This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [oras-project/setup-oras](https://github.com/oras-project/setup-oras) | action | major | `v1.2.4` -> `v2.0.0` |
---
> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the warning logs for more information.
---
### Release Notes
<details>
<summary>oras-project/setup-oras (oras-project/setup-oras)</summary>
### [`v2.0.0`](https://github.com/oras-project/setup-oras/releases/tag/v2.0.0)
[Compare Source](https://github.com/oras-project/setup-oras/compare/v1.2.4...v2.0.0)
#### Highlights
- Support [ORAS CLI v1.3.1](https://github.com/oras-project/oras/releases/tag/v1.3.1)
- Migrate action runtime from node20 to node24 ([#​153](https://github.com/oras-project/setup-oras/issues/153))
- Pin `undici` to `>=6.24.1` to address 5 CVEs: GHSA-f269-vfmq-vjvj, GHSA-2mjp-6q6p-2qxm, GHSA-vrm6-8vpv-qv8q, GHSA-v9p9-hfj2-hcw8, GHSA-4992-7rv2-5pvq
- Bump `@actions/core` from `^2.x` to `^3.0.0` (ESM-only)
- Bump `@actions/tool-cache` from `^3.x` to `^4.0.0` (ESM-only)
- Replace `@vercel/ncc` with `esbuild` as the build bundler
#### What's Changed
- Add version 1.3.1 with checksums ([#​150](https://github.com/oras-project/setup-oras/issues/150))
- feat: migrate action runtime from node20 to node24 ([#​153](https://github.com/oras-project/setup-oras/issues/153))
- fix: pin undici to >=6.24.1 to address CVEs ([#​157](https://github.com/oras-project/setup-oras/issues/157))
- chore(deps): bump [@​actions/core](https://github.com/actions/core) to 3.x and [@​actions/tool-cache](https://github.com/actions/tool-cache) to 4.x ([#​159](https://github.com/oras-project/setup-oras/issues/159))
- chore(deps): Bump [@​actions/core](https://github.com/actions/core) from 1.11.1 to 2.0.1 ([#​130](https://github.com/oras-project/setup-oras/issues/130))
- chore(deps): Bump typescript from 5.9.2 to 6.0.2 ([#​151](https://github.com/oras-project/setup-oras/issues/151))
- chore(deps): Bump actions/checkout from 5 to 6 ([#​128](https://github.com/oras-project/setup-oras/issues/128))
- chore(deps): Bump actions/setup-node from 5 to 6 ([#​123](https://github.com/oras-project/setup-oras/issues/123))
- chore(deps): Bump [@​types/node](https://github.com/types/node) from 24.12.0 to 25.5.2 (multiple PRs)
**Full Changelog**: <https://github.com/oras-project/setup-oras/compare/v1.2.4...v2.0.0>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNDAuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE0MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->
CSRBot
requested review from volker.raschek 2026-04-14 13:23:32 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v1.2.4->v2.0.0Release Notes
oras-project/setup-oras (oras-project/setup-oras)
v2.0.0Compare Source
Highlights
undicito>=6.24.1to address 5 CVEs: GHSA-f269-vfmq-vjvj, GHSA-2mjp-6q6p-2qxm, GHSA-vrm6-8vpv-qv8q, GHSA-v9p9-hfj2-hcw8, GHSA-4992-7rv2-5pvq@actions/corefrom^2.xto^3.0.0(ESM-only)@actions/tool-cachefrom^3.xto^4.0.0(ESM-only)@vercel/nccwithesbuildas the build bundlerWhat's Changed
Full Changelog: https://github.com/oras-project/setup-oras/compare/v1.2.4...v2.0.0
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
555ba90493to1c7aca4465