v1.36.0

What's Changed

Notable changes

• Bump c/* projects, Buildah to v1.35.0 and then to v1.36.0-dev by @TomSweeneyRedHat in #5385
• Update .gitignore by @mtrmac in #5389
• [CI:DOCS] Migrate buildah container image by @cevich in #5384
• tests: enable pasta tests by @Luap99 in #5381
• pr-should-include-tests: use GitHub label, not commit text by @edsantiago in #5374
• Bump google.golang.org/protobuf to v1.33.0 by @TomSweeneyRedHat in #5404
• [skip-ci] Makefile: update rpm target by @lsm5 in #5388
• [skip-ci] rpm: use go-rpm-macros supported vendoring by @lsm5 in #5410
• fix links to containerignore doc by @Pvlerick in #5402
• fix /etc/hosts and resolv.conf setup with network configs by @Luap99 in #5409
• CVE-2024-1753 container escape fix by @TomSweeneyRedHat in #5411
• [CI:DOCS] Stop rebasing renovate PRs automatically by @cevich in #5414
• Change RUN to comment in bud.bats by @TomSweeneyRedHat in #5415
• CI: bump VMs by @edsantiago in #5426
• Makefile - instead of calling as directly, use it from env var by @rahilarious in #5436
• Add support for passing CDI specs to --device by @nalind in #5443
• Makefile: softcode strip, use it from env var by @rahilarious in #5446
• Fix caching when mounting a cached stage with COPY/ADD by @aaronlehmann in #5445
• source-push: add support for --digestfile by @flouthoc in #5454
• Update install.md by @onlykzy in #5457
• heredoc: honor inline COPY irrespective of .containerignore file by @flouthoc in #5459
• [skip-ci] Fix issue/pr lock workflow by @cevich in #5466
• use containers/storage/pkg/fileutils/(Exists,Lexists) by @giuseppe in #5469
• Integration tests: fixup use of _prefetch by @nalind in #5480
• Switch packit configuration to use epel-9-$arch instead of centos-stream+epel-next-9-$arch by @nalind in #5484
• integration test: handle new labels in "bud and test --unsetlabel" by @nalind in #5487
• [CI:DOCS] Add golang 1.21 update warning by @cevich in #5437
• Makefile: add missing files to $(SOURCES) by @nalind in #5496
• Disable packit builds for centos-stream+epel-next-8 by @nalind in #5493
• Integration tests: switch some base images by @nalind in #5499
• Makefile: set GOTOOLCHAIN=local by @nalind in #5498
• containerImageRef.NewImageSource: merge the tar filters by @nalind in #5497
• Add link to Buildah image page to README.md by @TomSweeneyRedHat in #5515
• Don't set GOTOOLCHAIN=local by @nalind in #5513
• CI VMs: bump to new versions with tmpfs /tmp by @edsantiago in #5470
• Builder.cdiSetupDevicesInSpecdefConfig(): use configured CDI dirs by @nalind in #5494
• Address CVE-2024-3727 by @TomSweeneyRedHat in #5523
• Setting --arch should set the TARGETARCH build arg by @rhatdan in #5478
• fix CentOS/RHEL build - no BATS there by @jnovy in #5528
• Add release note template to split dependency chores by @der-eismann in #5463
• Don't leak temp files on failures by @rhatdan in #5527
• Don't expand RUN heredocs ourselves, let the shell do it by @nalind in #5473
• Integration tests: fake up a replacement for nixery.dev/shell by @nalind in #5495
• bud tests: fix breakage when vendoring into podman by @edsantiago in #5537
• Fix buildah prune --help examples by @naskya in #5534
• Bump to c/common v0.59.0 by @TomSweeneyRedHat in #5542
• build: be more selective about specifying the default OS by @nalind in #5543

Dependency updates

• chore(deps): update module github.com/go-jose/go-jose/v3 to v3.0.3 [security] by @renovate in #5395
• fix(deps): update module github.com/docker/docker to v25.0.4+incompatible by @renovate in #5387
• fix(deps): update module github.com/containers/ocicrypt to v1.1.10 by @renovate in #5397
• chore(deps): update module gopkg.in/go-jose/go-jose.v2 to v2.6.3 [security] by @renovate in #5396
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.16.0 by @renovate in #5377
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.17.0 by @renovate in #5412
• fix(deps): update module github.com/docker/docker to v25.0.5+incompatible by @renovate in #5418
• fix(deps): update github.com/containers/luksy digest to 3d2cf0e by @renovate in #5447
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.17.1 by @renovate in #5430
• chore(deps): update module golang.org/x/net to v0.23.0 [security] by @renovate in #5485
• fix(deps): update module github.com/containers/luksy to v0.0.0-20240408185936-afd8e7619947 by @renovate in #5502
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.17.2 by @renovate in #5505
• fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.5 by @renovate in #5511
• fix(deps): update module golang.org/x/exp to v0.0.0-20240416160154-fe59bbe5cc7f by @renovate in #5516
• chore(deps): update module github.com/opencontainers/runtime-spec to v1.2.0 by @renovate in #5363
• fix(deps): update module github.com/containers/luksy to v0.0.0-20240506205542-84b50f50f3ee by @renovate in #5518
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.18.0 by @renovate in #5540
• fix(deps): update module github.com/containers/image/v5 to v5.31.0 by @renovate in #5539

