This update for hauler fixes the following issues:
Changes in hauler:
- update to 2.1.1:
* bumped go version to v1.26.7 (backport #771)
* https registry auth fix (backport #763)
* adjust supporting artifact retrieval (backport #777)
* reject --platform on digest-pinned multi-platform images
* fix: serve registry returns an empty /v2/_catalog list
* added airgapped support for install.sh and added windows
install.ps1
* added/fixed basic auth with registry and fileserver
* fixed store inventory race with concurrent processes
* added type filter to store copy
* fixed missing dirs in containers
* updated github workflo
This update for hauler fixes the following issues:
Changes in hauler:
- update vendor.tar to fix:
* bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662:
hauler: golang.org/x/crypto/ssh: authentication bypass and
deadlocks in the crypto/ssh library
- update vendor.tar to fix:
* bsc#1279416, CVE-2026-84304
* bsc#1279296, CVE-2026-84303
* bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via
crash due to missing ':authority' and 'Host' headers
Update to 2.1.0 (bsc#1265425, CVE-2026-41888).
This update for hauler fixes the following issues:
Changes in hauler:
Update to 2.1.0 (bsc#1265425, CVE-2026-41888, bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662, ).
This update for hauler fixes the following issues:
Changes in hauler:
- update to 2.1.0 (bsc#1265425, CVE-2026-41888):
* `v2.1.0` is a **minor** release built on the containerd-
native foundation laid down in `v2.0.0`. The headline is that
`hauler store sync` and `hauler store add` are now fully
concurrent, with signature verification pinned to digests and
running in parallel too. Alongside that, this release adds an
audit trail, a store integrity checker, store-to-manifest
generation, private/insecure registry support across every
pull path, and a set of fixes for containerd imports, chunked
hauls, and Doc
This update for hauler fixes the following issues:
Changes in hauler:
- update to 2.0.1 (bsc#1269433, CVE-2026-48702):
* bump go to 1.26.4 to squash CVE noise
* Full v2 Release notes: https://github.com/hauler-
dev/hauler/releases/tag/v2.0.0
- update to 2.0.0:
* `v2.0.0` is a **major** release. It replaces Hauler's entire
OCI plumbing... the ORAS v1 dependency and the in-house
cosign fork with a native containerd based implementation,
drops the deprecated `v1alpha1` API, and layers on a
meaningful set of new capabilities and reliability fixes on
top of that new foundation.
* **Removed the ORAS v1 dependency*
This update for hauler fixes the following issues:
Changes in hauler:
- Update to version 1.4.1 (bsc#1256546, CVE-2026-22772):
* fixed typos for containerd imports (#493)
* fix and support containerd imports of `hauls` (#492)
* bump github.com/sigstore/fulcio (#489)
- Update to version 1.4.0:
* added/updated logging for `serve` and `remove` (#487)
* added/fixed helm chart images/dependencies features (#485)
* more experimental feature updates (#486)
* add experimental notes (#483)
* updated tempdir flag to store persistent flags (#484)
* delete artifacts from store (#473)
* path rewrites (#475)
* updated/fixed workflo
This update for hauler fixes the following issues:
- Update to version 1.3.1 (bsc#1251516, CVE-2025-47911,
bsc#1251891, CVE-2025-11579, bsc#1251651, CVE-2025-58190,
bsc#1248937, CVE-2025-58058):
* bump github.com/containerd/containerd (#474)
* another fix to tests for new tests (#472)
* fixed typo in testdata (#471)
* fixed/cleaned new tests (#470)
* trying a new way for hauler testing (#467)
* update for cosign v3 verify (#469)
* added digests view to info (#465)
* bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 in the go_modules group across 1 directory (#457)
* update oras-go to v1.2.7 for security patches (