosgajdos in #4415
• build(deps): bump github/codeql-action from 2.22.12 to 3.25.15 by @dependabot in #4426
• build(deps): bump ossf/scorecard-action from 2.3.3 to 2.4.0 by @dependabot in #4422
• build(deps): bump actions/configure-pages from 4 to 5 by @dependabot in #4409
• fix: skip removing layer's link file when '--dry-run' option specified by @microyahoo in #4425
• build(deps): bump actions/upload-artifact from 4.3.0 to 4.3.5 by @dependabot in #4428
• Use x.y.0 format for the go module version by @ialidzhikov in #4423
• build(deps): bump actions/upload-artifact from 4.3.5 to 4.3.6 by @dependabot in #4430
• build(deps): bump github/codeql-action from 3.25.15 to 3.26.0 by @dependabot in #4431
• build(deps): bump github/codeql-action from 3.26.0 to 3.26.2 by @dependabot in #4434
• chore: fix typo in rewrite storage middleware init by @milosgajdos in #4435
• build(deps): bump github/codeql-action from 3.26.2 to 3.26.3 by @dependabot in #4441
• Build artifacts and images for linux/riscv64 by @macabu in #4444
• build(deps): bump github/codeql-action from 3.26.3 to 3.26.5 by @dependabot in #4446
• chore: bump golangci-lint and fix govet issues by @milosgajdos in #4454
• Remove deprecated version field by @tiborrr in #4459
• Add a note regarding redirects to pre-signed URLs by @Felixoid in #4466
• fix: Add the token's rootcert public key to the list of known keys by @josegomezr in #4471
• TestProxyManifestsMetrics: use actual size of manifest by @thaJeztah in #4467
• docs: removed description of ELB as an example of an not sophisticated Load Balancer by @yamoyamoto in #4476
• Make Descriptor an alias for oci.Descriptor by @thaJeztah in #3888
• replace uses of Descriptor alias by @thaJeztah in #4479
• ci: Add validation for api docs by @pratik-parikh01 in #4481
• avoid appending directory as file path in s3 driver Walk by @flavianmissi in #4485
• ci: fix GHA CI build matrix by @milosgajdos in #4436
• docs: update hugo and theme versions by @dvdksn in #4499
• fix(registry/storage/driver/s3-aws): use a consistent multipart chunk size by @uhthomas in #4424
• feat: support custom exec-based credential helper in proxy mode by @chhsia0 in #4438
• Bump dependencies by @milosgajdos in #4498
• Prep for v3-rc.1 release by @milosgajdos in #4502

New Contributors

• @Ankurk99 made their first contribution in #4341
• @jkroepke made their first contribution in #4412
• @macabu made their first contribution in #4444
• @tiborrr made their first contribution in #4459
• @Felixoid made their first contribution in #4466
• @josegomezr made their first contribution in #4471
• @yamoyamoto made their first contribution in #4476
• @pratik-parikh01 made their first contribution in #4481
• @uhthomas made their first contribution in #4424
• @chhsia0 made their first contribution in #4438

Full Changelog: v3.0.0-beta.1...v3.0.0-rc.1

Welcome to the 3.0.0-beta.1 release of registry!

This is the last major pre-release of registry.

See the changelog below for full list of changes.

Deprecated

• the default configuration path has changed to /etc/distribution/config.yml

Notable Changes

• Support for sparse indexes enables selective mirroring of platform images
• Auth config now requires explicit declaration of token signing algorithms if using an unsupported signing algorithm
• Support for OpenTelemetry tracing has been added
• Redis cache now supports clustering and custom TLS config
• Caching proxy bug fixes and minor improvements
• Garbage collection fixes and improvements
• Documentation has received several updates

