Go backend engineer & AI builder.
- oras-project/oras-go — perf: avoid allocating 3x the content size in
ReadAll(#1426); fix: bound how far a registry can raise the chunk size in chunked blob push (#1464); fix: stop the OCI store from leaking a manifest after its tag moves (#1469); perf: send the Range request onReadinstead of on everySeek(#1473); perf: stop the OCI store'sDeletefrom copying the whole tag index for every node it removes (#1483); fix: make clients built without aCacheFactorycache auth tokens, as documented (#1488); perf: look up predecessors concurrently in extended copy, instead of one node at a time (#1496); fix: restore the default limit of 10 redirects in the auth client, so a redirect loop no longer runs until timeout (#1514); refactor: removeCopyOptions.PolicyCheck, which could not check digests or signatures, and the unusedRepositoryMiddlewarefrom the v3 API (#1563); fix: check the registry policy once per operation, soReferrersworks under asignedBypolicy on registries without the Referrers API (#1586) - gofr-dev/gofr — fix: reject empty basic auth credentials, so unset config values no longer let any client authenticate with
Basic Og==(#4530) - Security — reported GHSA-mm3p-9qjq-j454 in oras-go: a malicious registry could crash clients with a malformed referrer digest (fixed in v3.0.0-rc.3)