Image for v1.46.2 pulled from registry/tag overwritten

[morremeyer]

What platforms are affected?

linux

What architectures are affected?

all architectures

What SpiceDB version are you using?

v1.46.2

What SpiceDB flags do you use?

not relevant

Steps to Reproduce

Try pulling

quay.io/authzed/spicedb:v1.46.2@sha256:130326b253f4e5faa10f98dabb3d31418a4cb9cf9bf5326c4bfe560a4270f98f

We used this image successfully yesterday (2025-10-27, 12:35 UTC), as of now it is not available on the registry anymore.

Expected Result

Image exists and can be pulled.

Actual Result

Image can not be pulled, published v1.46.2 tag has the shasum f84a381f5557d2dc9915aa2fffb4cedd5400d43e10e30c16f35b53afdf08a3b6.

Can someone confirm that pushing v1.46.2 again with another build was intentional and not an error or attack of some kind?
Thanks!

[miparnisari]

Hello @morremeyer! Yes, this was caused by us. Yesterday we pushed a new git tag v1.47.0 that pointed at the same commit as v1.46.2. This push triggered Goreleaser, which seems to have borked things (ref 1, ref 2). We are looking into it.

[morremeyer]

Thanks for the confirmation, and for looking into it!

[tstirrat15]

We chose to move past this by releasing v1.47.1. Let us know if that isn't sufficient in this case.

[morremeyer]

@tstirrat15 Absolutely, thanks for taking the time!