[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Update	Pending
github.com/cli/cli/v2	v2.103.1 → v2.103.2					patch	v2.103.3
oras.land/oras	v1.3.5 → v1.3.6					patch
suzuki-shunsuke/pinact	v5.0.1 → v5.0.2					patch

---

Release Notes

cli/cli (github.com/cli/cli/v2)

v2.103.2: GitHub CLI 2.103.2

Compare Source

🐛 Fixes

• Allow server to arbitrate which GitHub App installation tokens can attach files by @​martinajir in #​14804
• Defer --attach credential checks to the upload endpoint by @​BagToad in #​14805

New Contributors

• @​martinajir made their first contribution in #​14804

Full Changelog: cli/cli@v2.103.1...v2.103.2

oras-project/oras (oras.land/oras)

v1.3.6

Compare Source

Changes since v1.3.5

Dependencies

• Update oras.land/oras-go/v2 from v2.6.4 to v2.7.0 (#​2284, fixes #​2275)
  • Behavior change: v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab (oras-project/oras-go#1631). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again.
  • Authentication now works after a same-host HTTP-to-HTTPS redirect.
  • Copy and verification fixes: FilterArtifactType matching for referrers with an empty config and for image indexes, PreCopy returning SkipNode after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes.

Bug fixes

• oras tag now checks that it gets a source reference and at least one tag (#​2265, fixes #​2264)
• --from-resolve and --to-resolve rules no longer overwrite each other when combined with --resolve (#​2282, fixes #​2277)
• Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout (#​2283, fixes #​2278)

Release and packaging

• Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with gh attestation verify in addition to GPG signatures (#​2271, fixes #​2269)
• Stable snap releases now publish to the candidate channel as well as stable. The classic snap no longer bundles its own ca-certificates and uses the host certificate store instead (#​2274)

Other

• More unit tests for display JSON metadata handlers and contentutil (#​2266, #​2267)
• Bump GitHub Actions dependencies (#​2263)

Full changelog: oras-project/oras@v1.3.5...v1.3.6

Changelog

• 9b1fc81 bump: tag and release ORAS CLI v1.3.6 (#​2285)
• 5f03555 docs: make oras-www release updates explicit (#​2286)
• 81f1656 fix: serialize progress console frames (#​2292)
• 27c1796 fix: share auth caches only between clients with the same credentials (#​2288)
• ecc3e87 fix: take the write lock in status.Render (#​2290)
• 3d087a2 fix: make the TTY progress manager safe against concurrent and repeated Close (#​2287)
• 9218890 fix: expose mount only for capable tracked targets (#​2283)
• fdf2ba3 fix: keep --from-resolve and --to-resolve rules separate (#​2282)
• cb601f5 chore: update oras-go to v2.7.0 (#​2284)
• a325603 build: keep snap candidate channel current (#​2274)
• 5236ba2 ci: publish build provenance attestations for release artifacts (#​2271)
• ed26899 test(display): cover the remaining JSON metadata handlers (#​2266)
• bd0668e test(contentutil): cover MultiReadOnlyTarget and IsDigest (#​2267)
• 38812fe fix: validate minimum arguments for tag command (#​2265)
• 17d5269 build(deps): bump the github-actions group with 3 updates (#​2263)

Verification

Release artifacts are signed with the ORAS project release key C6FC42F0DE84A345FAADB742F44418110791EF37. Signatures (.asc files) are attached to this release.

Public keys are available in the KEYS file.

Release archives and the checksums file also have GitHub build provenance attestations. Verify an archive with:

gh attestation verify oras_1.3.6_linux_amd64.tar.gz --repo oras-project/oras

The attestations are Sigstore bundles, so they can also be downloaded with gh attestation download and checked with cosign verify-blob-attestation.

suzuki-shunsuke/pinact

v5.0.2

Compare Source

#​1813 Publish packslip.sigstore.json

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign inteon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment