chore(deps): update regclient/regctl docker tag to v0.11.6

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
regclient/regctl	stage	minor	v0.9.0 → v0.11.6

---

Release Notes

regclient/regclient (regclient/regctl)

v0.11.6

Compare Source

Release v0.11.6

Features:

• image mod support for user, workdir, and author. (PR 1101)
• Support RC releases. (PR 1126)

Fixes:

• Add limits and controls to ReadAll. (PR 1096)
• Skip local check on requests going through a proxy. (PR 1099)
• URLs passed to ProxyFromEnvironment require a scheme. (PR 1104)
• Avoid a panic if http.DefaultTransport is altered. (PR 1109)
• Handle docker schema v1 with ocidir. (PR 1111)
• Do not checkout main branch for releases. (PR 1127)
• Pin Go version for regctl mod commands. (PR 1130)
• Improve reproducibility with tags on main branch. (PR 1131)
• Do not sign SBOMs. (PR 1133)

Other changes:

• Add copyright headers. (PR 1102)
• Improve error messages in ocidir scheme. (PR 1106)
• Upgrade osv-scanner to v2. (PR 1115)
• Remove go reportcard. (PR 1119)

Contributors:

• @​sudo-bmitch

v0.11.5

Compare Source

Release v0.11.5

Security:

• Prevent https to non-https downgrades and localhost redirects. (PR 1093)
• Forbid sending auth on redirects. (PR 1095)

Features:

• Add regbot manifest.descriptor to the sandbox. (PR 1091)

Contributors:

• @​GimmyDatBeeR
• @​sudo-bmitch

v0.11.4

Compare Source

Release v0.11.4

Security:

• Validate server URL in token auth. (PR 1075)
• Upgrading Go fixes CVE-2026-33814 and CVE-2026-39836, other vulnerabilities fixed in 1.26.3 were not called by this project. (PR 1084)

Features:

• Support scanning OCI Layout for referrers. (PR 1074)
• Add created timestamp in OCI Layout entries. (PR 1081)
• tag.ls now accepts the same pagination parameters as repo.ls. (PR 1086)

Fixes:

• Push tags for minor and major releases on Docker Hub. (PR 1087)

Contributors:

• @​ffried
• @​sudo-bmitch

v0.11.3

Compare Source

Release v0.11.3

Security:

• Go 1.26.2 release fixes CVE-2026-32280 (PR 1072)
• Go 1.26.2 release fixes CVE-2026-32281 (PR 1072)
• Go 1.26.2 release fixes CVE-2026-32283 (PR 1072)
• Go 1.26.2 release fixes CVE-2026-32288 (PR 1072)
• Go 1.26.2 release fixes CVE-2026-33810 (PR 1072)

Features:

• Add support for pushing digest with tags. (PR 1062)
• Handle OCI-Tag headers with comma separators. (PR 1070)

Contributors:

• @​sudo-bmitch

v0.11.2

Compare Source

Release v0.11.2

Features:

• Add support for regctl config in XDG and APPDATA. (PR 1038)
• Add ImageWithBlobReaderHook for callbacks per layer when copying an image. (PR 1046)

Fixes:

• Do not sign released images multiple times. (PR 1027)
• regctl/action update for path fix. (PR 1031)
• Remove default values from regctl config. (PR 1039)
• Apply Go modernizations with go fix from 1.26.0. (PR 1053)
• Adjust test repo names to avoid races. (PR 1054)
• Automatically upgrade goimports and gorelease. (PR 1056)

Other Changes:

• Add REGCTL_CONFIG to regctl help messages. (PR 1037)
• Go upgrade fixes CVE-2025-68121, govulncheck indicates this project is not vulnerable. (PR 1047)

Contributors:

• @​sudo-bmitch
• @​vrajashkr

v0.11.1

Compare Source

Release v0.11.1

Security:

• Go 1.25.5 fixes CVE-2025-61729 (PR 1025)
• Go 1.25.5 fixes CVE-2025-61727 (PR 1025)

Fixes:

• Correct selection of previous tag for releases. (PR 1023)
• Make sure ContentLength is correctly set in the request. (PR 1024)

Contributors:

• @​sudo-bmitch

v0.11.0

Compare Source

Release v0.11.0

Features:

• Build artifacts for riscv64. (PR 1011)
• Generate FreeBSD amd64 binaries. (PR 1013)
• Add support for cosign v3 bundles. (PR 1018)

Fixes:

• Fix ECR Helper version pin. (PR 1017)
• Fix the cosign use-signing-config flag. (PR 1019)
• Improve reproducibility in Dockerfiles. (PR 1020)

Other Changes:

• Add a policy for LLM generated contributions. (PR 1016)

Contributors:

• @​ffgan
• @​sudo-bmitch

v0.10.0

Compare Source

Release v0.10.0

Features:

• Feat: Support DOCKER_AUTH_CONFIG variable. (PR 996)
• Feat: Add regctl repo copy. (PR 997)
• Feat: regsync support for semantic versioning(semver) for matching tags (PR 1005)
• Feat: Add tagSets to regsync. (PR 1008)

Changes:

• Chore: Add go:fix lines to deprecated code. (PR 994)
• Chore: Add gofumpt to the build. (PR 995)
• Chore: Remove the unused bps field. (PR 998)
• Fix: Handle semver compare of numeric prerelease (PR 1007)

Security:

• CVE-2025-58187: Fixed with Go upgrade (https://osv.dev/GO-2025-4007).
• CVE-2025-58189: Fixed with Go upgrade (https://osv.dev/GO-2025-4008).
• CVE-2025-61723: Fixed with Go upgrade (https://osv.dev/GO-2025-4009).
• CVE-2025-47912: Fixed with Go upgrade (https://osv.dev/GO-2025-4010).
• CVE-2025-58185: Fixed with Go upgrade (https://osv.dev/GO-2025-4011).
• CVE-2025-58186: Fixed with Go upgrade (https://osv.dev/GO-2025-4012).
• CVE-2025-58188: Fixed with Go upgrade (https://osv.dev/GO-2025-4013).
• CVE-2025-58183: Fixed with Go upgrade (https://osv.dev/GO-2025-4014).
• CVE-2025-9230: Fixed with Alpine image upgrade.
• CVE-2025-9232: Fixed with Alpine image upgrade.
• CVE-2025-9231: Fixed with Alpine image upgrade.

Contributors:

• @​daimoniac
• @​sudo-bmitch

v0.9.2

Compare Source

Release v0.9.2

Security:

• xz upgrade fixes CVE-2025-58058 (PR 989)

Miscellaneous:

• Fix CLI lint errors. (PR 983)
• Cleanup version output. (PR 985)
• Dockerfile cleanup. (PR 986)

Contributors:

• @​sudo-bmitch

v0.9.1

Compare Source

Release v0.9.1

Features:

• Allow relative urls in bearer auth. (PR 963)
• Add "ns" query param to registry mirror requests. (PR 976)

Miscellaneous:

• Update to SLSA v1 provenance. (PR 968)
• Add a "make clean" command. (PR 969)

Contributors:

• @​sudo-bmitch
• @​wjordan

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.