chore(deps): update dependency oras-project/oras to v1.3.0

[renovate]

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Update	Change
oras-project/oras	minor	v1.2.3 -> v1.3.0

---

Release Notes

oras-project/oras (oras-project/oras)

v1.3.0

Compare Source

New Features

Stable

• oras is compliant with OCI distribution-spec v1.1.1
• Show OS and architecture in oras version
• Add alias oras manifest get for oras manifest fetch

Preview

• Improve tree view in oras discover
  • Display annotations by default
  • Colorize tree view 🌈

Experimental

• Introduce portable backup and restore of OCI artifacts, images, and repositories
  • oras backup: New command to back up artifacts from remote registries into local OCI image layouts, either as directories or tar archives.
  • oras restore: New command to restore artifacts from local OCI image layouts (directories or tar archives) back to remote registries.
• Introduce multi-arch image/artifact management
  • Add the oras manifest index command set to manage OCI image index manifests
    • oras manifest index create to create a new index from existing manifests
    • oras manifest index update to update an existing index manifest
  • Add --artifact-platform to oras push to push artifacts with platform information
  • Add --format to oras repo ls and oras repo tags with text, json, and go-template options
  • Support fully qualified references for OCI image layout via --oci-layout-path
• Refine the oras discover output for the json and go-template formats
  • BREAKING CHANGE: Rename the manifests field to referrers
  • Add subject manifest details to the json output
• oras discover now displays referrers recursively by default; the maximum recursion depth can be controlled via the --depth flag

Feature Promotions

• Promote the following commands and flags from Preview to Stable:
  • oras attach
  • oras attach --platform
  • oras pull --include-subject
• Promote oras resolve from Experimental to Preview

Deprecations

Stable

• Deprecate the -v, --verbose flag (verbose output is now enabled by default)

Preview

• BREAKING CHANGE Remove the global --no-tty flag
  • --no-tty remains available on individual TTY-capable commands

Experimental

• Deprecate the table option of the --format flag in oras discover

Bug Fixes

• Fix #​1436: oras tag creates referrers tags unexpectedly
• Fix #​1442: invalid progress bar shown for empty layers
• Fix #​1494: invalid reference in the formatted output of oras pull
• Fix #​1593: unable to download an artifact twice if it contains symbolic links
• Fix #​1599: Auth token scope not correctly added when using --debug or --no-tty with oras push
• Fix #​1623: Should show KB instead of kB in the progress bar
• Fix #​1728: oras cp now correctly copies the root index when the index has no referrers
• Fix #​1795, #​1825: redundant blank lines in terminal output

Other Changes

• Add support for the loong64 architecture
• Upgrade to Go 1.25.0
• Enhance UX:
  • Improve diagnostic experience through --debug logs
  • Improve error messages
• Improve documentation
• Optimize code structure
• Update dependencies
• Minor security enhancements

New Contributors

• @​bcho made their first contribution in #​1408
• @​njucjc made their first contribution in #​1435
• @​nmiyake made their first contribution in #​1477
• @​mauriciovasquezbernal made their first contribution in #​1507
• @​Horiodino made their first contribution in #​1607
• @​chrisguitarguy made their first contribution in #​1658
• @​kysucix made their first contribution in #​1671
• @​RohanMishra315 made their first contribution in #​1650
• @​apparentlymart made their first contribution in #​1696
• @​Copilot made their first contribution in #​1755
• @​tanyabhatnagar made their first contribution in #​1761
• @​amazingfate made their first contribution in #​1787

Full Changelog: oras-project/oras@v1.2.0...v1.3.0

What's Changed Since RC.2

• bump: tag and release ORAS CLI v1.3.0-rc.2 by @​Wwwsylvia in #​1834
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.25.2 in /test/e2e by @​dependabot[bot] in #​1836
• build(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @​dependabot[bot] in #​1837

Full Changelog: oras-project/oras@v1.3.0-rc.2...v1.3.0

Notes

This release was signed with 3E94 D52A FA46 5877 CAEA 79F1 E805 2EA1 7ECB 9A6C (@​Wwwsylvia's GPG key) which can be found here.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wuhuizuo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [wuhuizuo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2025-10-11 11:04:00.005946291 +0000 UTC m=+524629.037045609: ☑️ agreed by wuhuizuo.