registry 2.8.2-beta.2 Welcome to the 2.8.2-beta.2 release of registry! The 2.8.2-beta.2 registry release fixes several security vulnerabilities. The Go runtime has been bumped to 1.19. See the changelog below for full list of changes. ### CI * Dockerfile: fix filenames of artifacts ([#3911](https://github.com/distribution/distribution/pull/3911)) ### Bugfixes * Fix panic in inmemory driver ([#3815](https://github.com/distribution/distribution/pull/3815)) * Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#3893](https://github.com/distribution/distribution/pull/3893)) ### Runtime * Update to go1.19.9 ([#3908](https://github.com/distribution/distribution/pull/3908)) * Dockerfile: update xx to v1.2.1 ([#3907](https://github.com/distribution/distribution/pull/3907)) ### Security * Fix [CVE-2022-28391](https://www.cve.org/CVERecord?id=CVE-2022-28391) by bumping alpine from 3.14 to 3.16 ([#3650](https://github.com/distribution/distribution/pull/3650)) * Fix [CVE-2023-2253](https://www.cve.org/CVERecord?id=CVE-2023-2253) runaway allocation on /v2/_catalog [`521ea3d9`](https://github.com/distribution/distribution/commit/521ea3d973cb0c7089ebbcdd4ccadc34be941f54) ### Dependency Changes This release has no dependency changes Previous release can be found at [v2.8.1](https://github.com/distribution/distribution/releases/tag/v2.8.1) Please try out the release binaries and report any issues at https://github.com/distribution/distribution/issues. ### Contributors * Milos Gajdos * Sebastiaan van Stijn * CrazyMax * Milos Gajdos * Wang Yan * David van der Spek * Derek McGowan * Hayley Swimelar * Jose D. Gomez R * Shengjing Zhu * Silvin Lubecki ### Changes <details><summary>28 commits</summary> <p> * [`9e7e484f`](https://github.com/distribution/distribution/commit/9e7e484fb8479f9591f859e2b2973ca261b95916) Add release notes for 2.8.2-beta.2 release * [release/2.8 backport] Dockerfile: fix filenames of artifacts ([#3911](https://github.com/distribution/distribution/pull/3911)) * [`e884644f`](https://github.com/distribution/distribution/commit/e884644fff38a5bf601a2272f434ee2b01dd2b17) Dockerfile: fix filenames of artifacts * Add 2.8.2-beta.1 release notes ([#3909](https://github.com/distribution/distribution/pull/3909)) * [`ac6c72b2`](https://github.com/distribution/distribution/commit/ac6c72b25fd258449f166acd3bc5961479c8072f) Add 2.8.2-beta.1 release notes * [`dcb637d6`](https://github.com/distribution/distribution/commit/dcb637d6ea8e31e219dfab6ee5c27f09b7441667) Merge pull request from GHSA-hqxw-f8mx-cpmw * [`521ea3d9`](https://github.com/distribution/distribution/commit/521ea3d973cb0c7089ebbcdd4ccadc34be941f54) Fix runaway allocation on /v2/_catalog * [release/2.8] Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#3893](https://github.com/distribution/distribution/pull/3893)) * [`22a80503`](https://github.com/distribution/distribution/commit/22a805033aa861ad171f4a0b560d241a7c57ac86) fix(ci): use go install instead of go get * Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#2815](https://github.com/distribution/distribution/pull/2815)) * [release/2.8 backport] update to go1.19.9 ([#3908](https://github.com/distribution/distribution/pull/3908)) * [`ae58bde9`](https://github.com/distribution/distribution/commit/ae58bde9853c94e482333a4a2734c7ade5b3e344) Fix gofmt warnings * [`3f2a4e24`](https://github.com/distribution/distribution/commit/3f2a4e24a73c69087735b741ee197482d8fda41b) update to go1.19.9 * [`9c04409f`](https://github.com/distribution/distribution/commit/9c04409fdba2219c216b2d14a3f1dd65d4dcdd74) [release/2.8] ignore deprecation of io/ioutil * [release/2.8 backport] Dockerfile: update xx to v1.2.1 ([#3907](https://github.com/distribution/distribution/pull/3907)) * [`3d8f3cc4`](https://github.com/distribution/distribution/commit/3d8f3cc4a5d903a983f33b8b8b2f5713930902fd) Dockerfile: update xx to v1.2.1 * [release/2.8] bump up golang version (alternative) ([#3903](https://github.com/distribution/distribution/pull/3903)) * [`70db3a46`](https://github.com/distribution/distribution/commit/70db3a46d9badbde6a1533e799e292d2ff10b430) bump up golang version * [`db1389e0`](https://github.com/distribution/distribution/commit/db1389e0432ccd16c37c580c95ff2dd1853b8345) dockerfiles: formatting * [`018472de`](https://github.com/distribution/distribution/commit/018472de2d95025485d3e5429ea92dd18ce2665d) dockerfiles: set ALPINE_VERSION * [`19b3feb5`](https://github.com/distribution/distribution/commit/19b3feb5dfeac86148971785ca36190091a4803e) Update to xx 1.1.1 * [`14bd72bc`](https://github.com/distribution/distribution/commit/14bd72bcf8b8a2759e765d3a766b53c9141b677b) Dockerfile: switch to xx * [`2392893b`](https://github.com/distribution/distribution/commit/2392893bcfe7de3010c66626db46f59ab520c9a0) bump up golang v1.17 * [`092a2197`](https://github.com/distribution/distribution/commit/092a2197ff64d4a4b33fbe9d1080f37e9319d346) [release/2.8] fix package name in Dockerfile * [release/2.8] Fix panic in inmemory driver ([#3815](https://github.com/distribution/distribution/pull/3815)) * [`ad5991de`](https://github.com/distribution/distribution/commit/ad5991de09d424fe71ea795463533aa46bc7e74e) Fix panic in inmemory driver * [release/2.8 backport] Fix CVE-2022-28391 by bumping alpine from 3.14 to 3.16 ([#3650](https://github.com/distribution/distribution/pull/3650)) * [`38018aeb`](https://github.com/distribution/distribution/commit/38018aeb5d50b08baec9b7c1ee9b2130349aa47a) Fix CVE-2022-28391 by bumping alpine from 3.15 to 3.16 </p> </details> ### Dependency Changes This release has no dependency changes Previous release can be found at [v2.8.1](https://github.com/distribution/distribution/releases/tag/v2.8.1)