Welcome to the v3.1.1 release of registry!

This is a stable release

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

Notable Changes

• Fixes CVE-2026-41888
• Bounds-check the file basename in PurgeUploads Walk callback
• Add S3 Express One Zone support to the S3 storage driver (#4858)
• Fix tag list endpoint in proxy mode (#4846)
• Clamp oversized n query parameter in proxy mode instead of returning 400 (#4856)

See the full changelog below for the full list of changes.

What's Changed

• internal/client/auth/challenge: cleanups and minor refactor by @thaJeztah in #4832
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory by @dependabot[bot] in #4843
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory by @dependabot[bot] in #4850
• build(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in #4840
• chore(build): Bump go version to latest by @milosgajdos in #4851
• refactor: use slices.Backward to simplify the code by @chuanshanjida in #4848
• fix(proxy): fix tag list endpoint in proxy mode by @njucjc in #4846
• Update docker-compose structure in deploying.md by @jdg71nl in #4855
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #4854
• build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 by @dependabot[bot] in #4852
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #4847
• build(deps): bump docker/bake-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #4853
• fix(proxy): clamp oversized n query param instead of returning 400 by @milosgajdos in #4856
• feat(s3): add express zone one support to S3 driver by @milosgajdos in #4858
• fix(storage): bounds-check the file basename in PurgeUploads Walk callback by @SAY-5 in #4860
• chore(release): prepare for v3.1.1 release by @milosgajdos in #4864

New Contributors

• @chuanshanjida made their first contribution in #4848
• @jdg71nl made their first contribution in #4855
• @SAY-5 made their first contribution in #4860

Full Changelog: v3.1.0...v3.1.1

Welcome to the v3.1.0 release of registry!

This is a stable release

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

Notable Changes

• Fixes CVE-2026-35172
• Fixes CVE-2026-33540
• Adds support for tag pagination (#4360, #4353)
• Fixes default credentials in Azure storage provider (#4619)
• Drops support for go1.23 and go1.24 and updates to go1.25

See the full changelog below for the full list of changes.

What's Changed

• docs: Update to refer to new image tag v3 by @schanzel in #4373
• Fix default_credentials in azure storage provider by @switchboardOp in #4619
• chore: make function comment match function name by @closeobserve in #4622
• build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory by @dependabot[bot] in #4625
• fix: implement JWK thumbprint for Ed25519 public keys by @zhangyoufu in #4626
• fix: Annotate code block from validation.indexes configuration docs by @anzoman in #4629
• feat: extract redis config to separate struct by @shanduur in #4620
• Fix: resolve issue #4478 by using a temporary file for non-append writes by @onporat in #4624
• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in #4645
• docs: Add note about OTEL_TRACES_EXPORTER by @jcpunk in #4669
• fix: set OTEL traces to disabled by default by @jcpunk in #4671
• Fix markdown syntax for OTEL traces link in docs by @shantanoo-desai in #4676
• Switch UUIDs to UUIDv7 by @binaryfire in #4666
• refactor: replace map iteration with maps.Copy/Clone by @whosehang in #4632
• s3-aws: fix build for 386 by @ChenQi1989 in #4642
• docs: Add OpenTelemetry links to quickstart docs (#4270) by @dpw13 in #4640
• Fix S3 driver loglevel param by @milosgajdos in #4617
• Fixed data race in TestSchedule test by @horoshev in #4647
• Fixes #4683 - uses X/Y instead of Gx/Gy for thumbprint of ecdsa keys by @gpgenaiz in #4684
• build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #4687
• Fix broken link to Docker Hub fair use policy by @Klikini in #4688
• fix(registry/handlers/app): redis CAs by @ChandonPierre in #4668
• build(deps): bump actions/labeler from 5 to 6 by @dependabot[bot] in #4694
• build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #4693
• build(deps): bump actions/upload-pages-artifact from 3 to 4 by @dependabot[bot] in #4691
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #4706
• build(deps): bump github/codeql-action from 3.26.5 to 4.30.7 by @dependabot[bot] in #4710
• build(deps): bump github/codeql-action from 4.30.7 to 4.30.8 by @dependabot[bot] in #4714
• chore: labeler: add area/client mapping for internal/client/** by @artem-tkachuk in #4716
• client: add Accept headers to Exists() HEAD by @artem-tkachuk in #4715
• feat(registry): Make graceful shutdown test robust by @Sumedhvats in #4720
• fix(registry): Correct log formatting for upstream challenge by @Sumedhvats in #4721
• build(deps): bump github/codeql-action from 4.30.8 to 4.30.9 by @dependabot[bot] in #4722
• build(deps): bump github/codeql-action from 4.30.9 to 4.31.3 by @dependabot[bot] in #4735
• refactor: remove redundant variable declarations in for loops by @efcking in #4741
• "should" -> "must" regarding redis eviction policy by @dpedu in #4742
• build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #4744
• Incorrect warning hint by @nkaaf in #4708
• Add return error when list object by @tranthang2404 in #4753
• build(deps): bump actions/checkout from 5.0.1 to 6.0.0 by @dependabot[bot] in #4745
• build(deps): bump peter-evans/dockerhub-description from 4 to 5 by @dependabot[bot] in #4707
• fix: Logging regression for manifest HEAD requests by @tcuthbert in #4756
• Add boolean parsing util by @1raghavmahajan in #4763
• Expose useFIPSEndpoint for S3 by @1raghavmahajan in #4764
• Add Cloudfleet Container Registry to adopters by @cloudfleet-tech in #4765
• fix(ci): Fix broken Azure e2e storage tests by @milosgajdos in #4767
• BUG: Fix notification filtering to work with actions when mediatypes is empty by @acallejaszu in #4730
• build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #4761
• build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0 by @dependabot[bot] in #4760
• build(deps): bump github/codeql-action from 4.31.3 to 4.31.10 by @dependabot[bot] in #4766
• build(deps): bump github/codeql-action from 4.31.10 to 4.32.2 by @dependabot[bot] in #4778
• build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #4768
• update golangci-lint to v2.9 and fix linting issues by @thaJeztah in #4780
• update to go1.25.7, alpine 3.23, xx v1.9.0 by @thaJeztah in #4781
• vendor: github.com/sirupsen/logrus v1.9.4 by @thaJeztah in #4783
• vendor: update golang.org/x/* dependencies by @thaJeztah in #4782
• vendor: github.com/docker/docker-credential-helpers v0.9.5 by @thaJeztah in #4785
• vendor: github.com/opencontainers/image-spec v1.1.1 by @thaJeztah in #4786
• vendor: github.com/klauspost/compress v1.18.4 by @thaJeztah in #4787
• fix: prefer otel variables over hard coded service name by @kub3let in #4771
• vendor: github.com/spf13/cobra v1.10.2 by @thaJeztah in #4789
• vendor: github.com/bshuster-repo/logrus-logstash-hook v1.1.0 by @thaJeztah in #4788
• fix: sync parent dir to ensure data is reliably stored by @ningmingxiao in #4774
• modernize code by @thaJeztah in #4784
• vendor: github.com/docker/go-events 605354379745 by @thaJeztah in #4791
• vendor: github.com/go-jose/go-jose/v4 v4.1.3 by @thaJeztah in #4790
• build(deps): bump github/codeql-action from 4.32.2 to 4.32.5 by @dependabot[bot] in #4806
• build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #4807
• build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #4800
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #4811
• build(deps): bump docker/bake-action from 6 to 7 by @dependabot[bot] in #4809
• build(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #4810
• fix: nil-check scheduler in proxyingRegistry.Close() by @joonas in #4805
• fix: set MD5 on GCS writer before first Write call in putContent by @joonas in #4803
• docs: pull through cache will pull from remote multiple times by @yiyun-sj in #4664
• Update s3.md regionendpoint option by @Alexsandr-Random in #4534
• chore(deps): Bump Go to latest 1.25 in CI workflows and go.mod by @milosgajdos in #4819
• fix: correct Ed25519 JWK thumbprint kty from "OTP" to "OKP" by @joonas in #4801
• Update vacuum.go by @wutongjie23hao in #4610
• Opt: refector tag list pagination support (stage 1) by @njucjc in #4360
• Correctly match environment variables to YAML-inlined structs in configuration by @evanebb in #4639
• Enable Redis TLS without client certificates by @omartrigui in #4770
• build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #4826
• build(deps): bump github/codeql-action from 4.32.5 to 4.34.1 by @dependabot[bot] in #4823
• fix(registry/proxy): use detached context when flushing write buffer by @ChandonPierre in #4793
• ci: pin actions and apply zizmor auto-fixes by @thaJeztah in #4831
• build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #4833
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in the go_modules group across 1 directory by @dependabot[bot] in #4837
• chore(app): warn when partial TLS config is used in Redis by @milosgajdos in #4838
• feat(registry): enhance authentication checks in htpasswd implementation by @mnixry in #4758
• Opt: refactor tag list pagination support by @njucjc in #4353
• build(deps): bump codecov/codecov-action from 5.5.4 to 6.0.0 by @dependabot[bot] in #4836
• build(deps): bump actions/configure-pages from 5.0.0 to 6.0.0 by @dependabot[bot] in #4834
• fix(vendor): fix broke vendor validation by @milosgajdos in #4839
• chore(ci): Prep for v3.1 release by @milosgajdos in #4841

