[mergeraptor]

This PR contains the following updates:

Package	Type	Update	Change
oras-project/setup-oras	action	patch	v2.0.2 → v2.0.3

---

Release Notes

oras-project/setup-oras

v2.0.3

Compare Source

Highlights

• Support ORAS CLI version(s): 1.3.5, 1.3.6

What's Changed

• chore(deps): Bump @​types/node from 26.6.2 to 26.6.4 by @​dependabot[bot] in #​208
• docs: remove transient 1.3.4 note from RELEASING.md by @​SatvikMishra08 in #​209
• chore: pin create-pull-request action to commit SHA by @​Brilly-Bohyun in #​213
• docs: update usage examples and document version pinning by @​Brilly-Bohyun in #​215
• docs: document immutable releases and floating tag rules by @​Brilly-Bohyun in #​218
• ci: pin remaining GitHub Actions to commit SHAs by @​Brilly-Bohyun in #​219
• ci: check auto-release workflow names by @​Brilly-Bohyun in #​220
• chore(deps): Bump @​types/node from 26.6.4 to 26.6.5 by @​dependabot[bot] in #​221
• chore: update releases.json for 1.3.6,1.3.5 by @​github-actions[bot] in #​222

New Contributors

• @​SatvikMishra08 made their first contribution in #​209

Full Changelog: oras-project/setup-oras@v2.0.2...v2.0.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ahmedadan after the PR has been reviewed.
You can assign the PR to them by writing /assign @ahmedadan in a comment when ready.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Hive will not merge this PR: it changes path(s) listed in auto_merge.human_merge_paths for this repo, so a person must merge it.

• .github/workflows/registry-actions.yml

Hive added the hold label. A maintainer should review and merge this PR by hand.

[hivecommons-hive]

8d810c9

ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blocked

Hive flagged this PR (author @mergeraptor[bot], head 8d810c98c2c3) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/registry-actions.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[Danathar]

Merging by hand (human-merge path: workflow change, so the hive holds it for a person). Reviewed: bumps oras-project/setup-oras from v2.0.2 to v2.0.3, still pinned by full SHA; verified 5e2f2482 is upstream's v2.0.3 tag (upstream changes: new oras release data and a rebuilt dist bundle). Required checks green.