Commit 6e041cd
authored
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#268)
Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go)
from 2.6.1 to 2.6.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oras-project/oras-go/releases">oras.land/oras-go/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.6.2</h2>
<p>This is a security patch release addressing advisories in the content
and remote layers, plus additional hardening and bug fixes since
v2.6.1.</p>
<h2>Security Fixes</h2>
<ul>
<li>Resolve the hardlink (<code>TypeLink</code>) target before passing
it to <code>os.Link</code>, preventing a crafted OCI artifact from
hardlinking a file outside the extraction directory via the process CWD
(<a
href="https://redirect.github.com/oras-project/oras-go/issues/1232">#1232</a>,
<a
href="https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp">GHSA-fxhp-mv3v-67qp</a>
/ CVE-2026-50163)</li>
<li>Bound tag and referrer list pagination to prevent a malicious or
misbehaving registry from advertising an endless page chain and forcing
unbounded client requests (client-side DoS) (<a
href="https://redirect.github.com/oras-project/oras-go/issues/1215">#1215</a>)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>Bound <code>content.ReadAll</code> allocation by actual content read
rather than the descriptor size, correcting the over-broad 32 MiB cap
introduced for GHSA-f36w-mj3v-6jqv so legitimate in-memory
<code>Push</code>/<code>FetchAll</code>/<code>FetchBytes</code> are not
rejected (<a
href="https://redirect.github.com/oras-project/oras-go/issues/1223">#1223</a>)</li>
</ul>
<h2>Other Changes</h2>
<ul>
<li>Bump <code>golang.org/x/sync</code> from 0.20.0 to 0.21.0 (<a
href="https://redirect.github.com/oras-project/oras-go/issues/1208">#1208</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oras-project/oras-go/commit/105715ee12eac6895ec736a075285c34d9f2eeb6"><code>105715e</code></a>
release: v2.6.2 (<a
href="https://redirect.github.com/oras-project/oras-go/issues/1235">#1235</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842"><code>31da196</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422"><code>adab2f2</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/948a1dc4bd97da078a4f5f1a833d3e06d33793d6"><code>948a1dc</code></a>
build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 (<a
href="https://redirect.github.com/oras-project/oras-go/issues/1242">#1242</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451"><code>c463c65</code></a>
fix: prevent hardlink path traversal via process CWD
(GHSA-fxhp-mv3v-67qp) (#...</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/91c04abac3454f1710da28b43d9a95f8a86f228f"><code>91c04ab</code></a>
fix(content): bound ReadAll allocation by content, not descriptor size
(<a
href="https://redirect.github.com/oras-project/oras-go/issues/1223">#1223</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/314e8366361528882b6540e53bee9c2323338478"><code>314e836</code></a>
fix: bound tag and referrer list pagination to prevent unbounded
requests (<a
href="https://redirect.github.com/oras-project/oras-go/issues/1">#1</a>...</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/122e88f38be4e05d095bef13d5b5fe6cdc2c1bbf"><code>122e88f</code></a>
build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 (<a
href="https://redirect.github.com/oras-project/oras-go/issues/1208">#1208</a>)</li>
<li>See full diff in <a
href="https://github.com/oras-project/oras-go/compare/v2.6.1...v2.6.2">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>1 parent 62723bc commit 6e041cd
2 files changed
Lines changed: 6 additions & 6 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
360 | 360 | | |
361 | 361 | | |
362 | 362 | | |
363 | | - | |
| 363 | + | |
364 | 364 | | |
365 | 365 | | |
366 | 366 | | |
| |||
385 | 385 | | |
386 | 386 | | |
387 | 387 | | |
388 | | - | |
| 388 | + | |
389 | 389 | | |
390 | 390 | | |
391 | 391 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1173 | 1173 | | |
1174 | 1174 | | |
1175 | 1175 | | |
1176 | | - | |
1177 | | - | |
| 1176 | + | |
| 1177 | + | |
1178 | 1178 | | |
1179 | 1179 | | |
1180 | 1180 | | |
| |||
1351 | 1351 | | |
1352 | 1352 | | |
1353 | 1353 | | |
1354 | | - | |
1355 | | - | |
| 1354 | + | |
| 1355 | + | |
1356 | 1356 | | |
1357 | 1357 | | |
1358 | 1358 | | |
| |||
0 commit comments