New Contributors

• @switchboardOp made their first contribution in #4619
• @closeobserve made their first contribution in #4622
• @zhangyoufu made their first contribution in #4626
• @anzoman made their first contribution in #4629
• @onporat made their first contribution in #4624
• @jcpunk made their first contribution in #4669
• @shantanoo-desai made their first contribution in #4676
• @binaryfire made their first contribution in #4666
• @whosehang made their first contribution in #4632
• @ChenQi1989 made their first contribution in #4642
• @dpw13 made their first contribution in #4640
• @horoshev made their first contribution in #4647
• @gpgenaiz made their first contribution in #4684
• @Klikini made their first contribution in #4688
• @ChandonPierre made their first contribution in #4668
• @artem-tkachuk made their first contribution in #4716
• @Sumedhvats made their first contribution in #4720
• @efcking made their first contribution in #4741
• @dpedu made their first contribution in #4742
• @nkaaf made their first contribution in #4708
• @tranthang2404 made their first contribution in #4753
• @tcuthbert made their first contribution in #4756
• @1raghavmahajan made their first contribution in #4763
• @cloudfleet-tech made their first contribution in #4765
• @acallejaszu made their first contribution in #4730
• @kub3let made their first contribution in #4771
• @ningmingxiao made their first contribution in #4774
• @joonas made their first contribution in #4805
• @yiyun-sj made their first contribution in #4664
• @Alexsandr-Random made their first contribution in #4534
• @wutongjie23hao made their first contribution in #4610
• @njucjc made their first contribution in #4360
• @omartrigui made their first contribution in #4770
• @mnixry made their first contribution in #4758

Full Changelog: v3.0.0...v3.1.0

Welcome to the v3.0.0 release of registry!

This is the first v3 stable release since v2.8.3 which is a culmination of years of hard work of the container community and registry maintainers!

If you are upgrading from v2.x and have never used any of the release candidates, please familiarise yourselves with the v2.x deprecations properly.

Deprecations

• oss and swift storage drivers are no longer supported
• docker/libtrust has been replaced with go-jose/go-jose in #4096
• client is no longer supported as a standalone package in #4126
• the default configuration path has changed to /etc/distribution/config.yml
• ManifestBuilder interface in 3886
• manifest.Versioned has been deprecated in favor of oci.Versioned in 3887
• reference package has been moved to github.com/distribution/reference in #4063

Changes since the last release candidate

Changes

7 commits

• 2e63da99 Fix golangci-lint config (#4612)
• fd14cf19 Vrify the linter config first before running it
• 3a33ba12 Fix golangci-lint config
• 75f32197 Bump Azure deps (#4611)
• 52f0f6c4 Bump Azure deps
• ef21149b build(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 in the go_modules group across 1 directory (#4608)
• 05b308bc build(deps): bump github.com/golang-jwt/jwt/v5

Previous release can be found at v3.0.0-rc.4

Welcome to the v3.0.0-rc.4 release of registry!

This is the fourth stable release candidate!

See the changelog below for a full list of changes.

Notable changes

• Enable MD5 check on GCS driver by @milosgajdos in #4586
• Azure driver [retry] fix by @milosgajdos in #4576, thanks @vespian for reporting!

What's Changed

• registry/storage: add an option to silence GC output. by @r4f4 in #4560
• Fix broken signing algorithm configuration for token authentication by @evanebb in #4578
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5 in the go_modules group by @dependabot in #4582
• build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot in #4579
• build(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 by @dependabot in #4580
• Enable MD5 check on GCS driver by @milosgajdos in #4586
• Update osx-setup-guide.md and com.docker.registry.plist by @andy-cooper in #4592
• fix: remove nested structs from configuration by @shanduur in #4523
• use cached blob statter in ManifestService if available by @Ollegio in #4595
• Azure driver retry fix and refactor by @milosgajdos in #4576
• Rename cloud make targets to s3 by @milosgajdos in #4600
• Bump Go version in prep for a release by @milosgajdos in #4601
• build(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 in the go_modules group across 1 directory by @dependabot in #4597
• build(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2 by @dependabot in #4603
• Fix potential resource leak by ensuring the response body is closed in HTTPReadSeeker by @Vad1mo in #4605
• Prep for v3-rc.4 release by @milosgajdos in #4606

New Contributors

• @r4f4 made their first contribution in #4560
• @evanebb made their first contribution in #4578
• @andy-cooper made their first contribution in #4592
• @shanduur made their first contribution in #4523
• @Ollegio made their first contribution in #4595
• @Vad1mo made their first contribution in #4605

Full Changelog: v3.0.0-rc.3...v3.0.0-rc.4

Welcome to the v3.0.0-rc.3 release of registry!

This is the third stable release candidate!

See the changelog below for a full list of changes.

Notable changes

Fixes CVE-2025-24976, thanks @evanebb for reporting!

What's Changed

• build(deps): bump actions/upload-artifact from 4.3.6 to 4.5.0 by @dependabot in #4538
• ci: update bake-action to v6 by @crazy-max in #4554
• build(deps): bump actions/upload-artifact from 4.5.0 to 4.6.0 by @dependabot in #4553
• (security): Bump golang.org/x/net module by @milosgajdos in #4542
• (security): fix registry Token authentication bug by @milosgajdos in f4a500c
• ci: fix bake build by @crazy-max in #4555
• Bump Go version by @milosgajdos in #4566
• Prep for v3-rc.3 release by @milosgajdos in #4568

Full Changelog: v3.0.0-rc.2...v3.0.0-rc.3

Welcome to the v3.0.0-rc.2 release of registry!

This is the second release candidate of registry!

See the changelog below for a full list of changes.

Notable changes

• Upgrade Go OpenTelemetry #4508
• Add support for mTLS auth #4537
• Update Go runtime and Alpine image #4532

What's Changed

• build(deps): bump codecov/codecov-action from 4 to 5 by @dependabot in #4508
• Upgrade go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp by @krynju in #4507
• docs: Explain how to configure a list through env variables by @barbu110 in #4522
• build(deps): bump golang.org/x/crypto from 0.28.0 to 0.31.0 by @dependabot in #4531
• update xx to v1.6.1 for compatibility with alpine 3.21 and file 5.46+ by @thaJeztah in #4527
• chore: Bump alpine image version by @milosgajdos in #4532
• Update squizzi maintainer email by @squizzi in #4530
• feat(configuration): support mtls auth mod by @vitshev in #4537
• Prepare for rc2 release by @milosgajdos in #4539

New Contributors

• @krynju made their first contribution in #4507
• @barbu110 made their first contribution in #4522
• @squizzi made their first contribution in #4530
• @vitshev made their first contribution in #4537

Full Changelog: v3.0.0-rc.1...v3.0.0-rc.2

Welcome to the v3.0.0-rc.1 release of registry!

This is the the first release candidate of registry!

See the changelog below for full list of changes.

