Changelog
- d6e7b58 bump: tag and release ORAS CLI v1.3.5 (#2244)
- 4431829 docs: require cve fixes to land before preparing a release (#2258)
- 8ee66ac docs: add ORAS CLI release process (#2248)
- e09a8bb chore: bump oras-go to v2.6.4 in e2e tests (#2247)
- 8270f5f chore: update oras-go to v2.6.4 (#2242)
- ba3a3dc fix: validate extra destination tags before pushing (#2237)
- 6ca02d0 build(deps): bump the github-actions group across 1 directory with 3 updates (#2240)
- c9ccd95 build(deps): bump library/golang from 1.27.1-alpine to 1.27.2-alpine (#2239)
- b2dc645 build(deps): bump github.com/onsi/ginkgo/v2 from 2.33.0 to 2.33.1 in /test/e2e (#2238)
- bae5056 Preserve the index media type when the index body omits it (#2235)
- 227fc74 chore: update oras-go to v2.6.3 (#2234)
- 4d6c6e8 build(deps): bump golang.org/x/term from 0.46.0 to 0.47.0 (#2232)
- 21193d8 build(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 (#2231)
- 8b3b8bd Fall back to config media type for old-style artifact types (#2114)
- e58fee3 fix: validate format before special handling (#2205)
- 4e9a756 fix: validate empty OCI layout path with digest (#2230)
- b0a7bda fix: restore pretty output for manifest fetch-config (#2228)
- ab0ff3d fix: limit manifest config fetch size (#2222)
- 80f72e1 build(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 in the github-actions group (#2223)
- d608889 docs(e2e): correct test/e2e/README.md references (#2219)
- 8d737cd chore: drop dead .gitignore entries for the Docker e2e registry mounts (#2220)
- 02c5c20 ci: remove Docker-based e2e test run (#2208)
- d41f4eb fix: detect credentials in multiple JSON values (#2218)
- 5c33ab2 ci: pin e2e-k8s.yml action refs to commit SHAs (#2216)
- 1033ebb fix: generate coverage report in covhtml (#2214)
- ccf3e26 chore: update golang.org/x/crypto (#2207)
- 715917d feat(cp): support multiple platforms (#2191)
- 488b3fa fix: correct manifest fetch format error (#2203)
- a826d9a fix: clarify absolute path validation warning (#2201)
- 7327064 ci: replace action-publish with snapcraft CLI (#2199)
- 1dd0de8 build(deps): bump the github-actions group with 4 updates (#2200)
- 7c53cbf fix: clean up partial pull output on failure (#2194)
- bdf7835 test(errors): cover the CLI error type and its constructors (#2196)
- 88f46a4 build(deps): bump github.com/onsi/gomega from 1.43.1 to 1.44.0 in /test/e2e (#2195)
- 8c979f1 test(display): cover the pulled-file model (#2189)
- a0cd4de feat: add Kubernetes-based e2e testing infrastructure (#1913)
- be79214 fix: fix concurrency in Tagged (#2183)
- 44e831a ci: publish stable rolling image tags (#2184)
- bc28b9c fix: keep an index's own children out of its reported referrers (#2174)
- 458c186 build(deps): bump the github-actions group across 1 directory with 3 updates (#2186)
- ba0b7df build(deps): bump library/alpine from 3.24.1 to 3.24.2 (#2185)
- 8016ba3 fix: only infer platform from OCI image configs (#2177)
- a9965b3 test(display): cover the raw content handlers (#2182)
- e0dd8f2 build(deps): bump github.com/onsi/gomega from 1.43.0 to 1.43.1 in /test/e2e (#2180)
- ce4dc19 fix(display): report files as [] instead of null when a pull produces none (#2175)
- 0d1f61e test(display): cover the metadata model types (#2176)
- 283000c build(deps): bump github.com/onsi/ginkgo/v2 from 2.32.2 to 2.33.0 in /test/e2e (#2179)
- 87495d5 fix(display): report referenceAsTags as [] instead of null when untagged (#2170)
- 4e589f5 feat: add release automation script (#1992)
- 1cd8618 test(display): split template repo handler tests to match source files (#2171)
- 27c2d04 test(display): cover the pull metadata handler (#2168)
- ec461af build(deps): bump the github-actions group with 2 updates (#2172)
- 0afd96e build(deps): bump github.com/onsi/ginkgo/v2 from 2.32.1 to 2.32.2 in /test/e2e (#2167)
- 36a446d build(deps): bump golang.org/x/term from 0.45.0 to 0.46.0 (#2166)
- d1c4808 test(display): cover the template and descriptor metadata handlers (#2164)
- d0da4a9 build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 (#2162)
- 898a195 fix(cli): pluralize "argument" in argument-count errors (#2161)
- 4728be6 test(credential): fix TestNewStoreError failing on Windows (#2159)
- 003dfd1 build(deps): bump library/golang from 1.27.0-alpine to 1.27.1-alpine (#2160)
- c508a57 build(deps): bump the github-actions group across 1 directory with 5 updates (#2149)
- b16846a fix(ci): resolve licenserc go.mod path relative to config directory (#2155)
- f54f368 fix: attribute recursive copy tag failures to the destination (#2157)
- c75e8f3 feat(ci): add windows/arm64 build to github release (#2153)
- 749d9c1 build(deps): bump github.com/onsi/gomega from 1.42.1 to 1.43.0 in /test/e2e (#2147)
- 86eb615 build(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 (#2146)
- 71d17dd build: bump Go toolchain to 1.26 (#2145)
- 20df556 ci: fetch full history for release changelog (#2143)
Verification
Release artifacts are signed with the ORAS project release key C6FC42F0DE84A345FAADB742F44418110791EF37. Signatures (.asc files) are attached to this release.
Public keys are available in the KEYS file.