chore(deps): Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2

[dependabot]

Bumps oras.land/oras-go/v2 from 2.6.1 to 2.6.2.

Release notes

Sourced from oras.land/oras-go/v2's releases.

v2.6.2

This is a security patch release addressing advisories in the content and remote layers, plus additional hardening and bug fixes since v2.6.1.

Security Fixes

• Resolve the hardlink (TypeLink) target before passing it to os.Link, preventing a crafted OCI artifact from hardlinking a file outside the extraction directory via the process CWD (#1232, GHSA-fxhp-mv3v-67qp / CVE-2026-50163)
• Bound tag and referrer list pagination to prevent a malicious or misbehaving registry from advertising an endless page chain and forcing unbounded client requests (client-side DoS) (#1215)

Bug Fixes

• Bound content.ReadAll allocation by actual content read rather than the descriptor size, correcting the over-broad 32 MiB cap introduced for GHSA-f36w-mj3v-6jqv so legitimate in-memory Push/FetchAll/FetchBytes are not rejected (#1223)

Other Changes

• Bump golang.org/x/sync from 0.20.0 to 0.21.0 (#1208)

Commits

• 105715e release: v2.6.2 (#1235)
• 31da196 Merge commit from fork
• adab2f2 Merge commit from fork
• 948a1dc build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 (#1242)
• c463c65 fix: prevent hardlink path traversal via process CWD (GHSA-fxhp-mv3v-67qp) (#...
• 91c04ab fix(content): bound ReadAll allocation by content, not descriptor size (#1223)
• 314e836 fix: bound tag and referrer list pagination to prevent unbounded requests (#1...
• 122e88f build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 (#1208)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[swirlds-automation]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[alex-au]

🤖 Dependabot review — no concerns

Reviewed the diff for oras.land/oras-go/v2: v2.6.1 → v2.6.2 (Go non-vendored, indirect dependency).

This is an upstream security patch release. Reachability here is pkg/helm → helm.sh/helm/v3/pkg/registry → oras.land/oras-go/v2, i.e. it is on the OCI-registry path used for Helm chart pulls, so the fixes below are relevant rather than theoretical.

Checks performed:

• ✅ Diff scoped to expected files — go.mod (+1/-1) and go.sum (+2/-2) only; nothing under application source, workflows, or CI config
• ✅ Head branch is dependabot/go_modules/oras.land/oras-go/v2-2.6.2, author is dependabot[bot]
• ✅ go mod verify — all modules verified; go.sum hashes match the proxy
• ✅ No transitive fan-out — oras-go bumps its own golang.org/x/sync to v0.22.0, which this repo already requires, hence the minimal 2-line go.sum change
• ✅ No install/build hooks, no //go:generate, no //go:embed, no CGo (import "C"), no unsafe, no runtime.SetFinalizer
• ✅ No new init() functions (zero in both versions) — no import-time side effects
• ✅ No new process spawning or network dialing; os/exec file count unchanged (3 → 3), exec.Command unchanged (1 → 1)
• ✅ No credential access, no writes outside the package, no new telemetry/beacon URLs
• ✅ No obfuscated payloads — no base64 blobs >200 chars, no bidi/zero-width characters, no non-ASCII at all in the patch
• ✅ No files added or removed between the two module versions
• ✅ Upstream compare v2.6.1...v2.6.2 matches the module-cache diff exactly: 8 commits, 12 files, +441/-21
• ✅ All 8 upstream commits are signature-verified, authored by TerryHowe (oras-project maintainer) and dependabot[bot]
• ✅ Tag v2.6.2 is a lightweight tag resolving to 105715ee12eac6895ec736a075285c34d9f2eeb6, the tip of the compare — the tag was not moved (last commit 14:50Z, release published 16:30Z the same day)
• ✅ All 20 CI checks currently green on this PR

What actually changed (all four are defensive hardening):

1. content/file/utils.go — symlink-chain bypass in tar extraction (GHSA-m37j-52j7-pjw7, high). Re-verifies containment with symlinks resolved before touching the filesystem, resolves relative hardlink targets against the entry's directory instead of the process CWD, and unlinks a pre-existing symlink before writeFile opens the path.
2. registry/remote/utils.go — blind SSRF via the registry-controlled Link header (GHSA-h7vf-4x9w-h99v, medium). Pagination is now constrained to the same origin (scheme + host + default-aware port) as the originating request.
3. registry/remote/repository.go — new TagListMaxPages / ReferrerListMaxPages bounds so a misbehaving registry cannot advertise an endless page chain (client-side DoS). New sentinel errdef.ErrTooManyPages.
4. content/reader.go — ReadAll no longer pre-allocates make([]byte, desc.Size) from the attacker-controllable descriptor size (a forged 2^62 panics makeslice); it caps the initial allocation at 32 MiB and grows as it reads, with VerifyReader still enforcing declared size and digest.

Notes (non-blocking):

• Release notes are incomplete relative to the diff. The published v2.6.2 notes cover items 3 and 4 and the hardlink fix, but not items 1 and 2. This reconciles: those two arrived as the commits labelled "Merge commit from fork" — GitHub's marker for privately-developed embargoed fixes — and their advisories were only published 2026-08-01, three weeks after the 2026-07-10 release. Both GHSAs exist on oras-project/oras-go, and the code comments in the diff cite GHSA-m37j-52j7-pjw7 by ID. Normal coordinated disclosure, not a discrepancy worth blocking on. A second golang.org/x/sync bump (0.21.0 → 0.22.0, #1242) is likewise unmentioned.
• ReadAll relaxes a hard limit. v2.6.1 outright rejected any descriptor over 32 MiB with ErrInvalidDescriptorSize; v2.6.2 accepts it and reads incrementally. Upstream states the old cap was over-broad and rejected legitimate Push/FetchAll/FetchBytes calls, so this is a net win for large chart/plugin layers — but it does mean in-memory reads are now bounded by actual content rather than a fixed ceiling.
• The new pagination limits are opt-in and default to unlimited. TagListMaxPages / ReferrerListMaxPages of zero means unbounded, and Helm does not set them, so this repo gains the SSRF and tar-extraction fixes but not the pagination bound unless something configures remote.Repository directly. Nothing to do here — just so the protection isn't assumed.

Recommendation: safe to merge.

Automated review by Claude. Verify before merging — this is a second pair of eyes, not a replacement for human review.