Update registry Docker tag to v3.1.2

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
registry (source)	service	patch	3.1.1 → 3.1.2

---

Release Notes

distribution/distribution (registry)

v3.1.2

Compare Source

Welcome to the v3.1.2 release of registry!

This is a stable release

This patch release includes security fixes, storage and pagination fixes, and dependency updates.

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

Notable Changes

• Verify manifest and blob content against the requested digest in the registry client, protecting digest-pinned requests and pull-through caches (CVE-2026-85747 / GHSA-685w-q87j-wqw3).
• Update security-sensitive dependencies, including gRPC, OpenTelemetry, and golang.org/x/crypto (#​4912, #​4963, #​4965, #​4968). The OTLP gRPC log exporter now honors TLS certificates configured through environment variables.
• Fix S3 tag pagination and catalog listing when one name is a prefix of another (#​4898, #​4904), and return an empty tag array after the final pagination marker (#​4931).
• Fix Azure blob type migration and a concurrent append-write race (#​4871, #​4888).
• Check the storage backend directly when writing blobs to avoid stale descriptor-cache entries (#​4868).
• Reject malformed manifest digests and out-of-order final upload chunks correctly (#​4945), accept unknown total sizes in Content-Range (#​4892), and preserve upstream error codes (#​4917).
• Stop the upload purger during registry shutdown (#​4956).
• Validate S3 redirect endpoints at driver initialization (#​4870).
• Remove the logrus-logstash-hook dependency while retaining the logstash formatter option (#​4970).

Build Updates

• Building from source now requires Go 1.26 or newer (#​4961).
• Container images now use Alpine Linux 3.24 (#​4966).

See the changelog below for the full list of changes.

What's Changed

• build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @​dependabot[bot] in #​4861
• build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @​dependabot[bot] in #​4859
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @​dependabot[bot] in #​4865
• build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @​dependabot[bot] in #​4867
• chore: smol go fix changes by @​milosgajdos in #​4876
• build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @​dependabot[bot] in #​4877
• build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 by @​dependabot[bot] in #​4874
• build(deps): bump docker/bake-action from 7.1.0 to 7.2.0 by @​dependabot[bot] in #​4879
• fix(storage): Fix blob type migration in the azure driver by @​DMarby in #​4871
• fix: report error in DeleteManifest when Delete returns ErrDigestUnsupported by @​joonas in #​4802
• feat(s3): parse and strictly validate redirectendpoint on driver initialization by @​DARSHANR007 in #​4870
• azure: fix race condition in PutContent causing duplicate append writes by @​Fricounet in #​4888
• fix(s3): tags/list drops tags that are a lexical prefix of another tag by @​milosgajdos in #​4898
• fix contentRangeRegexp to accept unknown total size by @​alhudz in #​4892
• fix: check backend directly in blobStore.Put to avoid stale cache by @​chenhuiluo in #​4868
• fix(security): fix CVE-2026-46595 by bumping golang.org/x/crypto by @​milosgajdos in #​4912
• docs: document catalog.maxentries configuration by @​tokuhirom in #​4911
• build(deps): bump actions/labeler from 6.0.1 to 6.1.0 by @​dependabot[bot] in #​4866
• build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 by @​dependabot[bot] in #​4881
• build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​4882
• build(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​4880
• pass thru upstream error code by @​darshanime in #​4917
• fix(storage): don't drop catalog repos that prefix another name by @​mrnicegyu11 in #​4904
• build(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 in the go_modules group across 1 directory by @​dependabot[bot] in #​4922
• fix(tags): return empty array after final pagination marker by @​joonas in #​4931
• docs: fix CloudFront Origin Path guidance for S3 driver by @​VedantMadane in #​4936
• chore(deps): github.com/docker/go-metrics v0.1.0 by @​thaJeztah in #​4941
• chore: update testify, logrus, and migrate to go.yaml.in/yaml/v2 by @​thaJeztah in #​4940
• test: use ephemeral ports for registry listen tests by @​locker95 in #​4929
• Fix 500s from malformed manifest digests and out-of-order final chunk PUTs by @​tianon in #​4945
• fix(ci): fix broken minio image by @​milosgajdos in #​4960
• fix(s3): use path.Dir instead of filepath.Dir in directoryDiff by @​pujitha24 in #​4950
• docs: fix 'allows to rewrite' grammar in rewrite storage middleware by @​mrchatam in #​4955
• chore(build): Bump Go version to latest 1.26 by @​milosgajdos in #​4961
• fix(handlers): cancel context on Shutdown to stop upload purger goroutine by @​Tyagiquamar in #​4956
• fix(deps): bump grpc dep to fix sec vuln by @​milosgajdos in #​4963
• docs: explain Redis Sentinel configuration by @​git-jxj in #​4964
• fix(deps): update deps to fix security vulns by @​milosgajdos in #​4965
• chore(ci): bump alpine image version by @​milosgajdos in #​4966
• chore(deps): bump oltp version by @​milosgajdos in #​4968
• build(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @​dependabot[bot] in #​4915
• chore(docs): fix build status badge by @​milosgajdos in #​4969
• registry: remove logrus-logstash-hook dependency by @​thaJeztah in #​4970
• ci: dependabot: group CodeQL and Docker action updates by @​thaJeztah in #​4975
• build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 by @​dependabot[bot] in #​4979
• build(deps): bump the codeql-actions group with 4 updates by @​dependabot[bot] in #​4977
• build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​4982
• build(deps): bump the docker-actions group across 1 directory with 3 updates by @​dependabot[bot] in #​4978
• chore(release): prepare for v3.1.2 release by @​milosgajdos in #​4981

New Contributors

• @​DMarby made their first contribution in #​4871
• @​DARSHANR007 made their first contribution in #​4870
• @​Fricounet made their first contribution in #​4888
• @​alhudz made their first contribution in #​4892
• @​chenhuiluo made their first contribution in #​4868
• @​tokuhirom made their first contribution in #​4911
• @​darshanime made their first contribution in #​4917
• @​mrnicegyu11 made their first contribution in #​4904
• @​VedantMadane made their first contribution in #​4936
• @​locker95 made their first contribution in #​4929
• @​pujitha24 made their first contribution in #​4950
• @​mrchatam made their first contribution in #​4955
• @​Tyagiquamar made their first contribution in #​4956
• @​git-jxj made their first contribution in #​4964

Full Changelog: distribution/distribution@v3.1.1...v3.1.2

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 03:00 AM and 06:59 AM, Monday through Friday (* 3-6 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: renovate-bot
Once this PR has been reviewed and has the lgtm label, please assign jnpacker for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @renovate-bot. Thanks for your PR.

I'm waiting for a backube member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.8%. Comparing base (e3e67f1) to head (6460f9b).

Additional details and impacted files

@@          Coverage Diff          @@
##            main   #2115   +/-   ##
=====================================
  Coverage   68.7%   68.8%           
=====================================
  Files         58      58           
  Lines       6076    6076           
=====================================
+ Hits        4178    4184    +6     
+ Misses      1585    1582    -3     
+ Partials     313     310    -3     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud