zot

What's Changed

• fix(api): return 416 for bad upload range on PUT; fix GET upload Range at size zero by @andaaron in https://github.com/project-zot/zot/pull/3983
• feat(zb): Support for TTFB measurement + on-demand sync tests by @vrajashkr in https://github.com/project-zot/zot/pull/3929
• fix(api): recognize Docker Compose/Buildx User-Agent in v2 challenge workaround by @gjed in https://github.com/project-zot/zot/pull/3992
• chore: fix dependabot alerts by @rchincha in https://github.com/project-zot/zot/pull/3990
• feat(auth): support OIDC RP-Initiated Logout by @krjakbrjak in https://github.com/project-zot/zot/pull/3975
• fix(security): enhance timeout configurations and body size limits fo… by @rchincha in https://github.com/project-zot/zot/pull/3984
• Improve zli CVE diff output by @AkashKumar7902 in https://github.com/project-zot/zot/pull/3994
• chore: fix dependabot alerts by @rchincha in https://github.com/project-zot/zot/pull/4020
• Support multipart range blob pulls by @AkashKumar7902 in https://github.com/project-zot/zot/pull/3995
• fix(sync): apply tag filters before destination mapping by @AkashKumar7902 in https://github.com/project-zot/zot/pull/4003
• Multipart download enhancements by @andaaron in https://github.com/project-zot/zot/pull/4021
• docs(config): reference generated config schema by @AkashKumar7902 in https://github.com/project-zot/zot/pull/4015
• feat(cosign): add support for cosign bundle by @rchincha in https://github.com/project-zot/zot/pull/4023
• feat(auth): map OpenID groups claim by @AkashKumar7902 in https://github.com/project-zot/zot/pull/3999
• test: refactor countingReader into partialReaderOpenTracker and partialReaderReadCloser by @andaaron in https://github.com/project-zot/zot/pull/4027
• fix(auth): refine OIDC identity handling and claim-mapping logs by @andaaron in https://github.com/project-zot/zot/pull/4028
• feat(api): log session/audit subject from UserAccessControl by @andaaron in https://github.com/project-zot/zot/pull/4029
• refactor(zli): add typed ~/.zot config layer and strict validation by @andaaron in https://github.com/project-zot/zot/pull/4030
• refactor(build): move build metadata to pkg/buildinfo by @andaaron in https://github.com/project-zot/zot/pull/4045
• feat(zli): add config list/show/get/set/reset and isolate deprecated syntax by @andaaron in https://github.com/project-zot/zot/pull/4037
• fix(zli config): print help for missing args by @andaaron in https://github.com/project-zot/zot/pull/4046
• feat(authz): introduce conditional access control via CEL by @matheuscscp in https://github.com/project-zot/zot/pull/4040
• ci: sync go 1.26 images to ghcr.io/project-zot/golang by @andaaron in https://github.com/project-zot/zot/pull/4049
• ci: fix golangci-lint install URL by @andaaron in https://github.com/project-zot/zot/pull/4052
• chore: fix dependabot alerts by @rchincha in https://github.com/project-zot/zot/pull/4048
• fix: downgrade expected missing-blob HEAD logging from error to debug by @rchincha in https://github.com/project-zot/zot/pull/4056
• chore: fix dependabot alerts by @rchincha in https://github.com/project-zot/zot/pull/4059
• fix(lint): silence deprecated gomodguard linter warning by @benoittgt in https://github.com/project-zot/zot/pull/4070
• feat(metrics): add Prometheus GC metrics by @benoittgt in https://github.com/project-zot/zot/pull/3863
• chore: fix dependabot alerts by @rchincha in https://github.com/project-zot/zot/pull/4072
• chore: bump zui version by @rchincha in https://github.com/project-zot/zot/pull/4074

New Contributors

• @gjed made their first contribution in https://github.com/project-zot/zot/pull/3992
• @krjakbrjak made their first contribution in https://github.com/project-zot/zot/pull/3975
• @AkashKumar7902 made their first contribution in https://github.com/project-zot/zot/pull/3994

Full Changelog: https://github.com/project-zot/zot/compare/v2.1.16...v2.1.17