Repository Issue Activity (beta)

#2455 ggcr: test suite failures under Go 1.27

#1004 ContentLength mismatch in blob upload

#2346 🚨 Security Vulnerability Report

#2345 crane: pull hangs on certain images on 0.21.6

#2101 crane: Rebase give inconsistent layer types if the original image and new base use different layer types

#2109 crane: push command erroring with "file manifest.json not found in tar"

#2120 crane: registry needs to hold full layers in memory

#2129 Please provide `debug` images tagged with specific versions

#1168 mutate.Time should be lazy

#2131 crane: Can't be used with mTLS/CBA/ECP enabled accounts

#2440 🚨 Zero-Day: Incomplete SSRF mitigation in `pkg/v1/remote` — DNS hostname bypass and missing safe dialer

#2433 crane: flatten creates an index image with mixed OCI and docker mediatypes

#2352 Security: Missing CheckRedirect (SSRF protection) in writer's http.Client

#2430 crane: v0.22.0 release binaries built with go1.25.0 instead of the declared toolchain go1.26.6

#2145 Allow overriding the default repository prefix when parsing image references in `pkg/name`

#2172 crane: Latest debug container gives Unauthorized in Gitlab CICD

#2173 crane: regression on handling public.ecr.aws/cardinalhq.io/lakerunner repo

#779 using https scheme in image URI fails when parsing

#2409 crane validate fails on indexes with BuildKit attestation manifests (empty OCI config)

#2193 Credential leak via unvalidated WWW-Authenticate realm URL

#2376 crane: allow empty label values

#2204 multiple unbounded io.ReadAll reads allow registry-controlled memory exhaustion (dos)

#2205 remote: lost update when updating OCI referrers fallback tag under concurrent writers

#2222 krane/gcrane: Add --impersonate-service-account flag

#2252 lack of testing?