oras-project/oras v1.3.3

on GitHub

ORAS CLI v1.3.3 is a maintenance release focused on security hardening, dependency updates, and a few user-facing improvements to oras attach.

Highlights

• 🔒 Security: upgraded oras-go to v2.6.2, which addresses a tar-extraction path-traversal advisory (GHSA-fxhp-mv3v-67qp) affecting hardlink entries during pull/extract.
• ✨ oras attach gains --config support, and --annotation $config:* values now flow through to the packed manifest.
• 🛡️ Supply-chain hardening: GitHub Actions are now pinned to commit SHAs, SBOMs are attached to release artifacts, and static security scanning (gosec) runs in CI.
• 🐛 Copy/mount fixes: no longer mounts when source and destination credentials differ, and falls back to blob upload when a cross-repo mount fails.

✨ Features

• Add --config flag support for oras attach by @ogulcanaydogan in #2000
• Pass --annotation $config:* through to PackManifestOptions for attach by @SAY-5 in #2037
• Allow setting org.opencontainers.image.title in the annotation file by @rafaelgieschke in #1872
• Add SBOMs to the release workflow by @bupd in #1940

🐛 Bug Fixes

• cp should not mount when source and destination credentials differ by @wangxiaoxuan273 in #1903
• Fall back to blob upload when cross-repo mount fails by @bupd in #1924
• Redact password values from e2e test execution logs by @TerryHowe in #2042
• Revert Alpine base image to fix multi-arch build by @bupd in #1933
• Set GOTOOLCHAIN=local in snapcraft.yaml to prevent auto-download by @TerryHowe in #2012
• Fix typo in logEntrySeparator const by @Ahmad-Faraj in #2087

🔒 Security

• Bump oras.land/oras-go/v2 to 2.6.2 (addresses GHSA-fxhp-mv3v-67qp) by @dependabot in #2105, #2106
• Add static security scanning (gosec) to CI by @bupd in #1934; resolve gosec findings (G703, G117, G704) by @TerryHowe in #1985
• Pin GitHub Actions to commit SHAs by @TerryHowe in #2016; pin to full version comments by @alliasgher in #2038
• Add golangci-lint configuration with additional linters by @bupd in #1936

📖 Documentation

• Add examples to the logout command help text by @ogulcanaydogan in #2079
• Add multi-repository backup and restore proposal by @shizhMSFT in #1917

🧰 Maintenance

• Upgrade to Go 1.25.7 by @TerryHowe / @adriansali in #1980, #1910
• Migrate from unmaintained gopkg.in/yaml.v3 to go.yaml.in/yaml/v4 by @bupd in #1922
• Add goheader (license headers) and revive linters, plus gofmt/go modernize passes
• ~110 dependency updates across Go modules, Docker base images, and GitHub Actions via Dependabot

New Contributors

• @rafaelgieschke made their first contribution in #1872
• @ManishhDev made their first contribution in #1883
• @johnsonshi made their first contribution in #1889
• @vr-varad made their first contribution in #1898
• @adriansali made their first contribution in #1910
• @bupd made their first contribution in #1933
• @alliasgher made their first contribution in #2038
• @ogulcanaydogan made their first contribution in #2000
• @bimakw made their first contribution in #1950
• @SAY-5 made their first contribution in #2037
• @gaoflow made their first contribution in #2093
• @Ahmad-Faraj made their first contribution in #2087

Full Changelog: v1.3.2...v1.3.3