Welcome to the v3.0.0-rc.3 release of registry!

This is the third stable release candidate!

See the changelog below for a full list of changes.

Notable changes

• Fixes CVE-2025-24976, thanks @evanebb for reporting!

What's Changed

• build(deps): bump actions/upload-artifact from 4.3.6 to 4.5.0 by @dependabot in https://github.com/distribution/distribution/pull/4538
• ci: update bake-action to v6 by @crazy-max in https://github.com/distribution/distribution/pull/4554
• build(deps): bump actions/upload-artifact from 4.5.0 to 4.6.0 by @dependabot in https://github.com/distribution/distribution/pull/4553
• (security): Bump golang.org/x/net module by @milosgajdos in https://github.com/distribution/distribution/pull/4542
• (security): fix registry Token authentication bug by @milosgajdos in https://github.com/distribution/distribution/commit/f4a500caf68169dccb0b54cb90523e68ee1ac2be
• ci: fix bake build by @crazy-max in https://github.com/distribution/distribution/pull/4555
• Bump Go version by @milosgajdos in https://github.com/distribution/distribution/pull/4566
• Prep for v3-rc.3 release by @milosgajdos in https://github.com/distribution/distribution/pull/4568

Full Changelog: https://github.com/distribution/distribution/compare/v3.0.0-rc.2...v3.0.0-rc.3