volker.raschek/db-wait
1
0
Fork 0
Code Issues 1 Pull Requests Actions 3 Packages Projects Releases 3 Wiki Activity

chore(deps): update dependency oras-project/oras to v1.3.3 #249

Merged
CSRBot merged 1 commits from renovate/oras-project-oras-1.x into master 2026-07-10 23:10:28 +02:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-07-10 23:04:39 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
oras-project/oras patch 1.3.2 → 1.3.3

Release Notes

oras-project/oras (oras-project/oras)

v1.3.3

Compare Source

ORAS CLI v1.3.3 is a maintenance release focused on security hardening, dependency updates, and a few user-facing improvements to oras attach.

Highlights

  • 🔒 Security: upgraded oras-go to v2.6.2, which addresses a tar-extraction path-traversal advisory (GHSA-fxhp-mv3v-67qp) affecting hardlink entries during pull/extract.
  • ✨ oras attach gains --config support, and --annotation $config:* values now flow through to the packed manifest.
  • 🛡️ Supply-chain hardening: GitHub Actions are now pinned to commit SHAs, SBOMs are attached to release artifacts, and static security scanning (gosec) runs in CI.
  • 🐛 Copy/mount fixes: no longer mounts when source and destination credentials differ, and falls back to blob upload when a cross-repo mount fails.

✨ Features

🐛 Bug Fixes

🔒 Security

📖 Documentation

🧰 Maintenance

  • Upgrade to Go 1.25.7 by @​TerryHowe / @​adriansali in #​1980, #​1910
  • Migrate from unmaintained gopkg.in/yaml.v3 to go.yaml.in/yaml/v4 by @​bupd in #​1922
  • Add goheader (license headers) and revive linters, plus gofmt/go modernize passes
  • ~110 dependency updates across Go modules, Docker base images, and GitHub Actions via Dependabot

