openSUSE-SU-2026:21793-1

This update for hauler fixes the following issues:

Changes in hauler:

• update to 2.1.0 (bsc#1265425, CVE-2026-41888):

  • v2.1.0 is a minor release built on the containerd- native foundation laid down in v2.0.0. The headline is that hauler store sync and hauler store add are now fully concurrent, with signature verification pinned to digests and running in parallel too. Alongside that, this release adds an audit trail, a store integrity checker, store-to-manifest generation, private/insecure registry support across every pull path, and a set of fixes for containerd imports, chunked hauls, and Docker Hub reference handling.
  • Notable dependency bumps: Go → 1.26.6; containerd/v2 → 2.3.4; sigstore/cosign/v3 → 3.1.3; sigstore/sigstore → 1.10.9; go-containerregistry → 0.22.0; helm/v4 → 4.2.4; k8s.io libs (apimachinery, api, client-go) → 0.37.0; logrus → 1.10.2; docker/go-metrics → 0.1.0; sigstore/rekor → 1.5.4 (CVE resolution); plus x/mod and go-isatty.

• update to 2.0.3 (bsc#1276124, CVE-2026-72817,CVE-2026-72815,CVE-2026-72816):

  • Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport #688)
  • Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the go_modules group across 1 directory (backport #691)
  • fix for homebrew macOS binary quarantine (backport #690)
  • fix: process Helm deps before --add-images discovery (backport #703)
  • update hauler store remove to handle registry reference as part of string (backport #705)
  • fixed vuln for golang grpc