From 6308239c4b63657869a7732c9006ca960bd0c5b1 Mon Sep 17 00:00:00 2001 From: Bisman-Singh Date: Mon, 31 Aug 2026 08:20:00 +0530 Subject: [PATCH] fix(deps): bump oras.land/oras-go/v2 to v2.6.2 on release-4.2 oras-go v2.6.1's descriptor-size security patch added a hard 32 MiB cap in content.ReadAll, so pulling any OCI artifact with a layer over 32 MiB fails with 'failed to perform "Push" on destination: invalid descriptor size'. Helm's plugin install path copies the plugin tarball layer into an in-memory store, so plugins like helm-unittest (~160 MiB layer) cannot be installed by any released 4.2.x: v4.2.1 through v4.2.4 all pin v2.6.1. oras-go v2.6.2 bounds only the initial buffer allocation instead of rejecting on declared size, with VerifyReader still enforcing size and digest, so large legitimate layers work again. main already carries this bump (84e63e5c3, #32333); this applies the same dependency update to release-4.2. Verified against the report in #32247: a binary built from this branch installs oci://ghcr.io/helm-unittest/helm-unittest/unittest:1.1.1 successfully, while the v4.2.4 binary fails; pkg/registry and internal/plugin tests pass. Fixes #32247 Signed-off-by: Bisman-Singh --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 602cc86ac..de2700291 100644 --- a/go.mod +++ b/go.mod @@ -47,7 +47,7 @@ require ( k8s.io/client-go v0.36.1 k8s.io/klog/v2 v2.140.0 k8s.io/kubectl v0.36.1 - oras.land/oras-go/v2 v2.6.1 + oras.land/oras-go/v2 v2.6.2 sigs.k8s.io/controller-runtime v0.24.1 sigs.k8s.io/kustomize/kyaml v0.21.1 sigs.k8s.io/yaml v1.6.0 diff --git a/go.sum b/go.sum index 4168f132b..1edd9d24e 100644 --- a/go.sum +++ b/go.sum @@ -511,8 +511,8 @@ k8s.io/kubectl v0.36.1 h1:96HqS9twIdHM0MlJLTwbo14b9kUKPkOzZ4tlRDLv4qI= k8s.io/kubectl v0.36.1/go.mod h1:/DGPAIewKsFWF9VFgGvkPhao2Ev4SNuE3BioZo8yPbk= k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU= k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= -oras.land/oras-go/v2 v2.6.1 h1:bonOEkjLfp8tt6qXWRRWP6p1F+9octchOf2EqnWB4Zs= -oras.land/oras-go/v2 v2.6.1/go.mod h1:dhtFrFOuZuDtAVeZ9FUnaa5zfzplG3ZnFX9/uH1J/Yk= +oras.land/oras-go/v2 v2.6.2 h1:N04RXngAp1LJKTG6ifz3xHPipasEkWr+hFmInja5YKo= +oras.land/oras-go/v2 v2.6.2/go.mod h1:PlTtg4JTDJkDe8yVHpM2wz7/YDc00GVas+i4jAW2TZ4= sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4= sigs.k8s.io/controller-runtime v0.24.1/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=