New Contributors

Full Changelog: https://github.com/oras-project/oras/compare/v1.3.2...v1.3.3

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [oras-project/oras](https://github.com/oras-project/oras) | patch | `1.3.2` → `1.3.3` | --- ### Release Notes <details> <summary>oras-project/oras (oras-project/oras)</summary> ### [`v1.3.3`](https://github.com/oras-project/oras/releases/tag/v1.3.3) [Compare Source](https://github.com/oras-project/oras/compare/v1.3.2...v1.3.3) ORAS CLI v1.3.3 is a maintenance release focused on security hardening, dependency updates, and a few user-facing improvements to `oras attach`. #### Highlights - 🔒 **Security:** upgraded `oras-go` to **v2.6.2**, which addresses a tar-extraction path-traversal advisory ([GHSA-fxhp-mv3v-67qp](https://github.com/advisories/GHSA-fxhp-mv3v-67qp)) affecting hardlink entries during `pull`/extract. - ✨ **`oras attach` gains `--config`** support, and `--annotation $config:*` values now flow through to the packed manifest. - 🛡️ **Supply-chain hardening:** GitHub Actions are now pinned to commit SHAs, SBOMs are attached to release artifacts, and static security scanning (gosec) runs in CI. - 🐛 Copy/mount fixes: no longer mounts when source and destination credentials differ, and falls back to blob upload when a cross-repo mount fails. #### ✨ Features - Add `--config` flag support for `oras attach` by [@&#8203;ogulcanaydogan](https://github.com/ogulcanaydogan) in [#&#8203;2000](https://github.com/oras-project/oras/issues/2000) - Pass `--annotation $config:*` through to `PackManifestOptions` for `attach` by [@&#8203;SAY-5](https://github.com/SAY-5) in [#&#8203;2037](https://github.com/oras-project/oras/issues/2037) - Allow setting `org.opencontainers.image.title` in the annotation file by [@&#8203;rafaelgieschke](https://github.com/rafaelgieschke) in [#&#8203;1872](https://github.com/oras-project/oras/issues/1872) - Add SBOMs to the release workflow by [@&#8203;bupd](https://github.com/bupd) in [#&#8203;1940](https://github.com/oras-project/oras/issues/1940) #### 🐛 Bug Fixes - `cp` should not mount when source and destination credentials differ by [@&#8203;wangxiaoxuan273](https://github.com/wangxiaoxuan273) in [#&#8203;1903](https://github.com/oras-project/oras/issues/1903) - Fall back to blob upload when cross-repo mount fails by [@&#8203;bupd](https://github.com/bupd) in [#&#8203;1924](https://github.com/oras-project/oras/issues/1924) - Redact password values from e2e test execution logs by [@&#8203;TerryHowe](https://github.com/TerryHowe) in [#&#8203;2042](https://github.com/oras-project/oras/issues/2042) - Revert Alpine base image to fix multi-arch build by [@&#8203;bupd](https://github.com/bupd) in [#&#8203;1933](https://github.com/oras-project/oras/issues/1933) - Set `GOTOOLCHAIN=local` in `snapcraft.yaml` to prevent auto-download by [@&#8203;TerryHowe](https://github.com/TerryHowe) in [#&#8203;2012](https://github.com/oras-project/oras/issues/2012) - Fix typo in `logEntrySeparator` const by [@&#8203;Ahmad-Faraj](https://github.com/Ahmad-Faraj) in [#&#8203;2087](https://github.com/oras-project/oras/issues/2087) #### 🔒 Security - Bump `oras.land/oras-go/v2` to **2.6.2** (addresses GHSA-fxhp-mv3v-67qp) by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;2105](https://github.com/oras-project/oras/issues/2105), [#&#8203;2106](https://github.com/oras-project/oras/issues/2106) - Add static security scanning (gosec) to CI by [@&#8203;bupd](https://github.com/bupd) in [#&#8203;1934](https://github.com/oras-project/oras/issues/1934); resolve gosec findings (G703, G117, G704) by [@&#8203;TerryHowe](https://github.com/TerryHowe) in [#&#8203;1985](https://github.com/oras-project/oras/issues/1985) - Pin GitHub Actions to commit SHAs by [@&#8203;TerryHowe](https://github.com/TerryHowe) in [#&#8203;2016](https://github.com/oras-project/oras/issues/2016); pin to full version comments by [@&#8203;alliasgher](https://github.com/alliasgher) in [#&#8203;2038](https://github.com/oras-project/oras/issues/2038) - Add `golangci-lint` configuration with additional linters by [@&#8203;bupd](https://github.com/bupd) in [#&#8203;1936](https://github.com/oras-project/oras/issues/1936) #### 📖 Documentation - Add examples to the `logout` command help text by [@&#8203;ogulcanaydogan](https://github.com/ogulcanaydogan) in [#&#8203;2079](https://github.com/oras-project/oras/issues/2079) - Add multi-repository backup and restore proposal by [@&#8203;shizhMSFT](https://github.com/shizhMSFT) in [#&#8203;1917](https://github.com/oras-project/oras/issues/1917) #### 🧰 Maintenance - Upgrade to Go 1.25.7 by [@&#8203;TerryHowe](https://github.com/TerryHowe) / [@&#8203;adriansali](https://github.com/adriansali) in [#&#8203;1980](https://github.com/oras-project/oras/issues/1980), [#&#8203;1910](https://github.com/oras-project/oras/issues/1910) - Migrate from unmaintained `gopkg.in/yaml.v3` to `go.yaml.in/yaml/v4` by [@&#8203;bupd](https://github.com/bupd) in [#&#8203;1922](https://github.com/oras-project/oras/issues/1922) - Add `goheader` (license headers) and `revive` linters, plus `gofmt`/`go modernize` passes - \~110 dependency updates across Go modules, Docker base images, and GitHub Actions via Dependabot #### New Contributors - [@&#8203;rafaelgieschke](https://github.com/rafaelgieschke) made their first contribution in [#&#8203;1872](https://github.com/oras-project/oras/issues/1872) - [@&#8203;ManishhDev](https://github.com/ManishhDev) made their first contribution in [#&#8203;1883](https://github.com/oras-project/oras/issues/1883) - [@&#8203;johnsonshi](https://github.com/johnsonshi) made their first contribution in [#&#8203;1889](https://github.com/oras-project/oras/issues/1889) - [@&#8203;vr-varad](https://github.com/vr-varad) made their first contribution in [#&#8203;1898](https://github.com/oras-project/oras/issues/1898) - [@&#8203;adriansali](https://github.com/adriansali) made their first contribution in [#&#8203;1910](https://github.com/oras-project/oras/issues/1910) - [@&#8203;bupd](https://github.com/bupd) made their first contribution in [#&#8203;1933](https://github.com/oras-project/oras/issues/1933) - [@&#8203;alliasgher](https://github.com/alliasgher) made their first contribution in [#&#8203;2038](https://github.com/oras-project/oras/issues/2038) - [@&#8203;ogulcanaydogan](https://github.com/ogulcanaydogan) made their first contribution in [#&#8203;2000](https://github.com/oras-project/oras/issues/2000) - [@&#8203;bimakw](https://github.com/bimakw) made their first contribution in [#&#8203;1950](https://github.com/oras-project/oras/issues/1950) - [@&#8203;SAY-5](https://github.com/SAY-5) made their first contribution in [#&#8203;2037](https://github.com/oras-project/oras/issues/2037) - [@&#8203;gaoflow](https://github.com/gaoflow) made their first contribution in [#&#8203;2093](https://github.com/oras-project/oras/issues/2093) - [@&#8203;Ahmad-Faraj](https://github.com/Ahmad-Faraj) made their first contribution in [#&#8203;2087](https://github.com/oras-project/oras/issues/2087) **Full Changelog**: <https://github.com/oras-project/oras/compare/v1.3.2...v1.3.3> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzYuMyIsInVwZGF0ZWRJblZlciI6IjQzLjEzNi4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2F1dG9tZXJnZSIsInJlbm92YXRlL2dpdGh1Yi1hY3Rpb24iXX0=-->
CSRBot added 1 commit 2026-07-10 23:04:40 +02:00
chore(deps): update dependency oras-project/oras to v1.3.3
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (pull_request) Successful in 1m44s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (push) Successful in 18s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (pull_request) Successful in 11s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (pull_request) Successful in 2m37s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (push) Successful in 31s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (push) Successful in 11s
Details
Lint Markdown files / Run markdown linter (pull_request) Successful in 6s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (pull_request) Successful in 27s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (push) Successful in 27s
Details
48aa428105
CSRBot scheduled this pull request to auto merge when all checks succeed 2026-07-10 23:04:42 +02:00
CSRBot merged commit 3002c80627 into master 2026-07-10 23:10:28 +02:00
CSRBot deleted branch renovate/oras-project-oras-1.x 2026-07-10 23:10:29 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 renovate/rebase
Rebase branch on base branch via renovate
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/db-wait#249