Distribution Files

Welcome to the v3.1.2 release of registry!

This is a stable release

This patch release includes security fixes, storage and pagination fixes, and dependency updates.

Please try out the release binaries and report any issues at https://github.com/distribution/distribution/issues.

Notable Changes

• Verify manifest and blob content against the requested digest in the registry client, protecting digest-pinned requests and pull-through caches (CVE-2026-85747 / GHSA-685w-q87j-wqw3).
• Update security-sensitive dependencies, including gRPC, OpenTelemetry, and golang.org/x/crypto (#4912, [#4963], [#4965], [#4968]). The OTLP gRPC log exporter now honors TLS certificates configured through environment variables.
• Fix S3 tag pagination and catalog listing when one name is a prefix of another (#4898, [#4904]), and return an empty tag array after the final pagination marker (#4931).
• Fix Azure blob type migration and a concurrent append-write race (#4871, [#4888]).
• Check the storage backend directly when writing blobs to avoid stale descriptor-cache entries (#4868).
• Reject malformed manifest digests and out-of-order final upload chunks correctly (#4945), accept unknown total sizes in Content-Range (#4892), and preserve upstream error codes (#4917).
• Stop the upload purger during registry shutdown (#4956).
• Validate S3 redirect endpoints at driver initialization (#4870).
• Remove the logrus-logstash-hook dependency while retaining the logstash formatter option (#4970).

Build Updates

• Building from source now requires Go 1.26 or newer (#4961).
• Container images now use Alpine Linux 3.24 (#4966).

See the changelog below for the full list of changes.

What's Changed

• build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4861
• build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4859
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4865
• build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4867
• chore: smol go fix changes by @milosgajdos in https://github.com/distribution/distribution/pull/4876
• build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4877
• build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4874
• build(deps): bump docker/bake-action from 7.1.0 to 7.2.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4879
• fix(storage): Fix blob type migration in the azure driver by @DMarby in https://github.com/distribution/distribution/pull/4871
• fix: report error in DeleteManifest when Delete returns ErrDigestUnsupported by @joonas in https://github.com/distribution/distribution/pull/4802
• feat(s3): parse and strictly validate redirectendpoint on driver initialization by @DARSHANR007 in https://github.com/distribution/distribution/pull/4870
• azure: fix race condition in PutContent causing duplicate append writes by @Fricounet in https://github.com/distribution/distribution/pull/4888
• fix(s3): tags/list drops tags that are a lexical prefix of another tag by @milosgajdos in https://github.com/distribution/distribution/pull/4898
• fix contentRangeRegexp to accept unknown total size by @alhudz in https://github.com/distribution/distribution/pull/4892
• fix: check backend directly in blobStore.Put to avoid stale cache by @chenhuiluo in https://github.com/distribution/distribution/pull/4868
• fix(security): fix CVE-2026-46595 by bumping golang.org/x/crypto by @milosgajdos in https://github.com/distribution/distribution/pull/4912
• docs: document catalog.maxentries configuration by @tokuhirom in https://github.com/distribution/distribution/pull/4911
• build(deps): bump actions/labeler from 6.0.1 to 6.1.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4866
• build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4881
• build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4882
• build(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4880
• pass thru upstream error code by @darshanime in https://github.com/distribution/distribution/pull/4917
• fix(storage): don't drop catalog repos that prefix another name by @mrnicegyu11 in https://github.com/distribution/distribution/pull/4904
• build(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/distribution/distribution/pull/4922
• fix(tags): return empty array after final pagination marker by @joonas in https://github.com/distribution/distribution/pull/4931
• docs: fix CloudFront Origin Path guidance for S3 driver by @VedantMadane in https://github.com/distribution/distribution/pull/4936
• chore(deps): github.com/docker/go-metrics v0.1.0 by @thaJeztah in https://github.com/distribution/distribution/pull/4941
• chore: update testify, logrus, and migrate to go.yaml.in/yaml/v2 by @thaJeztah in https://github.com/distribution/distribution/pull/4940
• test: use ephemeral ports for registry listen tests by @locker95 in https://github.com/distribution/distribution/pull/4929
• Fix 500s from malformed manifest digests and out-of-order final chunk PUTs by @tianon in https://github.com/distribution/distribution/pull/4945
• fix(ci): fix broken minio image by @milosgajdos in https://github.com/distribution/distribution/pull/4960
• fix(s3): use path.Dir instead of filepath.Dir in directoryDiff by @pujitha24 in https://github.com/distribution/distribution/pull/4950
• docs: fix 'allows to rewrite' grammar in rewrite storage middleware by @mrchatam in https://github.com/distribution/distribution/pull/4955
• chore(build): Bump Go version to latest 1.26 by @milosgajdos in https://github.com/distribution/distribution/pull/4961
• fix(handlers): cancel context on Shutdown to stop upload purger goroutine by @Tyagiquamar in https://github.com/distribution/distribution/pull/4956
• fix(deps): bump grpc dep to fix sec vuln by @milosgajdos in https://github.com/distribution/distribution/pull/4963
• docs: explain Redis Sentinel configuration by @git-jxj in https://github.com/distribution/distribution/pull/4964
• fix(deps): update deps to fix security vulns by @milosgajdos in https://github.com/distribution/distribution/pull/4965
• chore(ci): bump alpine image version by @milosgajdos in https://github.com/distribution/distribution/pull/4966
• chore(deps): bump oltp version by @milosgajdos in https://github.com/distribution/distribution/pull/4968
• build(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4915
• chore(docs): fix build status badge by @milosgajdos in https://github.com/distribution/distribution/pull/4969
• registry: remove logrus-logstash-hook dependency by @thaJeztah in https://github.com/distribution/distribution/pull/4970
• ci: dependabot: group CodeQL and Docker action updates by @thaJeztah in https://github.com/distribution/distribution/pull/4975
• build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4979
• build(deps): bump the codeql-actions group with 4 updates by @dependabot[bot] in https://github.com/distribution/distribution/pull/4977
• build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 by @dependabot[bot] in https://github.com/distribution/distribution/pull/4982
• build(deps): bump the docker-actions group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/distribution/distribution/pull/4978
• chore(release): prepare for v3.1.2 release by @milosgajdos in https://github.com/distribution/distribution/pull/4981

New Contributors

• @DMarby made their first contribution in https://github.com/distribution/distribution/pull/4871
• @DARSHANR007 made their first contribution in https://github.com/distribution/distribution/pull/4870
• @Fricounet made their first contribution in https://github.com/distribution/distribution/pull/4888
• @alhudz made their first contribution in https://github.com/distribution/distribution/pull/4892
• @chenhuiluo made their first contribution in https://github.com/distribution/distribution/pull/4868
• @tokuhirom made their first contribution in https://github.com/distribution/distribution/pull/4911
• @darshanime made their first contribution in https://github.com/distribution/distribution/pull/4917
• @mrnicegyu11 made their first contribution in https://github.com/distribution/distribution/pull/4904
• @VedantMadane made their first contribution in https://github.com/distribution/distribution/pull/4936
• @locker95 made their first contribution in https://github.com/distribution/distribution/pull/4929
• @pujitha24 made their first contribution in https://github.com/distribution/distribution/pull/4950
• @mrchatam made their first contribution in https://github.com/distribution/distribution/pull/4955
• @Tyagiquamar made their first contribution in https://github.com/distribution/distribution/pull/4956
• @git-jxj made their first contribution in https://github.com/distribution/distribution/pull/4964

Full Changelog: https://github.com/distribution/distribution/compare/v3.1.1...v3.1.2