Skip to content

chore(deps): update dependencies (minor) - #19

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-updates
Open

chore(deps): update dependencies (minor)#19
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-updates

Conversation

@renovate

@renovate renovate Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
github/codeql-action action minor v4.37.7 → v4.39.1
open-component-model/open-component-model minor 0.15.0 → 0.21.0
ossf/scorecard-action action minor v2.4.4 → v2.5.0
zizmorcore/zizmor-action action minor v0.6.4 → v0.8.0

Release Notes

github/codeql-action

v4.39.1

Compare Source

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

v4.38.3

Compare Source

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
  • Update default CodeQL bundle version to 2.27.2. #​4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

v4.38.2

Compare Source

v4.38.1

Compare Source

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

v4.38.0

Compare Source

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
  • Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

v4.37.8

Compare Source

No user facing changes.

open-component-model/open-component-model

v0.21.0: OCM 0.21.0

Compare Source

Promoted from v0.21.0-rc.3 on 2026-10-23

[0.21.0] - 2026-10-23

🚀 Features
  • (transfer) [breaking] Replace --upload-as and copyMode with uploader configurations (#​3702)
  • (gpg) [breaking] Sign and verify GPG signatures with the system gpg binary (#​3691)
  • Git transfer (#​3709)
  • [breaking] Build CLI and controller for FIPS 140-3 (#​3747)
  • (cli) Add full CLI image with FIPS gpg and cosign, keep scratch image as -slim (#​3789)
  • (git) [breaking] Git uploader (simple-mode) (#​3794)
  • (oci) Read and transfer relativeOciReference (v1 compat) (#​3804)
  • (transfer) Add Git uploader (#​3841)
  • Add OCI pre-defined annotations to controller and cli images (#​3856)
  • (git) Add specific git credentials (#​3776)
  • (credentials) Support ** in identity paths and convert legacy pathprefix (#​3746)
  • (gpg) [breaking] Sign and verify GPG FIPS 140 compliant in pure Go on the Go Cryptographic Module (#​3858)
  • (sigstore) Use OCM's FIPS cosign build everywhere (#​3891)
  • (cli) Verify digest-pinned component references (#​3889)
  • Add RFC 3161 TSA timestamping for OCM signatures (#​3636)
  • (cli) Warn when a constructor uses the deprecated GitHub access (#​3890)
  • Add namespaced deployer (#​3779)
🐛 Bug Fixes
  • (controller) Deflake workerpool event channel notification test (#​3748)
  • (helm) Resolve HTTP chart versions with build metadata (#​3750)
  • Allow direct CTF reference as source (#​3743)
  • (gpg) Honor tempFolder and accept spaced/0x key fingerprints (#​3755)
  • Canonicalize test header keys flagged by canonicalheader (#​3807)
  • (oci) Digest compatibility (#​3681)
  • (cli) [breaking] Read config from stdin only with --config - (#​3810)
  • (gpg) Accept fips-mode:y when gpgconf exits non-zero on FIPS hosts (#​3823)
  • (transfer) Set referenceName only for OCI-family by-value transfers (#​3851)
  • (controllers) Enable controllers to verify more signatures (#​3687)
  • (cli) Accept unversioned plugin.config.ocm.software type (#​3877)
  • (oci) Fall back to referrers tag schema when the referrers API answers NAME_UNKNOWN (#​3855)
  • Access type OCIImageLayer does not work as expected (#​2873) (#​3215)
  • (oci) Follow referrer subjects with the source descriptor (#​3902)
  • (test) Fix integration test report and test flakyness (#​3906)
  • (helm) Resolve local Helm/v1 input path against the working directory (#​3901)
  • Enable streaming passthrough for blob cache (#​3816)
  • (test) Fix integration test reporting and use an empty config for ocm v1 test (#​3910)
  • (oci) Make manifest tagging idempotent on immutable registries (#​3900)
  • (transfer) [breaking] Preserve resource digest, never inject during transfer (#​3921)
  • Revert "fix: Enable streaming passthrough for blob cache (#​3816)" (#​3929)