Deprecated

ManifestBuilder interface 3886

Versioned in favor of oci.Versioned 3887

Notable Changes

Attempt HeadObject on Stat call first before failing over to List in S3 driver 4401

Use a consistent multipart chunk size in S3 driver 4424

Build artifacts and images for linux/riscv64 4444

Fix token verification chain in auth 4415

Support custom exec-based credential helper in proxy mode #4438

What's Changed

vendor: github.com/opencontainers/image-spec v1.1.0 by @thaJeztah in #3889

Descriptor: do not implement Describable interface by @thaJeztah in #3886

S3 driver: Attempt HeadObject on Stat first, fail over to List by @milosgajdos in #4401

manifest: slight cleanup of init / registration by @thaJeztah in #4403

ci:bump Go version by @milosgajdos in #4402

deprecate Versioned in favor of oci.Versioned by @thaJeztah in #3887

fix logic for handling regionEndpoint by @Ankurk99 in #4341

fix nil pointer in s3 list api by @jkroepke in #4412

build(deps): bump softprops/action-gh-release from 1 to 2 by @dependabot in #4407

build(deps): bump docker/bake-action from 4 to 5 by @dependabot in #4410

build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @dependabot in #4416

chore: fix typos returned in some errors by @milosgajdos in #4414

auth: fix token verification chain by @milosgajdos in #4415

build(deps): bump github/codeql-action from 2.22.12 to 3.25.15 by @dependabot in #4426

build(deps): bump ossf/scorecard-action from 2.3.3 to 2.4.0 by @dependabot in #4422

build(deps): bump actions/configure-pages from 4 to 5 by @dependabot in #4409

fix: skip removing layer's link file when '--dry-run' option specified by @microyahoo in #4425

build(deps): bump actions/upload-artifact from 4.3.0 to 4.3.5 by @dependabot in #4428

Use x.y.0 format for the go module version by @ialidzhikov in #4423

build(deps): bump actions/upload-artifact from 4.3.5 to 4.3.6 by @dependabot in #4430

build(deps): bump github/codeql-action from 3.25.15 to 3.26.0 by @dependabot in #4431

build(deps): bump github/codeql-action from 3.26.0 to 3.26.2 by @dependabot in #4434

chore: fix typo in rewrite storage middleware init by @milosgajdos in #4435

build(deps): bump github/codeql-action from 3.26.2 to 3.26.3 by @dependabot in #4441

Build artifacts and images for linux/riscv64 by @macabu in #4444

build(deps): bump github/codeql-action from 3.26.3 to 3.26.5 by @dependabot in #4446

chore: bump golangci-lint and fix govet issues by @milosgajdos in #4454

Remove deprecated version field by @tiborrr in #4459

Add a note regarding redirects to pre-signed URLs by @Felixoid in #4466

fix: Add the token's rootcert public key to the list of known keys by @josegomezr in #4471

TestProxyManifestsMetrics: use actual size of manifest by @thaJeztah in #4467

docs: removed description of ELB as an example of an not sophisticated Load Balancer by @yamoyamoto in #4476

Make Descriptor an alias for oci.Descriptor by @thaJeztah in #3888

replace uses of Descriptor alias by @thaJeztah in #4479

ci: Add validation for api docs by @pratik-parikh01 in #4481

avoid appending directory as file path in s3 driver Walk by @flavianmissi in #4485

ci: fix GHA CI build matrix by @milosgajdos in #4436

docs: update hugo and theme versions by @dvdksn in #4499

fix(registry/storage/driver/s3-aws): use a consistent multipart chunk size by @uhthomas in #4424

feat: support custom exec-based credential helper in proxy mode by @chhsia0 in #4438

Bump dependencies by @milosgajdos in #4498

Prep for v3-rc.1 release by @milosgajdos in #4502

New Contributors

@Ankurk99 made their first contribution in #4341

@jkroepke made their first contribution in #4412

@macabu made their first contribution in #4444

@tiborrr made their first contribution in #4459

@Felixoid made their first contribution in #4466

@josegomezr made their first contribution in #4471

@yamoyamoto made their first contribution in #4476

@pratik-parikh01 made their first contribution in #4481

@uhthomas made their first contribution in #4424

@chhsia0 made their first contribution in #4438

Full Changelog: v3.0.0-beta.1...v3.0.0-rc.1

Welcome to the 3.0.0-beta.1 release of registry!

This is the last major pre-release of registry.

See the changelog below for full list of changes.

Deprecated

the default configuration path has changed to /etc/distribution/config.yml

Notable Changes

Support for sparse indexes enables selective mirroring of platform images

Auth config now requires explicit declaration of token signing algorithms if using an unsupported signing algorithm

Support for OpenTelemetry tracing has been added

Redis cache now supports clustering and custom TLS config

Caching proxy bug fixes and minor improvements

Garbage collection fixes and improvements

Documentation has received several updates

What's Changed

update: set User-Agent header in GCS storage driver by @milosgajdos in #4203
version: export getter functions by @corhere in #4204
feat: add GH issue template by @milosgajdos in #4206
fix: build status badge by @milosgajdos in #4207
docs: remove legacy kramdown options from link by @SKalt in #4209
update: readme cleanup and fxes by @milosgajdos in #4208
feat: add PR labeler by @milosgajdos in #4205
fix: add missing skip in s3 driver test by @katexochen in #4219
vendor: github.com/mitchellh/mapstructure v1.5.0 by @thaJeztah in #4222
chore: dependabot to keep gha up to date by @crazy-max in #4217
build(deps): bump github/codeql-action from 1.0.26 to 3.22.12 by @dependabot in #4225
build(deps): bump actions/deploy-pages from 2 to 4 by @dependabot in #4224
build(deps): bump actions/checkout from 3 to 4 by @dependabot in #4226
build(deps): bump actions/setup-go from 3 to 5 by @dependabot in #4228
build(deps): bump actions/configure-pages from 3 to 4 by @dependabot in #4227
chore: generate authors and update mailmap by @crazy-max in #4215
chore: use no-cache-filter for outdated stage by @crazy-max in #4216
build(deps): bump actions/upload-pages-artifact from 2 to 3 by @dvdksn in #4234
build(deps): bump docker/login-action from 2 to 3 by @dependabot in #4239
build(deps): bump docker/metadata-action from 4 to 5 by @dependabot in #4240
update to alpine 3.19 by @thaJeztah in #4210
build(deps): bump docker/setup-buildx-action from 2 to 3 by @dependabot in #4230
fix: load gcs credentials and client inside DriverConstructor by @katexochen in #4218
build(deps): bump docker/bake-action from 2 to 4 by @crazy-max in #4253
build(deps): bump actions/upload-artifact from 3.0.0 to 4.1.0 by @dependabot in #4254
remove deprecated ReadSeekCloser interfaces by @thaJeztah in #4245
vendor: github.com/gorilla/handlers v1.5.2 by @thaJeztah in #4211
fix: update Dockerfile version output by @milosgajdos in #4212
fix: add labeler action by @milosgajdos in #4213
chore: Remove duplicate area/ci entry in PR labeler by @erezrokah in #4256
chore: Remove area/config duplicate entry in labeler.yml by @erezrokah in #4257
chore: Migrate PR labeler config to v5 by @erezrokah in #4258
docs: add rendering hook and fix broken links by @dvdksn in #4247
refactor(storage/s3): remove redundant len check by @Juneezee in #4259
feat: Add HTTP2 for unencrypted HTTP (v3) by @erezrokah in #4248
build(deps): bump actions/upload-artifact from 4.1.0 to 4.3.0 by @dependabot in #4265
build(deps): bump peter-evans/dockerhub-description from 3 to 4 by @dependabot in #4267
Add a trademarks and docs license link by @Jamstah in #4276
Do not write manifests on HEAD requests by @jaimem88 in #4286
build(deps): bump codecov/codecov-action from 3 to 4 by @dependabot in #4271
Update notifications.md by @wyckster in #4287
fix: typo by @testwill in #4290
[otel-tracing] Added Tracing to Base package (driver) by @gotgelf in #4196
Standardize OTEL error logging format to match application logs by @gotgelf in #4292
fix: typo by @testwill in #4296
Support redirects in gcs storage with default credentials by @teqwve in #4295
build(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 by @dependabot in #4301
build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 by @dependabot in #4297
Update go versions by @ialidzhikov in #4303
Initialize proxy prometheus counters values to 0 by @dimitar-kostadinov in #4283
Don't try to parse error responses with no body by @markusthoemmes in #4307
Upgrade Scorecard Action version to fix error by @joycebrum in #4311
build(deps): bump ossf/scorecard-action from 2.0.6 to 2.3.1 by @dependabot in #4231
build(deps): bump fossa-contrib/fossa-action from 2 to 3 by @dependabot in #4232
chore: remove repetitive words in comments by @xiaoxiangxianzi in #4313
chore: bump distriution/reference dependency by @milosgajdos in #4312
Add Go 1.22 support to CI by @austinvazquez in #4314
Fix garbage-collect --delete-untagged to handle schema 2 manifest list and OCI image index by @thewolt in #4285
proxy: Do not configure HTTP secret for proxy registry by @ialidzhikov in #4305
chore: fix some typos in comments by @goodactive in #4332
build(deps): bump golang.org/x/net from 0.20.0 to 0.23.0 by @dependabot in #4333
chore: fix some typos in comments by @testwill in #4335
Allow setting s3 forcepathstyle without regionendpoint by @schanzel in #4291
fix: ignore error of manifest tag path not found in gc by @microyahoo in #4331
add bounded concurrency for tag lookup and untag by @microyahoo in #4329
Add Shutdown method to registry.Registry by @robinkb in #4338
Set readStartAtFile context aware for purge uploads by @artpej in #4339
Fix #2902: ‘autoRedirect’ hardcode ‘https’ scheme by @icefed in #2903
Stop proxy scheduler on system exit by @dimitar-kostadinov in #4293
Add support for Basic Authentication to proxyingRegistry by @oliver-goetz in #4263
Include headers when serving blob through proxy by @mikelr in #4273
docs: update location of filesystem.md by @emmanuel-ferdman in #4355
Add a go.mod toolchain version by @Jamstah in #4347
Add option to enable sparse indexes by @Jamstah in #3536
feature: Bump go-jose and require signing algorithms in auth by @milosgajdos in #4349
New path for distribution config by @milosgajdos in #4365
build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.3.0 to 1.6.0 by @dependabot in #4380
Update dockerhub.md by @MahmoudKKandil in #4394
remove layer's link file by gc by @microyahoo in #4344
docs: disable base element override by @dvdksn in #4391
Replace custom Redis config struct with go-redis UniversalOptions (adds sentinel & cluster support) by @andsens in #4306
feat: implement 'rewrite' storage middleware by @smira in #4146
Update docs: JWKS credentials and AZ identity by @milosgajdos in #4397
Bump Go and golang linter by @milosgajdos in #4389
Prep for v3-beta1 release by @milosgajdos in #4399

