[bootc-bot]

This PR contains the following updates:

Package	Update	Change
oras-project/oras	patch	1.3.4 → 1.3.6

---

Release Notes

oras-project/oras

v1.3.6

Compare Source

Changes since v1.3.5

Dependencies

• Update oras.land/oras-go/v2 from v2.6.4 to v2.7.0 (#​2284, fixes #​2275)
  • Behavior change: v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab (oras-project/oras-go#1631). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again.
  • Authentication now works after a same-host HTTP-to-HTTPS redirect.
  • Copy and verification fixes: FilterArtifactType matching for referrers with an empty config and for image indexes, PreCopy returning SkipNode after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes.

Bug fixes

• oras tag now checks that it gets a source reference and at least one tag (#​2265, fixes #​2264)
• --from-resolve and --to-resolve rules no longer overwrite each other when combined with --resolve (#​2282, fixes #​2277)
• Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout (#​2283, fixes #​2278)

Release and packaging

• Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with gh attestation verify in addition to GPG signatures (#​2271, fixes #​2269)
• Stable snap releases now publish to the candidate channel as well as stable. The classic snap no longer bundles its own ca-certificates and uses the host certificate store instead (#​2274)

Other

• More unit tests for display JSON metadata handlers and contentutil (#​2266, #​2267)
• Bump GitHub Actions dependencies (#​2263)

Full changelog: oras-project/oras@v1.3.5...v1.3.6

Changelog

• 9b1fc81 bump: tag and release ORAS CLI v1.3.6 (#​2285)
• 5f03555 docs: make oras-www release updates explicit (#​2286)
• 81f1656 fix: serialize progress console frames (#​2292)
• 27c1796 fix: share auth caches only between clients with the same credentials (#​2288)
• ecc3e87 fix: take the write lock in status.Render (#​2290)
• 3d087a2 fix: make the TTY progress manager safe against concurrent and repeated Close (#​2287)
• 9218890 fix: expose mount only for capable tracked targets (#​2283)
• fdf2ba3 fix: keep --from-resolve and --to-resolve rules separate (#​2282)
• cb601f5 chore: update oras-go to v2.7.0 (#​2284)
• a325603 build: keep snap candidate channel current (#​2274)
• 5236ba2 ci: publish build provenance attestations for release artifacts (#​2271)
• ed26899 test(display): cover the remaining JSON metadata handlers (#​2266)
• bd0668e test(contentutil): cover MultiReadOnlyTarget and IsDigest (#​2267)
• 38812fe fix: validate minimum arguments for tag command (#​2265)
• 17d5269 build(deps): bump the github-actions group with 3 updates (#​2263)

Verification

Release artifacts are signed with the ORAS project release key C6FC42F0DE84A345FAADB742F44418110791EF37. Signatures (.asc files) are attached to this release.

Public keys are available in the KEYS file.

Release archives and the checksums file also have GitHub build provenance attestations. Verify an archive with:

gh attestation verify oras_1.3.6_linux_amd64.tar.gz --repo oras-project/oras

The attestations are Sigstore bundles, so they can also be downloaded with gh attestation download and checked with cosign verify-blob-attestation.

