renovate-bot opened a new pull request, #494: URL: https://github.com/apache/superset-kubernetes-operator/pull/494
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [oras-project/oras](https://redirect.github.com/oras-project/oras) | patch | `v1.3.5` → `v1.3.6` | --- ### Release Notes <details> <summary>oras-project/oras</summary> ### [`v1.3.6`](https://redirect.github.com/oras-project/oras/releases/tag/v1.3.6) [Compare Source](https://redirect.github.com/oras-project/oras/compare/v1.3.5...v1.3.6) ##### Changes since v1.3.5 ##### Dependencies - Update `oras.land/oras-go/v2` from v2.6.4 to v2.7.0 ([#​2284](https://redirect.github.com/oras-project/oras/issues/2284), fixes [#​2275](https://redirect.github.com/oras-project/oras/issues/2275)) - **Behavior change:** v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab ([oras-project/oras-go#1631](https://redirect.github.com/oras-project/oras-go/issues/1631)). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again. - Authentication now works after a same-host HTTP-to-HTTPS redirect. - Copy and verification fixes: `FilterArtifactType` matching for referrers with an empty config and for image indexes, `PreCopy` returning `SkipNode` after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes. ##### Bug fixes - `oras tag` now checks that it gets a source reference and at least one tag ([#​2265](https://redirect.github.com/oras-project/oras/issues/2265), fixes [#​2264](https://redirect.github.com/oras-project/oras/issues/2264)) - `--from-resolve` and `--to-resolve` rules no longer overwrite each other when combined with `--resolve` ([#​2282](https://redirect.github.com/oras-project/oras/issues/2282), fixes [#​2277](https://redirect.github.com/oras-project/oras/issues/2277)) - Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout ([#​2283](https://redirect.github.com/oras-project/oras/issues/2283), fixes [#​2278](https://redirect.github.com/oras-project/oras/issues/2278)) ##### Release and packaging - Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with `gh attestation verify` in addition to GPG signatures ([#​2271](https://redirect.github.com/oras-project/oras/issues/2271), fixes [#​2269](https://redirect.github.com/oras-project/oras/issues/2269)) - Stable snap releases now publish to the `candidate` channel as well as `stable`. The classic snap no longer bundles its own `ca-certificates` and uses the host certificate store instead ([#​2274](https://redirect.github.com/oras-project/oras/issues/2274)) ##### Other - More unit tests for display JSON metadata handlers and `contentutil` ([#​2266](https://redirect.github.com/oras-project/oras/issues/2266), [#​2267](https://redirect.github.com/oras-project/oras/issues/2267)) - Bump GitHub Actions dependencies ([#​2263](https://redirect.github.com/oras-project/oras/issues/2263)) **Full changelog:** <https://github.com/oras-project/oras/compare/v1.3.5...v1.3.6> #### Changelog - [`9b1fc81`](https://redirect.github.com/oras-project/oras/commit/9b1fc815f6b7fba743f08b9b5c5846639cc11d3c) bump: tag and release ORAS CLI v1.3.6 ([#​2285](https://redirect.github.com/oras-project/oras/issues/2285)) - [`5f03555`](https://redirect.github.com/oras-project/oras/commit/5f0355536403621f11cb264e7082577d4cc7ea45) docs: make oras-www release updates explicit ([#​2286](https://redirect.github.com/oras-project/oras/issues/2286)) - [`81f1656`](https://redirect.github.com/oras-project/oras/commit/81f1656d2f78f5e1a3c1a350530369857234d6e2) fix: serialize progress console frames ([#​2292](https://redirect.github.com/oras-project/oras/issues/2292)) - [`27c1796`](https://redirect.github.com/oras-project/oras/commit/27c179624c30cc54016cbe02ad05764cede6022c) fix: share auth caches only between clients with the same credentials ([#​2288](https://redirect.github.com/oras-project/oras/issues/2288)) - [`ecc3e87`](https://redirect.github.com/oras-project/oras/commit/ecc3e870f435e18f25fe7e5b18be70d95ad3a8f9) fix: take the write lock in status.Render ([#​2290](https://redirect.github.com/oras-project/oras/issues/2290)) - [`3d087a2`](https://redirect.github.com/oras-project/oras/commit/3d087a2208f06e16a0d0ef5086d873521286ccbb) fix: make the TTY progress manager safe against concurrent and repeated Close ([#​2287](https://redirect.github.com/oras-project/oras/issues/2287)) - [`9218890`](https://redirect.github.com/oras-project/oras/commit/92188903a597b72d9678ddc0527e109ce5b4b268) fix: expose mount only for capable tracked targets ([#​2283](https://redirect.github.com/oras-project/oras/issues/2283)) - [`fdf2ba3`](https://redirect.github.com/oras-project/oras/commit/fdf2ba3f9047a91978985cb0c74744a045246b10) fix: keep --from-resolve and --to-resolve rules separate ([#​2282](https://redirect.github.com/oras-project/oras/issues/2282)) - [`cb601f5`](https://redirect.github.com/oras-project/oras/commit/cb601f51874d1f025f4ef1b0446fb3bf125caa63) chore: update oras-go to v2.7.0 ([#​2284](https://redirect.github.com/oras-project/oras/issues/2284)) - [`a325603`](https://redirect.github.com/oras-project/oras/commit/a3256036f43cd17d01e9def3a9e01778afa0e995) build: keep snap candidate channel current ([#​2274](https://redirect.github.com/oras-project/oras/issues/2274)) - [`5236ba2`](https://redirect.github.com/oras-project/oras/commit/5236ba228aeae1078ce0d7219c2994c3a85aa427) ci: publish build provenance attestations for release artifacts ([#​2271](https://redirect.github.com/oras-project/oras/issues/2271)) - [`ed26899`](https://redirect.github.com/oras-project/oras/commit/ed26899244145c32092d3a317eed2863d957a505) test(display): cover the remaining JSON metadata handlers ([#​2266](https://redirect.github.com/oras-project/oras/issues/2266)) - [`bd0668e`](https://redirect.github.com/oras-project/oras/commit/bd0668e9c6e56faf1122fb2eeac33617f8df53c9) test(contentutil): cover MultiReadOnlyTarget and IsDigest ([#​2267](https://redirect.github.com/oras-project/oras/issues/2267)) - [`38812fe`](https://redirect.github.com/oras-project/oras/commit/38812fe3b372034c1489976054d3758b4a580ca4) fix: validate minimum arguments for tag command ([#​2265](https://redirect.github.com/oras-project/oras/issues/2265)) - [`17d5269`](https://redirect.github.com/oras-project/oras/commit/17d5269b20d68df29b548bbbfa7742996f2ad674) build(deps): bump the github-actions group with 3 updates ([#​2263](https://redirect.github.com/oras-project/oras/issues/2263)) #### Verification Release artifacts are signed with the ORAS project release key `C6FC42F0DE84A345FAADB742F44418110791EF37`. Signatures (`.asc` files) are attached to this release. Public keys are available in the [KEYS](https://redirect.github.com/oras-project/oras/blob/main/KEYS) file. Release archives and the checksums file also have GitHub build provenance attestations. Verify an archive with: ```sh gh attestation verify oras_1.3.6_linux_amd64.tar.gz --repo oras-project/oras ``` The attestations are Sigstore bundles, so they can also be downloaded with `gh attestation download` and checked with `cosign verify-blob-attestation`. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/superset-kubernetes-operator). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODguMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE4OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