New Contributors

@SKalt made their first contribution in #4209
@katexochen made their first contribution in #4219
@erezrokah made their first contribution in #4256
@jaimem88 made their first contribution in #4286
@testwill made their first contribution in #4290
@teqwve made their first contribution in #4295
@markusthoemmes made their first contribution in #4307
@xiaoxiangxianzi made their first contribution in #4313
@austinvazquez made their first contribution in #4314
@thewolt made their first contribution in #4285
@goodactive made their first contribution in #4332
@schanzel made their first contribution in #4291
@microyahoo made their first contribution in #4331
@robinkb made their first contribution in #4338
@artpej made their first contribution in #4339
@icefed made their first contribution in #2903
@oliver-goetz made their first contribution in #4263
@mikelr made their first contribution in #4273
@emmanuel-ferdman made their first contribution in #4355
@MahmoudKKandil made their first contribution in #4394
@andsens made their first contribution in #4306
@smira made their first contribution in #4146

Full Changelog: v3.0.0-alpha.1...v3.0.0-beta.1

This is the first major release in years!
It's an accumulation of effort that's bringing major improvements in performance, security and general code quality!
See the abridged changelog below and the full release log here.
Deprecations
Image Manifest v2 Schema v1
oss and swift storage drivers
docker/libtrust has been replaced with go-jose/go-jose
reference package has been moved to a dedicated repository (see here)
client is no longer supported as a standalone package
Notable Changes
reference package has been moved to its own dedicated repository
Go module has changed from docker/distribution to distribution/distribution/v3
Major performance improvements across all supported storage drivers
Major dependencies updates (see the full list below)
Online documentation is available at https://distribution.github.io/distribution/
What's Changed
default autoredirect to false by @davidswu in #2800
Add docs for autoredirect config parameter by @caervs in #2801
Registry - make minimum TLS version user configurable by @gregrebholz in #2808
Support BYOK for OSS storage driver by @denverdino in #2791
Add reference. ParseDockerRef utility function by @thaJeztah in #2786
Fix gometalint errors by @manishtomar in #2840
registry: fix binary JSON content-type by @lucab in #2813
Log authorized username by @manishtomar in #2854
Fix cloudfront middleware by @vishesh92 in #2837
support Alibaba Cloud CDN storage middleware by @Shawnpku in #2849
replace rsc.io/letsencrypt in favour of golang.org/x/crypto by @tariq1890 in #2926
migrate to go modules from vndr by @tariq1890 in #2941
Fix typo: offest -> offset by @jabrown85 in #2894
Fix s3 driver for supporting ceph radosgw by @tbe in #2879
Fixes #2835 Process Accept header MIME types in case-insensitive way by @yuwaMSFT2 in #2861
change default Dockerfile to install ssl utils by @andyzhangx in #2809
Append the written bytes to the blob writer's size by @dmathieu in #2920
fix no error returned in fetchTokenWithOAuth by @sevki in #2900
use latest version of alpine when building the Docker container by @tariq1890 in #2946
Extract blob upload resume into its own method by @dmathieu in #2930
Handle Blob Create when the underlying registry doesn't provide 'Docker-Upload-UUID' by @dmathieu in #2927
Implement Repository ServeBlob by @dmathieu in #2921
Add notification metrics by @tifayuki in #2522
Update the versions of several dependencies by @tariq1890 in #2947
Implement Repository Blobs upload resuming by @dmathieu in #2917
allow for VERSION and REVISION to be passed in during docker builds by @alex-laties in #2955
swift: correct segment path generation by @terinjokes in #2950
Adding deprecated schema instructions by @adrian-plata in #3000
Test httpBlobUpload.Write method by @dmathieu in #2918
registry: Fix typo in RepositoryRemover warning by @bouk in #2984
use travis, not circle, build badge by @laverya in #3003
API to retrive tag's digests by @manishtomar in #2748
use latest version of alpine when building the Docker container by @ad-m in #2991
Add pathspec for repo _layers directory and allow Repository.BlobStore to enumerate over blobs by @guillaumerose in #3061
Fixing broken table by @adrian-plata in #3053
bump golang to 1.13.4 by @sootysec in #3050
make it possible to wrap the client transport in another one by @novas0x2a in #2985
Fix TestRegistryAsCacheMutationAPIs by @fermayo in #3072
Migrate to golangci-lint by @sayboras in #3023
[master] Use same env var in Dockerfile and Makefile by @thaJeztah in #3086
Update Golang 1.13.7, golang.org/x/crypto (CVE-2020-0601, CVE-2020-7919) by @thaJeztah in #3089
Fix the pointer initialization by @legionus in #2446
Fix typo cloudfront updatefrenquency by @kd7lxl in #3020
Update Golang 1.13.8 by @thaJeztah in #3105
Update readme and contributing docs by @dmcgowan in #3071
Increase Unit Test Code Coverage by @naveedjamil in #2272
Update governance and maintainers by @dmcgowan in #3110
vendor: update docker/go-metrics v0.0.1 by @thaJeztah in #3080
Use go-events package by @halcyonCorsair in #2550
Update reporting issues guidelines by @dmcgowan in #3111
Redis cache fixes and metrics by @dmcgowan in #3113
Update oci library by @wy65701436 in #3121
Fix gosimple checks by @dmcgowan in #3128
Fix err shadowing in gcs driver by @dmage in #3127
Fix CI failures, upgrade to Go 1.14+ by @jdolitsky in #3187
docs: add redirect for old URL by @thaJeztah in #3196
clean up code because err is always nil by @zhipengzuo in #3209
Add s390x support for travis by @srajmane in #3140
catalog: List repositories with no unique layers by @adamwg in #3173
Bump AWS SDK by @lawliet89 in #3118
vendor: opencontainers/go-digest v1.0.0 by @thaJeztah in #3226
Update logrus to v1.6.0, fixes #3223 by @AndreasHassing in #3224
Support ECS TaskRole in S3 storage driver by @abulford in #2973
Reopen PR #2973 (Support ECS TaskRole in S3 storage driver). by @ob1dev in #3245
Upgrade Redigo to 1.8.2. by @ob1dev in #3239
Upgrade Gorilla Mux to 1.8.0. by @ob1dev in #3237
#3288 Remove empty Content-Type header by @Smasherr in #3289
Add new maintainers by @justincormack in #3303
Add Adopters by @justincormack in #3306
Ignore self reference object on empty prefix by @ricardomaraschini in #3302
Dummy workflow to enable GitHub Actions by @crazy-max in #3314
Update roadmap by @justincormack in #3334
Replace Arko with Milos as a maintainer by @justincormack in #3335
Adding Steve Lasker as a maintainer by @SteveLasker in #3337
Adding first draft of CI on GitHub Actions by @chrispat in #3338
Fixing push workflow by @chrispat in #3344
Update slack channel to CNCF slack by @thaJeztah in #3343
Removing Travis by @chrispat in #3350
Propose two maintainers from Mirantis by @justincormack in #3353
Update README badges by @milosgajdos in #3352
Clarify repo name regex intention by @davidwarshaw in #3201
Upgrade Gorilla Handlers to 1.5.1. by @ob1dev in #3242
Fix typo for image digest regular expression in spec by @patrickeasters in #3244
Honor contexts passed to registry client methods by @2opremio in #2905
get rid of apache2-utils by @andriisoldatenko in #3146
Update README a bit by @justincormack in #3305
scripts: remove unused md2man from dev-tools by @thaJeztah in #3229
Fix minor spelling mistakes by @jubalh in #3300
Update repo normalize error message to include the name of the repo. by @cydu-cloud in #3265
Relax filesystem driver folder permissions to 0777 (cont) by @stefannica in #3204
go.mod: change imports to github.com/distribution/distribution/v3 by @thaJeztah in #3225
Add Codecov badge by @thomasrockhu in #3362
Upgrade Logstash hook for Logrus to 1.0.0. by @ob1dev in #3240
Bump Golang to 1.15. by @ob1dev in #3222
Added flag for user configurable cipher suites by @d-luu in #3169
