distribution

Welcome to the v3.1.1 release of registry!

This is a stable release

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

Notable Changes

• Fixes CVE-2026-41888
• Bounds-check the file basename in PurgeUploads Walk callback
• Add S3 Express One Zone support to the S3 storage driver (#4858)
• Fix tag list endpoint in proxy mode (#4846)
• Clamp oversized n query parameter in proxy mode instead of returning 400 (#4856)

See the full changelog below for the full list of changes.

What's Changed

• internal/client/auth/challenge: cleanups and minor refactor by @thaJeztah in https://github.com/distribution/distribution/pull/4832
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp from 0.18.0 to 0.19.0 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/distribution/distribution/pull/4843
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/distribution/distribution/pull/4850
• build(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4840
• chore(build): Bump go version to latest by @milosgajdos in https://github.com/distribution/distribution/pull/4851
• refactor: use slices.Backward to simplify the code by @chuanshanjida in https://github.com/distribution/distribution/pull/4848
• fix(proxy): fix tag list endpoint in proxy mode by @njucjc in https://github.com/distribution/distribution/pull/4846
• Update docker-compose structure in deploying.md by @jdg71nl in https://github.com/distribution/distribution/pull/4855
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4854
• build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4852
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4847
• build(deps): bump docker/bake-action from 7.0.0 to 7.1.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4853
• fix(proxy): clamp oversized n query param instead of returning 400 by @milosgajdos in https://github.com/distribution/distribution/pull/4856
• feat(s3): add express zone one support to S3 driver by @milosgajdos in https://github.com/distribution/distribution/pull/4858
• fix(storage): bounds-check the file basename in PurgeUploads Walk callback by @SAY-5 in https://github.com/distribution/distribution/pull/4860
• chore(release): prepare for v3.1.1 release by @milosgajdos in https://github.com/distribution/distribution/pull/4864

New Contributors

• @chuanshanjida made their first contribution in https://github.com/distribution/distribution/pull/4848
• @jdg71nl made their first contribution in https://github.com/distribution/distribution/pull/4855
• @SAY-5 made their first contribution in https://github.com/distribution/distribution/pull/4860

Full Changelog: https://github.com/distribution/distribution/compare/v3.1.0...v3.1.1