What's Changed

• update: set User-Agent header in GCS storage driver by @milosgajdos in #4203
• version: export getter functions by @corhere in #4204
• feat: add GH issue template by @milosgajdos in #4206
• fix: build status badge by @milosgajdos in #4207
• docs: remove legacy kramdown options from link by @SKalt in #4209
• update: readme cleanup and fxes by @milosgajdos in #4208
• feat: add PR labeler by @milosgajdos in #4205
• fix: add missing skip in s3 driver test by @katexochen in #4219
• vendor: github.com/mitchellh/mapstructure v1.5.0 by @thaJeztah in #4222
• chore: dependabot to keep gha up to date by @crazy-max in #4217
• build(deps): bump github/codeql-action from 1.0.26 to 3.22.12 by @dependabot in #4225
• build(deps): bump actions/deploy-pages from 2 to 4 by @dependabot in #4224
• build(deps): bump actions/checkout from 3 to 4 by @dependabot in #4226
• build(deps): bump actions/setup-go from 3 to 5 by @dependabot in #4228
• build(deps): bump actions/configure-pages from 3 to 4 by @dependabot in #4227
• chore: generate authors and update mailmap by @crazy-max in #4215
• chore: use no-cache-filter for outdated stage by @crazy-max in #4216
• build(deps): bump actions/upload-pages-artifact from 2 to 3 by @dvdksn in #4234
• build(deps): bump docker/login-action from 2 to 3 by @dependabot in #4239
• build(deps): bump docker/metadata-action from 4 to 5 by @dependabot in #4240
• update to alpine 3.19 by @thaJeztah in #4210
• build(deps): bump docker/setup-buildx-action from 2 to 3 by @dependabot in #4230
• fix: load gcs credentials and client inside DriverConstructor by @katexochen in #4218
• build(deps): bump docker/bake-action from 2 to 4 by @crazy-max in #4253
• build(deps): bump actions/upload-artifact from 3.0.0 to 4.1.0 by @dependabot in #4254
• remove deprecated ReadSeekCloser interfaces by @thaJeztah in #4245
• vendor: github.com/gorilla/handlers v1.5.2 by @thaJeztah in #4211
• fix: update Dockerfile version output by @milosgajdos in #4212
• fix: add labeler action by @milosgajdos in #4213
• chore: Remove duplicate area/ci entry in PR labeler by @erezrokah in #4256
• chore: Remove area/config duplicate entry in labeler.yml by @erezrokah in #4257
• chore: Migrate PR labeler config to v5 by @erezrokah in #4258
• docs: add rendering hook and fix broken links by @dvdksn in #4247
• refactor(storage/s3): remove redundant len check by @Juneezee in #4259
• feat: Add HTTP2 for unencrypted HTTP (v3) by @erezrokah in #4248
• build(deps): bump actions/upload-artifact from 4.1.0 to 4.3.0 by @dependabot in #4265
• build(deps): bump peter-evans/dockerhub-description from 3 to 4 by @dependabot in #4267
• Add a trademarks and docs license link by @Jamstah in #4276
• Do not write manifests on HEAD requests by @jaimem88 in #4286
• build(deps): bump codecov/codecov-action from 3 to 4 by @dependabot in #4271
• Update notifications.md by @wyckster in #4287
• fix: typo by @testwill in #4290
• [otel-tracing] Added Tracing to Base package (driver) by @gotgelf in #4196
• Standardize OTEL error logging format to match application logs by @gotgelf in #4292
• fix: typo by @testwill in #4296
• Support redirects in gcs storage with default credentials by @teqwve in #4295
• build(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 by @dependabot in #4301
• build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 by @dependabot in #4297
• Update go versions by @ialidzhikov in #4303
• Initialize proxy prometheus counters values to 0 by @dimitar-kostadinov in #4283
• Don't try to parse error responses with no body by @markusthoemmes in #4307
• Upgrade Scorecard Action version to fix error by @joycebrum in #4311
• build(deps): bump ossf/scorecard-action from 2.0.6 to 2.3.1 by @dependabot in #4231
• build(deps): bump fossa-contrib/fossa-action from 2 to 3 by @dependabot in #4232
• chore: remove repetitive words in comments by @xiaoxiangxianzi in #4313
• chore: bump distriution/reference dependency by @milosgajdos in #4312
• Add Go 1.22 support to CI by @austinvazquez in #4314
• Fix garbage-collect --delete-untagged to handle schema 2 manifest list and OCI image index by @thewolt in #4285
• proxy: Do not configure HTTP secret for proxy registry by @ialidzhikov in #4305
• chore: fix some typos in comments by @goodactive in #4332
• build(deps): bump golang.org/x/net from 0.20.0 to 0.23.0 by @dependabot in #4333
• chore: fix some typos in comments by @testwill in #4335
• Allow setting s3 forcepathstyle without regionendpoint by @schanzel in #4291
• fix: ignore error of manifest tag path not found in gc by @microyahoo in #4331
• add bounded concurrency for tag lookup and untag by @microyahoo in #4329
• Add Shutdown method to registry.Registry by @robinkb in #4338
• Set readStartAtFile context aware for purge uploads by @artpej in #4339
• Fix #2902: ‘autoRedirect’ hardcode ‘https’ scheme by @icefed in #2903
• Stop proxy scheduler on system exit by @dimitar-kostadinov in #4293
• Add support for Basic Authentication to proxyingRegistry by @oliver-goetz in #4263
• Include headers when serving blob through proxy by @mikelr in #4273
• docs: update location of filesystem.md by @emmanuel-ferdman in #4355
• Add a go.mod toolchain version by @Jamstah in #4347
• Add option to enable sparse indexes by @Jamstah in #3536
• feature: Bump go-jose and require signing algorithms in auth by @milosgajdos in #4349
• New path for distribution config by @milosgajdos in #4365
  ...