New Contributors

• @Pvlerick made their first contribution in #5402
• @aaronlehmann made their first contribution in #5445
• @onlykzy made their first contribution in #5457
• @jnovy made their first contribution in #5528
• @der-eismann made their first contribution in #5463
• @naskya made their first contribution in #5534

Full Changelog: v1.35.0...v1.36.0

v1.33.8

What's Changed

• [release-1.33] Bump to Buildah v1.33.8, CVE-2024-3727 by @TomSweeneyRedHat in #5533
• [release-1.33] Fix CVE-2024-1753, bump to v1.33.7 by @TomSweeneyRedHat in #5417
• [release-1.33] Bump ocicrypt and go-jose CVE-2024-28180 by @TomSweeneyRedHat in #5468
• [release-1.33] Bump go-jose CVE-2024-28180 by @TomSweeneyRedHat in #5482
• [release-1.33] integration test: handle new labels in "bud and test --unsetlabel" by @openshift-cherrypick-robot in #5504

Full Changelog: v1.33.7...v1.33.8

v1.35.4

What's Changed

• [release-1.35] Address CVE-2024-3727 by @TomSweeneyRedHat in #5521
• [release-1.35] Bump c/common to v0.58.1, Buildah to v1.35.3 by @TomSweeneyRedHat in #5441
• [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180 by @TomSweeneyRedHat in #5467
• [release-1.35] Bump go-jose CVE-2024-28180 by @TomSweeneyRedHat in #5481
• [release-1.35] integration test: handle new labels in "bud and test --unsetlabel" by @openshift-cherrypick-robot in #5503

Full Changelog: v1.35.3...v1.35.4

v1.26.7

What's Changed

• [release-1.26] CVE-2024-1753, Bump to Buildah v1.26.7 by @TomSweeneyRedHat in #5450
• [release-1.26] Mask /sys/devices/virtual/powercap by default by @openshift-cherrypick-robot in #5133
• [release-1.26] run the cross-compile test on M1 MacOS, not Intel by @openshift-cherrypick-robot in #5131

Full Changelog: v1.35.3...v1.26.7

v1.24.7

What's Changed

• [release-1.24] add: fail on bad HTTP response instead of writing to container for URL sources by @flouthoc in #4288
• [1.24] Define and use a safe, reliable test image by @edsantiago in #4384
• [release-1.24] [CI:BUILD] Cirrus: Migrate OSX task to M1 by @lsm5 in #4500
• [release-1.24] remove registry.centos.org by @edsantiago in #4827
• [release-1.24] Explicitly ref. quay images for CI by @cevich in #4850
• [release-1.24] Mask /sys/devices/virtual/powercap by default by @openshift-cherrypick-robot in #5134
• [release-1.24] conformance test: ignore file type bits when comparing layers by @cevich in #5260
• [release-1.24] bump golang.org/x/crypto to v0.17.0 by @lsm5 in #5245
• [release-1.24] Cirrus: disable cross_build task by @lsm5 in #5353
• [release-1.24] CVE-2024-1753, Bump to Buildah v1.24.7 by @TomSweeneyRedHat in #5451

Full Changelog: v1.35.3...v1.24.7

v1.35.3

What's Changed

• [release-1.35] Bump c/common to v0.58.1, Buildah to v1.35.3 by @TomSweeneyRedHat in #5441

Full Changelog: v1.35.2...v1.35.3

v1.31.5

What's Changed

*[release-1.31] bump to v1.31.5, fix conformance, CVE-2024-1753, CVE-2024-24786 by @TomSweeneyRedHat in #5444

• [release-1.31] Bump golang.org/x/crypto v0.17.0 by @TomSweeneyRedHat in #5337

Full Changelog: v1.35.2...v1.31.5

v1.32.3

What's Changed

• [release-1.32] Adresses CVE-2024-1753 and CVE-2024-24786, bump to V1.32.3 by TomSweeneyRedHat in #5424
• [release-1.32] .cirrus.yml: run tests relative to the release-1.32 branch by @nalind in #5048
• Fix for CVE-2023-39325 by @lsm5 in #5142
• [release-1.32] Recover release-branch CI by @cevich in #5431

Full Changelog: v1.35.2...v1.32.3

v1.29.3

What's Changed

• [release-1.29] bump to v1.29.3, fix conformance, CVE-2024-1753, CVE-2024-24786 by @TomSweeneyRedHat in #5434
• [release-1.29] conformance test: ignore file type bits when comparing layers by @nalind in #5257
• [release-1.29] bump golang.org/x/crypto to v0.17.0 by @lsm5 in #5244

Full Changelog: v1.35.2...v1.29.3

v1.27.4

What's Changed

• [release-1.27] Adresses CVE-2024-1753 and CVE-2024-24786, bump to V1.27.4by @TomSweeneyRedHat in #5435
• [release-1.27] Mask /sys/devices/virtual/powercap by default by @openshift-cherrypick-robot in #5128
• [release-1.27] Disable CI by @cevich in #4851
• [release-1.27] remove registry.centos.org by @edsantiago in #4826
• [release-1.27] Cirrus: Add CI self-destruct condition on EOL date by @cevich in #4770
• [release-1.27] [CI:BUILD] Cirrus: Migrate OSX task to M1 by @openshift-cherrypick-robot in #4504

Full Changelog: v1.35.2...v1.27.4