fix(deps): update module github.com/open-component-model/ocm to v0.18.0

[gardener-ci-robot]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
github.com/open-component-model/ocm	require	minor	v0.11.0 -> v0.18.0

---

Release Notes

open-component-model/ocm (github.com/open-component-model/ocm)

v0.18.0

Compare Source

Release v0.18.0

• change short text for help topic (#​1058)
• bug: allow http protocol for oci access (#​1060)
• bug: fix unmarshal consumer identity with empty value (#​1057)
• fix artifact set tagging (#​1033)
• component constructor with references field (#​1054)
• priority for CLI registration options (#​1045)
• chore: update 'flake.nix' (#​1049)
• add action doc (#​1032)
• chore: update 'flake.nix' (#​1040)
• chore: update 'flake.nix' (#​1039)
• fix downloader handling (#​1031)
• Adjust README with rotated GPG key (#​1025)

🐛 Bug Fixes

• [release-v0.18.0] fix: version info for OCI refs (#​1080)
• fix: set tlskyber=0 (#​1047)
• fix: remove ocm release key if present (#​1024)
• chore: release fallout corrections (#​1023)

🧰 Maintenance

8 changes

• chore: force bump to 0.18.0-dev (#​1061)
• chore: reuse aggregation from ctf during component build (#​1044)
• chore: disable runner cache for release note drafter (#​1051)
• chore: enhance the publishing to other repositories then github (#​1028)
• chore: migrate all component builds: ca => ctf (#​1043)
• chore(ci): various optimizations for build processing, caching and concurrency (#​996)
• fix: remove ocm release key if present (#​1024)
• chore: release fallout corrections (#​1023)

⬆️ Dependencies

4 changes

• chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 in the go_modules group (#​1048)
• chore(deps): bump github.com/containerd/errdefs from 0.3.0 to 1.0.0 (#​1037)
• chore(deps): bump the ci group with 2 updates (#​1038)
• chore(deps): bump the go group with 8 updates (#​1036)

v0.17.0

Compare Source

Release v0.17.0

• !OCI Annotations change in Component Descriptor for Component Versions: `ocm-artifact` -> `software.ocm.artifact` and introduce `software.ocm.creator` (#​987)
• Introduce update state on CV implementation API (#​976)

🐛 Bug Fixes

• Revert "feat: replace docker with oras (#<!---->904)" (#​1005)
• fix!(release): retract 0.16.0-z (#​1006)

Documentation

• documentation: fix uploader documentation (#​991)
• documentation: Update the installation options (#​979)
• chore: fixes for docu + cleanup test leftovers (#​993)

🧰 Maintenance

8 changes

• Fix/publish release (#​1001)
• chore: reduce cache pressure by early deleting cache entries after PR closure (#​986)
• chore: update 'flake.nix' (#​1012)
• chore(release): also call make generate to update files (#​992)
• chore(ci): remove i386, optimize latest build and add various comments (#​1010)
• chore(ci): use reusable stale bot configuration (#​1008)
• chore(ci): add stale bot for issues (#​1002)
• chore(ci): make sure we use candidates and branches by default (#​1004)

⬆️ Dependencies

3 changes

• Upgrade levenshtein dependency (#​1009)
• chore(deps): bump the go group with 5 updates (#​989)
• chore(deps): bump anchore/sbom-action from 0.17.3 to 0.17.4 in the ci group (#​988)

v0.16.2

Compare Source

Release v0.16.2

WARNING: We are receiving reports of Slowness and missing layers in the OCM library handling OCI Images (see https://github.com/open-component-model/ocm-project/issues/293 for Details). Until this is resolved, please hold back on a potential upgrade. We are working on resolving the issue. Please refer to v0.15 for now

• chore: update readme (#​985)

v0.16.1

Compare Source

Release v0.16.1

WARNING: We are receiving reports of Slowness and missing layers in the OCM library handling OCI Images (see https://github.com/open-component-model/ocm-project/issues/293 for Details). Until this is resolved, please hold back on a potential upgrade. We are working on resolving the issue. Please refer to v0.15 for now

• fix: wrap the TLS config into a retryer client (#<!---->968) (#​983)

v0.16.0

Compare Source

Release v0.16.0

WARNING: We are receiving reports of Slowness and missing layers in the OCM library handling OCI Images (see https://github.com/open-component-model/ocm-project/issues/293 for Details). Until this is resolved, please hold back on a potential upgrade. We are working on resolving the issue.

• Support standard object types for command plugins + options for templater types (#​958)
• feat: add function to satisfy accessMethodView interface (#​955)
• CLI: fix recursive mode for ocm hash component (#​954)
• OCI: prefer digest over tag (#​953)
• fix: docker registry returning internal server error on blobs not found (#​950)
• fix + doc for VerifyResourceDigest (#​946)
• Adjust verify digest again (#​945)
• Add a simpler digest verify function (#​943)
• [chore] fix: publish release (#​940)
• Fix/publish release (#​939)
• feat: replace docker with oras (#​904)
• feat: add gav matching and overwritable mediatype for file types (#​932)
• fix: some weird maven repositories do return bad index-of listings (#​938)
• Release process documentation (#​931)
• some fixes and alignments (#​934)
• Update CODEOWNERS (#​933)
• fix busy text file during plugin installation (#​929)
• Custom Unmarshaler for Consumer Identity (#​927)
• Documentation: `If the option ...` (#​928)
• feat: automatically label all issues with ipcei (#​923)

🐛 Bug Fixes

• [chore]: release-notes-url isn't supported by wingetcreate v1.6.1.0 (#​948)
• [chore]: Install wingetcreate (#​942)

