chore(deps): update module github.com/project-zot/zot to v2.1.20

[agntcy-automation]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/project-zot/zot	2.1.18 → 2.1.20

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

project-zot/zot (github.com/project-zot/zot)

v2.1.20

Compare Source

What's Changed

• chore: bump zui version by @​rchincha in #​4296
• fix(ci): pin zot release ver to v2.1.18 by @​vrajashkr in #​4297

Full Changelog: project-zot/zot@v2.1.19...v2.1.20

v2.1.19

Compare Source

What's Changed

• fix(api): align blob, manifest, and referrers handling with OCI conformance by @​andaaron in #​4165
• fix: update OCI conformance workflow and improve blob upload handling by @​rchincha in #​4170
• feat(notation): Add TSA truststore support to notation policy by @​flixman in #​4168
• feat: expose ArtifactType in ImageSummary GraphQL type by @​rchincha in #​4177
• fix(sync): enable exponential HTTP retry backoff via maxRetryDelay by @​andaaron in #​4175
• chore: fix dependabot alerts by @​rchincha in #​4181
• fix(gc): break orphan cycle when manifest blobs are missing from storage by @​andaaron in #​4180
• fix(notation): Decouple Signature trust UI processing from scanning by @​flixman in #​4178
• feat(oidc): support login flow for OIDC tokens by @​matheuscscp in #​4171
• fix(storage): normalize repository names to '/' separators on Windows by @​zaldre in #​4188
• feat(retention): add untagged retention configuration by @​rchincha in #​4191
• chore: fix dependabot alerts by @​rchincha in #​4192
• test(sync): stabilize file deletion in some of the tests by @​andaaron in #​4197
• chore: fix dependabot alerts by @​rchincha in #​4200
• fix(storage): only promote dedupe origin when the deleted blob is the origin (boltdb) by @​archy-rock3t-cloud in #​4201
• fix(gc): resolve subject digest for cosign .sbom tags, not only .sig by @​archy-rock3t-cloud in #​4203
• fix(meta): avoid panic on malformed cosign signature tag by @​archy-rock3t-cloud in #​4204
• fix(imagetrust): bind cosign signature verification to the manifest digest by @​archy-rock3t-cloud in #​4202
• fix(storage): defer blob deletes for cache-unknown blobs until dedupe rebuild completes by @​johnathan-sq in #​4195
• fix(zb): record benchmark errors in stats instead of aborting with log.Fatal by @​andaaron in #​4205
• ci: use more powerful runner to run unit tests by @​andaaron in #​4207
• chore: fix dependabot alerts by @​rchincha in #​4208
• ci: raise zb bench HTTP timeouts and wait for zot shutdown by @​andaaron in #​4219
• test: fix flaky test by @​andaaron in #​4218
• test: fix flaky server port binding in integration tests by @​andaaron in #​4216
• fix(meta): guard GetReferrersInfo against a missing referrer entry by @​archy-rock3t-cloud in #​4213
• feat(sync): add oauth2 credential helper for JWT assertion exchange #​4146 by @​Nafine in #​4147
• fix(sync): predict post-OCI digest for on-demand skip checks by @​andaaron in #​4185
• fix(storage): verify manifest and config blob digests during scrub by @​archy-rock3t-cloud in #​4212
• test: migrate extensions and pkg/test from GetFreePort to port "0" by @​andaaron in #​4220
• fix(search): use index descriptor platform when config platform is empty by @​andaaron in #​4221
• chore: bump zui version by @​rchincha in #​4222
• ci(nightly): increase sync timeout by @​rchincha in #​4230
• test(sync): query zot over kind network in on-demand E2E by @​andaaron in #​4231
• fix(storage): skip reserved dirs in GetNextRepository walk by @​thees in #​4227
• ci: relax dco check for dependabot alerts by @​rchincha in #​4232
• chore(deps): bump the github-actions group across 1 directory with 2 updates by @​dependabot[bot] in #​4225
• fix(meta): derive push timestamp from blob mod time on storage parse by @​thees in #​4234
• chore(deps): bump the go-dependencies group with 8 updates by @​dependabot[bot] in #​4237
• sync: prime auth before catalog lookup by @​ahfoysal in #​4186
• fix(api): reject backslash in OIDC callback redirect to prevent open redirect by @​andaaron in #​4238
• chore(deps): bump the github-actions group with 6 updates by @​dependabot[bot] in #​4242
• chore(deps): bump oras-go to v2.6.2 by @​rchincha in #​4247
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 by @​dependabot[bot] in #​4249
• chore: fix dependabot alerts by @​rchincha in #​4253
• fix(ci): stabilize blackbox GC and HTTP events tests by @​andaaron in #​4261
• feat: add ztsd layer support for cve scans by @​rchincha in #​4258
• fix(storage): check table existence before CreateTable in dynamodb cache by @​rchincha in #​4260
• feat: send an http event when an image has been scanned by @​rchincha in #​4257
• chore(deps): bump the github-actions group across 1 directory with 5 updates by @​dependabot[bot] in #​4264
• fix(ci): stabilize blackbox NATS events subscriber wait by @​andaaron in #​4265
• fix(sync): guard credential refresh under clientLock by @​andaaron in #​4272
• fix(gql): fix Vulnerabilities skip key by @​vrajashkr in #​4273
• fix(api): require update for digest multi-tag overwrites by @​andaaron in #​4266
• fix(sync): refresh helper credentials on every sync entry point by @​frauniki in #​4270
• fix: mask event headers when event config is present by @​andaaron in #​4274
• feat(sync): support RFC 8693 token exchange in oauth2 helper by @​frauniki in #​4269
• feat: restrict periodic storage GC to a configurable gcTimeWindow by @​shcherbak in #​4223
• feat(sync): add a Google Artifact Registry credential helper by @​frauniki in #​4276
• fix(events): apply default HTTP sink timeout when unset by @​andaaron in #​4277
• test: migrate pkg/api tests from GetFreePort to port "0" by @​andaaron in #​4278
• test: migrate pkg/cli tests from GetFreePort to port "0" by @​andaaron in #​4281
• chore(deps): bump the go-dependencies group with 12 updates by @​dependabot[bot] in #​4282
• test(gql): add more unit tests by @​vrajashkr in #​4283
• fix: dedupe digests before DynamoDB BatchGetItem by @​sfernandez-docline in #​4280
• fix(sync): surface the rejected media type in manifest sync failures by @​rchincha in #​4292
• refactor: CVE models cleanup by @​vrajashkr in #​4287
• chore(deps): bump the github-actions group with 8 updates by @​dependabot[bot] in #​4293
• ci: don't double checkout in the nightly job by @​andaaron in #​4294
• fix(meta): don't 500 a manifest delete once metaDB signature cleanup … by @​rchincha in #​4289

New Contributors

• @​flixman made their first contribution in #​4168
• @​zaldre made their first contribution in #​4188
• @​archy-rock3t-cloud made their first contribution in #​4201
• @​johnathan-sq made their first contribution in #​4195
• @​Nafine made their first contribution in #​4147
• @​dependabot[bot] made their first contribution in #​4225
• @​ahfoysal made their first contribution in #​4186
• @​frauniki made their first contribution in #​4270
• @​sfernandez-docline made their first contribution in #​4280

Full Changelog: project-zot/zot@v2.1.18...v2.1.19

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!