## What's Changed
* fix(api): return 416 for bad upload range on PUT; fix GET upload Range at size zero by @andaaron in https://github.com/project-zot/zot/pull/3983
* feat(zb): Support for TTFB measurement + on-demand sync tests by @vrajashkr in https://github.com/project-zot/zot/pull/3929
* fix(api): recognize Docker Compose/Buildx User-Agent in v2 challenge workaround by @gjed in https://github.com/project-zot/zot/pull/3992
* chore: fix dependabot alerts by @rchincha in https://github.com/project-zot/zot/pull/3990
* feat(auth): support OIDC RP-Initiated Logout by @krjakbrjak in https://github.com/project-zot/zot/pull/3975
* fix(security): enhance timeout configurations and body size limits fo… by @rchincha in https://github.com/project-zot/zot/pull/3984
* Improve zli CVE diff output by @AkashKumar7902 in https://github.com/project-zot/zot/pull/3994
* chore: fix dependabot alerts by @rchincha in https://github.com/project-zot/zot/pull/4020
* Support multipart range blob pulls by @AkashKumar7902 in https://github.com/project-zot/zot/pull/3995
* fix(sync): apply tag filters before destination mapping by @AkashKumar7902 in https://github.com/project-zot/zot/pull/4003
* Multipart download enhancements by @andaaron in https://github.com/project-zot/zot/pull/4021
* docs(config): reference generated config schema by @AkashKumar7902 in https://github.com/project-zot/zot/pull/4015
* feat(cosign): add support for cosign bundle by @rchincha in https://github.com/project-zot/zot/pull/4023
* feat(auth): map OpenID groups claim by @AkashKumar7902 in https://github.com/project-zot/zot/pull/3999
* test: refactor countingReader into partialReaderOpenTracker and partialReaderReadCloser by @andaaron in https://github.com/project-zot/zot/pull/4027
* fix(auth): refine OIDC identity handling and claim-mapping logs by @andaaron in https://github.com/project-zot/zot/pull/4028
* feat(api): log session/audit subject from UserAccessControl by @andaaron in https://github.com/project-zot/zot/pull/4029
* refactor(zli): add typed ~/.zot config layer and strict validation by @andaaron in https://github.com/project-zot/zot/pull/4030
* refactor(build): move build metadata to pkg/buildinfo by @andaaron in https://github.com/project-zot/zot/pull/4045
* feat(zli): add config list/show/get/set/reset and isolate deprecated syntax by @andaaron in https://github.com/project-zot/zot/pull/4037
* fix(zli config): print help for missing args by @andaaron in https://github.com/project-zot/zot/pull/4046
* feat(authz): introduce conditional access control via CEL by @matheuscscp in https://github.com/project-zot/zot/pull/4040
* ci: sync go 1.26 images to ghcr.io/project-zot/golang by @andaaron in https://github.com/project-zot/zot/pull/4049
* ci: fix golangci-lint install URL by @andaaron in https://github.com/project-zot/zot/pull/4052
* chore: fix dependabot alerts by @rchincha in https://github.com/project-zot/zot/pull/4048
* fix: downgrade expected missing-blob HEAD logging from error to debug by @rchincha in https://github.com/project-zot/zot/pull/4056
* chore: fix dependabot alerts by @rchincha in https://github.com/project-zot/zot/pull/4059
* fix(lint): silence deprecated gomodguard linter warning by @benoittgt in https://github.com/project-zot/zot/pull/4070
* feat(metrics): add Prometheus GC metrics by @benoittgt in https://github.com/project-zot/zot/pull/3863
* chore: fix dependabot alerts by @rchincha in https://github.com/project-zot/zot/pull/4072
* chore: bump zui version by @rchincha in https://github.com/project-zot/zot/pull/4074

## New Contributors
* @gjed made their first contribution in https://github.com/project-zot/zot/pull/3992
* @krjakbrjak made their first contribution in https://github.com/project-zot/zot/pull/3975
* @AkashKumar7902 made their first contribution in https://github.com/project-zot/zot/pull/3994

**Full Changelog**: https://github.com/project-zot/zot/compare/v2.1.16...v2.1.17