This is the first major release in years!

It's an accumulation of effort that's bringing major improvements in performance, security and general code quality!

See the abridged changelog below and the full release log here.

Deprecations

• Image Manifest v2 Schema v1
• oss and swift storage drivers
• docker/libtrust has been replaced with go-jose/go-jose
• reference package has been moved to a dedicated repository (see here)
• client is no longer supported as a standalone package

Notable Changes

• reference package has been moved to its own dedicated repository
• Go module has changed from docker/distribution to distribution/distribution/v3
• Major performance improvements across all supported storage drivers
• Major dependencies updates (see the full list below)
• Online documentation is available at https://distribution.github.io/distribution/

What's Changed

• default autoredirect to false by @davidswu in #2800
• Add docs for autoredirect config parameter by @caervs in #2801
• Registry - make minimum TLS version user configurable by @gregrebholz in #2808
• Support BYOK for OSS storage driver by @denverdino in #2791
• Add reference. ParseDockerRef utility function by @thaJeztah in #2786
• Fix gometalint errors by @manishtomar in #2840
• registry: fix binary JSON content-type by @lucab in #2813
• Log authorized username by @manishtomar in #2854
• Fix cloudfront middleware by @vishesh92 in #2837
• support Alibaba Cloud CDN storage middleware by @Shawnpku in #2849
• replace rsc.io/letsencrypt in favour of golang.org/x/crypto by @tariq1890 in #2926
• migrate to go modules from vndr by @tariq1890 in #2941
• Fix typo: offest -> offset by @jabrown85 in #2894
• Fix s3 driver for supporting ceph radosgw by @tbe in #2879
• Fixes #2835 Process Accept header MIME types in case-insensitive way by @yuwaMSFT2 in #2861
• change default Dockerfile to install ssl utils by @andyzhangx in #2809
• Append the written bytes to the blob writer's size by @dmathieu in #2920
• fix no error returned in fetchTokenWithOAuth by @sevki in #2900
• use latest version of alpine when building the Docker container by @tariq1890 in #2946
• Extract blob upload resume into its own method by @dmathieu in #2930
• Handle Blob Create when the underlying registry doesn't provide 'Docker-Upload-UUID' by @dmathieu in #2927
• Implement Repository ServeBlob by @dmathieu in #2921
• Add notification metrics by @tifayuki in #2522
• Update the versions of several dependencies by @tariq1890 in #2947
• Implement Repository Blobs upload resuming by @dmathieu in #2917
• allow for VERSION and REVISION to be passed in during docker builds by @alex-laties in #2955
• swift: correct segment path generation by @terinjokes in #2950
• Adding deprecated schema instructions by @adrian-plata in #3000
• Test httpBlobUpload.Write method by @dmathieu in #2918
• registry: Fix typo in RepositoryRemover warning by @bouk in #2984
