ORAS CLI 1.3.6

What's new in 1.3.6

Changes since v1.3.5

Dependencies

• Update oras.land/oras-go/v2 from v2.6.4 to v2.7.0 (#2284, fixes #2275)
• Behavior change: v2.6.4 rejected bearer token realms on any private address, which broke split-host registries such as self-hosted GitLab (oras-project/oras-go#1631). The default denylist now blocks only loopback, link-local, unspecified, and cloud metadata addresses. RFC 1918, IPv6 unique-local, and CGNAT realms are allowed again.
• Authentication now works after a same-host HTTP-to-HTTPS redirect.
• Copy and verification fixes：FilterArtifactType matching for referrers with an empty config and for image indexes, PreCopy returning SkipNode after a declined cross-repo mount, and a clearer error when a source fails after sending all its declared bytes.

Bug fixes

• oras tag now checks that it gets a source reference and at least one tag (#2265, fixes #2264)
• --from-resolve and --to-resolve rules no longer overwrite each other when combined with --resolve (#2282, fixes #2277)
• Fix a panic when a mount is attempted against a tracked target that does not support mounting, such as an OCI layout (#2283, fixes #2278)

Release and packaging

• Release archives and the checksums file now come with GitHub artifact attestations (SLSA build provenance). You can verify them with gh attestation verify in addition to GPG signatures (#2271, fixes #2269)
• Stable snap releases now publish to the candidate channel as well as stable. The classic snap no longer bundles its own ca-certificates and uses the host certificate store instead (#2274)

Other

• More unit tests for display JSON metadata handlers and contentutil (#2266, #2267)
• Bump GitHub Actions dependencies (#2263)

Full changelog: https://github.com/oras-project/oras/compare/v1.3.5...v1.3.6

Changelog

• 9b1fc815f6b7fba743f08b9b5c5846639cc11d3c bump：tag and release ORAS CLI v1.3.6 (#2285)
• 5f0355536403621f11cb264e7082577d4cc7ea45 docs：make oras-www release updates explicit (#2286)
• 81f1656d2f78f5e1a3c1a350530369857234d6e2 fix：serialize progress console frames (#2292)
• 27c179624c30cc54016cbe02ad05764cede6022c fix：share auth caches only between clients with the same credentials (#2288)
• ecc3e870f435e18f25fe7e5b18be70d95ad3a8f9 fix：take the write lock in status.Render (#2290)
• 3d087a2208f06e16a0d0ef5086d873521286ccbb fix：make the TTY progress manager safe against concurrent and repeated Close (#2287) …

Full release notes »