v1.26.5

Community Update

@Bixilon made their first contribution in #458

Also many thanks to @BlackTurtle123 and @xathon for reporting the issues fixed in this release.

What's Changed

Security

• go stdlib v1.25.5: CVE-2025-61726 CVE-2025-61728 CVE-2025-61730 CVE-2025-68121

Bugfixes

• dockerfile: don't use +x for chmod: by @Bixilon in #458
• fix KANIKO_DIR bootstrapping: #475
• cache mount fails to rename across filesystems: #455
• cleanup kaniko workspace on failure too: #453

Standardization

• resolve remote ONBUILD instructions: #354

Usability

• dynamically determine kanikoDir: #454

Maintenance

• chore(deps): bump cloud.google.com/go/storage from 1.58.0 to 1.59.2: #457 #461 #482
• chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.0 to 1.41.1: #456
• chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.6 to 1.32.7: #456
• chore(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/manager from 1.20.18 to 1.21.1: #456 #467 #482
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.95.0 to 1.96.0: #456 #482
• chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0: #459
• chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1.6.3 to 1.6.4: #460
• chore(deps): bump google.golang.org/api from 0.259.0 to 0.265.0: #462 #469 #472 #479 #484 #490
• chore(deps): bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4: #463
• chore(deps): bump github.com/docker/cli from 29.1.4+incompatible to 29.2.1+incompatible: #465 #478 #489
• chore(deps): bump actions/checkout from 6.0.1 to 6.0.2: #471
• chore(deps): bump golang from 1.25.5 to 1.25.7: #466 #491
• chore(deps): bump github.com/moby/buildkit from 0.26.3 to 0.27.1: #470 #483
• chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1: #476
• chore(deps): bump github.com/moby/moby/api from 1.52.0 to 1.53.0: #477
• chore(deps): bump imjasonh/setup-crane from 0.4 to 0.5: #492