LoginSign Up
← Back to all sparks
Q

Quay

INFRA · APIS
Velocity5.0

Container image registry with security scanning

quay.io ↗

Quay ships nothing but CVE remediation, mirrored across two supported branches

container-registrycve-remediationssrf-hardeningbackportsmaintenance
◆Current state
Every entry in Quay's recent history is a security maintenance release, and they arrive as coordinated pairs — a 3.10.x and a 3.12.x tag cut hours apart carrying the same fixes cherry-picked to each branch. The content is dependency remediation against tracked advisories plus two SSRF hardening fixes, one in proxy cache upstream registry configuration and one in repository mirroring sources. No feature work appears in the window.
◆Where it's heading
This is a registry in pure maintenance posture on its long-lived branches, with the release process itself automated down to changelog-bump commits. The recurring SSRF fixes across proxy cache and mirroring suggest a deliberate sweep through the code paths that fetch from upstream registries rather than isolated reports. Feature development, if it is happening, is landing on a branch this feed does not cover.
◆Prediction
Expect the paired-branch cadence to continue at roughly the rate advisories land against the bundled Python and npm dependencies. The SSRF sweep looks close to complete, having now covered both proxy cache and mirroring.

◆Recent moves

  1. 7d ago

    v3.12.21 patches six advisories and blocks SSRF in mirroring

    Dependency bumps against tracked advisories plus a fix preventing SSRF through repository mirroring sources. It is the 3.12 half of a coordinated pair cut alongside v3.10.25 the same day.

    View source ↗
  2. 7d ago

    v3.10.25 carries the same advisory fixes to the 3.10 branch

    The 3.10 twin of v3.12.21, carrying the identical dependency remediation and mirroring SSRF fix backported to the older supported branch. One body of work, two tags.

    View source ↗
  3. 27d ago

    v3.12.20 bumps Go and blocks SSRF in proxy cache config

    Toolchain and dependency maintenance plus the proxy-cache half of the SSRF sweep that the August releases later extended to mirroring. Paired with v3.10.24 on the older branch.

    View source ↗
  4. 1mo ago

    v3.10.24 backports the Go bump and proxy cache SSRF fix

    The 3.10 counterpart to v3.12.20, with the same Go version bump, dependency updates and proxy cache SSRF fix. No branch-specific content.

    View source ↗
  5. 1mo ago

    v3.10.23 clears PyJWT, urllib3 and shell-quote advisories

    A dependency-only security release on the 3.10 branch covering four tracked advisories. It pairs with v3.12.19, which shipped the same fixes days earlier.

    View source ↗
  6. 1mo ago

    v3.12.19 clears the same four dependency advisories

    The 3.12 half of the late-June remediation pair, identical in substance to v3.10.23. It establishes the twinned-release pattern that holds across the whole window.

    View source ↗