یہ پرانا ورژن ہے۔ موجودہ ورژن 1.3.6 ہے۔ ORAS CLI 1.3.6 · تاریخِ اجرا:
انسٹالر فائلیں 1.3.3
| آرکیٹیکچر | قسم | دائرہ | فائل کا سائز | ڈاؤن لوڈ | SHA256 |
|---|---|---|---|---|---|
| 64 بٹ | ZIP → پورٹیبل | — | — | github.com | VirusTotal |
لنک اور SHA256 Windows Package Manager کے کمیونٹی مینی فیسٹ سے لیے گئے ہیں۔ ڈاؤن لوڈ شدہ فائل چلانے سے پہلے اس کا ہیش ملا لیں۔
ریلیز نوٹس
ORAS CLI v1.3.3 is a maintenance release focused on security hardening, dependency updates, and a few user-facing improvements to `oras attach`.
## Highlights
🔒 **Security:** upgraded `oras-go` to **v2.6.2**, which addresses a tar-extraction path-traversal advisory ([GHSA-fxhp-mv3v-67qp](https://github.com/advisories/GHSA-fxhp-mv3v-67qp)) affecting hardlink entries during `pull`/extract.
✨ **`oras attach` gains `--config`** support, and `--annotation $config:*` values now flow through to the packed manifest.
🛡️ **Supply-chain hardening:** GitHub Actions are now pinned to commit SHAs, SBOMs are attached to release artifacts, and static security scanning (gosec) runs in CI.
🐛 Copy/mount fixes: no longer mounts when source and destination credentials differ, and falls back to blob upload when a cross-repo mount fails.
## ✨ Features
Add `--config` flag support for `oras attach` by @ogulcanaydogan in #2000
Pass `--annotation $config:*` through to `PackManifestOptions` for `attach` by @SAY-5 in #2037
Allow setting `org.opencontainers.image.title` in the annotation file by @rafaelgieschke in #1872
Add SBOMs to the release workflow by @bupd in #1940
## 🐛 Bug Fixes
`cp` should not mount when source and destination credentials differ by @wangxiaoxuan273 in #1903
Fall back to blob upload when cross-repo mount fails by @bupd in #1924
Redact password values from e2e test execution logs by @TerryHowe in #2042
Revert Alpine base image to fix multi-arch build by @bupd in #1933
Set `GOTOOLCHAIN=local` in `snapcraft.yaml` to prevent auto-download by @TerryHowe in #2012
Fix typo in `logEntrySeparator` const by @Ahmad-Faraj in #2087
## 🔒 Security
Bump `oras.land/oras-go/v2` to **2.6.2** (addresses GHSA-fxhp-mv3v-67qp) by @dependabot in #2105, #2106
Add static security scanning (gosec) to CI by @bupd in #1934; resolve gosec findings (G703, G117, G704) by @TerryHowe in #1985
Pin GitHub Actions to commit SHAs by @TerryHowe in #2016; pin to full version comments by @alliasgher in #2038
Add `golangci-lint` configuration with additional linters by @bupd in #1936
## 📖 Documentation
Add examples to the `logout` command help text by @ogulcanaydogan in #2079
Add multi-repository backup and restore proposal by @shizhMSFT in #1917
## 🧰 Maintenance
Upgrade to Go 1.25.7 by @TerryHowe / @adriansali in #1980, #1910
Migrate from unmaintained `gopkg.in/yaml.v3` to `go.yaml.in/yaml/v4` by @bupd in #1922
Add `goheader` (license headers) and `revive` linters, plus `gofmt`/`go modernize` passes
~110 dependency updates across Go modules, Docker base images, and GitHub Actions via Dependabot
## New Contributors
* @rafaelgieschke made their first contribution in #1872
* @ManishhDev made their first contribution in #1883
* @johnsonshi made their first contribution in #1889
* @vr-varad made their first contribution in #1898
* @adriansali made their first contribution in #1910
* @bupd made their first contribution in #1933
* @alliasgher made their first contribution in #2038
* @ogulcanaydogan made their first contribution in #2000
* @bimakw made their first contribution in #1950
* @SAY-5 made their first contribution in #2037
* @gaoflow made their first contribution in #2093
* @Ahmad-Faraj made their first contribution in #2087
**Full Changelog**: https://github.com/oras-project/oras/compare/v1.3.2...v1.3.3
