build(deps): bump oras.land/oras-go/v2 from 2.0.1 to 2.0.2 #5769
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) from 2.0.1 to 2.0.2. - [Release notes](https://github.com/oras-project/oras-go/releases) - [Commits](oras-project/oras-go@v2.0.1...v2.0.2) --- updated-dependencies: - dependency-name: oras.land/oras-go/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
dependabot
bot
deleted the
dependabot/go_modules/oras.land/oras-go/v2-2.0.2
branch
|
I see an error in |
|
Hi @yuseferi 👋 I'm not sure I follow :) Is there a linter warning emitted from their repo? The |
|
I'm also experiencing this issue. I've just upgraded from v0.49.0 to v.0.52.0 to resolve some vulns related to the previous docker dependency. $ go install -mod vendor ./vendor/github.com/open-policy-agent/opa
# oras.land/oras-go/v2/internal/descriptor
vendor/oras.land/oras-go/v2/internal/descriptor/descriptor.go:73:11: undefined: ocispec.MediaTypeArtifactManifest |
|
Thanks! @ashutosh-narkar / @johanfylling could one of you PTAL? |
|
Looks like this issue has been addressed upstream: oras-project/oras-go#495. Do we need to wait for a point release from that project before OPA will re-vendor it? |
|
Yes once a new release is created, OPA will re-vendor it. |
|
@ashutosh-narkar it looks like v2.1.0 has been released: https://github.com/oras-project/oras-go/releases |
|
Disregard. Looks like it has already landed in OPA: #5904 🎉 |
|
Nice. now we just need a release in OPA :). Thank you guys |
|
Hey guys, just due to update blocked on this, what the release plan for this? |
Bumps oras.land/oras-go/v2 from 2.0.1 to 2.0.2.
Release notes
Sourced from oras.land/oras-go/v2's releases.
Commits
336b9fbfix: refactor tagging implementation for OCI Store (#462)0c6633bchore: update owners (#459)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot will merge this PR once CI passes on it, as requested by @srenatus.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)