  • (oci) Revert "follow referrer subjects with the source descriptor" (#​3902) (#​3930)
  • (transfer) [breaking] Restore resource digest calculation during transfer (… (#​3988)
📚 Dependencies
  • (deps) Update github.com/gobwas/glob to v1 (#​3751)
  • (deps) Update go-openapi packages (#​3762)
  • (deps) Update digest pins (#​3760)
  • (deps) Update module github.com/go-jose/go-jose/v4 to v4.1.5 (#​3763)
  • (deps) Update aws-sdk-go-v2 monorepo (#​3765)
  • (deps) Update kubernetes dependencies (minor) (fixes 3770) (#​3775)
  • (deps) Update golang x repositories (#​3761)
  • (deps) Update module github.com/docker/cli to v29.8.0+incompatible (#​3771)
  • (deps) Update module github.com/moby/moby/api to v1.56.0 (#​3768)
  • (deps) Update module github.com/klauspost/compress to v1.20.0 (#​3767)
  • (deps) Update module github.com/google/go-github/v90 to v91 (fix 3772) (#​3774)
  • (deps) Update module github.com/moby/moby/client to v0.6.0 (#​3769)
  • (deps) Update digest pins (#​3820)
  • (deps) Update helm to v4.3.0 (#​3843)
  • (deps) Update aws-sdk-go-v2 monorepo (#​3870)
  • (deps) Update module github.com/moby/sys/userns to v0.2.1 (#​3864)
  • (deps) Update module github.com/onsi/ginkgo/v2 to v2.32.2 (#​3866)
  • (deps) Update go-openapi packages to v0.29.2 (#​3867)
  • (deps) Update ghcr.io/open-component-model/kubernetes/controller:latest docker digest to c82d83b (#​3860)
  • (deps) Update digest pins (#​3859)
  • (deps) Update module github.com/mattn/go-runewidth to v0.0.30 (#​3863)
  • (deps) Update module github.com/containerd/log to v0.2.0 (#​3868)
  • (deps) Update aws-sdk-go-v2 monorepo (#​3865)
  • (deps) Update go-openapi packages (#​3862)
  • (deps) Update sigs.k8s.io/json digest to 11ed52e (#​3861)
⚙️ Miscellaneous Tasks
  • (website) Render input and access types from JSON schemas (#​3745)
  • (tests) Introduce gotestsum for retry and cleaner logs (#​3752)
  • Enable linting for test files (#​3777)
  • (lint) Activate testifylint for _test.go files (#​3785)
  • (lint) Enable thelper linter for _test.go files (#​3786)
  • (lint) Activate err* linters for _test.go files (#​3788)
  • (lint) Activate unconvert and usetesting linters (#​3798)
  • (lint) Activate noctx linter for _test.go files (#​3800)
  • (ci) Provision sigstore scaffolding concurrently with the integration tests (#​3758)
  • (lint) Activate ineffassign, unused, and predeclared (#​3802)
  • (lint) Activate gocritic & canonicalheader linters (#​3806)
  • (lint) Activate staticcheck linter in _test.go files (#​3809)
  • (lint) Activate tparallel linter for _test.go files (#​3818)
  • (lint) Activate misspell and ginkgolinter linters (#​3831)
  • (lint) Activate depguard linter for _test.go files (#​3853)
  • Measure unit coverage across packages with -coverpkg (#​3871)
  • (controller) Remove unused object data hashing (#​3874)
  • Add run once to cosign install to prevent race during setup (#​3908)
  • Fix inconsistent empty list conversion (#​3904)
  • (sigstore) Bump OCM cosign to v3.1.3+ocm.27 (#​3928)
  • (releases-021) Fix(blob): truncate download targets and remove rejected content (#​3999)
📚 Documentation
  • (adr) Define OCI local blob chunking (#​3626)
Test
  • (controller) Run e2e specs in parallel and slim the kind setup (#​3757)
  • Fix filedescriptor leak in repository test (#​3828)
  • (cli) Cover hugo reference doc generation (#​3873)
  • (descriptor) Cover normalisation algorithm registry (#​3872)
  • (cli) Cover plugin manager config parsing and merge (#​3875)
  • (cli) Cover plugin registry list and get commands (#​3876)
  • (oci) Verify component versions in a Nexus docker hosted repository (#​3925)

Get This Release

Install the OCM CLI
curl -sfL https://ocm.software/install-cli.sh | OCM_VERSION=0.21.0 bash

For alternative installation options, see the installation guide.

You can also run the OCM CLI in a container without installing it:

docker run --rm -t ghcr.io/open-component-model/cli:0.21.0 --help

See the container image guide for more details.

