Tags

registry 2.8.3

Welcome to the v2.8.3 release of registry!

Welcome to the 2.8.3 release of registry!

The 2.8.3 registry release fixes a few bugs and makes a few dependency updates.
The Go runtime has been bumped to 1.20.8.

See the changelog below for full list of changes.

### Bugfixes

* Do not close HTTP request body in HTTP handler ([#4068](https://github.com/distribution/distribution/pull/4068))
* Set Content-Type header in registry client ReadFrom ([#4053](https://github.com/distribution/distribution/pull/4053))
* Do not parse errors as JSON unless Content-Type is set to JSON ([#4054](https://github.com/distribution/distribution/pull/4054))
* Enable Go build tags ([#4009](https://github.com/distribution/distribution/pull/4009))

### General updates

* replace deprecated function SplitHostname ([#4032](https://github.com/distribution/distribution/pull/4032))

### Runtime

* update to go1.20.8 ([#4056](https://github.com/distribution/distribution/pull/4056))

### Dependency Changes

* deprecate digestset package in favor of go-digest/digestset  ([#4064](https://github.com/distribution/distribution/pull/4064))
* deprecate reference package, migrate to github.com/distribution/reference ([#4063](https://github.com/distribution/distribution/pull/4063))

Previous release can be found at [v2.8.2](https://github.com/distribution/distribution/releases/tag/v2.8.2)

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

### Contributors

* Milos Gajdos
* Sebastiaan van Stijn
* Milos Gajdos
* James Hewitt
* Ben Manuel
* Marcus Pettersen Irgens
* zounengren

### Changes
<details><summary>30 commits</summary>
<p>

* Add v2.8.3 release notes ([#4088](https://github.com/distribution/distribution/pull/4088))
  * [`a4fa6992`](https://github.com/distribution/distribution/commit/a4fa69927538d336b6c537712b03ebb8e4194535) Add v2.8.3 release notes
* [release/2.8] Do not close HTTP request body in HTTP handler ([#4068](https://github.com/distribution/distribution/pull/4068))
  * [`5e6b1b5c`](https://github.com/distribution/distribution/commit/5e6b1b5c9823f5941f40f8dc2bbf93f86342a897) Do not close HTTP request body in HTTP handler
* [release/2.8] digestset: deprecate package in favor of go-digest/digestset  ([#4064](https://github.com/distribution/distribution/pull/4064))
  * [`29b00e8b`](https://github.com/distribution/distribution/commit/29b00e8b28994a706bb9eb20574ed60416ddc55c) digestset: deprecate package in favor of go-digest/digestset
  * [`d1ab2430`](https://github.com/distribution/distribution/commit/d1ab2430e6c6226cf54cb46d9a8c8f253f24f8ec) [release/2.8] vendor: github.com/opencontainers/go-digest v1.0.0
* [release/2.8] deprecate reference package, migrate to github.com/distribution/reference ([#4063](https://github.com/distribution/distribution/pull/4063))
  * [`3dda0677`](https://github.com/distribution/distribution/commit/3dda0677474a076ec5746e960fc0fb96ff738fd1) deprecate reference package, migrate to github.com/distribution/reference
* [release/2.8 backport] Set Content-Type header in registry client ReadFrom ([#4053](https://github.com/distribution/distribution/pull/4053))
  * [`cb121c3f`](https://github.com/distribution/distribution/commit/cb121c3f2061817ae1968d1b1e18dde58cfd4ca8) Set Content-Type header in registry client ReadFrom
* [release/2.8] update to go1.20.8 ([#4056](https://github.com/distribution/distribution/pull/4056))
  * [`3c6f7788`](https://github.com/distribution/distribution/commit/3c6f77884209e50bbe15cd95657c50cbd3a463bf) update to go1.20.8
  * [`31f5cd48`](https://github.com/distribution/distribution/commit/31f5cd4865c8053f8c5f62fba2ce13f7493aba1a) Handle rand deprecations in go 1.20
  * [`29b8ba0b`](https://github.com/distribution/distribution/commit/29b8ba0b937417c25700d641623ca09bf9b44f04) Update to go 1.20
  * [`3316b198`](https://github.com/distribution/distribution/commit/3316b19810e1b84bee372a8f285a59dd506381ef) Update to golang 1.19.10
  * [`444d053e`](https://github.com/distribution/distribution/commit/444d053e12d64179b6d3c7d610d493b53268f71c) update golangci-lint to v1.52
  * [`b800af44`](https://github.com/distribution/distribution/commit/b800af44090d4b70be7c5a94b15677327df84fcd) ignore SA1019: ac.(*accessController).rootCerts.Subjects has been deprecated
  * [`0a98a00d`](https://github.com/distribution/distribution/commit/0a98a00d175aa912275d603eadcf821168cf2208) Ignore SA1019: SplitHostname is deprecated.
* [release/2.8 backport] Dont parse errors as JSON unless Content-Type is set to JSON ([#4054](https://github.com/distribution/distribution/pull/4054))
  * [`2ec0471b`](https://github.com/distribution/distribution/commit/2ec0471bb5bb3e0380f5902ee38b92956fc56dff) Dont parse errors as JSON unless Content-Type is set to JSON
* [release/2.8 backport] reference: replace deprecated function SplitHostname ([#4032](https://github.com/distribution/distribution/pull/4032))
  * [`b57133cc`](https://github.com/distribution/distribution/commit/b57133cc21dd406aa8a927953ee06a4e99c14772) referene: fix formatting of "deprecated" comment.
  * [`2c4bf1a6`](https://github.com/distribution/distribution/commit/2c4bf1a66407e64b016d37fed681eadbaffff108) replace deprecated function
* [release/2.8 backport] Enable Go build tags ([#4009](https://github.com/distribution/distribution/pull/4009))
  * [`110cb753`](https://github.com/distribution/distribution/commit/110cb7538dc91e18fdf59893d9274e81cbba7201) Enable build tags in 2.8
  * [`2d62a402`](https://github.com/distribution/distribution/commit/2d62a4027add9ed41920784cf10bac0b6486a84b) s3: add interface assertion
  * [`2548973b`](https://github.com/distribution/distribution/commit/2548973b1d22e2f1de9b708f90218be8c4efd1b8) Enable Go build tags
* Pass `BUILDTAGS` argument to `go build` ([#3926](https://github.com/distribution/distribution/pull/3926))
  * [`ab7178cc`](https://github.com/distribution/distribution/commit/ab7178cc0aa708459cdf9f3b100999ba1ed12525) Pass BUILDTAGS argument to go build
</p>
</details>

### Dependency Changes

* **github.com/distribution/reference**    49c28499d219 **_new_**
* **github.com/opencontainers/go-digest**  a6d0ee40d420 -> ea51bea511f7

Previous release can be found at [v2.8.2](https://github.com/distribution/distribution/releases/tag/v2.8.2)
-----BEGIN SSH SIGNATURE-----
U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgh4y+kRbSvdeLJu2rKfx44OqYHU
W1q+O/zsrLH+cTp0gAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
AAAAQAjEkURNXNmoL3ZQs5i+EdSFqLwzRWQlQql8TzffuOEB+cmFMipYrygY9ErKH+4+++
bu2GMRx05H9J73YAUUvQI=
-----END SSH SIGNATURE-----

registry 2.8.2

Welcome to the v2.8.2 release of registry!

Welcome to the 2.8.2 release of registry!

The 2.8.2 registry release fixes several security vulnerabilities.
The Go runtime has been bumped to 1.19.

See the changelog below for full list of changes.

### CI

* Dockerfile: fix filenames of artifacts ([#3911](https://github.com/distribution/distribution/pull/3911))

### Bugfixes

* Fix panic in inmemory driver ([#3815](https://github.com/distribution/distribution/pull/3815))
* Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#3893](https://github.com/distribution/distribution/pull/3893))

### Runtime

* Update to go1.19.9 ([#3908](https://github.com/distribution/distribution/pull/3908))
* Dockerfile: update xx to v1.2.1 ([#3907](https://github.com/distribution/distribution/pull/3907))

### Security

* Fix [CVE-2022-28391](https://www.cve.org/CVERecord?id=CVE-2022-28391) by bumping alpine from 3.14 to 3.16 ([#3650](https://github.com/distribution/distribution/pull/3650))
* Fix [CVE-2023-2253](https://www.cve.org/CVERecord?id=CVE-2023-2253) runaway allocation on /v2/_catalog [`521ea3d9`](https://github.com/distribution/distribution/commit/521ea3d973cb0c7089ebbcdd4ccadc34be941f54)

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.8.1](https://github.com/distribution/distribution/releases/tag/v2.8.1)

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

### Contributors

* Milos Gajdos
* Sebastiaan van Stijn
* CrazyMax
* Milos Gajdos
* Wang Yan
* David van der Spek
* Derek McGowan
* Hayley Swimelar
* Jose D. Gomez R
* Nicolas De Loof
* Paweł Gronowski
* Shengjing Zhu
* Silvin Lubecki

### Changes
<details><summary>33 commits</summary>
<p>

* [release/2.8 backport] registry/errors: Parse http forbidden as denied ([#3914](https://github.com/distribution/distribution/pull/3914))
  * [`483ad69d`](https://github.com/distribution/distribution/commit/483ad69da3e3fb9ac885962d50834ff8619733a2) registry/errors: Parse http forbidden as denied
* [release/2.8 backport] revert "registry/client: set Accept: identity header when getting layers ([#3783](https://github.com/distribution/distribution/pull/3783))
  * [`2b0f84df`](https://github.com/distribution/distribution/commit/2b0f84df21e062bd0cc3676557c6bee4cbb9e9bc) Revert "registry/client: set Accept: identity header when getting layers"
* Add 2.8.2 beta.2 release notes ([#3912](https://github.com/distribution/distribution/pull/3912))
  * [`5f3ca1b2`](https://github.com/distribution/distribution/commit/5f3ca1b2fb6109705d729816e7260a6966d2b42d) Add release notes for 2.8.2-beta.2 release
* [release/2.8 backport] Dockerfile: fix filenames of artifacts ([#3911](https://github.com/distribution/distribution/pull/3911))
  * [`e884644f`](https://github.com/distribution/distribution/commit/e884644fff38a5bf601a2272f434ee2b01dd2b17) Dockerfile: fix filenames of artifacts
* Add 2.8.2-beta.1 release notes ([#3909](https://github.com/distribution/distribution/pull/3909))
  * [`ac6c72b2`](https://github.com/distribution/distribution/commit/ac6c72b25fd258449f166acd3bc5961479c8072f) Add 2.8.2-beta.1 release notes
  * [`dcb637d6`](https://github.com/distribution/distribution/commit/dcb637d6ea8e31e219dfab6ee5c27f09b7441667) Merge pull request from GHSA-hqxw-f8mx-cpmw
  * [`521ea3d9`](https://github.com/distribution/distribution/commit/521ea3d973cb0c7089ebbcdd4ccadc34be941f54) Fix runaway allocation on /v2/_catalog
* [release/2.8] Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#3893](https://github.com/distribution/distribution/pull/3893))
  * [`22a80503`](https://github.com/distribution/distribution/commit/22a805033aa861ad171f4a0b560d241a7c57ac86) fix(ci): use go install instead of go get
* Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#2815](https://github.com/distribution/distribution/pull/2815))
* [release/2.8 backport] update to go1.19.9 ([#3908](https://github.com/distribution/distribution/pull/3908))
  * [`ae58bde9`](https://github.com/distribution/distribution/commit/ae58bde9853c94e482333a4a2734c7ade5b3e344) Fix gofmt warnings
  * [`3f2a4e24`](https://github.com/distribution/distribution/commit/3f2a4e24a73c69087735b741ee197482d8fda41b) update to go1.19.9
  * [`9c04409f`](https://github.com/distribution/distribution/commit/9c04409fdba2219c216b2d14a3f1dd65d4dcdd74) [release/2.8] ignore deprecation of io/ioutil
* [release/2.8 backport] Dockerfile: update xx to v1.2.1 ([#3907](https://github.com/distribution/distribution/pull/3907))
  * [`3d8f3cc4`](https://github.com/distribution/distribution/commit/3d8f3cc4a5d903a983f33b8b8b2f5713930902fd) Dockerfile: update xx to v1.2.1
* [release/2.8] bump up golang version (alternative) ([#3903](https://github.com/distribution/distribution/pull/3903))
  * [`70db3a46`](https://github.com/distribution/distribution/commit/70db3a46d9badbde6a1533e799e292d2ff10b430) bump up golang version
  * [`db1389e0`](https://github.com/distribution/distribution/commit/db1389e0432ccd16c37c580c95ff2dd1853b8345) dockerfiles: formatting
  * [`018472de`](https://github.com/distribution/distribution/commit/018472de2d95025485d3e5429ea92dd18ce2665d) dockerfiles: set ALPINE_VERSION
  * [`19b3feb5`](https://github.com/distribution/distribution/commit/19b3feb5dfeac86148971785ca36190091a4803e) Update to xx 1.1.1
  * [`14bd72bc`](https://github.com/distribution/distribution/commit/14bd72bcf8b8a2759e765d3a766b53c9141b677b) Dockerfile: switch to xx
  * [`2392893b`](https://github.com/distribution/distribution/commit/2392893bcfe7de3010c66626db46f59ab520c9a0) bump up golang v1.17
  * [`092a2197`](https://github.com/distribution/distribution/commit/092a2197ff64d4a4b33fbe9d1080f37e9319d346) [release/2.8] fix package name in Dockerfile
* [release/2.8] Fix panic in inmemory driver ([#3815](https://github.com/distribution/distribution/pull/3815))
  * [`ad5991de`](https://github.com/distribution/distribution/commit/ad5991de09d424fe71ea795463533aa46bc7e74e) Fix panic in inmemory driver
* [release/2.8 backport] Fix CVE-2022-28391 by bumping alpine from 3.14 to 3.16 ([#3650](https://github.com/distribution/distribution/pull/3650))
  * [`38018aeb`](https://github.com/distribution/distribution/commit/38018aeb5d50b08baec9b7c1ee9b2130349aa47a) Fix CVE-2022-28391 by bumping alpine from 3.15 to 3.16
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.8.1](https://github.com/distribution/distribution/releases/tag/v2.8.1)

registry 2.8.2-beta.2

Welcome to the 2.8.2-beta.2 release of registry!

The 2.8.2-beta.2 registry release fixes several security vulnerabilities.
The Go runtime has been bumped to 1.19.

See the changelog below for full list of changes.

### CI

* Dockerfile: fix filenames of artifacts ([#3911](https://github.com/distribution/distribution/pull/3911))

### Bugfixes

* Fix panic in inmemory driver ([#3815](https://github.com/distribution/distribution/pull/3815))
* Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#3893](https://github.com/distribution/distribution/pull/3893))

### Runtime

* Update to go1.19.9 ([#3908](https://github.com/distribution/distribution/pull/3908))
* Dockerfile: update xx to v1.2.1 ([#3907](https://github.com/distribution/distribution/pull/3907))

### Security

* Fix [CVE-2022-28391](https://www.cve.org/CVERecord?id=CVE-2022-28391) by bumping alpine from 3.14 to 3.16 ([#3650](https://github.com/distribution/distribution/pull/3650))
* Fix [CVE-2023-2253](https://www.cve.org/CVERecord?id=CVE-2023-2253) runaway allocation on /v2/_catalog [`521ea3d9`](https://github.com/distribution/distribution/commit/521ea3d973cb0c7089ebbcdd4ccadc34be941f54)

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.8.1](https://github.com/distribution/distribution/releases/tag/v2.8.1)

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

### Contributors

* Milos Gajdos
* Sebastiaan van Stijn
* CrazyMax
* Milos Gajdos
* Wang Yan
* David van der Spek
* Derek McGowan
* Hayley Swimelar
* Jose D. Gomez R
* Shengjing Zhu
* Silvin Lubecki

### Changes
<details><summary>28 commits</summary>
<p>

  * [`9e7e484f`](https://github.com/distribution/distribution/commit/9e7e484fb8479f9591f859e2b2973ca261b95916) Add release notes for 2.8.2-beta.2 release
* [release/2.8 backport] Dockerfile: fix filenames of artifacts ([#3911](https://github.com/distribution/distribution/pull/3911))
  * [`e884644f`](https://github.com/distribution/distribution/commit/e884644fff38a5bf601a2272f434ee2b01dd2b17) Dockerfile: fix filenames of artifacts
* Add 2.8.2-beta.1 release notes ([#3909](https://github.com/distribution/distribution/pull/3909))
  * [`ac6c72b2`](https://github.com/distribution/distribution/commit/ac6c72b25fd258449f166acd3bc5961479c8072f) Add 2.8.2-beta.1 release notes
  * [`dcb637d6`](https://github.com/distribution/distribution/commit/dcb637d6ea8e31e219dfab6ee5c27f09b7441667) Merge pull request from GHSA-hqxw-f8mx-cpmw
  * [`521ea3d9`](https://github.com/distribution/distribution/commit/521ea3d973cb0c7089ebbcdd4ccadc34be941f54) Fix runaway allocation on /v2/_catalog
* [release/2.8] Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#3893](https://github.com/distribution/distribution/pull/3893))
  * [`22a80503`](https://github.com/distribution/distribution/commit/22a805033aa861ad171f4a0b560d241a7c57ac86) fix(ci): use go install instead of go get
* Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#2815](https://github.com/distribution/distribution/pull/2815))
* [release/2.8 backport] update to go1.19.9 ([#3908](https://github.com/distribution/distribution/pull/3908))
  * [`ae58bde9`](https://github.com/distribution/distribution/commit/ae58bde9853c94e482333a4a2734c7ade5b3e344) Fix gofmt warnings
  * [`3f2a4e24`](https://github.com/distribution/distribution/commit/3f2a4e24a73c69087735b741ee197482d8fda41b) update to go1.19.9
  * [`9c04409f`](https://github.com/distribution/distribution/commit/9c04409fdba2219c216b2d14a3f1dd65d4dcdd74) [release/2.8] ignore deprecation of io/ioutil
* [release/2.8 backport] Dockerfile: update xx to v1.2.1 ([#3907](https://github.com/distribution/distribution/pull/3907))
  * [`3d8f3cc4`](https://github.com/distribution/distribution/commit/3d8f3cc4a5d903a983f33b8b8b2f5713930902fd) Dockerfile: update xx to v1.2.1
* [release/2.8] bump up golang version (alternative) ([#3903](https://github.com/distribution/distribution/pull/3903))
  * [`70db3a46`](https://github.com/distribution/distribution/commit/70db3a46d9badbde6a1533e799e292d2ff10b430) bump up golang version
  * [`db1389e0`](https://github.com/distribution/distribution/commit/db1389e0432ccd16c37c580c95ff2dd1853b8345) dockerfiles: formatting
  * [`018472de`](https://github.com/distribution/distribution/commit/018472de2d95025485d3e5429ea92dd18ce2665d) dockerfiles: set ALPINE_VERSION
  * [`19b3feb5`](https://github.com/distribution/distribution/commit/19b3feb5dfeac86148971785ca36190091a4803e) Update to xx 1.1.1
  * [`14bd72bc`](https://github.com/distribution/distribution/commit/14bd72bcf8b8a2759e765d3a766b53c9141b677b) Dockerfile: switch to xx
  * [`2392893b`](https://github.com/distribution/distribution/commit/2392893bcfe7de3010c66626db46f59ab520c9a0) bump up golang v1.17
  * [`092a2197`](https://github.com/distribution/distribution/commit/092a2197ff64d4a4b33fbe9d1080f37e9319d346) [release/2.8] fix package name in Dockerfile
* [release/2.8] Fix panic in inmemory driver ([#3815](https://github.com/distribution/distribution/pull/3815))
  * [`ad5991de`](https://github.com/distribution/distribution/commit/ad5991de09d424fe71ea795463533aa46bc7e74e) Fix panic in inmemory driver
* [release/2.8 backport] Fix CVE-2022-28391 by bumping alpine from 3.14 to 3.16 ([#3650](https://github.com/distribution/distribution/pull/3650))
  * [`38018aeb`](https://github.com/distribution/distribution/commit/38018aeb5d50b08baec9b7c1ee9b2130349aa47a) Fix CVE-2022-28391 by bumping alpine from 3.15 to 3.16
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.8.1](https://github.com/distribution/distribution/releases/tag/v2.8.1)

registry 2.8.2-beta.1

Welcome to the 2.8.2-beta.1 release of registry!

The 2.8.2-beta.1 registry release fixes several security vulnerabilities.

### Dependency Changes

Previous release can be found at [v2.8.1](https://github.com/distribution/distribution/releases/tag/v2.8.1)

Please try out the release binaries and report any issues at
https://github.com/distribution/distribution/issues.

### Contributors

* Milos Gajdos
* CrazyMax
* Sebastiaan van Stijn
* Wang Yan
* David van der Spek
* Derek McGowan
* Hayley Swimelar
* Jose D. Gomez R
* Milos Gajdos
* Shengjing Zhu
* Silvin Lubecki

### Changes
<details><summary>23 commits</summary>
<p>

  * [`dcb637d6`](https://github.com/distribution/distribution/commit/dcb637d6ea8e31e219dfab6ee5c27f09b7441667) Merge pull request from GHSA-hqxw-f8mx-cpmw
  * [`521ea3d9`](https://github.com/distribution/distribution/commit/521ea3d973cb0c7089ebbcdd4ccadc34be941f54) Fix runaway allocation on /v2/_catalog
* [release/2.8] Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#3893](https://github.com/distribution/distribution/pull/3893))
  * [`22a80503`](https://github.com/distribution/distribution/commit/22a805033aa861ad171f4a0b560d241a7c57ac86) fix(ci): use go install instead of go get
* Add code to handle pagination of parts. Fixes max layer size of 10GB bug ([#2815](https://github.com/distribution/distribution/pull/2815))
* [release/2.8 backport] update to go1.19.9 ([#3908](https://github.com/distribution/distribution/pull/3908))
  * [`ae58bde9`](https://github.com/distribution/distribution/commit/ae58bde9853c94e482333a4a2734c7ade5b3e344) Fix gofmt warnings
  * [`3f2a4e24`](https://github.com/distribution/distribution/commit/3f2a4e24a73c69087735b741ee197482d8fda41b) update to go1.19.9
  * [`9c04409f`](https://github.com/distribution/distribution/commit/9c04409fdba2219c216b2d14a3f1dd65d4dcdd74) [release/2.8] ignore deprecation of io/ioutil
* [release/2.8 backport] Dockerfile: update xx to v1.2.1 ([#3907](https://github.com/distribution/distribution/pull/3907))
  * [`3d8f3cc4`](https://github.com/distribution/distribution/commit/3d8f3cc4a5d903a983f33b8b8b2f5713930902fd) Dockerfile: update xx to v1.2.1
* [release/2.8] bump up golang version (alternative) ([#3903](https://github.com/distribution/distribution/pull/3903))
  * [`70db3a46`](https://github.com/distribution/distribution/commit/70db3a46d9badbde6a1533e799e292d2ff10b430) bump up golang version
  * [`db1389e0`](https://github.com/distribution/distribution/commit/db1389e0432ccd16c37c580c95ff2dd1853b8345) dockerfiles: formatting
  * [`018472de`](https://github.com/distribution/distribution/commit/018472de2d95025485d3e5429ea92dd18ce2665d) dockerfiles: set ALPINE_VERSION
  * [`19b3feb5`](https://github.com/distribution/distribution/commit/19b3feb5dfeac86148971785ca36190091a4803e) Update to xx 1.1.1
  * [`14bd72bc`](https://github.com/distribution/distribution/commit/14bd72bcf8b8a2759e765d3a766b53c9141b677b) Dockerfile: switch to xx
  * [`2392893b`](https://github.com/distribution/distribution/commit/2392893bcfe7de3010c66626db46f59ab520c9a0) bump up golang v1.17
  * [`092a2197`](https://github.com/distribution/distribution/commit/092a2197ff64d4a4b33fbe9d1080f37e9319d346) [release/2.8] fix package name in Dockerfile
* [release/2.8] Fix panic in inmemory driver ([#3815](https://github.com/distribution/distribution/pull/3815))
  * [`ad5991de`](https://github.com/distribution/distribution/commit/ad5991de09d424fe71ea795463533aa46bc7e74e) Fix panic in inmemory driver
* [release/2.8 backport] Fix CVE-2022-28391 by bumping alpine from 3.14 to 3.16 ([#3650](https://github.com/distribution/distribution/pull/3650))
  * [`38018aeb`](https://github.com/distribution/distribution/commit/38018aeb5d50b08baec9b7c1ee9b2130349aa47a) Fix CVE-2022-28391 by bumping alpine from 3.15 to 3.16
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.8.1](https://github.com/distribution/distribution/releases/tag/v2.8.1)