chore(deps): update dependency oras-project/oras to v1.3.6 #141

Merged

CSRBot merged 1 commits from renovate/oras-project-oras-1.x into master 2026-10-25 17:35:18 +01:00

Conversation 0 Commits 1 Files Changed 1

+1 -1

CSRBot commented 2026-10-24 21:11:47 +02:00

Collaborator

Copy link

Copy source

This PR contains the following updates:

Package	Update	Change
oras-project/oras	patch	1.3.5 → 1.3.6

---

Release Notes

oras-project/oras (oras-project/oras)

v1.3.6

Compare Source

Changes since v1.3.5

Dependencies

• Update oras.land/oras-go/v2 from v2.6.4 to v2.7.0 (#​2284, fixes #​2275)
  • Behavior change: v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab (oras-project/oras-go#1631). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again.
  • Authentication now works after a same-host HTTP-to-HTTPS redirect.
  • Copy and verification fixes: FilterArtifactType matching for referrers with an empty config and for image indexes, PreCopy returning SkipNode after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes.

Bug fixes

• oras tag now checks that it gets a source reference and at least one tag (#​2265, fixes #​2264)
• --from-resolve and --to-resolve rules no longer overwrite each other when combined with --resolve (#​2282, fixes #​2277)
• Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout (#​2283, fixes #​2278)

Release and packaging

• Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with gh attestation verify in addition to GPG signatures (#​2271, fixes #​2269)
• Stable snap releases now publish to the candidate channel as well as stable. The classic snap no longer bundles its own ca-certificates and uses the host certificate store instead (#​2274)

Other

• More unit tests for display JSON metadata handlers and contentutil (#​2266, #​2267)
• Bump GitHub Actions dependencies (#​2263)

Full changelog: https://github.com/oras-project/oras/compare/v1.3.5...v1.3.6

Changelog

• 9b1fc81 bump: tag and release ORAS CLI v1.3.6 (#​2285)
• 5f03555 docs: make oras-www release updates explicit (#​2286)
• 81f1656 fix: serialize progress console frames (#​2292)
• 27c1796 fix: share auth caches only between clients with the same credentials (#​2288)
• ecc3e87 fix: take the write lock in status.Render (#​2290)
• 3d087a2 fix: make the TTY progress manager safe against concurrent and repeated Close (#​2287)
• 9218890 fix: expose mount only for capable tracked targets (#​2283)
• fdf2ba3 fix: keep --from-resolve and --to-resolve rules separate (#​2282)
• cb601f5 chore: update oras-go to v2.7.0 (#​2284)
• a325603 build: keep snap candidate channel current (#​2274)
• 5236ba2 ci: publish build provenance attestations for release artifacts (#​2271)
• ed26899 test(display): cover the remaining JSON metadata handlers (#​2266)
• bd0668e test(contentutil): cover MultiReadOnlyTarget and IsDigest (#​2267)
• 38812fe fix: validate minimum arguments for tag command (#​2265)
• 17d5269 build(deps): bump the github-actions group with 3 updates (#​2263)

Verification

Release artifacts are signed with the ORAS project release key C6FC42F0DE84A345FAADB742F44418110791EF37. Signatures (.asc files) are attached to this release.

Public keys are available in the KEYS file.

Release archives and the checksums file also have GitHub build provenance attestations. Verify an archive with:

gh attestation verify oras_1.3.6_linux_amd64.tar.gz --repo oras-project/oras

The attestations are Sigstore bundles, so they can also be downloaded with gh attestation download and checked with cosign verify-blob-attestation.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [oras-project/oras](https://github.com/oras-project/oras) | patch | `1.3.5` → `1.3.6` | --- ### Release Notes <details> <summary>oras-project/oras (oras-project/oras)</summary> ### [`v1.3.6`](https://github.com/oras-project/oras/releases/tag/v1.3.6) [Compare Source](https://github.com/oras-project/oras/compare/v1.3.5...v1.3.6) ##### Changes since v1.3.5 ##### Dependencies - Update `oras.land/oras-go/v2` from v2.6.4 to v2.7.0 ([#&#8203;2284](https://github.com/oras-project/oras/issues/2284), fixes [#&#8203;2275](https://github.com/oras-project/oras/issues/2275)) - **Behavior change:** v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab ([oras-project/oras-go#1631](https://github.com/oras-project/oras-go/issues/1631)). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again. - Authentication now works after a same-host HTTP-to-HTTPS redirect. - Copy and verification fixes: `FilterArtifactType` matching for referrers with an empty config and for image indexes, `PreCopy` returning `SkipNode` after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes. ##### Bug fixes - `oras tag` now checks that it gets a source reference and at least one tag ([#&#8203;2265](https://github.com/oras-project/oras/issues/2265), fixes [#&#8203;2264](https://github.com/oras-project/oras/issues/2264)) - `--from-resolve` and `--to-resolve` rules no longer overwrite each other when combined with `--resolve` ([#&#8203;2282](https://github.com/oras-project/oras/issues/2282), fixes [#&#8203;2277](https://github.com/oras-project/oras/issues/2277)) - Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout ([#&#8203;2283](https://github.com/oras-project/oras/issues/2283), fixes [#&#8203;2278](https://github.com/oras-project/oras/issues/2278)) ##### Release and packaging - Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with `gh attestation verify` in addition to GPG signatures ([#&#8203;2271](https://github.com/oras-project/oras/issues/2271), fixes [#&#8203;2269](https://github.com/oras-project/oras/issues/2269)) - Stable snap releases now publish to the `candidate` channel as well as `stable`. The classic snap no longer bundles its own `ca-certificates` and uses the host certificate store instead ([#&#8203;2274](https://github.com/oras-project/oras/issues/2274)) ##### Other - More unit tests for display JSON metadata handlers and `contentutil` ([#&#8203;2266](https://github.com/oras-project/oras/issues/2266), [#&#8203;2267](https://github.com/oras-project/oras/issues/2267)) - Bump GitHub Actions dependencies ([#&#8203;2263](https://github.com/oras-project/oras/issues/2263)) **Full changelog:** <https://github.com/oras-project/oras/compare/v1.3.5...v1.3.6> #### Changelog - [`9b1fc81`](https://github.com/oras-project/oras/commit/9b1fc815f6b7fba743f08b9b5c5846639cc11d3c) bump: tag and release ORAS CLI v1.3.6 ([#&#8203;2285](https://github.com/oras-project/oras/issues/2285)) - [`5f03555`](https://github.com/oras-project/oras/commit/5f0355536403621f11cb264e7082577d4cc7ea45) docs: make oras-www release updates explicit ([#&#8203;2286](https://github.com/oras-project/oras/issues/2286)) - [`81f1656`](https://github.com/oras-project/oras/commit/81f1656d2f78f5e1a3c1a350530369857234d6e2) fix: serialize progress console frames ([#&#8203;2292](https://github.com/oras-project/oras/issues/2292)) - [`27c1796`](https://github.com/oras-project/oras/commit/27c179624c30cc54016cbe02ad05764cede6022c) fix: share auth caches only between clients with the same credentials ([#&#8203;2288](https://github.com/oras-project/oras/issues/2288)) - [`ecc3e87`](https://github.com/oras-project/oras/commit/ecc3e870f435e18f25fe7e5b18be70d95ad3a8f9) fix: take the write lock in status.Render ([#&#8203;2290](https://github.com/oras-project/oras/issues/2290)) - [`3d087a2`](https://github.com/oras-project/oras/commit/3d087a2208f06e16a0d0ef5086d873521286ccbb) fix: make the TTY progress manager safe against concurrent and repeated Close ([#&#8203;2287](https://github.com/oras-project/oras/issues/2287)) - [`9218890`](https://github.com/oras-project/oras/commit/92188903a597b72d9678ddc0527e109ce5b4b268) fix: expose mount only for capable tracked targets ([#&#8203;2283](https://github.com/oras-project/oras/issues/2283)) - [`fdf2ba3`](https://github.com/oras-project/oras/commit/fdf2ba3f9047a91978985cb0c74744a045246b10) fix: keep --from-resolve and --to-resolve rules separate ([#&#8203;2282](https://github.com/oras-project/oras/issues/2282)) - [`cb601f5`](https://github.com/oras-project/oras/commit/cb601f51874d1f025f4ef1b0446fb3bf125caa63) chore: update oras-go to v2.7.0 ([#&#8203;2284](https://github.com/oras-project/oras/issues/2284)) - [`a325603`](https://github.com/oras-project/oras/commit/a3256036f43cd17d01e9def3a9e01778afa0e995) build: keep snap candidate channel current ([#&#8203;2274](https://github.com/oras-project/oras/issues/2274)) - [`5236ba2`](https://github.com/oras-project/oras/commit/5236ba228aeae1078ce0d7219c2994c3a85aa427) ci: publish build provenance attestations for release artifacts ([#&#8203;2271](https://github.com/oras-project/oras/issues/2271)) - [`ed26899`](https://github.com/oras-project/oras/commit/ed26899244145c32092d3a317eed2863d957a505) test(display): cover the remaining JSON metadata handlers ([#&#8203;2266](https://github.com/oras-project/oras/issues/2266)) - [`bd0668e`](https://github.com/oras-project/oras/commit/bd0668e9c6e56faf1122fb2eeac33617f8df53c9) test(contentutil): cover MultiReadOnlyTarget and IsDigest ([#&#8203;2267](https://github.com/oras-project/oras/issues/2267)) - [`38812fe`](https://github.com/oras-project/oras/commit/38812fe3b372034c1489976054d3758b4a580ca4) fix: validate minimum arguments for tag command ([#&#8203;2265](https://github.com/oras-project/oras/issues/2265)) - [`17d5269`](https://github.com/oras-project/oras/commit/17d5269b20d68df29b548bbbfa7742996f2ad674) build(deps): bump the github-actions group with 3 updates ([#&#8203;2263](https://github.com/oras-project/oras/issues/2263)) #### Verification Release artifacts are signed with the ORAS project release key `C6FC42F0DE84A345FAADB742F44418110791EF37`. Signatures (`.asc` files) are attached to this release. Public keys are available in the [KEYS](https://github.com/oras-project/oras/blob/main/KEYS) file. Release archives and the checksums file also have GitHub build provenance attestations. Verify an archive with: ```sh gh attestation verify oras_1.3.6_linux_amd64.tar.gz --repo oras-project/oras ``` The attestations are Sigstore bundles, so they can also be downloaded with `gh attestation download` and checked with `cosign verify-blob-attestation`. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTYuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjExNi4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2F1dG9tZXJnZSIsInJlbm92YXRlL2dpdGh1Yi1hY3Rpb24iXX0=-->

CSRBot added 1 commit 2026-10-24 21:11:47 +02:00

chore(deps): update dependency oras-project/oras to v1.3.6 7504a20be7

CSRBot scheduled this pull request to auto merge when all checks succeed 2026-10-24 21:11:49 +02:00

CSRBot merged commit 7504a20be7 into master 2026-10-25 17:35:18 +01:00

CSRBot deleted branch renovate/oras-project-oras-1.x 2026-10-25 17:35:18 +01:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

CSRBot (CSRBot) volker.raschek (Markus Pesch)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: volker.raschek/docker-compose-docker#141