chore(deps): update dependency oras-project/oras to v1.3.2

[bootc-bot]

This PR contains the following updates:

Package	Update	Change
oras-project/oras	minor	1.2.2 → 1.3.2

---

Release Notes

oras-project/oras (oras-project/oras)

v1.3.2

Compare Source

Changelog

• Upgrade Go snap to 1.26 in snapcraft.yaml (#​2011)
• Bump alpine base image from 3.22.1 → 3.22.3 (#​2014)
• Bump Go to 1.26.2, patching Go CVEs from 1.26.1 (#​2026)

Verification

All release artifacts are signed with GPG key E462A3894CBAAA47. Signatures (.asc files) are attached to this release.

Public keys are available in the KEYS file.

v1.3.1

Compare Source

Bug Fixes

• Fix #​1903: oras cp should not mount if source and destination credentials are different
• Fix #​1872: allow setting org.opencontainers.image.title in annotation file

Other Changes

• Upgrade to Go 1.26
• Update dependencies

What's Changed

• fix: cp should not mount if src and dst credentials are different by @​wangxiaoxuan273 in #​1903
• fix: allow setting org.opencontainers.image.title in annotation file by @​rafaelgieschke in #​1872
• build(deps): cherry-pick Go 1.25.7 bump to release-1.3 by @​TerryHowe in #​1990
• build(deps): cherry-pick golang.org/x/crypto bump to release-1.3 by @​TerryHowe in #​1994
• chore: bump Go to 1.26 by @​TerryHowe in #​2001

Full Changelog: oras-project/oras@v1.3.0...v1.3.1

Notes

This release was signed with 2DA4 61D1 3B0C 2784 5EDF A77F E462 A389 4CBA AA47 (@​TerryHowe's GPG key) which can be found here.

v1.3.0

Compare Source

New Features

Stable

• oras is compliant with OCI distribution-spec v1.1.1
• Show OS and architecture in oras version
• Add alias oras manifest get for oras manifest fetch

Preview

• Improve tree view in oras discover
  • Display annotations by default
  • Colorize tree view 🌈

Experimental

• Introduce portable backup and restore of OCI artifacts, images, and repositories
  • oras backup: New command to back up artifacts from remote registries into local OCI image layouts, either as directories or tar archives.
  • oras restore: New command to restore artifacts from local OCI image layouts (directories or tar archives) back to remote registries.
• Introduce multi-arch image/artifact management
  • Add the oras manifest index command set to manage OCI image index manifests
    • oras manifest index create to create a new index from existing manifests
    • oras manifest index update to update an existing index manifest
  • Add --artifact-platform to oras push to push artifacts with platform information
  • Add --format to oras repo ls and oras repo tags with text, json, and go-template options
  • Support fully qualified references for OCI image layout via --oci-layout-path
• Refine the oras discover output for the json and go-template formats
  • BREAKING CHANGE: Rename the manifests field to referrers
  • Add subject manifest details to the json output
• oras discover now displays referrers recursively by default; the maximum recursion depth can be controlled via the --depth flag

Feature Promotions

• Promote the following commands and flags from Preview to Stable:
  • oras attach
  • oras attach --platform
  • oras pull --include-subject
• Promote oras resolve from Experimental to Preview

Deprecations

Stable

• Deprecate the -v, --verbose flag (verbose output is now enabled by default)

Preview

• BREAKING CHANGE Remove the global --no-tty flag
  • --no-tty remains available on individual TTY-capable commands

Experimental

• Deprecate the table option of the --format flag in oras discover

Bug Fixes

• Fix #​1436: oras tag creates referrers tags unexpectedly
• Fix #​1442: invalid progress bar shown for empty layers
• Fix #​1494: invalid reference in the formatted output of oras pull
• Fix #​1593: unable to download an artifact twice if it contains symbolic links
• Fix #​1599: Auth token scope not correctly added when using --debug or --no-tty with oras push
• Fix #​1623: Should show KB instead of kB in the progress bar
• Fix #​1728: oras cp now correctly copies the root index when the index has no referrers
• Fix #​1795, #​1825: redundant blank lines in terminal output

Other Changes

• Add support for the loong64 architecture
• Upgrade to Go 1.25.0
• Enhance UX:
  • Improve diagnostic experience through --debug logs
  • Improve error messages
• Improve documentation
• Optimize code structure
• Update dependencies
• Minor security enhancements

New Contributors

• @​bcho made their first contribution in #​1408
• @​njucjc made their first contribution in #​1435
• @​nmiyake made their first contribution in #​1477
• @​mauriciovasquezbernal made their first contribution in #​1507
• @​Horiodino made their first contribution in #​1607
• @​chrisguitarguy made their first contribution in #​1658
• @​kysucix made their first contribution in #​1671
• @​RohanMishra315 made their first contribution in #​1650
• @​apparentlymart made their first contribution in #​1696
• @​Copilot made their first contribution in #​1755
• @​tanyabhatnagar made their first contribution in #​1761
• @​amazingfate made their first contribution in #​1787

Full Changelog: oras-project/oras@v1.2.0...v1.3.0

What's Changed Since RC.2

• bump: tag and release ORAS CLI v1.3.0-rc.2 by @​Wwwsylvia in #​1834
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.25.2 in /test/e2e by @​dependabot[bot] in #​1836
• build(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @​dependabot[bot] in #​1837

Full Changelog: oras-project/oras@v1.3.0-rc.2...v1.3.0

Notes

This release was signed with 3E94 D52A FA46 5877 CAEA 79F1 E805 2EA1 7ECB 9A6C (@​Wwwsylvia's GPG key) which can be found here.

v1.2.3

Compare Source

Bug Fixes

• Fix #​1599: Auth token scope not correctly added when using --debug or --no-tty with oras push
• Fix #​1623: Should show KB instead of kB in the progress bar

Other Changes

• Minor security enhancements
• Update dependencies

Detailed Commits

• bump: tag and release ORAS CLI v1.2.2 by @​shizhMSFT in #​1592
• fix: scope action only has pull when get service token in executing cmd org push by @​hopegi in #​1600
• build: upgrade Go version and dependencies to the latest by @​Wwwsylvia in #​1706
• backport(fix): show KB in progress bar instead of kB (#​1623) by @​Wwwsylvia in #​1707
• build: use alpine 3.21.3 by @​Wwwsylvia in #​1708

New Contributors

• @​hopegi made their first contribution in #​1600

Full Changelog: oras-project/oras@v1.2.2...v1.2.3

Notes

This release was signed with 73C7 F42E 8F0B 4493 115A BED6 4F72 3223 E9DF 0185 (@​shizhMSFT's GPG key) which can be found here.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.