manifests: Return UNSUPPORTED when deleting manifests by tag by @adamwg in #3174
Add a basic e2e test for CI by @wy65701436 in #3348
Fix bug in parsing domain from repository reference by @avtakkar in #2979
Populate the platform information when calling the References() method of manifest list by @ywk253100 in #2911
log: Include configured fields in all logs by @adamwg in #3136
docs/spec/manifest-v2-2.md: fix ARM variant by @AkihiroSuda in #3371
Add code to handle pagination of parts. Fixes max layer size of 10GB bug by @bainsy88 in #2815
fix CI dependency error by @wy65701436 in #3383
fix: disable DisableHTMLEscape on logrus json logging by @donbowman in #3364
Add CodeQL Security Scanning by @caniszczyk in #3341
Add docker image release workflow by @milosgajdos in #3386
close the io.ReadCloser from storage driver by @Mark3K in #3309
Add configuration option for Redis TLS by @jdolitsky in #3161
go.mod: gopkg.in/yaml.v2 v2.4.0, sirupsen/logrus v1.8.1 by @thaJeztah in #3398
Release ticker resources by @itsmatinx in #3404
OCI: verify digest and check blob presence when put manifest by @fuweid in #3395
OCI: add content range handling in patch blob by @wy65701436 in #3227
add documentation how to access pull-through proxy stats by @xoxys in #3415
FOSSA scan enabled by @idvoretskyi in #3396
OCI: Add pagination on /v2/<name>/tags/list by @eyJhb in #3143
Add tests for tags list pagination by @joaodrp in #3422
Add tag delete API by @joaodrp in #3427
Update API spec by @joaodrp in #3432
Update distribution logo by @caniszczyk in #3434
fix the /v2/_catalog n parameter description by @lostsquirrel in #3425
typo: a client implementation by @yecril71pl in #3435
Fix html not rendering markdown link properly by @khaosdoctor in #3410
OCI: add conformance test github action by @wy65701436 in #3382
Fixing http status for PUT/PATCH APIs by @sudo-bmitch in #3444
Make GH workflows job names unique by @milosgajdos in #3448
Fix OCI conformance workflow report and README badge by @milosgajdos in #3442
use memory as the cache in test by @wy65701436 in #3450
Propose Sargun as a maintainer by @justincormack in #3441
Updated s3 delete to no longer noop under a rare edge case by @CollinShoop in #3479
Update to go 1.16, and run CI on 1.15.x and 1.16.x by @thaJeztah in #3474
Change should to must in v2 spec by @justincormack in #3487
docs: update release-tool link by @aviral26 in #3488
chore: update azure go-autorest dependencies by @devigned in #3138
updatefrequency should not be saved into duration by @dmage in #3411
Optimize storagedriver/s3 Walk (up to ~500x) + small bugfix by @CollinShoop in #3480
bump up golang v1.17 by @wy65701436 in #3518
Fixed typo in error message by @wyckster in #3515
fix go check issues by @wy65701436 in #3529
go.mod: github.com/opencontainers/image-spec v1.0.2 by @thaJeztah in #3534
Improve error message in case invalid env var found by @robermorales in #2460
Update Milos' email address by @milosgajdos in #3548
Fuzzing: Add 3 fuzzers by @AdamKorcz in #3458
Add CNCF Security email account by @SteveLasker in #3549
Add [email protected] to maintainers file by @SteveLasker in #3551
Add dualstack option to S3 storage driver by @adambkaplan in #3068
Native cross-compilation, artifacts and multi-platform image by @crazy-max in #3315
feat: add option to disable combining the pending part by @huangnauh in #3556
Improve how reference regexps are built by @paulcacheux in #3566
fix image cache incompletely by @justadogistaken in #3567
update build workflow by @crazy-max in #3571
optimize: disable insecure cipher suites by @justadogistaken in #3576
go.mod: spf13/cobra v1.0.0 by @thaJeztah in #3228
Fix: Avoid a false type assertion in the inmemory driver by @milosgajdos in #3579
Update golangci-lint version and fix reports by @milosgajdos in #3580
go.mod: github.com/Azure/go-autorest/autorest v0.11.24 by @thaJeztah in #3575
ci: use proper git ref for versioning by @crazy-max in #3585
Restore documentation that was moved to docker docs repository (take 2) by @thaJeztah in #3397
fix: paginate through s3 multipart uploads by @jtherin in #3519
go.mod: github.com/aws/aws-sdk-go v1.43.16 by @taharah in #3606
Incorrect variable in test output by @Jamstah in #3613
Fix panic in inmemory driver by @zhsj in #3615
Remove duplicate code of conduct by @dmcgowan in #3112
Add new parameter accelerate to S3 storage driver. by @pimuzzo in #3181
Add forcepathstyle parameter for s3 by @duanhongyi in #3632
Update s3 ListObjects to V2 API by @milosgajdos in #3624
(docs) Fix rendering of markdown links in OAuth docs HTML by @hasheddan in #3498
docs/spec: provide valid manifest examples by @lucab in #2291
Support all S3 instant retrieval storage classes by @ddelange in #3622
validate and update vendor targets by @crazy-max in #3634
Dockerfile: switch to xx by @crazy-max in #3641
lint target and workflow job by @crazy-max in #3640
update to go 1.18 (continue testing against 1.17) by @thaJeztah in #3643
vendor: github.com/prometheus/client_golang v1.12.1 by @thaJeztah in #3642
Fix CVE-2022-28391 by bumping alpine from 3.15 to 3.16 by @thaJeztah in #3649
go.mod: remove outdated comment by @thaJeztah in #3651
Update maintainers mailing list by @Jamstah in #3655
fix json syntax error in error api spec by @iasoon in #3658
Explain important caveat in htpasswd tutorial by @raxod502 in #3630
Fix comment for manifest list by @sudo-bmitch in #3669
Change GET in example request to POST by @aaronlehmann in #3692
Update to xx 1.1.1 by @crazy-max in #3693
ci: cleanup ci workflow by @crazy-max in #3644
Ipv6 registries by @aojea in #3489
Do not recreate mux router for each incoming request by @aaronlehmann in #3683
Fix Grammar Mistake by @Ailuridae in #3688
Use http.NewRequestWithContext for outgoing HTTP requests by @aaronlehmann in #3711
configuration: use "fake" values for tests by @kaovilai in #3706
Add build tags to BUILDING.md by @Jamstah in #3687
Review contributing for Docker references by @Jamstah in #3682
fix all json syntax error in error api spec by @Littlemoon917 in #3724
registry/storage/cache/memory: Use LRU cache to bound cache size by @aaronlehmann in #3689
Add Go 1.19 to GHA by @gliptak in #3748
Remove workaround from 2.1.1 for faulty 2.1.0 manifest links by @brackendawson in #3365
vendor: golang.org/x/net v0.0.0-20220906165146-f3363e06e74c by @thaJeztah in #3727
fit get status issue by @wy65701436 in #3755
Revert "registry/client: set Accept: identity header when getting layers by @ndeloof in #3754
use http consts for request methods by @thaJeztah in #3768
Update doc to reflect that logs go to stderr by @Jamstah in #3770
format code with gofumpt by @thaJeztah in #3766
Delete S3 keys incrementally in batches by @milosgajdos in #3635
Raise a specific error for env var parsing issues by @Jamstah in #3680
Fix API doc parameter placeholder: last by @Jamstah in #3681
replace deprecated io/ioutil by @thaJeztah in #3767
reference: remove support for deprecated "shortid" refs by @thaJeztah in #3774
registry: configureLogging() simplify logic a bit by @thaJeztah in #3772
reference: replace deprecated function SplitHostname by @thaJeztah in #3776
reference: implement Sort() by @thaJeztah in #3777
Update the BUILDING.md to a world with modules by @Jamstah in #3679
digestset: deprecate package in favor of go-digest/digestset by @thaJeztah in #3775
Remove uses of deprecated go-digest.NewDigestFromHex, go-digest.Digest.Hex by @thaJeztah in #3781
go.mod: github.com/spf13/cobra v1.6.1 by @thaJeztah in #3764
replace strings.Split(N) for strings.Cut() or alternatives by @thaJeztah in #3769
Realloc slice exponentially in mfs by @m5i-work in #3686
deprecate ReadSeekCloser in favor of io.ReadSeekCloser by @thaJeztah in #3788
simplify mocks by @thaJeztah in #3787
reference: rewrite various tests to use subtests by @thaJeztah in #3786
reference: clean up regular expressions by @thaJeztah in #3789
ci: update github actions by @crazy-max in #3805
Fuzzing: Rewrite existing fuzzers to native go fuzzers by @AdamKorcz in #3794
minor fixes and enhancements by @thaJeztah in #3807
Descriptor: align field order with OCI image specification by @thaJeztah in #3810
remove script directory and fuzz left-overs by @thaJeztah in #3814
vendor: golang.org/x/net v0.4.0 by @thaJeztah in #3816
manifest/schema1: mark docker manifest v2, schema 1 deprecated by @thaJeztah in #3804
Fix separator regex to disallow empty strings by @ckw017 in #3818
add double newlines in ADOPTERS.md by @drornir in #3823
Support AWS_CA_BUNDLE when talking to the S3 API by @kirat-singh in #3841
Update fossa-contrib/fossa-action action to v2 by @smorimoto in #3838
Log username on successful requests by @aaronlehmann in #3736
build(deps): bump golang.org/x/net from 0.4.0 to 0.7.0 by @dependabot in #3845
Fix S3 multipart upload pagination loop condition by @aaronlehmann in #3847
Enable pushing empty blobs by @milosgajdos in #3763
Update Azure SDK and support additional authentication schemes by @kirat-singh in #3839
Accept list of strings in audience claim in token auth by @sagikazarmark in #3742
remove dot-imports for gopkg.in/check.v1 by @thaJeztah in #3882
registry/errors: Parse http forbidden as denied by @vvoland in #3881
reference: rewrite test to use sub-tests, add benchmark by @thaJeztah in #3883
Fuzzing: Move over two fuzzers from cncf-fuzzing by @AdamKorcz in #3795
Remove registry storage testdriver by @glefloch in #2766
Fix the issue that the debug server with port 5001 run twice by @davidspek in #3895
assorted test updates by @thaJeztah in #3885
Dockerfile: update xx to v1.2.1 by @thaJeztah in #3904
update golangci-lint to v1.52, fix linting issues by @thaJeztah in #3906
update to go1.19.9 by @thaJeztah in #3905
Update configuration.md by @ecormaksin in #3898
Dockerfile: fix filenames of artifacts by @thaJeztah in #3910
valye typo again and ignore section table layout is broken by @ecormaksin in #3917
Remove blobstore from manifest builder by @davidspek in #3896
Fix panic in the s3 backend walk logic by @splucs in #3930
bump azure sdk by @flavianmissi in #3916
registry/storage/driver: test call to Stat(ctx, "/") by @flavianmissi in #3932
Fix gcs storage driver by @flavianmissi in #3929
docs: note restriction on URL format of mirrors by @dvdksn in #3933
Support ztsd compression as Content-Encoding by @laurazard in #3900
Fix Content type octet stream typos by @7flying in #3939
Add option to enable caller information in logger by @stonezdj in #3934
Add content cache required changes to distribution by @davidswu in #2752
Fix path not found error in Azure by @flavianmissi in #3936
registry/handlers/app: log healthcheck error before return by @flavianmissi in #3948
Use docker-compose spec v3 in nginx receipt by @das7pad in #3872
Enable Go build tags by @milosgajdos in #3950
Update to golang 1.19.10 by @bmanuel in #3952
docs: fix typo by @cuishuang in #3955
Centered logo in README.md by @d1nch8g in #3957
Option to configure proxy cache TTL by @wzshiming in #3880
Make redirect middleware can use path by @takmatsu in #3206
Added support for specifying ACME-server by using REGISTRY_HTTP_TLS_LETSENCRYPT_DIRECTORYURL by @lavalleeale in #3942
Add information about security by @Jamstah in #3739
Split OCI Image Index from Docker Manifest List by @brackendawson in #3869
Fix json formatting in registry api docs by @iasoon in #3801
Update OCI conformance workflow check by @milosgajdos in #3973
Update Code of Conduct by @milosgajdos in #3971
feat: added support for redis username configuration by @chlins in #3974
Propose David van der Spek as a new reviewer by @milosgajdos in #3980
Drop docker prefix from storage driver API user agent by @milosgajdos in #3979
GitHub Workflows security hardening by @sashashura in #3741
Remove references to schema1 pacakge from proxy package by @milosgajdos in #3977
Cleanup storage cache metrics by @SuperQ in #2897
Remove references to schema1 pacakge from notifications package by @milosgajdos in #3976
Added support for configuring array values with environment variables by @andriisoldatenko in #3511
Set Content-Type header in registry client ReadFrom by @milosgajdos in #3981
Fix Azure tests by @Jamstah in #3983
Remove SWIFT storage driver by @milosgajdos in #3982
Remove oss storage driver and alicdn storage driver middleware by @milosgajdos in #3985
fix(deps): update module github.com/aws/aws-sdk-go to v1.44.325 by @davidspek in #3990
Propose James Hewitt as a new reviewer by @davidspek in #3994
Remove references to schema1 pacakge from handlers by @milosgajdos in #3987
Update github.com/hashicorp/golang-lru to v2 by @davidspek in #3993
Optimise catalog function rebase of #3145 by @davidspek in #3902
Remove waynr from MAINTAINERS by @waynr in #3995
Add some secure compilation options, especially PIE and RELRO. by @TaylorKanper in #3623
Regroup direct and indirect dependencies by @milosgajdos in #3997
remove contrib folder by @davidspek in #4003
Small update of API docs by @milosgajdos in #3998
Revert 3902 by @Jamstah in #4004
Remove NewRelic by @davidspek in #4001
Enable bodyclose linter by @milosgajdos in #4006
s3: add interface assertion by @thaJeztah in #4008
Remove schema1 references from registry client by @milosgajdos in #4007
S3 tests by @Jamstah in #3713
Enable OpenSSF Scorecard Github Action by @joycebrum in #3740
fix typo in comment and log by @liubin in #4012
Remove bugsnag by @davidspek in #4000
Update milosgajdos maintainer email by @milosgajdos in #4016
Scorecard Badge Viewer Improvement by @joycebrum in #4017
Small Makefie update by @milosgajdos in #4018
Update to go 1.20 by @Jamstah in #4021
Remove references to schema1 pacakge from storage by @davidspek in #4002
Dont parse errors as JSON unless Content-Type is set to JSON by @milosgajdos in #4013
Replace redigo with redis-go by @milosgajdos in #4019
Add username to create redis client by @liubin in #4027
Don't make a new buffer for catalog listing by @Jamstah in #4022
feat!: remove schema1 manifest and config options by @davidspek in #4023
remove duplicated code by @liubin in #4028
fix typos in registry/storage/paths.go by @liubin in #4030
Work with the storage driver to minimise work when paging by @Jamstah in #3685
deprecate reference package, migrate to github.com/distribution/reference by @thaJeztah in #4031
go.mod: remove outdated comment by @thaJeztah in #4033
Add note on custom storage drivers by @Jamstah in #4034
Remove outdated docs by @milosgajdos in #4035
Propagate storage driver context to S3 API calls by @milosgajdos in #4036
Enable prealloc linter by @milosgajdos in #4037
Remove duplicate code that instruments Redis otel by @milosgajdos in #4041
Remove libtrust from handler tests by @milosgajdos in #4042
Bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 by @dependabot in #4049
update to go1.20.8 by @thaJeztah in #4055
registry/client: combine SuccessStatus and HandleErrorResponse by @thaJeztah in #4052
registry/api: move all errors to "errcode" package, and split "Register" to internal / exported by @thaJeztah in #4040
optimize: avoid redundant blob fetching by @justadogistaken in #3569
Support systemd socket-activation by @PhracturedBlue in #4020
remove not exist function name in comment by @liubin in #4062
document resource class deprecation by @sagikazarmark in #4061
Do not close HTTP request body in HTTP handler by @milosgajdos in #4067
remove go build directive for older go version by @liubin in #4071
add repositoriesRootPathSpec in pathFor documentation by @liubin in #4070
docs: remove README.md that point to Docker's repo by @liubin in #4073
Add make targets to allow starting local cloud storage environment. by @milosgajdos in #4069
driver testsuite: Add zero byte file checks by @NeilW in #4072