• use travis, not circle, build badge by @laverya in #3003
• API to retrive tag's digests by @manishtomar in #2748
• use latest version of alpine when building the Docker container by @ad-m in #2991
• Add pathspec for repo _layers directory and allow Repository.BlobStore to enumerate over blobs by @guillaumerose in #3061
• Fixing broken table by @adrian-plata in #3053
• bump golang to 1.13.4 by @sootysec in #3050
• make it possible to wrap the client transport in another one by @novas0x2a in #2985
• Fix TestRegistryAsCacheMutationAPIs by @fermayo in #3072
• Migrate to golangci-lint by @sayboras in #3023
• [master] Use same env var in Dockerfile and Makefile by @thaJeztah in #3086
• Update Golang 1.13.7, golang.org/x/crypto (CVE-2020-0601, CVE-2020-7919) by @thaJeztah in #3089
• Fix the pointer initialization by @legionus in #2446
• Fix typo cloudfront updatefrenquency by @kd7lxl in #3020
• Update Golang 1.13.8 by @thaJeztah in #3105
• Update readme and contributing docs by @dmcgowan in #3071
• Increase Unit Test Code Coverage by @naveedjamil in #2272
• Update governance and maintainers by @dmcgowan in #3110
• vendor: update docker/go-metrics v0.0.1 by @thaJeztah in #3080
• Use go-events package by @halcyonCorsair in #2550
• Update reporting issues guidelines by @dmcgowan in #3111
• Redis cache fixes and metrics by @dmcgowan in #3113
• Update oci library by @wy65701436 in #3121
• Fix gosimple checks by @dmcgowan in #3128
• Fix err shadowing in gcs driver by @dmage in #3127
• Fix CI failures, upgrade to Go 1.14+ by @jdolitsky in #3187
• docs: add redirect for old URL by @thaJeztah in #3196
• clean up code because err is always nil by @zhipengzuo in #3209
• Add s390x support for travis by @srajmane in #3140
• catalog: List repositories with no unique layers by @adamwg in #3173
• Bump AWS SDK by @lawliet89 in #3118
• vendor: opencontainers/go-digest v1.0.0 by @thaJeztah in #3226
• Update logrus to v1.6.0, fixes #3223 by @AndreasHassing in #3224
• Support ECS TaskRole in S3 storage driver by @abulford in #2973
• Reopen PR #2973 (Support ECS TaskRole in S3 storage driver). by @ob1dev in #3245
• Upgrade Redigo to 1.8.2. by @ob1dev in #3239
• Upgrade Gorilla Mux to 1.8.0. by @ob1dev in #3237
• #3288 Remove empty Content-Type header by @Smasherr in #3289
• Add new maintainers by @justincormack in #3303
• Add Adopters by @justincormack in #3306
• Ignore self reference object on empty prefix by @ricardomaraschini in #3302
• Dummy workflow to enable GitHub Actions by @crazy-max in #3314
• Update roadmap by @justincormack in #3334
• Replace Arko with Milos as a maintainer by @justincormack in #3335
• Adding Steve Lasker as a maintainer by @SteveLasker in #3337
• Adding first draft of CI on GitHub Actions by @chrispat in #3338
• Fixing push workflow by @chrispat in #3344
• Update slack channel to CNCF slack by @thaJeztah in #3343
• Removing Travis by @Chri...