v1.3.5

Compare Source

Changelog

• d6e7b58 bump: tag and release ORAS CLI v1.3.5 (#​2244)
• 4431829 docs: require cve fixes to land before preparing a release (#​2258)
• 8ee66ac docs: add ORAS CLI release process (#​2248)
• e09a8bb chore: bump oras-go to v2.6.4 in e2e tests (#​2247)
• 8270f5f chore: update oras-go to v2.6.4 (#​2242)
• ba3a3dc fix: validate extra destination tags before pushing (#​2237)
• 6ca02d0 build(deps): bump the github-actions group across 1 directory with 3 updates (#​2240)
• c9ccd95 build(deps): bump library/golang from 1.27.1-alpine to 1.27.2-alpine (#​2239)
• b2dc645 build(deps): bump github.com/onsi/ginkgo/v2 from 2.33.0 to 2.33.1 in /test/e2e (#​2238)
• bae5056 Preserve the index media type when the index body omits it (#​2235)
• 227fc74 chore: update oras-go to v2.6.3 (#​2234)
• 4d6c6e8 build(deps): bump golang.org/x/term from 0.46.0 to 0.47.0 (#​2232)
• 21193d8 build(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 (#​2231)
• 8b3b8bd Fall back to config media type for old-style artifact types (#​2114)
• e58fee3 fix: validate format before special handling (#​2205)
• 4e9a756 fix: validate empty OCI layout path with digest (#​2230)
• b0a7bda fix: restore pretty output for manifest fetch-config (#​2228)
• ab0ff3d fix: limit manifest config fetch size (#​2222)
• 80f72e1 build(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 in the github-actions group (#​2223)
• d608889 docs(e2e): correct test/e2e/README.md references (#​2219)
• 8d737cd chore: drop dead .gitignore entries for the Docker e2e registry mounts (#​2220)
• 02c5c20 ci: remove Docker-based e2e test run (#​2208)
• d41f4eb fix: detect credentials in multiple JSON values (#​2218)
• 5c33ab2 ci: pin e2e-k8s.yml action refs to commit SHAs (#​2216)
• 1033ebb fix: generate coverage report in covhtml (#​2214)
• ccf3e26 chore: update golang.org/x/crypto (#​2207)
• 715917d feat(cp): support multiple platforms (#​2191)
• 488b3fa fix: correct manifest fetch format error (#​2203)
• a826d9a fix: clarify absolute path validation warning (#​2201)
• 7327064 ci: replace action-publish with snapcraft CLI (#​2199)
• 1dd0de8 build(deps): bump the github-actions group with 4 updates (#​2200)
• 7c53cbf fix: clean up partial pull output on failure (#​2194)
• bdf7835 test(errors): cover the CLI error type and its constructors (#​2196)
• 88f46a4 build(deps): bump github.com/onsi/gomega from 1.43.1 to 1.44.0 in /test/e2e (#​2195)
• 8c979f1 test(display): cover the pulled-file model (#​2189)
• a0cd4de feat: add Kubernetes-based e2e testing infrastructure (#​1913)
• be79214 fix: fix concurrency in Tagged (#​2183)
• 44e831a ci: publish stable rolling image tags (#​2184)
• bc28b9c fix: keep an index's own children out of its reported referrers (#​2174)
• 458c186 build(deps): bump the github-actions group across 1 directory with 3 updates (#​2186)
• ba0b7df build(deps): bump library/alpine from 3.24.1 to 3.24.2 (#​2185)
• 8016ba3 fix: only infer platform from OCI image configs (#​2177)
• a9965b3 test(display): cover the raw content handlers (#​2182)
• e0dd8f2 build(deps): bump github.com/onsi/gomega from 1.43.0 to 1.43.1 in /test/e2e (#​2180)
• ce4dc19 fix(display): report files as [] instead of null when a pull produces none (#​2175)
• 0d1f61e test(display): cover the metadata model types (#​2176)
• 283000c build(deps): bump github.com/onsi/ginkgo/v2 from 2.32.2 to 2.33.0 in /test/e2e (#​2179)
• 87495d5 fix(display): report referenceAsTags as [] instead of null when untagged (#​2170)
• 4e589f5 feat: add release automation script (#​1992)
• 1cd8618 test(display): split template repo handler tests to match source files (#​2171)
• 27c2d04 test(display): cover the pull metadata handler (#​2168)
• ec461af build(deps): bump the github-actions group with 2 updates (#​2172)
• 0afd96e build(deps): bump github.com/onsi/ginkgo/v2 from 2.32.1 to 2.32.2 in /test/e2e (#​2167)
• 36a446d build(deps): bump golang.org/x/term from 0.45.0 to 0.46.0 (#​2166)
• d1c4808 test(display): cover the template and descriptor metadata handlers (#​2164)
• d0da4a9 build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 (#​2162)
• 898a195 fix(cli): pluralize "argument" in argument-count errors (#​2161)
• 4728be6 test(credential): fix TestNewStoreError failing on Windows (#​2159)
• 003dfd1 build(deps): bump library/golang from 1.27.0-alpine to 1.27.1-alpine (#​2160)
• c508a57 build(deps): bump the github-actions group across 1 directory with 5 updates (#​2149)
• b16846a fix(ci): resolve licenserc go.mod path relative to config directory (#​2155)
• f54f368 fix: attribute recursive copy tag failures to the destination (#​2157)
• c75e8f3 feat(ci): add windows/arm64 build to github release (#​2153)
• 749d9c1 build(deps): bump github.com/onsi/gomega from 1.42.1 to 1.43.0 in /test/e2e (#​2147)
• 86eb615 build(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 (#​2146)
• 71d17dd build: bump Go toolchain to 1.26 (#​2145)
• 20df556 ci: fetch full history for release changelog (#​2143)

Verification

Release artifacts are signed with the ORAS project release key C6FC42F0DE84A345FAADB742F44418110791EF37. Signatures (.asc files) are attached to this release.

Public keys are available in the KEYS file.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.