[updateclibot]

deps(go): bump module oras.land/oras-go/v2

clean: go mod tidy

ran shell command "go mod tidy"

deps(go): bump module oras.land/oras-go/v2 to v2.7.0

go.mod updated Module path "oras.land/oras-go/v2" version from "v2.6.4" to "v2.7.0"

v2.7.0

This is a minor release that adds a configurable bearer realm address denylist to the auth client to restore split-host internal registry compatibility, restores authentication after same-host HTTP-to-HTTPS redirects, and backports bug fixes to content copy and verification since v2.6.4.

## New Features

- Add `auth.Client.BlockedRealmPrefixes`, `auth.DefaultBlockedRealmPrefixes()`, and `auth.PrivateRealmPrefixes()` to configure which addresses a bearer realm host must not be, or resolve to. A nil list uses the defaults, an empty non-nil list disables address blocking, and a non-empty list is used exactly. IPv4 addresses embedded in IPv4-mapped, NAT64, and 6to4 IPv6 addresses are unwrapped before matching. The scheme check and the https-to-http downgrade check always apply (#1633, #1658)

## Behavior Change

- v2.6.4 rejected bearer realms on private addresses, breaking split-host deployments such as self-hosted GitLab where the token realm is on another internal host (#1631). The default denylist blocks loopback, link-local, link-local multicast, unspecified, and cloud metadata addresses, and **no longer blocks RFC 1918, IPv6 unique-local (fc00::/7), or carrier-grade NAT (100.64.0.0/10) addresses**. To restore the v2.6.4 strict behavior, set `BlockedRealmPrefixes: append(auth.DefaultBlockedRealmPrefixes(), auth.PrivateRealmPrefixes()...)` (#1658)

## Bug Fixes

- Authenticate after a same-host redirect from the standard HTTP port to the standard HTTPS port, which the v2.6.1 origin check had blocked. The redirect chain is validated, authentication is not reused across repositories, and an insecure HTTP token realm is rejected after the upgrade (#1245, #1666, #1667)
- Match a referrer image manifest's `artifactType` before its config media type in `FilterArtifactType`, so referrers with an empty config are no longer skipped for OCI layouts and `memory.Store` sources (#1641, #1643)
- Fetch an image index when the predecessor descriptor omits `artifactType` and match `FilterArtifactType` against the index's `artifactType` (#1645, #1654)
- Report a source that fails after all declared bytes as `read failed: <cause>`, matchable with `errors.Is`, instead of `ErrTrailingData` (#1649, #1655)
- Skip a blob when `PreCopy` returns `SkipNode` after the registry declines a cross-repository mount, instead of failing the copy with "skip node" (#1646, #1656)

v2.6.4

This is a patch release with security fixes to the file store and auth client, and bug fixes to the file store, OCI store, and retry layers since v2.6.3.

## Security Fixes

- Remove a symlink at the target path before writing in the file store's `pushFile` and `pushDir`, and open files with `O_NOFOLLOW` on unix, so a pushed blob can no longer be written through a planted terminal symlink to a file outside the store root (GHSA-2hhj-vj64-hx3j)
- Skip restoring times and mode on symlinks during tar extraction, and replace a symlink at a directory entry's path with a real directory, so a crafted unpack layer can no longer change the timestamps or permissions of files outside the store root (GHSA-jh75-xv39-vhvx)
- Compare each redirect hop against the first request in `auth.Client`, so a second same-origin hop on the redirect target no longer restores the `Authorization` header removed by the GHSA-vh4v-2xq2-g5cg guard, and refuse to resend an OAuth2 token request body (password or refresh token) to another origin on a 307 or 308 (GHSA-xc97-9f2f-9hrx)
- Resolve non-literal bearer realm hosts and reject realms resolving to loopback, link-local, private, unspecified, or carrier-grade NAT addresses, and re-validate every redirect hop of distribution and OAuth2 token requests, so a realm such as `localhost` or a DNS name pointing at an internal address no longer bypasses `validateRealm` (GHSA-mm27-wq9c-mxxr)

## Bug Fixes

- Resolve tar hard link targets from the archive root rather than the link's directory, so a hard link whose target sits in another directory extracts instead of failing with "no such file or directory" (#1510, #1572)
- Skip digest-named directories under `blobs/<alg>/` during OCI store `GC`, which previously aborted on a non-empty directory; `os.Remove` errors now include the blob path (#1526, #1579, #1588)
- Retry on connection reset by peer and unexpected EOF in `retry.DefaultPredicate`, so a single reset from a registry no longer fails the whole operation (#1567, #1570)

GitHub Action workflow link

---

Created automatically by Updatecli Options: Most of Updatecli configuration is done via its manifest(s). If you close this pull request, Updatecli will automatically reopen it, the next time it runs. If you close this pull request and delete the base branch, Updatecli will automatically recreate it, erasing all previous commits made. Feel free to report any issues at github.com/updatecli/updatecli. If you find this tool useful, do not hesitate to star our GitHub repository as a sign of appreciation, and/or to tell us directly on our chat!

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5a6067ca-e9f2-47b3-ba77-bd7298e68167

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn