[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
oras.land/oras-go/v2	v2.6.4 → v2.7.0

---

Release Notes

oras-project/oras-go (oras.land/oras-go/v2)

v2.7.0

Compare Source

This is a minor release that adds a configurable bearer realm address denylist to the auth client to restore split-host internal registry compatibility, restores authentication after same-host HTTP-to-HTTPS redirects, and backports bug fixes to content copy and verification since v2.6.4.

New Features

• Add auth.Client.BlockedRealmPrefixes, auth.DefaultBlockedRealmPrefixes(), and auth.PrivateRealmPrefixes() to configure which addresses a bearer realm host must not be, or resolve to. A nil list uses the defaults, an empty non-nil list disables address blocking, and a non-empty list is used exactly. IPv4 addresses embedded in IPv4-mapped, NAT64, and 6to4 IPv6 addresses are unwrapped before matching. The scheme check and the https-to-http downgrade check always apply (#​1633, #​1658)

Behavior Change

• v2.6.4 rejected bearer realms on private addresses, breaking split-host deployments such as self-hosted GitLab where the token realm is on another internal host (#​1631). The default denylist blocks loopback, link-local, link-local multicast, unspecified, and cloud metadata addresses, and no longer blocks RFC 1918, IPv6 unique-local (fc00::/7), or carrier-grade NAT (100.64.0.0/10) addresses. To restore the v2.6.4 strict behavior, set BlockedRealmPrefixes: append(auth.DefaultBlockedRealmPrefixes(), auth.PrivateRealmPrefixes()...) (#​1658)

Bug Fixes

• Authenticate after a same-host redirect from the standard HTTP port to the standard HTTPS port, which the v2.6.1 origin check had blocked. The redirect chain is validated, authentication is not reused across repositories, and an insecure HTTP token realm is rejected after the upgrade (#​1245, #​1666, #​1667)
• Match a referrer image manifest's artifactType before its config media type in FilterArtifactType, so referrers with an empty config are no longer skipped for OCI layouts and memory.Store sources (#​1641, #​1643)
• Fetch an image index when the predecessor descriptor omits artifactType and match FilterArtifactType against the index's artifactType (#​1645, #​1654)
• Report a source that fails after all declared bytes as read failed: <cause>, matchable with errors.Is, instead of ErrTrailingData (#​1649, #​1655)
• Skip a blob when PreCopy returns SkipNode after the registry declines a cross-repository mount, instead of failing the copy with "skip node" (#​1646, #​1656)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.