v0.20.3

What's Changed

• remote/transport: Make bearer transport go-routine-safe by @2opremio in #1806
• Expose compare package by @jonjohnsonjr in #2001
• fix: redact.URL uses (*URL).Redacted to omit basic-auth password by @bmoylan in #1947
• bump actions to latest by @ajayk in #2011
• don't pin chainguard-dev/actions by @imjasonh in #2025
• Check for 406 status code when handling referrers API endpoint response by @malancas in #2026
• mutate: Create a defensive annotations copy by @jonjohnsonjr in #2030
• Detect zstd in crane append by @jonjohnsonjr in #2023
• bump deps using hack/bump-deps.sh by @imjasonh in #2042

New Contributors

• @bmoylan made their first contribution in #1947
• @ajayk made their first contribution in #2011
• @malancas made their first contribution in #2026

Full Changelog: v0.20.2...v0.20.3