[dependabot]: Bump OrasProject.Oras from 0.5.0 to 0.8.0

[dependabot]

Updated OrasProject.Oras from 0.5.0 to 0.8.0.

Release notes

Sourced from OrasProject.Oras's releases.

0.8.0

The NuGet package is available at nuget.org.

[!NOTE]
This release contains no API breaking changes, but it does include a behavioral change to
blob redirect handling: GetBlobLocationAsync now resolves a relative Location header instead of
throwing, and the redirect target's scheme is now validated in all modes (including PlainHttp).
See Behavioral Changes below.

Behavioral Changes

• A relative redirect Location is now resolved instead of rejected (#​423).
  BlobStore.GetBlobLocationAsync previously threw
  HttpIOException("redirect Location header must be an absolute URI") for any redirect whose
  Location header was a relative reference. It now resolves the reference against the effective
  request URI, per RFC 9110 §10.2.2,
  matching what this library already does for upload sessions in PushAsync and MountAsync. No
  API signatures changed — a path that used to throw now returns a value. Note that a relative
  location resolves onto the registry host, so the returned URL may require registry credentials
  rather than being the direct storage-backend URL this API is normally used for; the XML docs on
  BlobStore and IBlobLocationProvider now state this.
• The redirect target's scheme is now validated even when PlainHttp is enabled (#​423).
  The scheme check previously ran only when PlainHttp was disabled, so with PlainHttp = true a
  Location such as file:///c:/secret, javascript:alert(1), or \\host\share was returned to
  the caller unvalidated. The resolved location must now be HTTPS, or HTTP when PlainHttp is
  enabled. The check lives in the remote BlobStore rather than in the IBlobLocationProvider
  contract, so local and third-party implementations remain free to return other schemes.

Bug Fixes

• Resolve relative redirect Location headers in GetBlobLocationAsync
  (#​423). Registries that emit a relative or
  protocol-relative Location on a blob-pull redirect — including the common pre-signed-token form
  such as ?token=xyz — no longer fail with HttpIOException. The redirect is resolved against the
  request URI and then scheme-validated, and the redirect target itself is never contacted while
  obtaining the location.
• Remove unnecessary async from the TrustedHosts_IsReadOnly test
  (#​417). The test method had no await
  operators, producing CS1998 (async method lacks await), which is an error under
  warnings-as-errors.

Other Changes

• build(deps): bump github/codeql-action from 4 to 4.37.4 by @​dependabot in #​419
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.302 to 10.0.400 by @​dependabot in #​420
• Bump Microsoft.NET.Test.Sdk from 18.8.1 to 18.9.0 by @​dependabot in #​421
• Bump xunit.runner.visualstudio from 3.1.5 to 4.0.0 by @​dependabot in #​422

All Changes

• fix: remove unnecessary async from TrustedHosts_IsReadOnly test by @​sajayantony in #​417
  ... (truncated)

0.7.0

The NuGet package is available at nuget.org.

[!IMPORTANT]
This release includes API and behavioral breaking changes in authentication. The auth
challenge type was refactored (Challenge.Scheme → top-level ChallengeScheme, and
ParseChallenge → Parse / TryParse), custom ICache implementations must be updated, and
stale cached-token challenge recovery is now part of the default auth flow. Please read the
Breaking Changes and Migration Guide sections before upgrading.