fix comment typos by @liubin in #4080
use manifestTagsPathSpec for listing all tags by @liubin in #4077
Optimise push in S3 driver by @milosgajdos in #4066
Add few more sentences for the debug endpoint by @ialidzhikov in #4089
Properly indent prometheus docs by @milosgajdos in #4086
Update Docker Hub README and keep it in sync with this repository. by @milosgajdos in #4087
refactor redis cache by @liubin in #4081
registry: add loglevel support for aws s3 storage driver by @flavianmissi in #4076
docs: remove blank line by @dvdksn in #4091
Bump golang.org/x/net from 0.8.0 to 0.17.0 by @dependabot in #4100
docs: add hugo website by @dvdksn in #4101
Move dockerhub-readme workflow to the correct path by @milosgajdos in #4103
Add annotation for descriptor by @tosone in #4106
Update docs GHA and renamed a doc file by @milosgajdos in #4102
Update dockerhub-readme GH Action by @milosgajdos in #4105
json encode storage driver enclosed error by @glynternet in #4099
refactor: Storage driver errors by @milosgajdos in #4108
reference: fix broken alias for DomainRegexp by @thaJeztah in #4113
update to go1.20.10, test go1.21.3 by @thaJeztah in #4116
Add context to storagedriver.(Filewriter).Commit() by @milosgajdos in #4109
Replace docker/libtrust with go-jose/go-jose by @milosgajdos in #4096
Make S3 tests pass with MinIO by @Jamstah in #4107
Move registry client internal by @corhere in #4126
Make our UUID package internal by @corhere in #4129
Delete reference package by @corhere in #4127
Bump google.golang.org/grpc from 1.53.0 to 1.56.3 by @dependabot in #4133
docs: fix rendering issues for raw html and images by @dvdksn in #4136
Switch to github.com/google/uuid by @Jamstah in #4132
Add prometheus proxy related metrics by @dimitar-kostadinov in #4047
ci: add cloud storage driver integration tests to CI by @milosgajdos in #4121
Plumb contexts into storage driver factories and middlewares by @corhere in #4142
cleanup: a small Azure driver cleanup by @milosgajdos in #4138
cleanup: make chunk sizes easier to understand and change writer append by @milosgajdos in #4139
feat: push distribution images to GHCR by @milosgajdos in #4130
cleanup: make byte sizes easier to understand by @milosgajdos in #4148
docs: remove unused go.mod by @thaJeztah in #4115
Hide our misuses of contexts from the public interface by @corhere in #4128
fix: fix broken build by @milosgajdos in #4150
refactor: gcs storage driver by @milosgajdos in #4120
Fix proxy statistics by @dimitar-kostadinov in #4045
feat(linter): enable errcheck linter in golangci-lint by @milosgajdos in #4158
docs: fix typo in mirror.md by @JackuB in #4163
build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 by @dependabot in #4165
dockerfile: keep context mount as read only by @crazy-max in #4167
fix: invalid conversion when using Content-Range in client by @milosgajdos in #4166
fix: if reference exceeds max threshold return 400 and detail by @milosgajdos in #4168
Plumb contexts into health checks by @corhere in #4141
remove uuid package by @gotgelf in #4157
feat: add tparallel linter to improve handling (parallel) tests by @milosgajdos in #4173
cleanup: move init funcs to the top of the source by @milosgajdos in #4172
vendor: github.com/klauspost/compress v1.17.4 by @thaJeztah in #4181
vendor: github.com/gorilla/mux v1.8.1 by @thaJeztah in #4180
vendor: github.com/sirupsen/logrus v1.9.3 by @thaJeztah in #4179
update: AWS Go SDK bump to the latest release by @milosgajdos in #4177
vendor: github.com/spf13/cobra v1.8.0 by @thaJeztah in #4182
update: bump Go version by @milosgajdos in #4176
update: remove gcs storage driver build tags by @milosgajdos in #4186
Update nginx.md by @murlock in #4187
Otel tracing MVP by @gotgelf in #4188
testing: replace legacy gopkg.in/check.v1 by @Juneezee in #4185
Update the gotcha in the proxy guide by @ialidzhikov in #4164
fix: use http.DefaultTransport in S3 client by @milosgajdos in #4190
fix: don't override storage driver useragent if it's set by @milosgajdos in #4195
update: S3 driver docs by @milosgajdos in #4194
build(deps): bump golang.org/x/crypto from 0.15.0 to 0.17.0 by @dependabot in #4197
fix: remove disabling of multipart combine small parts by @milosgajdos in #4193
release: prep for the v3 alpha-1 release by @milosgajdos in #4201
New Contributors
@gregrebholz made their first contribution in #2808
@lucab made their first contribution in #2813
@vishesh92 made their first contribution in #2837
@Shawnpku made their first contribution in #2849
@tariq1890 made their first contribution in #2926
@jabrown85 made their first contribution in #2894
@tbe made their first contribution in #2879
@andyzhangx made their first contribution in #2809
@dmathieu made their first contribution in #2920
@sevki made their first contribution in #2900
@alex-laties made their first contribution in #2955
@terinjokes made their first contribution in #2950
@bouk made their first contribution in #2984
@laverya made their first contribution in #3003
@ad-m made their first contribution in #2991
@guillaumerose made their first contribution in #3061
@sootysec made their first contribution in #3050
@novas0x2a made their first contribution in #2985
@fermayo made their first contribution in #3072
@sayboras made their first contribution in #3023
@kd7lxl made their first contribution in #3020
@naveedjamil made their first contribution in #2272
@halcyonCorsair made their first contribution in #2550
@jdolitsky made their first contribution in #3187
@zhipengzuo made their first contribution in #3209
@srajmane made their first contribution in #3140
@adamwg made their first contribution in #3173
@lawliet89 made their first contribution in #3118
@AndreasHassing made their first contribution in #3224
@abulford made their first contribution in #2973
@ob1dev made their first contribution in #3245
@Smasherr made their first contribution in #3289
@ricardomaraschini made their first contribution in #3302
@SteveLasker made their first contribution in #3337
@chrispat made their first contribution in #3338
@davidwarshaw made their first contribution in #3201
@patrickeasters made their first contribution in #3244
@2opremio made their first contribution in #2905
@andriisoldatenko made their first contribution in #3146
@jubalh made their first contribution in #3300
@cydu-cloud made their first contribution in #3265
@stefannica made their first contribution in #3204
@thomasrockhu made their first contribution in #3362
@d-luu made their first contribution in #3169
@avtakkar made their first contribution in #2979
@AkihiroSuda made their first contribution in #3371
@bainsy88 made their first contribution in #2815
@donbowman made their first contribution in #3364
@caniszczyk made their first contribution in #3341
@Mark3K made their first contribution in #3309
@itsmatinx made their first contribution in #3404
@fuweid made their first contribution in #3395
@xoxys made their first contribution in #3415
@idvoretskyi made their first contribution in #3396
@eyJhb made their first contribution in #3143
@joaodrp made their first contribution in #3422
@lostsquirrel made their first contribution in #3425
@yecril71pl made their first contribution in #3435
@khaosdoctor made their first contribution in #3410
@sudo-bmitch made their first contribution in #3444
@CollinShoop made their first contribution in #3479
@aviral26 made their first contribution in #3488
@devigned made their first contribution in #3138
@wyckster made their first contribution in #3515
@robermorales made their first contribution in #2460
@AdamKorcz made their first contribution in #3458
@adambkaplan made their first contribution in #3068
@huangnauh made their first contribution in #3556
@paulcacheux made their first contribution in #3566
@justadogistaken made their first contribution in #3567
@jtherin made their first contribution in #3519
@taharah made their first contribution in #3606
@Jamstah made their first contribution in #3613
@zhsj made their first contribution in #3615
@pimuzzo made their first contribution in #3181
@duanhongyi made their first contribution in #3632
@hasheddan made their first contribution in #3498
@ddelange made their first contribution in #3622
@iasoon made their first contribution in #3658
@raxod502 made their first contribution in #3630
@aojea made their first contribution in #3489
@Ailuridae made their first contribution in #3688
@kaovilai made their first contribution in #3706
@Littlemoon917 made their first contribution in #3724
@gliptak made their first contribution in #3748
@brackendawson made their first contribution in #3365
@m5i-work made their first contribution in #3686
@ckw017 made their first contribution in #3818
@drornir made their first contribution in #3823
@kirat-singh made their first contribution in #3841
@smorimoto made their first contribution in #3838
@dependabot made their first contribution in #3845
@sagikazarmark made their first contribution in #3742
@glefloch made their first contribution in #2766
@ecormaksin made their first contribution in #3898
@splucs made their first contribution in #3930
@flavianmissi made their first contribution in #3916
@laurazard made their first contribution in #3900
@7flying made their first contribution in #3939
@stonezdj made their first contribution in #3934
@das7pad made their first contribution in #3872
@bmanuel made their first contribution in #3952
@cuishuang made their first contribution in #3955
@d1nch8g made their first contribution in #3957
@wzshiming made their first contribution in #3880
@takmatsu made their first contribution in #3206
@lavalleeale made their first contribution in #3942
@chlins made their first contribution in #3974
@sashashura made their first contribution in #3741
@SuperQ made their first contribution in #2897
@waynr made their first contribution in #3995
@TaylorKanper made their first contribution in #3623
@joycebrum made their first contribution in #3740
@PhracturedBlue made their first contribution in #4020
@NeilW made their first contribution in #4072
@ialidzhikov made their first contribution in #4089
@tosone made their first contribution in #4106
@glynternet made their first contribution in #4099
@corhere made their first contribution in #4126
@dimitar-kostadinov made their first contribution in #4047
@JackuB made their first contribution in #4163
@gotgelf made their first contribution in #4157
@murlock made their first contribution in #4187
@Juneezee made their first contribution in #4185
Dependency Changes
cloud.google.com/go v0.110.7 new
cloud.google.com/go/compute v1.23.0 new
cloud.google.com/go/compute/metadata v0.2.3 new
cloud.google.com/go/iam v1.1.1 new
cloud.google.com/go/storage v1.30.1 new
github.com/AdaLogics/go-fuzz-headers 443f56ff4ba8 new
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.0 new
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0 new
github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 new
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0 new
github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0 new
github.com/aws/aws-sdk-go f831d5a0822a -> v1.48.10
github.com/beorn7/perks 4c0e84591b9a -> v1.0.1
github.com/bshuster-repo/logrus-logstash-hook d2c0ecc1836d -> v1.0.0
github.com/cenkalti/backoff/v4 v4.2.1 new
github.com/cespare/xxhash/v2 v2.2.0 new
github.com/coreos/go-systemd/v22 v22.5.0 new
github.com/cyphar/filepath-securejoin v0.2.4 new
github.com/davecgh/go-spew v1.1.1 new
github.com/dgryski/go-rendezvous 9f7001d12a5f new
github.com/docker/go-events e31b211e4f1c new
github.com/docker/go-metrics 399ea8c73916 -> v0.0.1
github.com/felixge/httpsnoop v1.0.4 new
github.com/go-jose/go-jose/v3 v3.0.1 new
github.com/go-logr/logr v1.3.0 new
github.com/go-logr/stdr v1.2.2 new
github.com/golang-jwt/jwt/v4 v4.5.0 new
github.com/golang/groupcache 41bb18bfe9da new
github.com/golang/protobuf 8d92cf5fc15a -> v1.5.3
github.com/google/s2a-go v0.1.4 new
github.com/google/uuid v1.3.1 new
github.com/googleapis/enterprise-certificate-proxy v0.2.3 new
github.com/googleapis/gax-go/v2 v2.11.0 new
github.com/gorilla/handlers 60c7bfde3e33 -> v1.5.1
github.com/gorilla/mux 599cba5e7b61 -> v1.8.1
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 new
github.com/hashicorp/golang-lru/arc/v2 v2.0.5 new
github.com/hashicorp/golang-lru/v2 v2.0.5 new
github.com/inconshreveable/mousetrap 76626ae9c91c -> v1.1.0
github.com/jmespath/go-jmespath bd40a432e4c7 -> v0.4.0
github.com/klauspost/compress v1.17.4 new
github.com/kylelemons/godebug v1.1.0 new
github.com/matttproud/golang_protobuf_extensions c12348ce28de -> v1.0.4
github.com/mitchellh/mapstructure 482a9fd5fa83 -> v1.1.2
github.com/pkg/browser 681adbf594b8 new
github.com/pmezard/go-difflib v1.0.0 new
github.com/prometheus/client_golang c332b6f63c06 -> v1.17.0
github.com/prometheus/client_model 99fa1f4be8e5 -> v0.5.0
github.com/prometheus/common 89604d197083 -> v0.44.0
github.com/prometheus/procfs cb4147076ac7 -> v0.11.1
github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 new
github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 new
github.com/redis/go-redis/v9 v9.1.0 new
github.com/sirupsen/logrus 3d4380f53a34 -> v1.9.3
github.com/spf13/cobra 312092086bed -> v1.8.0
github.com/spf13/pflag 564482062245 -> v1.0.5
github.com/stretchr/testify v1.8.4 new
go.opencensus.io v0.24.0 new
go.opentelemetry.io/contrib/exporters/autoexport v0.46.1 new
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 new
go.opentelemetry.io/otel v1.21.0 new
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0 new
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.44.0 new
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 new
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 new
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 new
go.opentelemetry.io/otel/exporters/prometheus v0.44.0 new
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v0.44.0 new
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.21.0 new
go.opentelemetry.io/otel/metric v1.21.0 new
go.opentelemetry.io/otel/sdk v1.21.0 new
go.opentelemetry.io/otel/sdk/metric v1.21.0 new
go.opentelemetry.io/otel/trace v1.21.0 new
go.opentelemetry.io/proto/otlp v1.0.0 new
golang.org/x/crypto c10c31b5e94b -> v0.17.0
golang.org/x/net 4876518f9e71 -> v0.18.0
golang.org/x/oauth2 045497edb623 -> v0.11.0
golang.org/x/sync v0.3.0 new
golang.org/x/sys v0.15.0 new
golang.org/x/text v0.14.0 new
golang.org/x/text v0.14.0 new
golang.org/x/xerrors 04be3eba64a2 new
google.golang.org/api 9bf6e6e569ff -> v0.126.0
google.golang.org/appengine 12d5545dc1cf -> v1.6.7
google.golang.org/genproto b8732ec3820d new
google.golang.org/genproto/googleapis/api b8732ec3820d new
google.golang.org/genproto/googleapis/rpc b8732ec3820d new
google.golang.org/grpc d3ddb4469d5a -> v1.59.0
google.golang.org/protobuf v1.31.0 new
gopkg.in/yaml.v2 v2.2.1 -> v2.4.0
gopkg.in/yaml.v3 v3.0.1 new
Previous release can be found at v2.8.3

What's Changed

• Pass BUILDTAGS argument to go build by @marcusirgens in #3926
• Enable Go build tags by @thaJeztah in #4009
• reference: replace deprecated function SplitHostname by @thaJeztah in #4032
• Dont parse errors as JSON unless Content-Type is set to JSON by @thaJeztah in #4054
• update to go 1.20.8 by @thaJeztah in #4056
• Set Content-Type header in registry client ReadFrom by @thaJeztah in #4053
• deprecate reference package, migrate to github.com/distribution/reference by @thaJeztah in #4063
• digestset: deprecate package in favor of go-digest/digestset by @thaJeztah in #4064
• Do not close HTTP request body in HTTP handler by @milosgajdos in #4068
• Add v2.8.3 release notes by @milosgajdos in #4088

New Contributors

• @marcusirgens made their first contribution in #3926

Full Changelog: v2.8.2...v2.8.3