Release v0.11.1

Security:

• Go 1.25.5 fixes CVE-2025-61729 (PR 1025)
• Go 1.25.5 fixes CVE-2025-61727 (PR 1025)

Fixes:

• Correct selection of previous tag for releases. (PR 1023)
• Make sure ContentLength is correctly set in the request. (PR 1024)

Contributors:

• @sudo-bmitch

Release v0.11.0

Features:

• Build artifacts for riscv64. (PR 1011)
• Generate FreeBSD amd64 binaries. (PR 1013)
• Add support for cosign v3 bundles. (PR 1018)

Fixes:

• Fix ECR Helper version pin. (PR 1017)
• Fix the cosign use-signing-config flag. (PR 1019)
• Improve reproducibility in Dockerfiles. (PR 1020)

Other Changes:

• Add a policy for LLM generated contributions. (PR 1016)

Contributors:

• @ffgan
• @sudo-bmitch

Release v0.10.0

Features:

• Feat: Support DOCKER_AUTH_CONFIG variable. (PR 996)
• Feat: Add regctl repo copy. (PR 997)
• Feat: regsync support for semantic versioning(semver) for matching tags (PR 1005)
• Feat: Add tagSets to regsync. (PR 1008)

Changes:

• Chore: Add go:fix lines to deprecated code. (PR 994)
• Chore: Add gofumpt to the build. (PR 995)
• Chore: Remove the unused bps field. (PR 998)
• Fix: Handle semver compare of numeric prerelease (PR 1007)

Security:

• CVE-2025-58187: Fixed with Go upgrade (https://osv.dev/GO-2025-4007).
• CVE-2025-58189: Fixed with Go upgrade (https://osv.dev/GO-2025-4008).
• CVE-2025-61723: Fixed with Go upgrade (https://osv.dev/GO-2025-4009).
• CVE-2025-47912: Fixed with Go upgrade (https://osv.dev/GO-2025-4010).
• CVE-2025-58185: Fixed with Go upgrade (https://osv.dev/GO-2025-4011).
• CVE-2025-58186: Fixed with Go upgrade (https://osv.dev/GO-2025-4012).
• CVE-2025-58188: Fixed with Go upgrade (https://osv.dev/GO-2025-4013).
• CVE-2025-58183: Fixed with Go upgrade (https://osv.dev/GO-2025-4014).
• CVE-2025-9230: Fixed with Alpine image upgrade.
• CVE-2025-9232: Fixed with Alpine image upgrade.
• CVE-2025-9231: Fixed with Alpine image upgrade.

Contributors:

• @daimoniac
• @sudo-bmitch

Release v0.9.2

Security:

• xz upgrade fixes CVE-2025-58058 (PR 989)

Miscellaneous:

• Fix CLI lint errors. (PR 983)
• Cleanup version output. (PR 985)
• Dockerfile cleanup. (PR 986)

Contributors:

• @sudo-bmitch

Release v0.9.1

Features:

• Allow relative urls in bearer auth. (PR 963)
• Add "ns" query param to registry mirror requests. (PR 976)

Miscellaneous:

• Update to SLSA v1 provenance. (PR 968)
• Add a "make clean" command. (PR 969)

Contributors:

• @sudo-bmitch
• @wjordan

Release v0.9.0

Breaking:

• Drop support for 3rd Go release because of upstream forced upgrades (see golang/go#69095). (PR 948)

Features:

• Add a script to reproduce regclient images. (PR 940)
• Support IPv6 hosts. (PR 956)

Fixes:

• Convert docker attestations built with oci-artifact=true. (PR 949)
• Allow duplicate keys in yaml config. (PR 952)

Miscellaneous:

• Migrate yaml library. (PR 947)
• Convert the build to use OCI style attestations. (PR 950)

Contributors:

• @JimmyMa
• @sudo-bmitch

Release v0.8.3

Features:

• Add ref.AddDigest method that does not unset the tag. (PR 910)
• Adding a regctl registry whoami command. (PR 912)
• Improve regctl image check-base output. (PR 917)
• regsync option to abort on errors. (PR 924)
• Improve fallback tag handling. (PR 925)
• regctl flag to ignore missing images on delete. (PR 930)

Fixes:

• Validate registry names. (PR 911)
• Escape regexp example. (PR 920)
• Auth header parsing. (PR 936)

Changes:

• Update supported Go releases to 1.22, 1.23, and 1.24. (PR 909)
• Modernize Go to the 1.22 specs. (PR 910)
• Refactor cobra commands. (PR 915)
• Include Docker Hub repository documentation. (PR 918)
• Move documentation pointers to the website. (PR 939)

Contributors:

• @sudo-bmitch

Release v0.8.2

This fixes a regression in v0.8.1 for users authenticating using a refresh token.

Fixes:

• Allow authentication with a token. (PR 908)

Contributors:

• @sudo-bmitch

Release v0.8.1

Security:

• Go v1.23.6 fixes CVE-2025-22866. (PR 906)

Features:

• Improve regctl arg completion. (PR 895)
• Add cobra command for documentation. (PR 900)

Fixes:

• Do not request offline refresh token. (PR 893)
• Ignore unsupported entries in docker config. (PR 894)
• Align log levels with slog. (PR 901)
• Interval overrides a default schedule in regsync and regbot. (PR 904)

Miscellaneous:

• Adding a logo. (PR 889)

Contributors:

• @obaibula
• @sudo-bmitch

Release v0.8.0

Highlights

There are three headline changes in this release: slog support, external referrers, and deprecating legacy packages.

This release switches from logrus to slog.
Migration methods are included to minimize the impact on existing users.
Anyone parsing the logging output from regctl, regsync, and regbot will notice the format has changed.

External referrers allow referrers to be pushed and pulled from a separate repository from the subject image.
This feature requires users to provide the external repository themselves since a registry has no way to communicate this to the user.
An example use case of this feature are third parties, like security scanners, providing attestations of images they do not control.

Legacy packages have been disabled by default and will eventually be removed.
To continue using legacy packages until their removal, you may compile with -tags legacy.

Breaking

• Breaking: Warning handlers switched from logrus to slog which will only impact those with a custom warning handler. (PR 847)
• Breaking: Disable legacy packages by default. (PR 852)

Features

• Feat: Refactor logging to use log/slog. (PR 847)
• Feat: Switch regbot to slog. (PR 849)
• Feat: Switch regctl to slog. (PR 850)
• Feat: Switch regsync to slog. (PR 851)
• Feat: Move logrus calls into files excluded by wasm. (PR 853)
• Feat: Allow plus in ocidir path. (PR 856)
• Feat: Support referrers in an external repository. (PR 866)
• Feat: Image mod environment variables. (PR 867)
• Feat: Include source in referrers response. (PR 870)
• Feat: Add external flag to regctl artifact put. (PR 873)
• Feat: Copy image with external referrers. (PR 874)
• Feat: Document community maintained packages. (PR 878)
• Feat: Support external referrers in regsync. (PR 881)
• Feat: Support incomplete subject descriptor. (PR 885)

Fixes

• Fix: Inject release notes by file. (PR 854)
• Fix: Platform test for darwin/macos should not add variant. (PR 879)
• Fix: Handle repeated digest in copy with external referrers. (PR 882)

Chores

• Chore: Improve error message when inspecting artifacts. (PR 862)
• Chore: Remove unused short arg parameters. (PR 877)

Contributors

• @sudo-bmitch