[github-actions]

This PR contains the following updates:

Package	Type	Update	Change
oras.land/oras-go/v2	require	patch	v2.6.2 → v2.6.4

---

Release Notes

oras-project/oras-go (oras.land/oras-go/v2)

v2.6.4

Compare Source

This is a patch release with security fixes to the file store and auth client, and bug fixes to the file store, OCI store, and retry layers since v2.6.3.

Security Fixes

• Remove a symlink at the target path before writing in the file store's pushFile and pushDir, and open files with O_NOFOLLOW on unix, so a pushed blob can no longer be written through a planted terminal symlink to a file outside the store root (GHSA-2hhj-vj64-hx3j)
• Skip restoring times and mode on symlinks during tar extraction, and replace a symlink at a directory entry's path with a real directory, so a crafted unpack layer can no longer change the timestamps or permissions of files outside the store root (GHSA-jh75-xv39-vhvx)
• Compare each redirect hop against the first request in auth.Client, so a second same-origin hop on the redirect target no longer restores the Authorization header removed by the GHSA-vh4v-2xq2-g5cg guard, and refuse to resend an OAuth2 token request body (password or refresh token) to another origin on a 307 or 308 (GHSA-xc97-9f2f-9hrx)
• Resolve non-literal bearer realm hosts and reject realms resolving to loopback, link-local, private, unspecified, or carrier-grade NAT addresses, and re-validate every redirect hop of distribution and OAuth2 token requests, so a realm such as localhost or a DNS name pointing at an internal address no longer bypasses validateRealm (GHSA-mm27-wq9c-mxxr)

Bug Fixes

• Resolve tar hard link targets from the archive root rather than the link's directory, so a hard link whose target sits in another directory extracts instead of failing with "no such file or directory" (#​1510, #​1572)
• Skip digest-named directories under blobs/<alg>/ during OCI store GC, which previously aborted on a non-empty directory; os.Remove errors now include the blob path (#​1526, #​1579, #​1588)
• Retry on connection reset by peer and unexpected EOF in retry.DefaultPredicate, so a single reset from a registry no longer fails the whole operation (#​1567, #​1570)

v2.6.3

Compare Source

This is a patch release with bug fixes to the file store, OCI store, remote registry, auth client, copy, and retry layers since v2.6.2.

Bug Fixes

• Validate the descriptors resolved through the referrers tag schema fallback, so a registry that resolves the fallback tag to the subject itself no longer has the subject's own platform manifests reported as its referrers (#​1403, #​1461)
• Drop a moved tag from its previous manifest's tag set, so Delete with AutoGC no longer keeps a manifest whose tag has moved to another manifest, along with the blobs only it references, until an explicit GC() (#​1468, #​1469, #​1475)
• Remove a file from the file store when saving it fails verification, instead of leaving a short or mismatched file at the target path where it is indistinguishable from a successful pull (#​1456)
• Advance the subject walk in gcIndex, which re-read the first hop on every pass: garbage collection could spin without progress, and a referrer reaching the graph further up the chain was never recognised (#​1295, #​1458)
• Restore duplicate named layers when IgnoreNoName discards the manifest, which previously returned early and silently skipped the second name (#​1441, #​1452, #​1459)
• Re-push a node's manifest successors and retry once when the destination rejects a manifest push as missing referenced content, so CopyGraph self-heals a partially copied graph instead of failing (#​1212, #​1213)
• Restore the default limit of 10 redirects in auth.Client, which v2.6.1 and v2.6.2 stopped enforcing when no CheckRedirect is set (#​1500, #​1514, #​1519)
• Skip the random term in retry.ExponentialBackoff when the jitter is zero, which previously panicked on the first retry because rand.Int64N was called with a zero range (#​1549, #​1551)

Other Changes

• Bump golang.org/x/sync from 0.22.0 to 0.24.0 (#​1413, #​1529)
• Move the v2 release to a release-label triggered workflow authenticated with a PAT, and document the flow in RELEASES.md (#​1371, #​1422, #​1439, #​1446)
• Enable CI workflows for the v2 branch (#​1531)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
golang.org/x/sync	v0.22.0 -> v0.24.0

[github-actions]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.