chore(deps): update dependency oras-project/oras to v1.3.4 #195

2026-08-27T23:04:34+02:00

CSRBot commented

2026-08-27 23:04:34 +02:00

This PR contains the following updates:

Package	Update	Change
oras-project/oras	patch	`1.3.3` → `1.3.4`

Release Notes

oras-project/oras (oras-project/oras)

`v1.3.4`

Compare Source

ORAS CLI v1.3.4 is a security-focused maintenance release. It scopes registry credentials — mTLS client certificates, custom --header values, and --debug trace output — strictly to the configured registry origin, and adds an opt-in --force copy mode for registries that report incomplete content as present.

Highlights

🔒 Security: three credential-scoping advisories are fixed — mTLS client certificates (GHSA-h3wm-jjqf-8jm2), custom request headers (GHSA-whvf-jp7m-59f3), and --debug HTTP traces (GHSA-5jhf-2qmf-m8c5). All three were reported by Hardik Mehta (@hardw00t).
✨ oras cp and oras push gain --force, which walks every referenced manifest instead of trusting the destination's Exists() response — this fixes manifest blob unknown failures against pull-through caches (ACR Artifact Cache, ECR pull-through, GAR remote repositories).
⚡ Shared authentication cache: repeated in-process calls now reuse credentials instead of re-running the 401 challenge on every call.
🛡️ Supply-chain hardening: release checksums and archives are now GPG-signed in the release workflow with the ORAS project release key.

✨ Features

Add --force to oras cp/oras push to handle partially-populated destinations by @renshao in #2061
Save authentication context between calls so in-process usage authenticates once by @TerryHowe in #1923
Sign release checksums in the release workflow by @TerryHowe in #2112

🐛 Bug Fixes

Avoid send on closed channel in the progress messenger by @harshasiddartha in #2126
Route logger output to command stderr by @vigneshakaviki in #2123

🔒 Security

Registry mTLS client certificates are disclosed to cross-origin TLS peers (CWE-201, GHSA-h3wm-jjqf-8jm2): a certificate supplied via --cert-file/--key-file was installed on a single shared transport and presented to any HTTPS peer, including cross-origin redirect and bearer-realm targets and HTTPS proxies. The certificate is now scoped to the configured registry origin.
Registry custom credentials are forwarded across HTTP origins (GHSA-whvf-jp7m-59f3): values passed with --header/--from-header/--to-header were appended to every request, including redirect targets and bearer token realms on other hosts. They are now stripped for any origin that does not match the configured registry.
Debug HTTP traces expose replayable bearer credentials (CWE-532, GHSA-5jhf-2qmf-m8c5): --debug trace output persisted URL userinfo and query parameters (e.g. pre-signed X-Amz-Signature), Location/Content-Location/Referer headers, cookies, proxy authorization, configured custom headers, and token response bodies. These are now redacted.

All three were reported by Hardik Mehta (@hardw00t).

🧹 Maintenance

Replace containerd/console with golang.org/x/term by @TerryHowe in #2062
Group GitHub Actions Dependabot updates by @TerryHowe in #2119
Float the Go version in the release workflow to match the other workflows by @sooraj-sky in #2137
Cover the shared auth client cache in tests by @subotac in #2127
Strengthen display handler test assertions by @TerryHowe in #2055
Expect scrubbed custom header values in e2e by @TerryHowe in #2133
Dependency bumps: sirupsen/logrus 1.9.4 → 1.10.1 (#2130, #2138), onsi/ginkgo/v2 2.32.1 in /test/e2e (#2129), library/golang 1.26.5 → 1.27.0-alpine (#2134, #2139), and grouped GitHub Actions updates (#2115, #2116, #2117, #2120, #2122, #2124, #2128, #2135, #2140)

New Contributors

@renshao made their first contribution in #2061
@vigneshakaviki made their first contribution in #2123
@harshasiddartha made their first contribution in #2126
@subotac made their first contribution in #2127
@sooraj-sky made their first contribution in #2137

Full Changelog: https://github.com/oras-project/oras/compare/v1.3.3...v1.3.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [oras-project/oras](https://github.com/oras-project/oras) | patch | `1.3.3` → `1.3.4` | --- ### Release Notes <details> <summary>oras-project/oras (oras-project/oras)</summary> ### [`v1.3.4`](https://github.com/oras-project/oras/releases/tag/v1.3.4) [Compare Source](https://github.com/oras-project/oras/compare/v1.3.3...v1.3.4) ORAS CLI v1.3.4 is a security-focused maintenance release. It scopes registry credentials — mTLS client certificates, custom `--header` values, and `--debug` trace output — strictly to the configured registry origin, and adds an opt-in `--force` copy mode for registries that report incomplete content as present. #### Highlights - 🔒 **Security:** three credential-scoping advisories are fixed — mTLS client certificates ([GHSA-h3wm-jjqf-8jm2](https://github.com/oras-project/oras/security/advisories/GHSA-h3wm-jjqf-8jm2)), custom request headers ([GHSA-whvf-jp7m-59f3](https://github.com/oras-project/oras/security/advisories/GHSA-whvf-jp7m-59f3)), and `--debug` HTTP traces ([GHSA-5jhf-2qmf-m8c5](https://github.com/oras-project/oras/security/advisories/GHSA-5jhf-2qmf-m8c5)). All three were reported by Hardik Mehta ([@hardw00t](https://github.com/hardw00t)). - ✨ **`oras cp` and `oras push` gain `--force`**, which walks every referenced manifest instead of trusting the destination's `Exists()` response — this fixes `manifest blob unknown` failures against pull-through caches (ACR Artifact Cache, ECR pull-through, GAR remote repositories). - ⚡ **Shared authentication cache:** repeated in-process calls now reuse credentials instead of re-running the 401 challenge on every call. - 🛡️ **Supply-chain hardening:** release checksums and archives are now GPG-signed in the release workflow with the ORAS project release key. #### ✨ Features - Add `--force` to `oras cp`/`oras push` to handle partially-populated destinations by [@renshao](https://github.com/renshao) in [#2061](https://github.com/oras-project/oras/issues/2061) - Save authentication context between calls so in-process usage authenticates once by [@TerryHowe](https://github.com/TerryHowe) in [#1923](https://github.com/oras-project/oras/issues/1923) - Sign release checksums in the release workflow by [@TerryHowe](https://github.com/TerryHowe) in [#2112](https://github.com/oras-project/oras/issues/2112) #### 🐛 Bug Fixes - Avoid send on closed channel in the progress messenger by [@harshasiddartha](https://github.com/harshasiddartha) in [#2126](https://github.com/oras-project/oras/issues/2126) - Route logger output to command stderr by [@vigneshakaviki](https://github.com/vigneshakaviki) in [#2123](https://github.com/oras-project/oras/issues/2123) #### 🔒 Security - **Registry mTLS client certificates are disclosed to cross-origin TLS peers** (CWE-201, [GHSA-h3wm-jjqf-8jm2](https://github.com/oras-project/oras/security/advisories/GHSA-h3wm-jjqf-8jm2)): a certificate supplied via `--cert-file`/`--key-file` was installed on a single shared transport and presented to any HTTPS peer, including cross-origin redirect and bearer-realm targets and HTTPS proxies. The certificate is now scoped to the configured registry origin. - **Registry custom credentials are forwarded across HTTP origins** ([GHSA-whvf-jp7m-59f3](https://github.com/oras-project/oras/security/advisories/GHSA-whvf-jp7m-59f3)): values passed with `--header`/`--from-header`/`--to-header` were appended to every request, including redirect targets and bearer token realms on other hosts. They are now stripped for any origin that does not match the configured registry. - **Debug HTTP traces expose replayable bearer credentials** (CWE-532, [GHSA-5jhf-2qmf-m8c5](https://github.com/oras-project/oras/security/advisories/GHSA-5jhf-2qmf-m8c5)): `--debug` trace output persisted URL userinfo and