volker.raschek/dcmerge
1
0 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

chore(deps): update dependency oras-project/oras to v1.3.6 #232

Merged
CSRBot merged 1 commits from renovate/oras-project-oras-1.x into master 2026-10-25 17:33:51 +01:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-10-24 21:02:34 +02:00
Collaborator
Copy link
Copy source

This PR contains the following updates:

Package Update Change
oras-project/oras patch 1.3.5 → 1.3.6

Release Notes

oras-project/oras (oras-project/oras)

v1.3.6

Compare Source

Changes since v1.3.5
Dependencies
  • Update oras.land/oras-go/v2 from v2.6.4 to v2.7.0 (#​2284, fixes #​2275)
    • Behavior change: v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab (oras-project/oras-go#1631). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again.
    • Authentication now works after a same-host HTTP-to-HTTPS redirect.
    • Copy and verification fixes: FilterArtifactType matching for referrers with an empty config and for image indexes, PreCopy returning SkipNode after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes.
Bug fixes
  • oras tag now checks that it gets a source reference and at least one tag (#​2265, fixes #​2264)
  • --from-resolve and --to-resolve rules no longer overwrite each other when combined with --resolve (#​2282, fixes #​2277)
  • Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout (#​2283, fixes #​2278)
Release and packaging
  • Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with gh attestation verify in addition to GPG signatures (#​2271, fixes #​2269)
  • Stable snap releases now publish to the candidate channel as well as stable. The classic snap no longer bundles its own ca-certificates and uses the host certificate store instead (#​2274)
Other
  • More unit tests for display JSON metadata handlers and contentutil (#​2266, #​2267)
  • Bump GitHub Actions dependencies (#​2263)

Full changelog: https://github.com/oras-project/oras/compare/v1.3.5...v1.3.6

Changelog

Verification

Release artifacts are signed with the ORAS project release key C6FC42F0DE84A345FAADB742F44418110791EF37. Signatures (.asc files) are attached to this release.

Public keys are available in the KEYS file.

Release archives and the checksums file also have GitHub build provenance attestations. Verify an archive with:

