Skip to content

oras

v1.3.3 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 16d Artifact Management
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

docker containers registry storage

Affected surfaces

rce_ssrf deps

ReleasePort's take

Moderate signal
editorial:auto 11d

The oras-go dependency was upgraded to v2.6.2, fixing a path‑traversal vulnerability (GHSA-fxhp-mv3v-67qp).

Why it matters: Severity 90 GHSA‑fxhp‑mv3v‑67qp tar‑extraction path‑traversal flaw resolved by upgrading oras-go to v2.6.2.

Summary

AI summary

Updates 🐛 Bug Fixes, Highlights, and ✨ Features across a mixed release.

Changes in this release

Security Critical

Upgraded oras-go to v2.6.2, fixing tar‑extraction path‑traversal vulnerability GHSA-fxhp-mv3v-67qp.

Upgraded oras-go to v2.6.2, fixing tar‑extraction path‑traversal vulnerability GHSA-fxhp-mv3v-67qp.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Security Low

Added static security scanning (gosec) to CI and resolved findings G703, G117, G704.

Added static security scanning (gosec) to CI and resolved findings G703, G117, G704.

Source: llm_adapter@2026-07-15

Confidence: low

 —
Security Low

Pinned GitHub Actions to specific commit SHAs for supply‑chain hardening.

Pinned GitHub Actions to specific commit SHAs for supply‑chain hardening.

Source: llm_adapter@2026-07-15

Confidence: low

 —
Feature Medium

`oras attach` now supports the `--config` flag.

`oras attach` now supports the `--config` flag.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

`oras attach` passes `--annotation $config:*` values to the packed manifest.

`oras attach` passes `--annotation $config:*` values to the packed manifest.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Allow setting `org.opencontainers.image.title` annotation via file.

Allow setting `org.opencontainers.image.title` annotation via file.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Dependency Medium

Migrated from unmaintained gopkg.in/yaml.v3 to go.yaml.in/yaml/v4.

Migrated from unmaintained gopkg.in/yaml.v3 to go.yaml.in/yaml/v4.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Dependency Low

Upgraded Go runtime to version 1.25.7.

Upgraded Go runtime to version 1.25.7.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

`cp` no longer mounts when source and destination credentials differ.

`cp` no longer mounts when source and destination credentials differ.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

`cp` falls back to blob upload when a cross‑repo mount fails.

`cp` falls back to blob upload when a cross‑repo mount fails.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Full changelog

ORAS CLI v1.3.3 is a maintenance release focused on security hardening, dependency updates, and a few user-facing improvements to oras attach.

Highlights

  • 🔒 Security: upgraded oras-go to v2.6.2, which addresses a tar-extraction path-traversal advisory (GHSA-fxhp-mv3v-67qp) affecting hardlink entries during pull/extract.
  • ✨ oras attach gains --config support, and --annotation $config:* values now flow through to the packed manifest.
  • 🛡️ Supply-chain hardening: GitHub Actions are now pinned to commit SHAs, SBOMs are attached to release artifacts, and static security scanning (gosec) runs in CI.
  • 🐛 Copy/mount fixes: no longer mounts when source and destination credentials differ, and falls back to blob upload when a cross-repo mount fails.

✨ Features

  • Add --config flag support for oras attach by @ogulcanaydogan in #2000
  • Pass --annotation $config:* through to PackManifestOptions for attach by @SAY-5 in #2037
  • Allow setting org.opencontainers.image.title in the annotation file by @rafaelgieschke in #1872
  • Add SBOMs to the release workflow by @bupd in #1940

🐛 Bug Fixes

  • cp should not mount when source and destination credentials differ by @wangxiaoxuan273 in #1903
  • Fall back to blob upload when cross-repo mount fails by @bupd in #1924
  • Redact password values from e2e test execution logs by @TerryHowe in #2042
  • Revert Alpine base image to fix multi-arch build by @bupd in #1933
  • Set GOTOOLCHAIN=local in snapcraft.yaml to prevent auto-download by @TerryHowe in #2012
  • Fix typo in logEntrySeparator const by @Ahmad-Faraj in #2087

🔒 Security

  • Bump oras.land/oras-go/v2 to 2.6.2 (addresses GHSA-fxhp-mv3v-67qp) by @dependabot in #2105, #2106
  • Add static security scanning (gosec) to CI by @bupd in #1934; resolve gosec findings (G703, G117, G704) by @TerryHowe in #1985
  • Pin GitHub Actions to commit SHAs by @TerryHowe in #2016; pin to full version comments by @alliasgher in #2038
  • Add golangci-lint configuration with additional linters by @bupd in #1936

📖 Documentation

  • Add examples to the logout command help text by @ogulcanaydogan in #2079
  • Add multi-repository backup and restore proposal by @shizhMSFT in #1917

🧰 Maintenance

  • Upgrade to Go 1.25.7 by @TerryHowe / @adriansali in #1980, #1910
  • Migrate from unmaintained gopkg.in/yaml.v3 to go.yaml.in/yaml/v4 by @bupd in #1922
  • Add goheader (license headers) and revive linters, plus gofmt/go modernize passes
  • ~110 dependency updates across Go modules, Docker base images, and GitHub Actions via Dependabot

New Contributors

  • @rafaelgieschke made their first contribution in #1872
  • @ManishhDev made their first contribution in #1883
  • @johnsonshi made their first contribution in #1889
  • @vr-varad made their first contribution in #1898
  • @adriansali made their first contribution in #1910
  • @bupd made their first contribution in #1933
  • @alliasgher made their first contribution in #2038
  • @ogulcanaydogan made their first contribution in #2000
  • @bimakw made their first contribution in #1950
  • @SAY-5 made their first contribution in #2037
  • @gaoflow made their first contribution in #2093
  • @Ahmad-Faraj made their first contribution in #2087

Full Changelog: https://github.com/oras-project/oras/compare/v1.3.2...v1.3.3

Security Fixes

  • GHSA-fxhp-mv3v-67qp — upgraded oras-go to v2.6.2 addresses tar‑extraction path‑traversal advisory affecting hardlink entries during pull/extract
  • Added static security scanning (gosec) in CI and resolved gosec findings G703, G117, G704
  • Pinned GitHub Actions to commit SHAs for supply‑chain hardening
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track oras

Get notified when new releases ship.

Sign up free

About oras

OCI registry client - managing content like artifacts, images, packages

All releases →

Related context

Beta — feedback welcome: [email protected]