[dependabot]

Bumps the go_modules group with 1 update in the / directory: github.com/distribution/distribution/v3.

Updates github.com/distribution/distribution/v3 from 3.0.0-rc.3 to 3.1.2

Release notes

Sourced from github.com/distribution/distribution/v3's releases.

v3.1.2

Welcome to the v3.1.2 release of registry!

This is a stable release

This patch release includes security fixes, storage and pagination fixes, and dependency updates.

Please try out the release binaries and report any issues at https://github.com/distribution/distribution/issues.

Notable Changes

• Verify manifest and blob content against the requested digest in the registry client, protecting digest-pinned requests and pull-through caches (CVE-2026-85747 / GHSA-685w-q87j-wqw3).
• Update security-sensitive dependencies, including gRPC, OpenTelemetry, and golang.org/x/crypto (#4912, #4963, #4965, #4968). The OTLP gRPC log exporter now honors TLS certificates configured through environment variables.
• Fix S3 tag pagination and catalog listing when one name is a prefix of another (#4898, #4904), and return an empty tag array after the final pagination marker (#4931).
• Fix Azure blob type migration and a concurrent append-write race (#4871, #4888).
• Check the storage backend directly when writing blobs to avoid stale descriptor-cache entries (#4868).
• Reject malformed manifest digests and out-of-order final upload chunks correctly (#4945), accept unknown total sizes in Content-Range (#4892), and preserve upstream error codes (#4917).
• Stop the upload purger during registry shutdown (#4956).
• Validate S3 redirect endpoints at driver initialization (#4870).
• Remove the logrus-logstash-hook dependency while retaining the logstash formatter option (#4970).

Build Updates

• Building from source now requires Go 1.26 or newer (#4961).
• Container images now use Alpine Linux 3.24 (#4966).

See the changelog below for the full list of changes.

What's Changed

• build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @​dependabot[bot] in distribution/distribution#4861
• build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @​dependabot[bot] in distribution/distribution#4859
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @​dependabot[bot] in distribution/distribution#4865
• build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @​dependabot[bot] in distribution/distribution#4867
• chore: smol go fix changes by @​milosgajdos in distribution/distribution#4876
• build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @​dependabot[bot] in distribution/distribution#4877
• build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 by @​dependabot[bot] in distribution/distribution#4874
• build(deps): bump docker/bake-action from 7.1.0 to 7.2.0 by @​dependabot[bot] in distribution/distribution#4879
• fix(storage): Fix blob type migration in the azure driver by @​DMarby in distribution/distribution#4871
• fix: report error in DeleteManifest when Delete returns ErrDigestUnsupported by @​joonas in distribution/distribution#4802
• feat(s3): parse and strictly validate redirectendpoint on driver initialization by @​DARSHANR007 in distribution/distribution#4870
• azure: fix race condition in PutContent causing duplicate append writes by @​Fricounet in distribution/distribution#4888
• fix(s3): tags/list drops tags that are a lexical prefix of another tag by @​milosgajdos in distribution/distribution#4898
• fix contentRangeRegexp to accept unknown total size by @​alhudz in distribution/distribution#4892
• fix: check backend directly in blobStore.Put to avoid stale cache by @​chenhuiluo in distribution/distribution#4868
• fix(security): fix CVE-2026-46595 by bumping golang.org/x/crypto by @​milosgajdos in distribution/distribution#4912
• docs: document catalog.maxentries configuration by @​tokuhirom in distribution/distribution#4911
• build(deps): bump actions/labeler from 6.0.1 to 6.1.0 by @​dependabot[bot] in distribution/distribution#4866
• build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 by @​dependabot[bot] in distribution/distribution#4881
• build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 by @​dependabot[bot] in distribution/distribution#4882

... (truncated)

Commits

• 3220848 chore(release): prepare for v3.1.2 release (#4981)
• 973fbf7 build(deps): bump the docker-actions group across 1 directory with 3 updates ...
• 30301b1 build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 (#4982)
• 807a931 build(deps): bump actions/setup-go from 6.4.0 to 7.0.0
• fa720c9 build(deps): bump the docker-actions group across 1 directory with 3 updates
• fd67fd4 chore(release): prepare for v3.1.2 release
• 960439b Merge commit from fork
• ca9b887 build(deps): bump the codeql-actions group with 4 updates (#4977)
• 77aca8d build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 (#4979)
• 300e3a8 build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

None of your dependencies match this group anymore, you may need to update your configuration file to remove it or change its rules.