chore(deps): update dependency open-component-model/ocm to v0.22.1

[renovate]

This PR contains the following updates:

Package	Update	Change
open-component-model/ocm	minor	0.16.2 -> 0.22.1

---

Release Notes

open-component-model/ocm (open-component-model/ocm)

v0.22.1

Compare Source

What's Changed

🐛 Bug Fixes

• fix: retract v0.22.0 in releases/v0.22 by @​ikhandamirov in https://github.com/open-component-model/ocm/pull/1403

🧰 Maintenance

• chore: bump VERSION to 0.22.1-dev by @​ocmbot in https://github.com/open-component-model/ocm/pull/1394

Full Changelog: open-component-model/ocm@v0.22.0...v0.22.1

v0.22.0

Compare Source

What's Changed

‼️ Breaking Changes

• chore!: add bdba trigger to release and exclude subchartsdemo as well as helminstaller / helmdemo from release by @​morri-son in https://github.com/open-component-model/ocm/pull/1343

🐛 Bug Fixes

• fix: always initialize the system certificate store for the oras client by @​Skarlso in https://github.com/open-component-model/ocm/pull/1359
• fix: downport: make sure that other resolve requests such as 400 are also retur… by @​ikhandamirov in https://github.com/open-component-model/ocm/pull/1379
• fix: set the refresh token to password always by @​Skarlso in https://github.com/open-component-model/ocm/pull/1381
• fix: inherit secret for Trigger BDBA Scan by @​ikhandamirov in https://github.com/open-component-model/ocm/pull/1382

⬆️ Dependencies

8 changes

• chore(deps): bump the go group with 10 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1316
• chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 in the go_modules group by @​dependabot in https://github.com/open-component-model/ocm/pull/1322
• chore(deps): bump the go group across 1 directory with 16 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1338
• chore(deps): bump github.com/mandelsoft/spiff from 1.7.0-beta-6 to 1.7.0-beta-7 by @​dependabot in https://github.com/open-component-model/ocm/pull/1333
• chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 in the go_modules group by @​dependabot in https://github.com/open-component-model/ocm/pull/1328
• chore(deps): bump the go group with 2 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1342
• chore(deps): bump the go group with 12 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1354
• chore(deps): bump github.com/containerd/containerd from 1.7.26 to 1.7.27 in the go_modules group by @​dependabot in https://github.com/open-component-model/ocm/pull/1357

🧰 Maintenance

• chore: bump VERSION to 0.22.0-dev by @​ocmbhttps://github.com/open-component-model/ocm/pull/1313l/1313
• chore: switch blackduck sca to pull_request_target by @​jakobmoellerdhttps://github.com/open-component-model/ocm/pull/1329l/1329
• chore: remove gosec from codeql and correct gosec linter annotations by @​morri-shttps://github.com/open-component-model/ocm/pull/1320l/1320
• remove PR comment by @​morri-shttps://github.com/open-component-model/ocm/pull/1336l/1336

Other Changes

• correct workflow by @​morri-shttps://github.com/open-component-model/ocm/pull/1325l/1325
• correct worklfow by @​morri-shttps://github.com/open-component-model/ocm/pull/1326l/1326
• Update codeql.yml by @​morri-shttps://github.com/open-component-model/ocm/pull/1330l/1330
• add upload by @​morri-shttps://github.com/open-component-model/ocm/pull/1337l/1337

Full Changelog: open-component-model/ocm@v0.21...v0.22.0

v0.21.0

Compare Source

What's Changed

🐛 Bug Fixes

• fix: Add deprecation warning for CA by @​hilmarf in https://github.com/open-component-model/ocm/pull/1244
• fix: use app token because of PR / branch protection by @​morri-son in https://github.com/open-component-model/ocm/pull/1283
• fix: cap max length of git repository urls by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1298

⬆️ Dependencies

• chore(deps): bump the go group with 10 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1268
• chore(deps): bump the go group with 11 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1276
• chore(deps): bump the go group with 10 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1290
• chore(deps): bump the go group with 12 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1305
• chore(deps): bump golang from 1.23-alpine3.21 to 1.24-alpine3.21 by @​dependabot in https://github.com/open-component-model/ocm/pull/1304

