Upgrade: Bump github.com/google/go-containerregistry from 0.20.1 to 0.20.2

[dependabot]

Bumps github.com/google/go-containerregistry from 0.20.1 to 0.20.2.

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.20.2

What's Changed

• deps: bump docker dep by @​imjasonh in google/go-containerregistry#1991

Full Changelog: google/go-containerregistry@v0.20.1...v0.20.2

Commits

• c195f15 deps: bump docker dep (#1991)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The pull request updates the dependencies in the Go project, specifically the github.com/google/go-containerregistry and github.com/docker/cli dependencies, to newer versions, which is a common practice to address security vulnerabilities, bug fixes, or feature improvements, and the changes do not appear to introduce any obvious security risks, but it is recommended to review the release notes and changelogs for the updated dependencies and perform thorough testing to ensure no regressions or unintended behavior.

Expand for full summary

Summary:

The changes in this pull request are focused on updating the dependencies in the Go project. The key updates are to the github.com/google/go-containerregistry and github.com/docker/cli dependencies, which have been updated to newer versions. Updating dependencies is a common practice in software development and can help address security vulnerabilities, bug fixes, or feature improvements in the dependencies.

From an application security perspective, the changes in this pull request do not appear to introduce any obvious security risks. However, it's important to review the release notes and changelogs for the updated dependencies to ensure there are no security-related issues that need to be addressed. Additionally, it's recommended to perform thorough testing of the application to ensure the dependency updates do not introduce any regressions or unintended behavior.

Files Changed:

1. go.mod: The go.mod file has been updated to reflect the changes in the dependencies. Specifically, the version of the github.com/google/go-containerregistry dependency has been updated from v0.20.1 to v0.20.2, and the version of the github.com/docker/cli dependency has been updated from v24.0.7+incompatible to v27.1.1+incompatible.

2. go.sum: The go.sum file has been updated to record the exact versions of the dependencies used in the project. The changes in this file are consistent with the updates made in the go.mod file.

Code Analysis

We ran 9 analyzers against 2 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.