renovate-bot opened a new pull request, #342: URL: https://github.com/apache/superset-kubernetes-operator/pull/342
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [oras-project/oras](https://redirect.github.com/oras-project/oras) | patch | `v1.3.3` โ `v1.3.4` | --- ### Release Notes <details> <summary>oras-project/oras (oras-project/oras)</summary> ### [`v1.3.4`](https://redirect.github.com/oras-project/oras/releases/tag/v1.3.4) [Compare Source](https://redirect.github.com/oras-project/oras/compare/v1.3.3...v1.3.4) ORAS CLI v1.3.4 is a security-focused maintenance release. It scopes registry credentials โ mTLS client certificates, custom `--header` values, and `--debug` trace output โ strictly to the configured registry origin, and adds an opt-in `--force` copy mode for registries that report incomplete content as present. #### Highlights - ๐ **Security:** three credential-scoping advisories are fixed โ mTLS client certificates ([GHSA-h3wm-jjqf-8jm2](https://redirect.github.com/oras-project/oras/security/advisories/GHSA-h3wm-jjqf-8jm2)), custom request headers ([GHSA-whvf-jp7m-59f3](https://redirect.github.com/oras-project/oras/security/advisories/GHSA-whvf-jp7m-59f3)), and `--debug` HTTP traces ([GHSA-5jhf-2qmf-m8c5](https://redirect.github.com/oras-project/oras/security/advisories/GHSA-5jhf-2qmf-m8c5)). All three were reported by Hardik Mehta ([@​hardw00t](https://redirect.github.com/hardw00t)). - โจ **`oras cp` and `oras push` gain `--force`**, which walks every referenced manifest instead of trusting the destination's `Exists()` response โ this fixes `manifest blob unknown` failures against pull-through caches (ACR Artifact Cache, ECR pull-through, GAR remote repositories). - โก **Shared authentication cache:** repeated in-process calls now reuse credentials instead of re-running the 401 challenge on every call. - ๐ก๏ธ **Supply-chain hardening:** release checksums and archives are now GPG-signed in the release workflow with the ORAS project release key. #### โจ Features - Add `--force` to `oras cp`/`oras push` to handle partially-populated destinations by [@​renshao](https://redirect.github.com/renshao) in [#​2061](https://redirect.github.com/oras-project/oras/issues/2061) - Save authentication context between calls so in-process usage authenticates once by [@​TerryHowe](https://redirect.github.com/TerryHowe) in [#​1923](https://redirect.github.com/oras-project/oras/issues/1923) - Sign release checksums in the release workflow by [@​TerryHowe](https://redirect.github.com/TerryHowe) in [#​2112](https://redirect.github.com/oras-project/oras/issues/2112) #### ๐ Bug Fixes - Avoid send on closed channel in the progress messenger by [@​harshasiddartha](https://redirect.github.com/harshasiddartha) in [#​2126](https://redirect.github.com/oras-project/oras/issues/2126) - Route logger output to command stderr by [@​vigneshakaviki](https://redirect.github.com/vigneshakaviki) in [#​2123](https://redirect.github.com/oras-project/oras/issues/2123) #### ๐ Security - **Registry mTLS client certificates are disclosed to cross-origin TLS peers** (CWE-201, [GHSA-h3wm-jjqf-8jm2](https://redirect.github.com/oras-project/oras/security/advisories/GHSA-h3wm-jjqf-8jm2)): a certificate supplied via `--cert-file`/`--key-file` was installed on a single shared transport and presented to any HTTPS peer, including cross-origin redirect and bearer-realm targets and HTTPS proxies. The certificate is now scoped to the configured registry origin. - **Registry custom credentials are forwarded across HTTP origins** ([GHSA-whvf-jp7m-59f3](https://redirect.github.com/oras-project/oras/security/advisories/GHSA-whvf-jp7m-59f3)): values passed with `--header`/`--from-header`/`--to-header` were appended to every request, including redirect targets and bearer token realms on other hosts. They are now stripped for any origin that does not match the configured registry. - **Debug HTTP traces expose replayable bearer credentials** (CWE-532, [GHSA-5jhf-2qmf-m8c5](https://redirect.github.com/oras-project/oras/security/advisories/GHSA-5jhf-2qmf-m8c5)): `--debug` trace output persisted URL userinfo and query parameters (e.g. pre-signed `X-Amz-Signature`), `Location`/`Content-Location`/`Referer` headers, cookies, proxy authorization, configured custom headers, and token response bodies. These are now redacted. All three were reported by Hardik Mehta ([@​hardw00t](https://redirect.github.com/hardw00t)). #### ๐งน Maintenance - Replace `containerd/console` with `golang.org/x/term` by [@​TerryHowe](https://redirect.github.com/TerryHowe) in [#​2062](https://redirect.github.com/oras-project/oras/issues/2062) - Group GitHub Actions Dependabot updates by [@​TerryHowe](https://redirect.github.com/TerryHowe) in [#​2119](https://redirect.github.com/oras-project/oras/issues/2119) - Float the Go version in the release workflow to match the other workflows by [@​sooraj-sky](https://redirect.github.com/sooraj-sky) in [#​2137](https://redirect.github.com/oras-project/oras/issues/2137) - Cover the shared auth client cache in tests by [@​subotac](https://redirect.github.com/subotac) in [#​2127](https://redirect.github.com/oras-project/oras/issues/2127) - Strengthen display handler test assertions by [@​TerryHowe](https://redirect.github.com/TerryHowe) in [#​2055](https://redirect.github.com/oras-project/oras/issues/2055) - Expect scrubbed custom header values in e2e by [@​TerryHowe](https://redirect.github.com/TerryHowe) in [#​2133](https://redirect.github.com/oras-project/oras/issues/2133) - Dependency bumps: `sirupsen/logrus` 1.9.4 โ 1.10.1 ([#​2130](https://redirect.github.com/oras-project/oras/issues/2130), [#​2138](https://redirect.github.com/oras-project/oras/issues/2138)), `onsi/ginkgo/v2` 2.32.1 in `/test/e2e` ([#​2129](https://redirect.github.com/oras-project/oras/issues/2129)), `library/golang` 1.26.5 โ 1.27.0-alpine ([#​2134](https://redirect.github.com/oras-project/oras/issues/2134), [#​2139](https://redirect.github.com/oras-project/oras/issues/2139)), and grouped GitHub Actions updates ([#​2115](https://redirect.github.com/oras-project/oras/issues/2115), [#​2116](https://redirect.github.com/oras-project/oras/issues/2116), [#​2117](https://redirect.github.com/oras-project/oras/issues/2117), [#​2120](https://redirect.github.com/oras-project/oras/issues/2120), [#​2122](https://redirect.github.com/oras-project/oras/issues/2122), [#​2124](https://redirect.github.com/oras-project/oras/issues /2124), [#​2128](https://redirect.github.com/oras-project/oras/issues/2128), [#​2135](https://redirect.github.com/oras-project/oras/issues/2135), [#​2140](https://redirect.github.com/oras-project/oras/issues/2140)) #### New Contributors - [@​renshao](https://redirect.github.com/renshao) made their first contribution in [#​2061](https://redirect.github.com/oras-project/oras/issues/2061) - [@​vigneshakaviki](https://redirect.github.com/vigneshakaviki) made their first contribution in [#​2123](https://redirect.github.com/oras-project/oras/issues/2123) - [@​harshasiddartha](https://redirect.github.com/harshasiddartha) made their first contribution in [#​2126](https://redirect.github.com/oras-project/oras/issues/2126) - [@​subotac](https://redirect.github.com/subotac) made their first contribution in [#​2127](https://redirect.github.com/oras-project/oras/issues/2127) - [@​sooraj-sky](https://redirect.github.com/sooraj-sky) made their first contribution in [#​2137](https://redirect.github.com/oras-project/oras/issues/2137) **Full Changelog**: <https://github.com/oras-project/oras/compare/v1.3.3...v1.3.4> </details> --- ### Configuration ๐ **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) ๐ฆ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. โป **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. ๐ **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/superset-kubernetes-operator). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