query parameters (e.g. pre-signed `X-Amz-Signature`), `Location`/`Content-Location`/`Referer` headers, cookies, proxy authorization, configured custom headers, and token response bodies. These are now redacted. All three were reported by Hardik Mehta ([@hardw00t](https://github.com/hardw00t)). #### 🧹 Maintenance - Replace `containerd/console` with `golang.org/x/term` by [@TerryHowe](https://github.com/TerryHowe) in [#2062](https://github.com/oras-project/oras/issues/2062) - Group GitHub Actions Dependabot updates by [@TerryHowe](https://github.com/TerryHowe) in [#2119](https://github.com/oras-project/oras/issues/2119) - Float the Go version in the release workflow to match the other workflows by [@sooraj-sky](https://github.com/sooraj-sky) in [#2137](https://github.com/oras-project/oras/issues/2137) - Cover the shared auth client cache in tests by [@subotac](https://github.com/subotac) in [#2127](https://github.com/oras-project/oras/issues/2127) - Strengthen display handler test assertions by [@TerryHowe](https://github.com/TerryHowe) in [#2055](https://github.com/oras-project/oras/issues/2055) - Expect scrubbed custom header values in e2e by [@TerryHowe](https://github.com/TerryHowe) in [#2133](https://github.com/oras-project/oras/issues/2133) - Dependency bumps: `sirupsen/logrus` 1.9.4 → 1.10.1 ([#2130](https://github.com/oras-project/oras/issues/2130), [#2138](https://github.com/oras-project/oras/issues/2138)), `onsi/ginkgo/v2` 2.32.1 in `/test/e2e` ([#2129](https://github.com/oras-project/oras/issues/2129)), `library/golang` 1.26.5 → 1.27.0-alpine ([#2134](https://github.com/oras-project/oras/issues/2134), [#2139](https://github.com/oras-project/oras/issues/2139)), and grouped GitHub Actions updates ([#2115](https://github.com/oras-project/oras/issues/2115), [#2116](https://github.com/oras-project/oras/issues/2116), [#2117](https://github.com/oras-project/oras/issues/2117), [#2120](https://github.com/oras-project/oras/issues/2120), [#2122](https://github.com/oras-project/oras/issues/2122), [#2124](https://github.com/oras-project/oras/issues/2124), [#2128](https://github.com/oras-project/oras/issues/2128), [#2135](https://github.com/oras-project/oras/issues/2135), [#2140](https://github.com/oras-project/oras/issues/2140)) #### New Contributors - [@renshao](https://github.com/renshao) made their first contribution in [#2061](https://github.com/oras-project/oras/issues/2061) - [@vigneshakaviki](https://github.com/vigneshakaviki) made their first contribution in [#2123](https://github.com/oras-project/oras/issues/2123) - [@harshasiddartha](https://github.com/harshasiddartha) made their first contribution in [#2126](https://github.com/oras-project/oras/issues/2126) - [@subotac](https://github.com/subotac) made their first contribution in [#2127](https://github.com/oras-project/oras/issues/2127) - [@sooraj-sky](https://github.com/sooraj-sky) made their first contribution in [#2137](https://github.com/oras-project/oras/issues/2137) **Full Changelog**: <https://github.com/oras-project/oras/compare/v1.3.3...v1.3.4> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

CSRBot added 1 commit 2026-08-27 23:04:35 +02:00

chore(deps): update dependency oras-project/oras to v1.3.4

Helm / helm-lint (push) Successful in 11s

Details

Helm / helm-unittest (push) Successful in 19s

Details

Helm / helm-lint (pull_request) Successful in 11s

Details

Helm / helm-unittest (pull_request) Successful in 15s

Details

1717c06c93

CODEOWNERS rules requested review from volker.raschek 2026-08-27 23:04:36 +02:00

CSRBot scheduled this pull request to auto merge when all checks succeed 2026-08-27 23:04:38 +02:00

CSRBot merged commit f39b69cf8a into master

2026-08-27 23:05:21 +02:00

CSRBot deleted branch renovate/oras-project-oras-1.x

2026-08-27 23:05:22 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: volker.raschek/athens-proxy-charts#195