gh attestation verify oras_1.3.6_linux_amd64.tar.gz --repo oras-project/oras

The attestations are Sigstore bundles, so they can also be downloaded with gh attestation download and checked with cosign verify-blob-attestation.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [oras-project/oras](https://github.com/oras-project/oras) | patch | `1.3.5` → `1.3.6` | --- ### Release Notes <details> <summary>oras-project/oras (oras-project/oras)</summary> ### [`v1.3.6`](https://github.com/oras-project/oras/releases/tag/v1.3.6) [Compare Source](https://github.com/oras-project/oras/compare/v1.3.5...v1.3.6) ##### Changes since v1.3.5 ##### Dependencies - Update `oras.land/oras-go/v2` from v2.6.4 to v2.7.0 ([#&#8203;2284](https://github.com/oras-project/oras/issues/2284), fixes [#&#8203;2275](https://github.com/oras-project/oras/issues/2275)) - **Behavior change:** v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab ([oras-project/oras-go#1631](https://github.com/oras-project/oras-go/issues/1631)). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again. - Authentication now works after a same-host HTTP-to-HTTPS redirect. - Copy and verification fixes: `FilterArtifactType` matching for referrers with an empty config and for image indexes, `PreCopy` returning `SkipNode` after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes. ##### Bug fixes - `oras tag` now checks that it gets a source reference and at least one tag ([#&#8203;2265](https://github.com/oras-project/oras/issues/2265), fixes [#&#8203;2264](https://github.com/oras-project/oras/issues/2264)) - `--from-resolve` and `--to-resolve` rules no longer overwrite each other when combined with `--resolve` ([#&#8203;2282](https://github.com/oras-project/oras/issues/2282), fixes [#&#8203;2277](https://github.com/oras-project/oras/issues/2277)) - Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout ([#&#8203;2283](https://github.com/oras-project/oras/issues/2283), fixes [#&#8203;2278](https://github.com/oras-project/oras/issues/2278)) ##### Release and packaging - Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with `gh attestation verify` in addition to GPG signatures ([#&#8203;2271](https://github.com/oras-project/oras/issues/2271), fixes [#&#8203;2269](https://github.com/oras-project/oras/issues/2269)) - Stable snap releases now publish to the `candidate` channel as well as `stable`. The classic snap no longer bundles its own `ca-certificates` and uses the host certificate store instead ([#&#8203;2274](https://github.com/oras-project/oras/issues/2274)) ##### Other - More unit tests for display JSON metadata handlers and `contentutil` ([#&#8203;2266](https://github.com/oras-project/oras/issues/2266), [#&#8203;2267](https://github.com/oras-project/oras/issues/2267)) - Bump GitHub Actions dependencies ([#&#8203;2263](https://github.com/oras-project/oras/issues/2263)) **Full changelog:** <https://github.com/oras-project/oras/compare/v1.3.5...v1.3.6> #### Changelog - [`9b1fc81`](https://github.com/oras-project/oras/commit/9b1fc815f6b7fba743f08b9b5c5846639cc11d3c) bump: tag and release ORAS CLI v1.3.6 ([#&#8203;2285](https://github.com/oras-project/oras/issues/2285)) - [`5f03555`](https://github.com/oras-project/oras/commit/5f0355536403621f11cb264e7082577d4cc7ea45) docs: make oras-www release updates explicit ([#&#8203;2286](https://github.com/oras-project/oras/issues/2286)) - [`81f1656`](https://github.com/oras-project/oras/commit/81f1656d2f78f5e1a3c1a350530369857234d6e2) fix: serialize progress console frames ([#&#8203;2292](https://github.com/oras-project/oras/issues/2292)) - [`27c1796`](https://github.com/oras-project/oras/commit/27c179624c30cc54016cbe02ad05764cede6022c) fix: share auth caches only between clients with the same credentials ([#&#8203;2288](https://github.com/oras-project/oras/issues/2288)) - [`ecc3e87`](https://github.com/oras-project/oras/commit/ecc3e870f435e18f25fe7e5b18be70d95ad3a8f9) fix: take the write lock in status.Render ([#&#8203;2290](https://github.com/oras-project/oras/issues/2290)) - [`3d087a2`](https://github.com/oras-project/oras/commit/3d087a2208f06e16a0d0ef5086d873521286ccbb) fix: make the TTY progress manager safe against concurrent and repeated Close ([#&#8203;2287](https://github.com/oras-project/oras/issues/2287)) - [`9218890`](https://github.com/oras-project/oras/commit/92188903a597b72d9678ddc0527e109ce5b4b268) fix: expose mount only for capable tracked targets ([#&#8203;2283](https://github.com/oras-project/oras/issues/2283)) - [`fdf2ba3`](https://github.com/oras-project/oras/commit/fdf2ba3f9047a91978985cb0c74744a045246b10) fix: keep --from-resolve and --to-resolve rules separate ([#&#8203;2282](https://github.com/oras-project/oras/issues/2282)) - [`cb601f5`](https://github.com/oras-project/oras/commit/cb601f51874d1f025f4ef1b0446fb3bf125caa63) chore: update oras-go to v2.7.0 ([#&#8203;2284](https://github.com/oras-project/oras/issues/2284)) - [`a325603`](https://github.com/oras-project/oras/commit/a3256036f43cd17d01e9def3a9e01778afa0e995) build: keep snap candidate channel current ([#&#8203;2274](https://github.com/oras-project/oras/issues/2274)) - [`5236ba2`](https://github.com/oras-project/oras/commit/5236ba228aeae1078ce0d7219c2994c3a85aa427) ci: publish build provenance attestations for release artifacts ([#&#8203;2271](https://github.com/oras-project/oras/issues/2271)) - [`ed26899`](https://github.com/oras-project/oras/commit/ed26899244145c32092d3a317eed2863d957a505) test(display): cover the remaining JSON metadata handlers ([#&#8203;2266](https://github.com/oras-project/oras/issues/2266)) - [`bd0668e`](https://github.com/oras-project/oras/commit/bd0668e9c6e56faf1122fb2eeac33617f8df53c9) test(contentutil): cover MultiReadOnlyTarget and IsDigest ([#&#8203;2267](https://github.com/oras-project/oras/issues/2267)) - [`38812fe`](https://github.com/oras-project/oras/commit/38812fe3b372034c1489976054d3758b4a580ca4) fix: validate minimum arguments for tag command ([#&#8203;2265](https://github.com/oras-project/oras/issues/2265)) - [`17d5269`](https://github.com/oras-project/oras/commit/17d5269b20d68df29b548bbbfa7742996f2ad674) build(deps): bump the github-actions group with 3 updates ([#&#8203;2263](https://github.com/oras-project/oras/issues/2263)) #### Verification Release artifacts are signed with the ORAS project release key `C6FC42F0DE84A345FAADB742F44418110791EF37`. Signatures (`.asc` files) are attached to this release. Public keys are available in the [KEYS](https://github.com/oras-project/oras/blob/main/KEYS) file. Release archives and the checksums file also have GitHub build provenance attestations. Verify an archive with: ```sh gh attestation verify oras_1.3.6_linux_amd64.tar.gz --repo oras-project/oras ``` The attestations are Sigstore bundles, so they can also be downloaded with `gh attestation download` and checked with `cosign verify-blob-attestation`. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTYuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjExNi4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2F1dG9tZXJnZSIsInJlbm92YXRlL2dpdGh1Yi1hY3Rpb24iXX0=-->
CSRBot added 1 commit 2026-10-24 21:02:34 +02:00
chore(deps): update dependency oras-project/oras to v1.3.6
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (push) Successful in 30s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (push) Successful in 1m0s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (pull_request) Successful in 29s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (pull_request) Successful in 1m2s
Details
Lint Markdown files / Run markdown linter (pull_request) Successful in 11s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (push) Successful in 48s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (push) Successful in 21s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (pull_request) Successful in 17s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (pull_request) Successful in 20s
Details
97e3ce26a1
CSRBot scheduled this pull request to auto merge when all checks succeed 2026-10-24 21:02:36 +02:00
CSRBot merged commit dd94f8f0e8 into master 2026-10-25 17:33:51 +01:00
CSRBot deleted branch renovate/oras-project-oras-1.x 2026-10-25 17:33:52 +01:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/dcmerge#232