LoginSign Up
← Back to all sparks
Q

Quay

INFRA · APIS
Velocity5.0

Container image registry with security scanning

quay.io ↗

Quay patches three supported lines on one afternoon, mostly CVE bumps.

container-registrysecuritycve-patchinglts-maintenancedisconnected-installs
◆Current state
Quay's enterprise lines ship paired monthly security releases. On November 13 three lines moved within minutes: 3.14.10, 3.12.24 and 3.10.28, each bumping PyJWT, cryptography, pillow, oauthlib and other pinned libraries for CVEs, plus a fix for an onboarding issue. The mirror-registry installer tagged v3.0.0 on November 9 with only dependency bumps noted.
◆Where it's heading
Quay's public changelog is now maintenance only: CVE pins backported to every supported line and build files aligned for Red Hat's ART pipeline. No user-facing features have shipped on these lines in recent months.
◆Prediction
Expect the next set of paired CVE releases around mid-December; nothing in the entries points to a feature release.

◆Recent moves

  1. 19h ago

    Quay 3.10.28 backports November CVE fixes to LTS

    The 3.10 line gets the November CVE bumps (PyJWT, pillow, cryptography, oauthlib) and the onboarding fix. Same set as 3.12.24, landed minutes apart.

    View source ↗
  2. 19h ago

    Quay 3.12.24 patches PyJWT, pillow and other CVEs

    The 3.12 release of the November set: CVE pins, an onboarding fix and build-file changes. Matches the monthly pairing seen since August.

    View source ↗
  3. 19h ago

    Quay 3.14.10 rolls up CVE fixes and RHEL 8 builds

    The first 3.14 release in this feed bundles October and November CVE bumps with new RHEL 8 build files. It shows a third line now in the patch cycle.

    View source ↗
  4. 4d ago

    mirror-registry 3.0.0 tagged with only a dependency bump noted

    A major version for the mirror-registry installer, but the only listed change is bumped x/crypto and compression libraries. It fits Quay's maintenance-only pattern until notes say otherwise.

    View source ↗
  5. 1mo ago

    Quay 3.12.23 patches four CVEs and adds ART build file

    The 3.12 half of the October pair: CVE bumps for immutable, qs, WebOb and lxml, a compression update, and a Buildx pin in CI. The added Containerfile.art is build-pipeline plumbing, not a user-facing change.

    View source ↗
  6. 1mo ago

    Quay 3.10.27 backports October CVE fixes to LTS

    Same CVE set as 3.12.23 landed on the 3.10 line hours earlier, continuing the twinned-release pattern. A Konflux-oriented Containerfile is the only non-dependency change.

    View source ↗