chore(deps): update dependency oras-project/oras to v1.3.4

[bootc-bot]

This PR contains the following updates:

Package	Update	Change
oras-project/oras	patch	1.3.3 → 1.3.4

---

Release Notes

oras-project/oras (oras-project/oras)

v1.3.4

Compare Source

ORAS CLI v1.3.4 is a security-focused maintenance release. It scopes registry credentials — mTLS client certificates, custom --header values, and --debug trace output — strictly to the configured registry origin, and adds an opt-in --force copy mode for registries that report incomplete content as present.

Highlights

• 🔒 Security: three credential-scoping advisories are fixed — mTLS client certificates (GHSA-h3wm-jjqf-8jm2), custom request headers (GHSA-whvf-jp7m-59f3), and --debug HTTP traces (GHSA-5jhf-2qmf-m8c5). All three were reported by Hardik Mehta (@​hardw00t).
• ✨ oras cp and oras push gain --force, which walks every referenced manifest instead of trusting the destination's Exists() response — this fixes manifest blob unknown failures against pull-through caches (ACR Artifact Cache, ECR pull-through, GAR remote repositories).
• ⚡ Shared authentication cache: repeated in-process calls now reuse credentials instead of re-running the 401 challenge on every call.
• 🛡️ Supply-chain hardening: release checksums and archives are now GPG-signed in the release workflow with the ORAS project release key.

✨ Features

• Add --force to oras cp/oras push to handle partially-populated destinations by @​renshao in #​2061
• Save authentication context between calls so in-process usage authenticates once by @​TerryHowe in #​1923
• Sign release checksums in the release workflow by @​TerryHowe in #​2112

🐛 Bug Fixes

• Avoid send on closed channel in the progress messenger by @​harshasiddartha in #​2126
• Route logger output to command stderr by @​vigneshakaviki in #​2123

🔒 Security

• Registry mTLS client certificates are disclosed to cross-origin TLS peers (CWE-201, GHSA-h3wm-jjqf-8jm2): a certificate supplied via --cert-file/--key-file was installed on a single shared transport and presented to any HTTPS peer, including cross-origin redirect and bearer-realm targets and HTTPS proxies. The certificate is now scoped to the configured registry origin.
• Registry custom credentials are forwarded across HTTP origins (GHSA-whvf-jp7m-59f3): values passed with --header/--from-header/--to-header were appended to every request, including redirect targets and bearer token realms on other hosts. They are now stripped for any origin that does not match the configured registry.
• Debug HTTP traces expose replayable bearer credentials (CWE-532, GHSA-5jhf-2qmf-m8c5): --debug trace output persisted URL userinfo and query parameters (e.g. pre-signed X-Amz-Signature), Location/Content-Location/Referer headers, cookies, proxy authorization, configured custom headers, and token response bodies. These are now redacted.

All three were reported by Hardik Mehta (@​hardw00t).

🧹 Maintenance

• Replace containerd/console with golang.org/x/term by @​TerryHowe in #​2062
• Group GitHub Actions Dependabot updates by @​TerryHowe in #​2119
• Float the Go version in the release workflow to match the other workflows by @​sooraj-sky in #​2137
• Cover the shared auth client cache in tests by @​subotac in #​2127
• Strengthen display handler test assertions by @​TerryHowe in #​2055
• Expect scrubbed custom header values in e2e by @​TerryHowe in #​2133
• Dependency bumps: sirupsen/logrus 1.9.4 → 1.10.1 (#​2130, #​2138), onsi/ginkgo/v2 2.32.1 in /test/e2e (#​2129), library/golang 1.26.5 → 1.27.0-alpine (#​2134, #​2139), and grouped GitHub Actions updates (#​2115, #​2116, #​2117, #​2120, #​2122, #​2124, #​2128, #​2135, #​2140)

New Contributors

• @​renshao made their first contribution in #​2061
• @​vigneshakaviki made their first contribution in #​2123
• @​harshasiddartha made their first contribution in #​2126
• @​subotac made their first contribution in #​2127
• @​sooraj-sky made their first contribution in #​2137

Full Changelog: oras-project/oras@v1.3.3...v1.3.4

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.