🧰 Maintenance

15 changes

• chore: bump VERSION to 0.21.0-dev by @​ocmbot in https://github.com/open-component-model/ocm/pull/1265
• chore: docs/release process by @​fabianburth in https://github.com/open-component-model/ocm/pull/1271
• chore: add set milestone action by @​ocmbot in https://github.com/open-component-model/ocm/pull/1274
• chore: Gosec - enable security linting by @​hilmarf in https://github.com/open-component-model/ocm/pull/1266
• chore: resolve security findings by @​fabianburth in https://github.com/open-component-model/ocm/pull/1282
• chore: add set milestone action by @​ocmbot in https://github.com/open-component-model/ocm/pull/1288
• chore: Change-blackduck by @​morri-son in https://github.com/open-component-model/ocm/pull/1287
• chore(docs): Update RELEASE_PROCESS.md by @​hilmarf in https://github.com/open-component-model/ocm/pull/1292
• chore: raise alpine version by @​morri-son in https://github.com/open-component-model/ocm/pull/1297
• chore: remove .bridge folder from scans by @​morri-son in https://github.com/open-component-model/ocm/pull/1301
• chore: finalize blackduck scan by @​morri-son in https://github.com/open-component-model/ocm/pull/1302
• chore: add scheduled trigger to full scan by @​morri-son in https://github.com/open-component-model/ocm/pull/1303
• chore: Update codeql.yml by @​morri-son in https://github.com/open-component-model/ocm/pull/1307
• chore(refactor): replace utils.MapKeys with slices.Collect(maps.Keys(m)) by @​hilmarf in https://github.com/open-component-model/ocm/pull/1308
• chore: update 'flake.nix' by @​ocmbot in https://github.com/open-component-model/ocm/pull/1312

Full Changelog: open-component-model/ocm@v0.20...v0.21.0

v0.20.1

Compare Source

What's Changed

⬆️ Dependencies

• fix: cap max length of git repository urls (#​1298) by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1299

🧰 Maintenance

• chore: bump VERSION to 0.20.1-dev by @​ocmbot in https://github.com/open-component-model/ocm/pull/1293

Full Changelog: open-component-model/ocm@v0.20.0...v0.20.1

v0.20.0

Compare Source

What's Changed

🚀 Features

• feat: replace docker client code with oras - take 2 by @​Skarlso in https://github.com/open-component-model/ocm/pull/1184
• feat: support splitting blobs when stored as OCI layer by @​mandelsoft in https://github.com/open-component-model/ocm/pull/1140
• feat: git Access, AccessMethod through BlobAccess by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/869
• feat(normalisation): jsonNormalisation/v3 and fixes to jsonNormalisation/v1 as well as jsonNormalisation/v2 by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1218
• feat: jfrog plugin + helm upload handler by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1167

🐛 Bug Fixes

11 changes

• fix: allow cache push through PAT by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1166
• fix: replace juju with rogpeppe go internal by @​Skarlso in https://github.com/open-component-model/ocm/pull/1176
• fix: correct link and add notice file by @​morri-son in https://github.com/open-component-model/ocm/pull/1185
• fix: ocm transfer ignored --enforce when --overwrite is set by @​fabianburth in https://github.com/open-component-model/ocm/pull/1187
• fix: fix toi doc by @​mandelsoft in https://github.com/open-component-model/ocm/pull/1196
• fix: deal with internal error coming from docker registry by @​Skarlso in https://github.com/open-component-model/ocm/pull/1203
• fix: correct fetch order for manifests and blobs with hints on media type by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1209
• fix: do not handle root folder and the . folder by @​Skarlso in https://github.com/open-component-model/ocm/pull/1229
• fix(transfer): accidental extra identity defaulting during transfer by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1236
• fix: unable to close, unable to unref last: unable to cleanup component version, while unref last: closing component version by @​hilmarf in https://github.com/open-component-model/ocm/pull/1243
• fix(workaround): allow old norm algos to be hashed with old digest ctxts by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1263

⬆️ Dependencies

12 changes

• chore(deps): bump the go group with 3 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1151
• chore(deps): use mergo vanity url by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1161
• chore(deps): bump distroless/static-debian12 from to by @​dependabot in https://github.com/open-component-model/ocm/pull/1169
• chore(deps): bump the go group with 10 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1177
• chore(deps): bump github.com/fluxcd/cli-utils from 0.36.0-flux.9 to 0.36.0-flux.10 by @​dependabot in https://github.com/open-component-model/ocm/pull/1178
• chore(deps): bump the go group with 11 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1190
• chore(deps): bump the go group across 1 directory with 13 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1215
• chore(deps): bump the go group with 5 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1219
• chore(deps): bump github.com/go-git/go-git/v5 from 5.12.0 to 5.13.1 in the go_modules group by @​dependabot in https://github.com/open-component-model/ocm/pull/1226
• chore(deps): bump the go group with 12 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1248
• chore(deps): bump the go group with 17 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1261
• chore(deps): bump distroless/static-debian12 from to by @​dependabot in https://github.com/open-component-model/ocm/pull/1260

🧰 Maintenance

21 changes

• docs: release process - add follow up section by @​hilmarf in https://github.com/open-component-model/ocm/pull/1141
• chore: bump VERSION to 0.20.0-dev by @​ocmbot in https://github.com/open-component-model/ocm/pull/1144
• chore: autocollapse release notes by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1145
• chore: fixup release notes by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1148
• chore: adjust labels to new configuration by @​hilmarf in https://github.com/open-component-model/ocm/pull/1115
• feat: migrate to fully distroless ocm image by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1087
• chore: prioritize deps over chore by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1155
• chore: add catch all category for release by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1157
• chore: missed this occurrence of by @​hilmarf in https://github.com/open-component-model/ocm/pull/1159
• chore: make sure that dockerfiles are setup in a standard way by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1160
• chore: changes label check to any_of by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1162
• chore: rework default Dockerfile by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1165
• docs: adjust flags to options in cobra help and usage template by @​fabianburth in https://github.com/open-component-model/ocm/pull/1188
• chore: use the pull request head to run the integration tests by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1202
• chore: just a tiny refactor in the returning code by @​Skarlso in https://github.com/open-component-model/ocm/pull/1221
• chore(platforms): publish for: linux/amd64 and linux/arm64 by @​hilmarf in https://github.com/open-component-model/ocm/pull/1225
• chore(github-action): let's check for common typos in coding by @​hilmarf in https://github.com/open-component-model/ocm/pull/1206
• chore: fix codespell findings by @​hilmarf in https://github.com/open-component-model/ocm/pull/1210
• chore(ci): ensure body is encoded correctly and can never be recognized as secret for release by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1238
• chore(ci): patch release note write by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1241
• docs: update to release process documentation by @​ikhandamirov in https://github.com/open-component-model/ocm/pull/1251

Other Changes

• delete issue types as move to .github repo by @​morri-shttps://github.com/open-component-model/ocm/pull/1259l/1259

Full Changelog: open-component-model/ocm@v0.19...v0.20.0

v0.19.1

Compare Source

What's Changed

🚀 Features

• feat(normalisation): jsonNormalisation/v3 and fixes to jsonNormalisation/v1 as well as jsonNormalisation/v2 (#​1218) by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1230

🐛 Bug Fixes

• fix(transfer): accidental extra identity defaulting during transfer (#​1236) by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1237
• fix: unable to close, unable to unref last: unable to cleanup compone… by @​hilmarf in https://github.com/open-component-model/ocm/pull/1253
• fix(workaround): allow old norm algos to be hashed with old digest ctxts by @​frewilhelm in https://github.com/open-component-model/ocm/pull/1264

🧰 Maintenance

• chore: bump VERSION to 0.19.1-dev by @​ocmbot in https://github.com/open-component-model/ocm/pull/1197
• chore(ci): ensure body is encoded correctly and can never be recognized as secret for release (#​1238) by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1239

Full Changelog: open-component-model/ocm@v0.19.0...v0.19.1

v0.19.0

Compare Source

What's Changed

🚀 Features

• feat(log): log http requests for OCI and docker based on trace level by injecting a logger by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1118

🧰 Maintenance

34 changes

• chore: change guide for 0.18.0 by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1066
• chore(deps): bump the ci group with 2 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1068
• chore(deps): bump the go group with 10 updates by @​dependabot in https://github.com/open-component-model/ocm/pull/1067
• chore: allow publishing to Brew via custom script by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1059
• chore: remove ocm inception during build CTF aggregation by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1065
• chore: release branches as instead of by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1071
• chore: cleanup release action by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1076
• chore: disable mandatory period comments by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1079
• chore: make sure that version bumping happens everytime by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1090
• chore: also create a branch based on the tag to avoid dangling commits by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1098
• chore: add correct labels for flake nix job by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1100
• chore: allow triggering blackduck scans manually by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1104
• chore: remove the int test repository dispatch by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1106
• chore: rework labeling jobs by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1103
• chore: ensure that PR titles must be semantic by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1108
• chore: move process options to struct by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1109
• chore: automatically set github actions label by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1112
• chore: remove releasenotes.yaml by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1111
• docs: document complex artifact transfer by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1113
• chore: setup release to reuse CTF from components workflow by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1077
• docs: revise RELEASE_PROCESS.md by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1086
• chore: label prs based on conventional commit by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1121
• docs: finally some working examples for a lot of commands by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1123
• chore: let's not store the release notes in the repository by @​hilmarf in https://github.com/open-component-model/ocm/pull/1120
• chore: fixup release action versioning and notes process by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1124
• chore: make sure we release to brew too with our release by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1125
• chore(deps): bump anchore/sbom-action from 0.17.7 to 0.17.8 in the ci group by @​dependabot in https://github.com/open-component-model/ocm/pull/1128
• chore: publish to website as other by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1126
• chore(github_actions): push-to-winget: permissions: by @​hilmarf in https://github.com/open-component-model/ocm/pull/1133
• chore(signing): correct Fulcio service to correct address by @​morri-son in https://github.com/open-component-model/ocm/pull/1135
• chore(github_actions): using now classic secret of OCM_CI_ROBOT by @​hilmarf in https://github.com/open-component-model/ocm/pull/1137
• chore: rework release note handling by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1139
• chore(backport): fixup release notes (#​1148) by @​jakobmoellerdev in https://github.com/open-component-model/ocm/pull/1149
• chore(backport): adjust labels to new configuration by @​hilmarf in https://github.com/open-component-model/ocm/pull/1154

⬆️ Dependencies

• chore(deps): bump the go group with 17 updates by @​dependabhttps://github.com/open-component-model/ocm/pull/1127l/1127

Full Changelog: open-component-model/ocm@v0.18...v0.19.0

v0.18.0

Compare Source

Release v0.18.0

• change short text for help topic (#​1058)
• bug: allow http protocol for oci access (#​1060)
• bug: fix unmarshal consumer identity with empty value (#​1057)
• fix artifact set tagging (#​1033)
• component constructor with references field (#​1054)
• priority for CLI registration options (#​1045)
• chore: update 'flake.nix' (#​1049)
• add action doc (#​1032)
• chore: update 'flake.nix' (#​1040)
• chore: update 'flake.nix' (#​1039)
• fix downloader handling (#​1031)
• Adjust README with rotated GPG key (#​1025)

🐛 Bug Fixes

• [release-v0.18.0] fix: version info for OCI refs (#​1080)
• fix: set tlskyber=0 (#​1047)
• fix: remove ocm release key if present (#​1024)
• chore: release fallout corrections (#​1023)

🧰 Maintenance

8 changes

• chore: force bump to 0.18.0-dev (#​1061)
• chore: reuse aggregation from ctf during component build (#​1044)
• chore: disable runner cache for release note drafter (#​1051)
• chore: enhance the publishing to other repositories then github (#​1028)
• chore: migrate all component builds: ca => ctf (#​1043)
• chore(ci): various optimizations for build processing, caching and concurrency (#​996)
• fix: remove ocm release key if present (#​1024)
• chore: release fallout corrections (#​1023)

⬆️ Dependencies

4 changes

• chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 in the go_modules group (#​1048)
• chore(deps): bump github.com/containerd/errdefs from 0.3.0 to 1.0.0 (#​1037)
• chore(deps): bump the ci group with 2 updates (#​1038)
• chore(deps): bump the go group with 8 updates (#​1036)

v0.17.0

Compare Source

Release v0.17.0

• !OCI Annotations change in Component Descriptor for Component Versions: `ocm-artifact` -> `software.ocm.artifact` and introduce `software.ocm.creator` (#​987)
• Introduce update state on CV implementation API (#​976)

🐛 Bug Fixes

• Revert "feat: replace docker with oras (#<!---->904)" (#​1005)
• fix!(release): retract 0.16.0-z (#​1006)

Documentation

• documentation: fix uploader documentation (#​991)
• documentation: Update the installation options (#​979)
• chore: fixes for docu + cleanup test leftovers (#​993)

🧰 Maintenance

8 changes

• Fix/publish release (#​1001)
• chore: reduce cache pressure by early deleting cache entries after PR closure (#​986)
• chore: update 'flake.nix' (#​1012)
• chore(release): also call make generate to update files (#​992)
• chore(ci): remove i386, optimize latest build and add various comments (#​1010)
• chore(ci): use reusable stale bot configuration (#​1008)
• chore(ci): add stale bot for issues (#​1002)
• chore(ci): make sure we use candidates and branches by default (#​1004)

⬆️ Dependencies

3 changes

• Upgrade levenshtein dependency (#​1009)
• chore(deps): bump the go group with 5 updates (#​989)
• chore(deps): bump anchore/sbom-action from 0.17.3 to 0.17.4 in the ci group (#​988)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.