v1.41.0

What's Changed

Notable changes

• Bump c/storage v1.58.0, c/image v5.35.0, c/common v0.63.0, Buildah v1.40.0, then to dev by @TomSweeneyRedHat in #6136
• Filter image only when necessary by @hanwen-flow in #6141
• test/serve: fix a descriptor leak, add preliminary directory support by @nalind in #6146
• Support label_users in buildah by @rhatdan in #6161
• Fix typo in comment by @brawer in #6167
• Refactor NewImageSource to add a manifest type abstraction by @aaronlehmann in #5743
• [skip-ci] Packit: Ignore ELN and CentOS Stream jobs by @lsm5 in #6172
• internal/util.SetHas(): handle maps of [generic]generic by @nalind in #6173
• imagebuildah: select most recent layer for cache in case on conflict by @flouthoc in #6171
• [skip-ci] Packit: set fedora-all after F40 EOL by @lsm5 in #6170
• Use Fedora 42 instead of 41 in that one conformance test by @nalind in #6174
• [CI:DOCS] update a couple of lists in the build man page by @nalind in #6175
• pkg/parse.GetBuildOutput(): use strings.Cut() by @nalind in #6176
• build: allow --output to be specified multiple times by @nalind in #6177
• copier: add Ensure and ConditionalRemove by @nalind in #6179
• add: add a new --timestamp flag by @nalind in #6178
• [skip-ci] Packit: Disable osh_diff_scan by @lsm5 in #6164
• [CI:DOCS] Add CNCF roadmap, touchup other CNCF files by @TomSweeneyRedHat in #6124
• [CI:DOCS] README.md: add openssf passing badge by @lsm5 in #6181
• run: handle relabeling bind mounts ourselves by @nalind in #6132
• fix link to Maintainers file by @JayKayy in #6187
• remove static nix build by @Luap99 in #6191
• parse, validateExtraHost: honor host-gateway in format by @flouthoc in #6188
• Don't BuildRequires: ostree-devel by @mtrmac in #6192
• Tweak our handling of variant values, again by @nalind in #6190
• vendor latest c/{common,image,storage} by @Luap99 in #6200
• Ensure extendedGlob returns paths in lexical order by @Honny1 in #6169
• commit: add --source-date-epoch and --rewrite-timestamp flags by @nalind in #6189
• build: add --source-date-epoch and --rewrite-timestamp flags by @nalind in #6208
• build,config: add support for --unsetannotation by @flouthoc in #6195
• build: --source-date-epoch/--timestamp use static hostname/cid by @nalind in #6211
• Builder.sbomScan(): don't break non-root scanners by @nalind in #6217
• docs: add --setopt "*.countme=false" to dnf examples by @nalind in #6215
• dynamically link sqlite by @Luap99 in #6216
• commit,build: --source-date-epoch/--timestamp omit identity label by @nalind in #6214
• Support zstd compression in image commit by @aaronlehmann in #5452
• build: add support for --inherit-annotations by @flouthoc in #6198
• CI: give the rootless test user some supplemental groups by @nalind in #6227
• bud,run: runc does not support keep-groups by @ricardobranco777 in #6226
• "root fs only mounted once" test: accept root with only the rw option by @nalind in #6230
• conformance: use mirrored frontend and base images by @nalind in #6232
• CI: ensure rootless groups aren't duplicates by @nalind in #6228
• commit-with-extra-files test: use $TEST_SCRATCH_DIR by @nalind in #6231
• run,commit: clean up parents of mount targets, too by @nalind in #6233
• Add CommitOptions.OmitLayerHistoryEntry, for skipping the new bits by @nalind in #6236
• build, commit: set the OCI ...created annotation on OCI images by @nalind in #6239
• Add conditional release-checking system test by @cevich in #6243
• Use containers/common's formats package instead of our own by @nalind in #6242
• Update Neil Smith's GitHub username in MAINTAINERS.md by @actionmancan in #6248
• Accept SOURCE_DATE_EPOCH as a build-arg by @nalind in #6247
• vendor: update c/{common,image,storage} to main by @Luap99 in #6251
• Update "bud with --cpu-shares" test, and rename it by @nalind in #6271
• Remove BUILDTAG btrfs_noversion as no longer effective by @rahilarious in #6267
• buildah: move passwd command to tests by @flouthoc in #6264
• chore(typos): fix typos by @pstoeckle in #6252
• feat: ADD/COPY --link support for buildah by @2004joshua in #6240
• stage_executor: check platform of cache candidates by @flouthoc in #6269

Dependency updates

• fix(deps): update module github.com/containers/common to v0.63.0 by @renovate[bot] in #6135
• fix(deps): update module github.com/docker/docker to v28.1.1+incompatible by @renovate[bot] in #6138
• chore(deps): update dependency containers/automation_images to v20250422 by @renovate[bot] in #6142
• fix(deps): update module github.com/seccomp/libseccomp-golang to v0.11.0 by @renovate[bot] in #6144
• fix(deps): update module github.com/moby/buildkit to v0.21.1 by @renovate[bot] in #6149
• fix(deps): update module github.com/opencontainers/runc to v1.3.0 by @renovate[bot] in #6147
• fix(deps): update module github.com/opencontainers/cgroups to v0.0.2 by @renovate[bot] in #6150
• fix(deps): update github.com/containers/luksy digest to 4bb4c3f by @renovate[bot] in #6151
• fix(deps): update module golang.org/x/sync to v0.14.0 by @renovate[bot] in #6154
• fix(deps): update module golang.org/x/crypto to v0.38.0 by @renovate[bot] in #6156
• fix(deps): update module github.com/moby/buildkit to v0.22.0 by @renovate[bot] in #6180
• fix(deps): update module github.com/docker/docker to v28.2.0+incompatible by @renovate[bot] in #6186
• fix(deps): update module github.com/openshift/imagebuilder to v1.2.16 by @renovate[bot] in #6203
• fix(deps): update module golang.org/x/sync to v0.15.0 by @renovate[bot] in #6209
• fix(deps): update module golang.org/x/crypto to v0.39.0 by @renovate[bot] in #6210
• fix(deps): update module go.etcd.io/bbolt to v1.4.1 by @renovate[bot] in #6219
• fix(deps): update module github.com/moby/buildkit to v0.23.0 by @renovate[bot] in #6229
• Update module github.com/fsouza/go-dockerclient to v1.12.1 by @renovate[bot] in #6235
• Update module github.com/opencontainers/cgroups to v0.0.3 by @renovate[bot] in #6237
• Update module github.com/moby/buildkit to v0.23.1 by @renovate[bot] in #6238
• fix(deps): update module github.com/docker/docker to v28.3.0+incompatible by @renovate[bot] in #6244
• fix(deps): update module go.etcd.io/bbolt to v1.4.2 by @renovate[bot] in #6249
• chore(deps): update module github.com/go-viper/mapstructure/v2 to v2.3.0 [security] by @renovate[bot] in #6250
• fix(deps): update github.com/containers/luksy digest to bc60f96 by @renovate[bot] in #6255
• fix(deps): upda...

v1.40.1

What's Changed

Notable changes

• [release-1.40] Tweak our handling of variant values, again by @openshift-cherrypick-robot in #6197
• [release-1.40] run: handle relabeling bind mounts ourselves by @nalind in #6201
• [release-1.40] vendor: update c/common to v0.63.1 by @Luap99 in #6204

Full Changelog: v1.40.0...v1.40.1

v1.40.0

What's Changed

Notable changes

• Bump Buildah to v1.39.0, c/storage v1.57.1, c/image v5.34.0, c/common v0.62.0 by @TomSweeneyRedHat in #5962
• CI: parallize unit tests by @flouthoc in #5954
• .cirrus: bump ci resources by @flouthoc in #5979
• Distinguish --mount=type=cache locations by ownership, too by @nalind in #5978
• Switch to the CNCF Code of Conduct by @mheon in #5982
• .cirrus: use more cores for smoke task by @flouthoc in #5986
• Use tmpfs for integration tests by @flouthoc in #5959
• Support the containers.conf container_name_as_hostname option by @nalind in #5943
• cirrus: reduce task timeout by @Luap99 in #5994
• chroot createPlatformContainer: use MS_REMOUNT by @nalind in #5992
• conformance: make TestCommit and TestConformance parallel by @flouthoc in #5995
• Fix Conformance tests on ARM64 by @Honny1 in #5990
• tests/conformance/testdata/Dockerfile.add: update some URLs by @nalind in #6012
• [skip-ci] TMT: system tests by @lsm5 in #5885
• internal/mkcw.Archive(): use github.com/containers/storage/pkg/ioutils by @nalind in #6031
• github: disable cron rerun action by @Luap99 in #6036
• Use UnparsedInstance.Manifest instead of ImageSource.GetManifest by @mtrmac in #6014
• stage_executor: history should include heredoc summary correctly by @flouthoc in #6041
• buildah-build.1.md: secret examples by @hdub-tech in #5999
• github: remove cirrus rerun action by @Luap99 in #6063
• fix: dockerfiles... always evaluates to an empty list by @aeijdenberg in #6047
• Update to Go 1.23 and bump golang.org/x/crypto v0.36.0 by @Luap99 in #6060
• Add --parents option for COPY in Containerfiles by @Honny1 in #6008
• Mask thermal paths by @giuseppe in #6074
• vendor: bump c/common to dbeb17e40c80 by @flouthoc in #6039
• Fix built-in args on ARM64 by @Honny1 in #6076
• vendor: update github.com/opencontainers/selinux to v1.12.0 by @Luap99 in #6079
• feat: use HistoryTimestamp, if set, for oci-archive entries by @aeijdenberg in #6023
• createPlatformContainer: drop MS_REMOUNT|MS_BIND by @nalind in #6088
• add: report error while creating dir for URL source. by @flouthoc in #6087
• Allow extendedGlob to work with Windows paths by @danegsta in #6083
• build: return ExecErrorCodeGeneric when git operation fails instead of relaying error code directly from git by @flouthoc in #6092
• cmd/buildah: rm unused code by @kolyshkin in #6101
• stage_executor: reset platform in systemcontext for every stage. by @flouthoc in #5971
• Golangci v2 by @kolyshkin in #6109
• Modernize by @kolyshkin in #6118
• Add a link to project governance and MAINTAINERS file by @mheon in #6108
• stage_executor,getCreatedBy: expand buildArgs before invoking generatePathChecksum by @flouthoc in #6110
• .github: check_cirrus_cron work around github bug by @Luap99 in #6120
• build: add support for --inherit-labels by @flouthoc in #6103
• cli: hide the completion command instead of disabling it outright by @nalind in #6128
• cirrus: make Total Success wait for rootless integration by @Luap99 in #6130
• [CI:DOCS] Document rw/src for --mount in buildah-run(1) by @nalind in #6127
• Update Buildah issue template to new version and support podman build by @ninja-quokka in #6099
• chroot: use symbolic names when complaining about mount() errors by @nalind in #6129

Dependency updates

• Update dependency containers/automation_images to v20250131 by @renovate in #5966
• Update module golang.org/x/sync to v0.11.0 by @renovate in #5969
• Update module golang.org/x/sys to v0.30.0 by @renovate in #5970
• fix(deps): update module golang.org/x/term to v0.29.0 by @renovate in #5972
• fix(deps): update module golang.org/x/crypto to v0.33.0 by @renovate in #5981
• fix(deps): update module github.com/spf13/cobra to v1.9.0 by @renovate in #5991
• fix(deps): update module github.com/opencontainers/runc to v1.2.5 by @renovate in #5989
• fix(deps): update module github.com/moby/buildkit to v0.20.0 by @renovate in #5997
• fix(deps): update module tags.cncf.io/container-device-interface to v0.8.1 by @renovate in #6004
• chore(deps): update module github.com/go-jose/go-jose/v4 to v4.0.5 [security] by @renovate in #6005
• fix(deps): update module github.com/opencontainers/runtime-spec to v1.2.1 by @renovate in #6013
• fix(deps): update module github.com/containers/image/v5 to v5.34.1 by @renovate in #6015
• fix(deps): update module github.com/opencontainers/image-spec to v1.1.1 by @renovate in #6020
• fix(deps): update module github.com/moby/buildkit to v0.20.1 by @renovate in #6032
• fix(deps): update github.com/containers/luksy digest to 40bd943 by @renovate in #6016
• fix(deps): update module github.com/containers/common to v0.62.1 by @renovate in #6021
• fix(deps): update module github.com/containers/storage to v1.57.2 by @renovate in #6042
• fix(deps): update module github.com/containers/image/v5 to v5.34.2 by @renovate in #6057
• fix(deps): update module github.com/containers/common to v0.62.2 by @renovate in #6062
• chore(deps): update module golang.org/x/net to v0.36.0 [security] by @renovate in #6064
• fix(deps): update module tags.cncf.io/container-device-interface to v1 by @renovate in #6045
• fix(deps): update module github.com/opencontainers/runc to v1.2.6 by @renovate in #6070
• fix(deps): update module tags.cncf.io/container-device-interface to v1.0.1 by @renovate in #6078
• chore(deps): update dependency containers/automation_images to v20250324 by @renovate in #6081
• fix(deps): update module github.com/docker/docker to v28.0.2+incompatible by @renovate in #5998
• fix(deps): update github.com/openshift/imagebuilder digest to e87e4e1 by @renovate in #6017
• fix(deps): update module github.com/moby/buildkit to v0.20.2 by @renovate in #6082
• fix(deps): update module github.com/docker/docker to v28.0.3+incompatible by @renovate in #6085
• fix(deps): update github.com/opencontainers/runtime-tools digest to 260e151 by @renovate in #6102
• fix(deps): update module golang.org/x/crypto to v0.37.0 by @renovate in #6115
• fix(deps): update module github.com/containernetworking/cni to v1.3.0 by @renovate in #6117
• fix(deps): update github.com/containers/storage digest to b1d1b45 by @renovate in #6100
• chore(deps): update dependency golangci/golangci-lint to v2.1.0 by @renovate in #6122
• fix(deps): update module github.com/moby/buildkit to v0.21.0 by @renovate in #6125
• fix(deps): update module github.com/containers/storage to v1.58.0 by @renovate in #6131
• fix(deps): update modul...

v1.39.4

What's Changed

Notable changes

• [release-1.39] Bump c/image to v5.34.3, c/common v0.62.3, Bulidah v1.39.4 by @TomSweeneyRedHat in #6094
• [release-1.39] createPlatformContainer: drop MS_REMOUNT|MS_BIND by @openshift-cherrypick-robot in #6089

Full Changelog: v1.39.3...v1.39.4

v1.39.3

What's Changed

Notable changes

• [release-1.39] Bump c/storage to v1.57.2, c/image v5.34.2, c/common v0.62.2, c/buildah v1.39.3 by @TomSweeneyRedHat in #6061

Full Changelog: v1.39.2...v1.39.3

v1.39.2

What's Changed

Notable changes

• [release-1.39] Bump c/image to v5.34.1, c/common v0.62.1, c/buildah v1.39.2 by @TomSweeneyRedHat #6022
• [release-1.39] tag v1.39.1 by @nalind in #6007

Full Changelog: v1.39.1...v1.39.2

v1.39.1

What's Changed

Notable changes

• [release-1.39] chroot createPlatformContainer: use MS_REMOUNT by @nalind in #6003
• [release-1.39] chore(deps): update module github.com/go-jose/go-jose/v4 to v4.0.5 [security] by @openshift-cherrypick-robot in #6009

Full Changelog: v1.39.0...v1.39.1

v1.29.5

What's Changed

• [release-1.29] Properly validate cache IDs and sources by @dashea in #5787
• [release-1.29] Fix CVE-2024-11218 by @cevich in #5955

Full Changelog: v1.29.4...v1.29.5

v1.39.0

What's Changed

Notable changes

• Bump to c/common v0.61.0, c/image v5.33.0, c/storage v1.56.0, Buildah to v1.38.0 by @TomSweeneyRedHat in #5830
• CI VMs: bump again by @edsantiago in #5833
• Finish updating to go 1.22 by @nalind in #5835
• (not just) Makefile cleanups by @kolyshkin in #5832
• executor: allow to specify --no-pivot-root by @giuseppe in #5838
• Makefile: list sources via find conditionally by @danishprakash in #5807
• Tests: make _prefetch() parallel-safe by @edsantiago in #5841
• [skip-ci] Packit: f39 and rhel cleanups by @lsm5 in #5849
• CI: remove some inter-job dependencies, run cross-compile task with make -j, use /tmp for Go build cache by @nalind in #5856
• copier: use .PAXRecords instead of .Xattrs by @nalind in #5875
• Add context to an error message by @nalind in #5873
• manifest add: add --artifact-annotation by @nalind in #5854
• chroot: on Linux, try to pivot_root before falling back to chroot by @nalind in #5874
• Fix an error message in the chroot unit test by @nalind in #5876
• stage_executor: set avoidLookingCache only if mounting stage and not additional build context by @flouthoc in #5693
• Allow cache mounts to be stages and additional build contexts by @nalind in #5897
• New VM Images by @Luap99 in #5900
• [skip-ci] RPM: cleanup changelog conditionals by @lsm5 in #5888
• copy-preserving-extended-attributes: use a different base image by @nalind in #5901
• Add support for --security-opt mask and unmask by @rhatdan in #5883
• [CI:DOCS] Touch up changelogs by @TomSweeneyRedHat in #5907
• relabel(): correct a misleading parameter name by @nalind in #5922
• Add more checks to the --mount flag parsing logic by @nalind in #5925
• chroot mount flags integration test: copy binaries by @nalind in #5926
• bump github.com/vbatts/tar-split by @nalind in #5930
• fix broken doc link by @cheesesashimi in #5936
• run_freebsd.go: only import runtime-spec once by @nalind in #5935
• Update c/image and update tests by @mtrmac in #5932
• refactor: replace golang.org/x/exp with stdlib by @Juneezee in #5937
• Run(): always clean up options.ExternalImageMounts by @nalind in #5924
• Accept image names as sources for cache mounts by @nalind in #5934
• [skip-ci] RPM: use default gobuild macro on RHEL by @lsm5 in #5938
• vendor to latest c/{common,image,storage} by @Luap99 in #5929
• build, run: record hash or digest in image history for sources used in --mount by @flouthoc in #5691
• pkg/overlay: cleanups by @nalind in #5927
• bats tests - parallelize by @edsantiago in #5552
• CI, .cirrus: parallelize containerized integration by @flouthoc in #5947

Dependency updates

• Update module github.com/moby/sys/capability to v0.4.0 by @renovate in #5836
• Update module github.com/opencontainers/runc to v1.2.2 by @renovate in #5840
• Update module github.com/moby/buildkit to v0.17.2 by @renovate in #5844
• Update module github.com/stretchr/testify to v1.10.0 by @renovate in #5846
• Update github.com/opencontainers/runtime-tools digest to f7e3563 by @renovate in #5852
• Update golang.org/x/exp digest to 2d47ceb by @renovate in #5853
• Update module github.com/moby/buildkit to v0.18.1 by @renovate in #5848
• Update module golang.org/x/crypto to v0.30.0 by @renovate in #5859
• Update module github.com/docker/docker to v27.4.0-rc.4+incompatible by @renovate in #5863
• Update module github.com/cyphar/filepath-securejoin to v0.3.5 by @renovate in #5865
• Update module github.com/docker/docker to v27.4.0+incompatible by @renovate in #5870
• Update module github.com/opencontainers/runc to v1.2.3 by @renovate in #5871
• Update module golang.org/x/crypto to v0.31.0 by @renovate in #5872
• fix(deps): update module github.com/moby/buildkit to v0.18.2 by @renovate in #5879
• fix(deps): update module github.com/cyphar/filepath-securejoin to v0.3.6 by @renovate in #5880
• fix(deps): update module github.com/containers/ocicrypt to v1.2.1 by @renovate in #5878
• fix(deps): update module github.com/docker/docker to v27.4.1+incompatible by @renovate in #5882
• fix(deps): update module github.com/opencontainers/runc to v1.2.4 by @renovate in #5898
• fix(deps): update module golang.org/x/crypto to v0.32.0 by @renovate in #5896
• chore(deps): update module golang.org/x/net to v0.33.0 [security] by @renovate in #5887
• fix(deps): update github.com/containers/luksy digest to a3a812d by @renovate in #5890
• fix(deps): update module github.com/docker/docker to v27.5.0+incompatible by @renovate in #5904
• fix(deps): update module github.com/containers/image/v5 to v5.33.1 by @renovate in #5909
• fix(deps): update module github.com/containers/common to v0.61.1 by @renovate in #5912
• fix(deps): update module github.com/moby/buildkit to v0.19.0 by @renovate in #5923
• fix(deps): update module github.com/docker/docker to v27.5.1+incompatible by @renovate in #5933
• Update module github.com/containers/storage to v1.57.0 by @renovate in #5957

New Contributors

• @cheesesashimi made their first contribution in #5936

Full Changelog: v1.38.0...v1.39.0

v1.27.6

What's Changed

• [release-1.27] Properly validate cache IDs and sources by @dashea in #5797
• [release-1.27] Backport fix for CVE-2024-11218 by @dashea in #5946
• [release-1.27] Bump to 1.27.6 by @dashea in #5958

Full Changelog: v1.27.5...v1.27.6