fix(deps): update module github.com/containers/image/v5 to v5.36.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/containers/image/v5	v5.35.0 -> v5.36.0

---

Release Notes

containers/image (github.com/containers/image/v5)

v5.36.0

Compare Source

What's Changed

• Bump c/storage to v1.58.0, c/image to v5.35.0 by @​TomSweeneyRedHat in https://github.com/containers/image/pull/2828
• chore(deps): update dependency golangci/golangci-lint to v2.1.2 by @​renovate[bot] inhttps://github.com/containers/image/pull/28277
• fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.28 by @​renovate[bot] inhttps://github.com/containers/image/pull/28299
• fix(deps): update module github.com/docker/docker to v28.1.0+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28344
• fix(deps): update module github.com/docker/cli to v28.1.0+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28333
• fix(deps): update module github.com/docker/cli to v28.1.1+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28366
• fix(deps): update module github.com/docker/docker to v28.1.1+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28355
• chore(deps): update dependency containers/automation_images to v20250422 by @​renovate[bot] inhttps://github.com/containers/image/pull/28399
• chore(deps): update dependency golangci/golangci-lint to v2.1.5 by @​renovate[bot] inhttps://github.com/containers/image/pull/28400
• fix(deps): update module github.com/sigstore/sigstore to v1.9.4 by @​renovate[bot] inhttps://github.com/containers/image/pull/28422
• chore(deps): update dependency golangci/golangci-lint to v2.1.6 by @​renovate[bot] inhttps://github.com/containers/image/pull/28466
• fix(deps): update module github.com/vbauerster/mpb/v8 to v8.10.0 by @​renovate[bot] inhttps://github.com/containers/image/pull/28455
• fix(deps): update module golang.org/x/oauth2 to v0.30.0 by @​renovate[bot] inhttps://github.com/containers/image/pull/28477
• fix(deps): update module golang.org/x/sync to v0.14.0 by @​renovate[bot] inhttps://github.com/containers/image/pull/28488
• fix(deps): update module golang.org/x/term to v0.32.0 by @​renovate[bot] inhttps://github.com/containers/image/pull/28500
• fix(deps): update module golang.org/x/crypto to v0.38.0 by @​renovate[bot] inhttps://github.com/containers/image/pull/28499
• fix(deps): update module dario.cat/mergo to v1.0.2 by @​renovate[bot] inhttps://github.com/containers/image/pull/28511
• vendor: update c/storage by @​giuseppe in https://github.com/containers/image/pull/2844
• fix(deps): update module github.com/vbauerster/mpb/v8 to v8.10.1 by @​renovate[bot] inhttps://github.com/containers/image/pull/28533
• Update old indirect dependencies by @​mtrmac in https://github.com/containers/image/pull/2787
• Stop setting the btrfs_noversion build tag by @​mtrmac in https://github.com/containers/image/pull/2831
• fix(deps): update module github.com/santhosh-tekuri/jsonschema/v6 to v6.0.2 by @​renovate[bot] inhttps://github.com/containers/image/pull/28555
• fix(deps): update module github.com/docker/docker to v28.2.1+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28599
• fix(deps): update module github.com/docker/cli to v28.2.1+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28588
• fix(deps): update module github.com/docker/docker to v28.2.2+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28622
• fix(deps): update module github.com/docker/cli to v28.2.2+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28611
• INCOMPATIBLE: Remove the implementation of the ostree transport by @​mtrmac in https://github.com/containers/image/pull/2821
• Only upload sigstore signatures to the sigstore tag schema by @​mtrmac in https://github.com/containers/image/pull/2717
• Update old dependencies by @​mtrmac in https://github.com/containers/image/pull/2863
• fix(deps): update github.com/containers/storage digest to 78f4258 by @​renovate[bot] inhttps://github.com/containers/image/pull/28644
• Queue a partially-pulled layer for commit immediately after staging it by @​mtrmac in https://github.com/containers/image/pull/2799
• fix(deps): update module github.com/vbauerster/mpb/v8 to v8.10.2 by @​renovate[bot] inhttps://github.com/containers/image/pull/28655
• fix(deps): update module golang.org/x/sync to v0.15.0 by @​renovate[bot] inhttps://github.com/containers/image/pull/28666
• fix(deps): update module golang.org/x/crypto to v0.39.0 by @​renovate[bot] inhttps://github.com/containers/image/pull/28677
• fix(deps): update module github.com/sigstore/sigstore to v1.9.5 by @​renovate[bot] inhttps://github.com/containers/image/pull/28711
• fix(deps): update module go.etcd.io/bbolt to v1.4.1 by @​renovate[bot] inhttps://github.com/containers/image/pull/28700
• fix(deps): update module github.com/hashicorp/go-retryablehttp to v0.7.8 by @​renovate[bot] inhttps://github.com/containers/image/pull/28722
• Regenerate keys TestKeyFingerprintWithPassphrase and TestKeyFingerprint by @​mtrmac in https://github.com/containers/image/pull/2875
• fix(deps): update module github.com/docker/docker to v28.3.0+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28800
• fix(deps): update module github.com/docker/cli to v28.3.0+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28799
• CI: run tests that need root as root by @​Luap99 in https://github.com/containers/image/pull/2878
• remove containers_image_{fulcio_stub,rekor_stub} build tags by @​Luap99 in https://github.com/containers/image/pull/2881
• Replace sigstore/rekor/pkg/client with a manually-created client by @​Luap99 in https://github.com/containers/image/pull/2873
• Update module go.etcd.io/bbolt to v1.4.2 by @​renovate[bot] inhttps://github.com/containers/image/pull/28822
• Update the Rekor client to match Rekor 1.3.10 by @​mtrmac in https://github.com/containers/image/pull/2884
• Update dependency golangci/golangci-lint to v2.2.1 by @​renovate[bot] inhttps://github.com/containers/image/pull/28855
• Update github.com/containers/storage digest to 83650ab by @​renovate[bot] inhttps://github.com/containers/image/pull/28866
• Update module github.com/docker/docker to v28.3.1+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28899
• Update module github.com/docker/cli to v28.3.1+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28888
• Run CI all on the Fedora images by @​mtrmac in https://github.com/containers/image/pull/2890
• Restrict the root-only tests to ./storage by @​mtrmac in https://github.com/containers/image/pull/2891
• Update module golang.org/x/sync to v0.16.0 by @​renovate[bot] inhttps://github.com/containers/image/pull/28922
• Update module github.com/docker/cli to v28.3.2+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28933
• Update module golang.org/x/term to v0.33.0 by @​renovate[bot] inhttps://github.com/containers/image/pull/28955
• Update module github.com/docker/docker to v28.3.2+incompatible by @​renovate[bot] inhttps://github.com/containers/image/pull/28944
• Add a new Signer API for creating simple signing signatures with Sequoia-PGP by @​mtrmac in https://github.com/containers/image/pull/2896
• Update module golang.org/x/crypto to v0.40.0 by @​renovate[bot] inhttps://github.com/containers/image/pull/28977
• Update dependency golangci/golangci-lint to v2.2.2 by @​renovate[bot] inhttps://github.com/containers/image/pull/28988

Full Changelog: containers/image@v5.35.0...v5.36.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 14 additional dependencies were updated

Details:

Package	Change
github.com/containers/storage	v1.58.0 -> v1.59.0
dario.cat/mergo	v1.0.1 -> v1.0.2
github.com/Microsoft/hcsshim	v0.12.9 -> v0.13.0
github.com/docker/docker	v28.0.4+incompatible -> v28.3.2+incompatible
github.com/go-logr/logr	v1.4.2 -> v1.4.3
github.com/mattn/go-sqlite3	v1.14.27 -> v1.14.28
github.com/sigstore/sigstore	v1.9.3 -> v1.9.5
github.com/tchap/go-patricia/v2	v2.3.2 -> v2.3.3
github.com/vbauerster/mpb/v8	v8.9.3 -> v8.10.2
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.59.0 -> v0.60.0
go.opentelemetry.io/otel	v1.34.0 -> v1.35.0
go.opentelemetry.io/otel/metric	v1.34.0 -> v1.35.0
go.opentelemetry.io/otel/trace	v1.34.0 -> v1.35.0
google.golang.org/grpc	v1.71.0 -> v1.72.2

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: renovate[bot]
Once this PR has been reviewed and has the lgtm label, please assign jwhonce for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

The pull request #2477 has too many files changed.

We can only review pull requests with up to 300 changed files, and this pull request has 708.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v5.36.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.