⬆️ Dependencies

5 changes

• chore(deps): bump the ci group across 1 directory with 3 updates (#​957)
• Bump the go group with 7 updates (#​941)
• Bump the go group with 9 updates (#​936)
• Bump the go group with 13 updates (#​925)
• Bump DeterminateSystems/nix-installer-action from 13 to 14 in the ci group (#​926)

v0.15.0

Compare Source

Release v0.15.0

• Update check_diff_action.yaml (#​924)
• fix: default component download link (#​920)
• extend signing list component descriptors (#​922)
• small change to test github actions (#​921)
• feat: remove deprecated code - v2 (#​919)
• move identity packages into tech packages (#​914)
• mega fix for new selector handling + accessor interface alignment + tests (#​918)
• chore: fixup validate usage context passage (#​912)
• fix: runner caching code that it uses (#​917)
• Revert "feat: remove deprecated functions" (#​916)
• feat: remove deprecated functions (#​915)
• chore: nightly build (#​903)
• docu: remove some command crosslinks (#​895)
• Add cv parameter to walking step function (#​909)
• release branch creation workflow (#​899)
• Add utilities for ocm controllers (#​898)
• Chore: setup-go@<!---->v4 does caching automatically (#​908)
• chore: publish latest release to different package registries (#​897)
• fix npm input (#​900)
• feedback from migrating a project (#​907)
• access method ocm (#​896)
• annotate oci layers with component information (#​882)
• align package names with folder names (#​906)
• add extended description and remove archlinux (#​901)
• chore: always create a new release branch and delete all old ones during new release action (#​894)
• chore: change release notes template, auto label PRs, ... (#​893)

🚀 Features

• Resource resolution on CD set (#​865)

⬆️ Dependencies

4 changes

• Bump the go group with 10 updates (#​910)
• Bump the go group with 11 updates (#​905)
• Bump the go group with 7 updates (#​892)
• Bump anchore/sbom-action from 0.17.1 to 0.17.2 in the ci group (#​891)

v0.14.0

Compare Source

Release v0.14.0

• move migrate tooling to 'hack' folder (#​889)
• feat: add npm input type (#​886)
• Validate method for oci/ocm repository specs (#​866)
• add public GPG key that can be used for signing (#​884)
• disable manual/secondary caching (#​885)
• Add linux packages to goreleaser (#​888)
• raise alpine version (#​883)
• fix: typo + missing bin directory (#​880)
• Verify/markdown (#​871)
• Bump the go group with 16 updates (#​878)
• more path mappings (#​877)
• ignore status error for reading pubsub config (#​873)
• introduce optional repository interface for resolvers (#​867)
• Bump anchore/sbom-action from 0.17.0 to 0.17.1 in the ci group (#​875)
• fix cli docu generation (#​876)
• Adjust workflow: check diff (#​874)
• Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 in the ci group (#​868)
• Bump the go group with 15 updates (#​870)
• Package restructuring (#​784)

v0.13.0

Compare Source

Release v0.13.0

• fix goreleaser (#​863)
• feat: add check for diffs after go mod tidy and generate (#​861)
• Typo (#​860)
• Bump the go group across 1 directory with 26 updates (#​854)
• feat: remove GetInexpensiveContentVersionIdentity (#​845)
• Bump the ci group across 1 directory with 5 updates (#​853)
• add changes for multi-arch (#​851)
• Bump github.com/docker/docker from 27.0.1+incompatible to 27.1.0+incompatible in the go_modules group (#​857)
• Improve errors (#​850)
• rework selectors (#​858)
• Rework adding elements to a component version (#​844)
• Add AUR as installation option for OCM-CLI (#​855)
• extension point for pub/sub support (#​832)
• cleanup json schemes (#​840)
• Exchange Algorithm constant in polymorphic handler method (#​852)
• forward error message from OCI registry (#​848)

This is the last release using the module name github.com/open-component-model/ocm. The next releases
will use the new module name ocm.software/ocm. Additionally the package structure of the new module will change.
You can use the migration script provided by the next release to migrate your project to the new module and structure.

v0.12.1

Compare Source

v0.12.0

Compare Source

Release v0.12.0

• Extend version regexp to support semver (#​834)
• fix broken links (#​837)
• fix duplicate command argument for plugin command execution (#​831)
• fix plugin error propagation (#​830)
• rework source info access for plugin clients (#​829)
• Bump github.com/hashicorp/go-retryablehttp from 0.7.6 to 0.7.7 in the go_modules group (#​827)
• Support for CLI Extensions by OCM Plugins (#​815)
• Bump github.com/docker/docker from 26.1.4+incompatible to 27.0.0+incompatible (#​817)
• cleanup unused (#​828)
• close() writer, before trying to rename (#​824)
• enhance the auto update of the flake vendor hash (#​826)
• Bump the go group with 7 updates (#​825)
• Update README.md (#​822)
• fix https://github.com/open-component-model/ocm-project/issues/196 (#​819)
• Bump the go group with 8 updates (#​816)
• Fix make cmds (#​810)
• Adjust action (#​813)
• adjust github action definition (#​811)
• restruct blobaccess (#​804)
• auto update `flake.nix` vendor hash incl. singed commit (#​809)
• Simplify Pull Request Template (#​808)

---

Configuration

📅 Schedule: Branch creation - "after 07:30am,before 07:15pm,every weekday" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[gardener-ci-robot]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: github.com/open-component-model/ocm@v0.18.0: parsing go.mod:
	module declares its path as: ocm.software/ocm
	        but was required as: github.com/open-component-model/ocm

[gardener-robot]

@gardener-ci-robot Thank you for your contribution.

[guewa]

deleted useless comment