Skip to content

Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 - #1561

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/oras.land/oras-go/v2-2.6.2
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/oras.land/oras-go/v2-2.6.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026 •

Copy link
Copy Markdown
Contributor

Bumps oras.land/oras-go/v2 from 2.6.1 to 2.6.2.

Release notes

Sourced from oras.land/oras-go/v2's releases.

v2.6.2

This is a security patch release addressing advisories in the content and remote layers, plus additional hardening and bug fixes since v2.6.1.

Security Fixes

  • Resolve the hardlink (TypeLink) target before passing it to os.Link, preventing a crafted OCI artifact from hardlinking a file outside the extraction directory via the process CWD (#1232, GHSA-fxhp-mv3v-67qp / CVE-2026-50163)
  • Bound tag and referrer list pagination to prevent a malicious or misbehaving registry from advertising an endless page chain and forcing unbounded client requests (client-side DoS) (#1215)

Bug Fixes

  • Bound content.ReadAll allocation by actual content read rather than the descriptor size, correcting the over-broad 32 MiB cap introduced for GHSA-f36w-mj3v-6jqv so legitimate in-memory Push/FetchAll/FetchBytes are not rejected (#1223)

Other Changes

  • Bump golang.org/x/sync from 0.20.0 to 0.21.0 (#1208)
Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency label Aug 19, 2026
Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) from 2.6.1 to 2.6.2.
- [Release notes](https://github.com/oras-project/oras-go/releases)
- [Changelog](https://github.com/oras-project/oras-go/blob/main/RELEASES.md)
- [Commits](oras-project/oras-go@v2.6.1...v2.6.2)

---
updated-dependencies:
- dependency-name: oras.land/oras-go/v2
  dependency-version: 2.6.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/oras.land/oras-go/v2-2.6.2 branch from 12e8477 to 56bb32e Compare August 31, 2026 13:26
@dependabot @github

dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/go_modules/oras.land/oras-go/v2-2.6.2 branch October 23, 2026 12:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant