🐛 Bug fixes

• Regression when file already exists when exploding archive (#720) @jonesbusy

📦 Dependency updates

• Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 (#722) @dependabot[bot]
• Bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.33 (#724) @dependabot[bot]
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.5.1 to 3.6.0 (#723) @dependabot[bot]
• Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (#721) @dependabot[bot]

❗ Security

• [GHSA-j6hm-v3x2-qv6j] Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

🚦 Tests

• Bump zot v2.1.17 (#718) @github-actions[bot]

📦 Dependency updates

• Bump release-drafter/release-drafter from 7.3.0 to 7.3.1 (#719) @dependabot[bot]
• Bump zot v2.1.17 (#718) @github-actions[bot]
• Bump org.junit:junit-bom from 6.0.3 to 6.1.0 (#716) @dependabot[bot]
• Bump codecov/codecov-action from 6.0.0 to 6.0.1 (#715) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.7-8 to 1.5.7-9 (#714) @dependabot[bot]
• Bump dev.sigstore:sigstore-maven-plugin from 2.0.0 to 2.1.0 (#713) @dependabot[bot]
• Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 (#712) @dependabot[bot]
• Bump github/codeql-action from 4.35.5 to 4.36.0 (#717) @dependabot[bot]
• Bump Maven 3.9.16 (#711) @github-actions[bot]

🚀 New features and improvements

• Add YAML utils (#709) @jonesbusy

👻 Maintenance

• Add some constants for other CNCF projects (#710) @jonesbusy
• Do not include null on serialized model (#705) @jonesbusy

📦 Dependency updates

• Bump github/codeql-action from 4.35.4 to 4.35.5 (#707) @dependabot[bot]
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.4.0 to 3.5.1 (#708) @dependabot[bot]
• Bump updatecli/updatecli-action from 3.1.3 to 3.2.0 (#706) @dependabot[bot]
• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 (#704) @dependabot[bot]

❗ Security

• [GHSA-xm96-gfjx-jcrc] Normalize and validate path from org.opencontainers.image.title (#703) @jonesbusy

🐛 Bug fixes

• Use unique metric name for HTTP requests (#702) @jonesbusy
• Make ArchiveUtils work on Windows (#683) @ThomasVitale

👻 Maintenance

• Run workflows on Windows to discover to support more platform (#690) @jonesbusy

📦 Dependency updates

• Bump release-drafter/release-drafter from 7.2.1 to 7.3.0 (#700) @dependabot[bot]
• Bump github/codeql-action from 4.35.3 to 4.35.4 (#701) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.7-7 to 1.5.7-8 (#695) @dependabot[bot]
• Bump release-drafter/release-drafter from 7.2.0 to 7.2.1 (#697) @dependabot[bot]
• Bump tools.jackson:jackson-bom from 3.1.2 to 3.1.3 (#696) @dependabot[bot]
• Bump github/codeql-action from 4.35.2 to 4.35.3 (#698) @dependabot[bot]
• Bump com.github.ben-manes.caffeine:caffeine from 3.2.3 to 3.2.4 (#699) @dependabot[bot]

🚀 New features and improvements

• Support configuring custom CA certificates (#687) @ThomasVitale

🐛 Bug fixes

• Fix rewrite of unqualified reference (#692) @jonesbusy

👻 Maintenance

• Bump version to 0.6.0-SNAPSHOT (#688) @jonesbusy
• Add missing @OrasModel annotation on CredentialHelperResponse (#685) @ThomasVitale

🚦 Tests

• Bump zot v2.1.16 (#689) @github-actions[bot]

📦 Dependency updates

• Bump Maven 3.9.15 (#686) @github-actions[bot]
• Bump updatecli/updatecli-action from 3.1.2 to 3.1.3 (#693) @dependabot[bot]
• Bump testcontainer.version from 2.0.4 to 2.0.5 (#694) @dependabot[bot]
• Bump updatecli/updatecli-action from 3.1.1 to 3.1.2 (#691) @dependabot[bot]
• Bump zot v2.1.16 (#689) @github-actions[bot]

🚀 New features and improvements

• Allow to pass auth token to build registry (#677) @jonesbusy

🐛 Bug fixes

• Change JUnit dependency scope from compile to scope (#666) @ThomasVitale

🚦 Tests

• Fix flaky tests (#667) @jonesbusy

📦 Dependency updates

🚀 New features and improvements

• Implement blobs mount (#651) @jonesbusy

🐛 Bug fixes

• Fix copy using target tag (#653) @jonesbusy

👻 Maintenance

• Fix mount for insecure registry (parameter order) (#652) @jonesbusy
• Implement canMount (#650) @jonesbusy

📦 Dependency updates

• Bump release-drafter/release-drafter from 6.4.0 to 7.0.0 (#645) @dependabot[bot]
• Bump Maven 3.9.14 (#649) @github-actions[bot]
• Bump webfactory/ssh-agent from 0.9.1 to 0.10.0 (#646) @dependabot[bot]
• Bump mockito.version from 5.22.0 to 5.23.0 (#647) @dependabot[bot]
• Bump io.micrometer:micrometer-bom from 1.16.3 to 1.16.4 (#644) @dependabot[bot]

🚀 New features and improvements

• Enable micrometer metrics and add one for token refresh (#639) @copilot-swe-agent[bot]
• Allow consumers to provide their executor service (#637) @jonesbusy
• Concurrency for layer pull and push (#629) @jonesbusy
• Global scopes and look for token with broader scope in the cache (#633) @jonesbusy
• Cache hit with service (#632) @jonesbusy
• Store token into caffeine cache (#631) @jonesbusy
• Tags pagination (#628) @jonesbusy

🐛 Bug fixes

• Ensure to URI escape service name (#623) @jonesbusy

👻 Maintenance

• Increase Maven central publication waitMaxTime to 2h (30mn fail too often) (#621) @jonesbusy

🚦 Tests

• Build docker-credential-fake with Go 1.26.1 (#642) @jonesbusy
• Bump zot v2.1.15 (#636) @github-actions[bot]

✍ Other changes

• Use bom and pass service and realm to token refresh (#641) @jonesbusy

📦 Dependency updates

• Build docker-credential-fake with Go 1.26.1 (#642) @jonesbusy
• Bump io.micrometer:micrometer-core from 1.15.0 to 1.16.3 (#640) @dependabot[bot]
• Bump zot v2.1.15 (#636) @github-actions[bot]
• Bump release-drafter/release-drafter from 6.3.0 to 6.4.0 (#634) @dependabot[bot]
• Bump Maven 3.9.13 (#625) @github-actions[bot]
• Bump release-drafter/release-drafter from 6.2.0 to 6.3.0 (#627) @dependabot[bot]
• Bump github/codeql-action from 4.32.5 to 4.32.6 (#626) @dependabot[bot]
• Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 (#624) @dependabot[bot]

🚀 New features and improvements

• Add CopyOption with includeReferrers option and ensure to copy index on index (#610) @jonesbusy
• Add optional OS version and feature (#608) @jonesbusy
• Add zip compression for artifact but never unpack it (Not a standard OCI layer mediatype) (#606) @jonesbusy

🐛 Bug fixes

• Fix index serialization when adding manifests (#615) @jonesbusy

📝 Documentation updates

• Fix javadoc warnings (#620) @jonesbusy

👻 Maintenance

• Change order of ensureSafeEntry to satisfy CodeQL (#618) @jonesbusy
• Add utils to remove one descriptor from Index (#614) @jonesbusy
• Better error message when getting legacy manifests (#600) @jonesbusy

🚦 Tests

• Missing OrasModel and ensure we scan all for the tests (#599) @jonesbusy

✍ Other changes

• [StepSecurity] ci: Harden GitHub Actions (#619) @step-security-bot

📦 Dependency updates

• Bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 (#613) @dependabot[bot]
• Bump github/codeql-action from 4.32.4 to 4.32.5 (#611) @dependabot[bot]
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.2.1 to 3.3.0 (#612) @dependabot[bot]
• Bump mockito.version from 5.21.0 to 5.22.0 (#605) @dependabot[bot]
• Bump actions/upload-artifact from 6.0.0 to 7.0.0 (#601) @dependabot[bot]
• Bump updatecli/updatecli-action from 2.99.0 to 2.100.0 (#602) @dependabot[bot]