Breaking Changes

• The nested Challenge.Scheme enum is now the top-level ChallengeScheme (#​415). The
  Basic / Bearer / Unknown values moved from Challenge.Scheme to a new top-level
  public enum ChallengeScheme in OrasProject.Oras.Registry.Remote.Auth. Replace every
  Challenge.Scheme reference with ChallengeScheme (e.g. Challenge.Scheme.Bearer →
  ChallengeScheme.Bearer).
• Challenge is now a readonly record struct, and ParseChallenge is replaced by Parse / TryParse (#​415).
  Challenge changed from a static helper class to a readonly record struct carrying
  ChallengeScheme Scheme and IReadOnlyDictionary<string, string>? Parameters. The
  ParseChallenge(string?) method that returned a (Scheme, Dictionary<string, string>?) tuple was
  removed. Use Challenge.Parse(header) (throws FormatException on a malformed challenge) or
  Challenge.TryParse(header, out var challenge) (non-throwing).
• ICache implementations must switch to ChallengeScheme (#​415). ICache.TryGetScheme,
  ICache.SetCache, and ICache.TryGetToken now take (or emit) ChallengeScheme instead of
  Challenge.Scheme. Any custom ICache implementation must update these signatures to compile.
• Malformed-challenge parsing no longer throws, and duplicate parameters no longer fail (#​415).
  An unterminated quoted parameter value now makes Challenge.TryParse return false (instead of
  throwing), and a repeated parameter key keeps its last value instead of throwing. Challenge.Parse
  still throws FormatException for a malformed challenge.
• Stale cached-token challenge recovery is now built into the default auth flow (#​415). See
  Bug Fixes below. This only changes behavior when a request carried an SDK-cached bearer token
  and standard challenge handling dead-ends; conformant registries are unaffected, and a caller that
  sets its own Authorization header opts out of recovery.

Migration Guide (v0.6.0 → v0.7.0)

1. Replace Challenge.Scheme with ChallengeScheme — the enum is now top-level:

   // before
   if (scheme == Challenge.Scheme.Bearer) { /* ... */ }
   
   // after
   if (scheme == ChallengeScheme.Bearer) { /* ... */ }

2. Update custom ICache implementations to the new enum type on all three members:

   // before

... (truncated)

0.6.0

The NuGet package is available at nuget.org.

[!IMPORTANT]
This release includes behavioral breaking changes in authentication and OCI manifest
serialization that are not obvious from method signatures. Please read the Breaking Changes
and Migration Guide sections before upgrading.

Breaking Changes

• Auth realm validation is now enabled by default and is least-permissive (#​393, #​403). A
  freshly constructed auth Client now validates the bearer-challenge realm and, by default, only
  allows realms on the same host as the registry (HTTPS; scheme-default or matching port; no
  built-in trusted hosts). Registries whose token realm lives on a different host (e.g. Docker Hub:
  registry-1.docker.io → auth.docker.io) now require explicit opt-in:

  new Client(httpClient)
  {
      RealmValidator = new DefaultRealmValidator
      {
          TrustedRealmHosts = ImmutableHashSet.Create("auth.docker.io")
      }
  };

• ScopeManager scope state is now partitioned by partitionId (#​404). Six public methods
  (GetScopesForHost, GetScopesStringForHost, both SetActionsForRepository overloads, and both
  SetScopeForRegistry overloads) gained a required string? partitionId parameter. Pass null
  to preserve the previous unpartitioned behavior.
• OCI manifests now use Go-compatible JSON encoding (#​348). Serialized manifest bytes are now
  byte-for-byte compatible with oras-go / Go encoding/json (+ is no longer escaped; <, >,
  &, U+2028 and U+2029 are escaped as Go does). This changes the digest of any manifest whose
  fields contain those characters — recompute or re-push any digests cached from earlier versions.
• Manifest serialization now enforces a 4 MiB limit (#​348). Packing a manifest that serializes
  to more than 4 MiB now throws SizeLimitExceededException.
• Stricter auth scope parsing (#​396, #​404). Scope.TryParse now rejects malformed scope
  strings that were previously accepted (empty resource type/name/action segments).

Migration Guide (v0.5.0 → v0.6.0)

1. Update ScopeManager calls — the six methods now take a partitionId. Pass null for the
   previous behavior (or a non-null id to isolate scope state per tenant/identity):

   // before
   scopeManager.SetActionsForRepository(reference, Scope.Action.Pull);
   var scopes = scopeManager.GetScopesForHost("registry.example.com");
   // after
   scopeManager.SetActionsForRepository(reference, partitionId: null, Scope.Action.Pull);
   var scopes = scopeManager.GetScopesForHost("registry.example.com", partitionId: null);

2. Opt into cross-host auth realms — if a registry's token realm is on a different host from the
   registry (Docker Hub, GitLab, NVIDIA NGC, …), add the realm host to TrustedRealmHosts or supply
   ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Dependabot could not find a dependency.. Because of this, Dependabot cannot update this pull request.

[lbussell]

@dependabot recreate

[dependabot]

Dependabot could not find a dependency.. Because of this, Dependabot cannot update this pull request.