What's Changed

• Pass BUILDTAGS argument to go build by @marcusirgens in #3926
• Enable Go build tags by @thaJeztah in #4009
• reference: replace deprecated function SplitHostname by @thaJeztah in #4032
• Dont parse errors as JSON unless Content-Type is set to JSON by @thaJeztah in #4054
• update to go 1.20.8 by @thaJeztah in #4056
• Set Content-Type header in registry client ReadFrom by @thaJeztah in #4053
• deprecate reference package, migrate to github.com/distribution/reference by @thaJeztah in #4063
• digestset: deprecate package in favor of go-digest/digestset by @thaJeztah in #4064
• Do not close HTTP request body in HTTP handler by @milosgajdos in #4068
• Add v2.8.3 release notes by @milosgajdos in #4088

New Contributors

• @marcusirgens made their first contribution in #3926

Full Changelog: v2.8.2...v2.8.3

What's Changed

• Revert registry/client: set Accept: identity header when getting layers by @ndeloof in #3783
• Parse http forbidden as denied by @vvoland in #3914
• Fix CVE-2022-28391 by bumping alpine from 3.14 to 3.16 by @thaJeztah (#3650)
• Fix CVE-2023-2253 runaway allocation on /v2/_catalog by @josegomezr 521ea3d9
• Fix panic in inmemory driver by @wy65701436 in #3815
• bump up golang version (alternative) by @thaJeztah in #3903
• Dockerfile: update xx to v1.2.1 by @thaJeztah in #3907
• update to go1.19.9 by @thaJeztah in #3908
• Add code to handle pagination of parts. Fixes max layer size of 10GB bug by @davidspek in #3893
• Dockerfile: fix filenames of artifacts by @thaJeztah in #3911

Full Changelog: v2.8.1...v2.8.2

What's Changed

• Fix CVE-2022-28391 by bumping alpine from 3.14 to 3.16 by @thaJeztah (#3650)
• Fix CVE-2023-2253 runaway allocation on /v2/_catalog by @josegomezr 521ea3d9
• Fix panic in inmemory driver by @wy65701436 in #3815
• bump up golang version (alternative) by @thaJeztah in #3903
• Dockerfile: update xx to v1.2.1 by @thaJeztah in #3907
• update to go1.19.9 by @thaJeztah in #3908
• Add code to handle pagination of parts. Fixes max layer size of 10GB bug by @davidspek in #3893
• Dockerfile: fix filenames of artifacts by @thaJeztah in #3911

Full Changelog: v2.8.1...v2.8.2-beta.2

NOTE: This is a pre-release that does not contain any artifacts!

What's Changed

• Fix runaway allocation on /v2/_catalog by @josegomezr 521ea3d9
• Fix CVE-2022-28391 by bumping alpine from 3.14 to 3.16 by @thaJeztah in #3650
• Fix panic in inmemory driver by @wy65701436 in #3815
• bump up golang version (alternative) by @thaJeztah in #3903
• Dockerfile: update xx to v1.2.1 by @thaJeztah in #3907
• update to go1.19.9 by @thaJeztah in #3908
• Add code to handle pagination of parts. Fixes max layer size of 10GB bug by @davidspek in #3893

Full Changelog: v2.8.1...v2.8.2-beta.1

Welcome to the v2.8.1 release of registry!

The 2.8.1 registry release fixes the Go module issues that have popped up in the v2.8.0

There have been no changes made in the released binaries other than the bump of the Go runtime.

See the changelog below for a full list of changes.

CI

• ci: use proper git ref for versioning #3595
• Go: make Go version explicit and pin it to the latest 1.16 release #3604

Contributors

• CrazyMax
• Milos Gajdos

Changes

Dependency Changes

This release has no dependency changes

The previous release can be found at v2.8.0