chore(deps): update dependency oras-project/oras to v1.3.3

[bootc-bot]

This PR contains the following updates:

Package	Update	Change
oras-project/oras	patch	1.3.2 → 1.3.3

---

Release Notes

oras-project/oras (oras-project/oras)

v1.3.3

Compare Source

ORAS CLI v1.3.3 is a maintenance release focused on security hardening, dependency updates, and a few user-facing improvements to oras attach.

Highlights

• 🔒 Security: upgraded oras-go to v2.6.2, which addresses a tar-extraction path-traversal advisory (GHSA-fxhp-mv3v-67qp) affecting hardlink entries during pull/extract.
• ✨ oras attach gains --config support, and --annotation $config:* values now flow through to the packed manifest.
• 🛡️ Supply-chain hardening: GitHub Actions are now pinned to commit SHAs, SBOMs are attached to release artifacts, and static security scanning (gosec) runs in CI.
• 🐛 Copy/mount fixes: no longer mounts when source and destination credentials differ, and falls back to blob upload when a cross-repo mount fails.

✨ Features

• Add --config flag support for oras attach by @​ogulcanaydogan in #​2000
• Pass --annotation $config:* through to PackManifestOptions for attach by @​SAY-5 in #​2037
• Allow setting org.opencontainers.image.title in the annotation file by @​rafaelgieschke in #​1872
• Add SBOMs to the release workflow by @​bupd in #​1940

🐛 Bug Fixes

• cp should not mount when source and destination credentials differ by @​wangxiaoxuan273 in #​1903
• Fall back to blob upload when cross-repo mount fails by @​bupd in #​1924
• Redact password values from e2e test execution logs by @​TerryHowe in #​2042
• Revert Alpine base image to fix multi-arch build by @​bupd in #​1933
• Set GOTOOLCHAIN=local in snapcraft.yaml to prevent auto-download by @​TerryHowe in #​2012
• Fix typo in logEntrySeparator const by @​Ahmad-Faraj in #​2087

🔒 Security

• Bump oras.land/oras-go/v2 to 2.6.2 (addresses GHSA-fxhp-mv3v-67qp) by @​dependabot in #​2105, #​2106
• Add static security scanning (gosec) to CI by @​bupd in #​1934; resolve gosec findings (G703, G117, G704) by @​TerryHowe in #​1985
• Pin GitHub Actions to commit SHAs by @​TerryHowe in #​2016; pin to full version comments by @​alliasgher in #​2038
• Add golangci-lint configuration with additional linters by @​bupd in #​1936

📖 Documentation

• Add examples to the logout command help text by @​ogulcanaydogan in #​2079
• Add multi-repository backup and restore proposal by @​shizhMSFT in #​1917

🧰 Maintenance

• Upgrade to Go 1.25.7 by @​TerryHowe / @​adriansali in #​1980, #​1910
• Migrate from unmaintained gopkg.in/yaml.v3 to go.yaml.in/yaml/v4 by @​bupd in #​1922
• Add goheader (license headers) and revive linters, plus gofmt/go modernize passes
• ~110 dependency updates across Go modules, Docker base images, and GitHub Actions via Dependabot

New Contributors

• @​rafaelgieschke made their first contribution in #​1872
• @​ManishhDev made their first contribution in #​1883
• @​johnsonshi made their first contribution in #​1889
• @​vr-varad made their first contribution in #​1898
• @​adriansali made their first contribution in #​1910
• @​bupd made their first contribution in #​1933
• @​alliasgher made their first contribution in #​2038
• @​ogulcanaydogan made their first contribution in #​2000
• @​bimakw made their first contribution in #​1950
• @​SAY-5 made their first contribution in #​2037
• @​gaoflow made their first contribution in #​2093
• @​Ahmad-Faraj made their first contribution in #​2087

Full Changelog: oras-project/oras@v1.3.2...v1.3.3

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.