Deploy the OCM Controller

Install into a Kubernetes cluster via Helm:

helm install ocm-k8s-toolkit oci://ghcr.io/open-component-model/kubernetes/controller/chart \
--version 0.21.0 \
--namespace ocm-k8s-toolkit-system \
--create-namespace

See the controller setup guide for full configuration options.

OCM Component Distribution (for existing OCM users)

Every OCM release is published as OCM component versions to ghcr.io/open-component-model - the same distribution mechanism OCM enables for your own software. Components in this release:

Component Contents
ocm.software/ocm:0.21.0 Product wrapper referencing CLI + controller
ocm.software/cli:0.21.0 CLI binaries and OCI image
ocm.software/kubernetes/controller:0.21.0 Controller image and Helm chart

Inspect the full product component:

ocm get component-version ghcr.io/open-component-model//ocm.software/ocm:0.21.0 -o yaml

Download a CLI binary directly via OCM (requires OCM CLI already installed; replace os and architecture as needed — e.g. linux/amd64, darwin/arm64):

ocm download resource ghcr.io/open-component-model//ocm.software/cli:0.21.0 \
--identity os=linux,architecture=amd64
Community & Contributors

This release we had a total of 9 contributors!
If you want to engage with us, check our community page!

v0.19.1: OCM 0.19.1

Compare Source

Promoted from v0.19.1-rc.1 on 2026-10-09

[0.19.1] - 2026-10-09

🐛 Bug Fixes
  • (cli) [breaking] Read config from stdin only with --config - (cherry-pick #​3810) (#​3827)

Get This Release

Install the OCM CLI
curl -sfL https://ocm.software/install-cli.sh | OCM_VERSION=0.19.1 bash

For alternative installation options, see the installation guide.

You can also run the OCM CLI in a container without installing it:

docker run --rm -t ghcr.io/open-component-model/cli:0.19.1 --help

See the container image guide for more details.

Deploy the OCM Controller

Install into a Kubernetes cluster via Helm:

helm install ocm-k8s-toolkit oci://ghcr.io/open-component-model/kubernetes/controller/chart \
--version 0.19.1 \
--namespace ocm-k8s-toolkit-system \
--create-namespace

See the controller setup guide for full configuration options.

OCM Component Distribution (for existing OCM users)

Every OCM release is published as OCM component versions to ghcr.io/open-component-model - the same distribution mechanism OCM enables for your own software. Components in this release:

Component Contents
ocm.software/ocm:0.19.1 Product wrapper referencing CLI + controller
ocm.software/cli:0.19.1 CLI binaries and OCI image
ocm.software/kubernetes/controller:0.19.1 Controller image and Helm chart

Inspect the full product component:

ocm get component-version ghcr.io/open-component-model//ocm.software/ocm:0.19.1 -o yaml

Download a CLI binary directly via OCM (requires OCM CLI already installed; replace os and architecture as needed — e.g. linux/amd64, darwin/arm64):

ocm download resource ghcr.io/open-component-model//ocm.software/cli:0.19.1 \
--identity os=linux,architecture=amd64
Community & Contributors

This release we had a total of 1 contributors!
If you want to engage with us, check our community page!

v0.19.0: OCM 0.19.0

Compare Source

Promoted from v0.19.0-rc.1 on 2026-10-06

[0.19.0] - 2026-10-06

🚀 Features
  • (oci) Chunked blob push with streaming for unknown digests (#​3642)
  • Ocm s3 v1 support (#​3682)
  • (transfer) Add configurable uploader configurations (#​3643)
  • (wget) Add checksum policy for wget inputs (#​3644)
  • (versioning) Pluggable, config-driven versioning schemes (#​3635)
  • Allow missing subjects in oci manifests (#​3684)
  • Git access (#​3577)
  • (cli) Apply OCM config piped into stdin (#​3679)
  • Discovery controller (#​3600)
  • Enable concurrent transfer processing (#​3698)
  • Git input (#​1259) (#​3675)
  • (transfer) [breaking] Add Artifactory and Nexus repository uploaders (#​3690)
  • (transfer) [breaking] Replace --upload-as and copyMode with uploader configurations (#​3742)
🐛 Bug Fixes
  • (oci) Allow digest-only uploads in the materialized upload path (#​3591)
  • Credential type registration (#​1146) (#​3398)
  • 3674 - digest override in oci upload (#​3680)
  • (cli) Drop cobra version template to restore linker dead-code elimination (#​3693)
  • Better specify // seperator in ocm download resource docs (#​3700)
  • (http) Return response bytes unmodified by default (#​3701)
📚 Dependencies
  • (deps) Update module github.com/sirupsen/logrus to v1.10.2 (#​3720)
  • (deps) Update module github.com/ebitengine/purego to v0.11.0 (#​3723)
  • (deps) Update module github.com/prometheus/common to v0.71.0 (#​3725)
  • (deps) Update module github.com/klauspost/cpuid/v2 to v2.4.0 (#​3724)
  • (deps) Update module github.com/gofrs/flock to v0.13.1 (#​3716)
  • (deps) Update module github.com/docker/docker-credential-helpers to v0.9.9 (#​3715)
  • (deps) Update module github.com/mattn/go-runewidth to v0.0.29 (#​3717)
  • (deps) Update digest pins (#​3712)
  • (deps) Update ghcr.io/open-component-model/kubernetes/controller:latest docker digest to 0901f1c (#​3713)
  • (deps) Update module github.com/shirou/gopsutil/v4 to v4.26.8 (#​3719)
  • (deps) Update google golang repositories to 8a89bd6 (#​3714)
  • (deps) Update aws-sdk-go-v2 monorepo (#​3721)
  • (deps) Update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.71.0 (#​3726)
  • (deps) Update module github.com/prometheus/client_model to v0.6.3 (#​3718)
  • (deps) Update module github.com/onsi/gomega to v1.43.0 (#​3730)
  • (deps) Update aws-sdk-go-v2 monorepo (#​3727)
  • (deps) Update module github.com/coreos/go-oidc/v3 to v3.21.0 (#​3729)
⚙️ Miscellaneous Tasks
  • (config) [breaking] Remove the verification field and make config the canonical verifier (#​3576)
  • Migrate to rustfs (#​3606)
  • Optimize CEL environment construction in transfer graph (#​3686)
  • [breaking] Don't repeatedly check whole graph for cycle detection (#​3688)
  • Enable digest verification across blob technologies during download (#​3641)
  • Log time spent in progress reports (#​3697)
  • [breaking] Remove support for nested generic configs in v2 (#​3639)
  • Add HTTP alias to Wget access type (#​3672)
  • Progress bar for transfer graph construction (#​3696)
  • Add pprof build tag to enable proper profiling later (#​3707)
  • Add HTTP alias for Wget input type (#​3706)
  • Don't double discover config files (#​3737)
📚 Documentation
  • (website) Add caching configuration reference (#​3734)

Get This Release

Install the OCM CLI
curl -sfL https://ocm.software/install-cli.sh | OCM_VERSION=0.19.0 bash

For alternative installation options, see the installation guide.

You can also run the OCM CLI in a container without installing it:

docker run --rm -t ghcr.io/open-component-model/cli:0.19.0 --help

See the container image guide for more details.

Deploy the OCM Controller

Install into a Kubernetes cluster via Helm:

helm install ocm-k8s-toolkit oci://ghcr.io/open-component-model/kubernetes/controller/chart \
--version 0.19.0 \
--namespace ocm-k8s-toolkit-system \
--create-namespace

See the controller setup guide for full configuration options.

OCM Component Distribution (for existing OCM users)

Every OCM release is published as OCM component versions to ghcr.io/open-component-model - the same distribution mechanism OCM enables for your own software. Components in this release:

Component Contents
ocm.software/ocm:0.19.0 Product wrapper referencing CLI + controller
ocm.software/cli:0.19.0 CLI binaries and OCI image
ocm.software/kubernetes/controller:0.19.0 Controller image and Helm chart

Inspect the full product component:

ocm get component-version ghcr.io/open-component-model//ocm.software/ocm:0.19.0 -o yaml

Download a CLI binary directly via OCM (requires OCM CLI already installed; replace os and architecture as needed — e.g. linux/amd64, darwin/arm64):

ocm download resource ghcr.io/open-component-model//ocm.software/cli:0.19.0 \
--identity os=linux,architecture=amd64
Community & Contributors

This release we had a total of 9 contributors!
If you want to engage with us, check our community page!

v0.17.0: OCM 0.17.0

Compare Source

Promoted from v0.17.0-rc.1 on 2026-09-25

[0.17.0] - 2026-09-25

🚀 Features
  • (go) Use go toolchain directive (#​3592)
  • (cli) Human-readable version output and --version/-v flag (#​3618)
  • (sbom) Discover sboms for transferred local blobs (#​3572)
  • Fix transferID collisions by implementing ADR 28 (#​3612)
  • Render resources within component on -o widetree (#​3527)
🐛 Bug Fixes
  • Rendering errors in ocm add cv for unregistered types (#​3526)
  • Rename S3Bucket to S3 types (#​3597)
  • Replace removed minio image (#​3605)
  • Http unlimited default timeout (#​3615)
  • Reject malformed credentials at ingestion time (#​3623)
  • (oci) Name the requested artifact in digest-pinned resource layouts (#​3588)
📚 Dependencies
  • (deps) Update dependency golangci/golangci-lint to v2.13.1 (fix #​3637) (#​3638)
  • (deps) Update module github.com/google/cel-go to v0.32.0 (fix #​3648) (#​3650)
  • (deps) Update github.com/opencontainers/go-digest digest to 3650f26 (#​3655)
  • (deps) Update google golang repositories to cecb647 (#​3656)
  • (deps) Update ghcr.io/open-component-model/kubernetes/controller:latest docker digest to d638ee1 (#​3654)
  • (deps) Update module github.com/aws/smithy-go to v1.27.9 (#​3659)
  • (deps) Update dependency go to v1.26.7 (#​3657)
  • (deps) Update module github.com/onsi/ginkgo/v2 to v2.32.1 (#​3664)
  • (deps) Update kubernetes dependencies to v0.36.4 (#​3663)
  • (deps) Update module github.com/mattn/go-runewidth to v0.0.28 (#​3661)
  • (deps) Update module github.com/fxamacker/cbor/v2 to v2.9.3 (#​3660)
  • (deps) Update module cel.dev/expr to v0.25.3 (#​3658)
  • (deps) Update go-openapi packages to v0.29.1 (#​3666)
  • (deps) Update module github.com/sirupsen/logrus to v1.10.1 (#​3668)
  • (deps) Update module github.com/moby/sys/userns to v0.2.0 (#​3667)
  • (deps) Bump golang.org/x/crypto (#​3669)
  • (deps) Update digest pins (#​3653)
⚙️ Miscellaneous Tasks
  • Clean-up outdated logic in Taskfiles (#​3601)
  • Generate dependency table & readme overview from linting rules (#​3541)
  • Add link to credential migration docs (#​3629)
  • Update CONTRIBUTING.md to reflect lockstep release (#​3630)
  • (website) Use aliased to keep old urls (#​3632)
  • [breaking] Bump go version to 1.27 (#​3671)

Get This Release

Install the OCM CLI
curl -sfL https://ocm.software/install-cli.sh | OCM_VERSION=0.17.0 bash

For alternative installation options, see the installation guide.

You can also run the OCM CLI in a container without installing it:

docker run --rm -t ghcr.io/open-component-model/cli:0.17.0 --help

See the container image guide for more details.

Deploy the OCM Controller

Install into a Kubernetes cluster via Helm:

helm install ocm-k8s-toolkit oci://ghcr.io/open-component-model/kubernetes/controller/chart \
--version 0.17.0 \
--namespace ocm-k8s-toolkit-system \
--create-namespace

See the controller setup guide for full configuration options.

OCM Component Distribution (for existing OCM users)

Every OCM release is published as OCM component versions to ghcr.io/open-component-model - the same distribution mechanism OCM enables for your own software. Components in this release:

Component Contents
ocm.software/ocm:0.17.0 Product wrapper referencing CLI + controller
ocm.software/cli:0.17.0 CLI binaries and OCI image
ocm.software/kubernetes/controller:0.17.0 Controller image and Helm chart

Inspect the full product component:

ocm get component-version ghcr.io/open-component-model//ocm.software/ocm:0.17.0 -o yaml

Download a CLI binary directly via OCM (requires OCM CLI already installed; replace os and architecture as needed — e.g. linux/amd64, darwin/arm64):

ocm download resource ghcr.io/open-component-model//ocm.software/cli:0.17.0 \
--identity os=linux,architecture=amd64
Community & Contributors

This release we had a total of 8 contributors!
If you want to engage with us, check our community page!

v0.16.0: OCM 0.16.0

Compare Source

Promoted from v0.16.0-rc.1 on 2026-09-15

[0.16.0] - 2026-09-15

🚀 Features
🐛 Bug Fixes
  • versioncheck merge semantics (#​3485)
  • Adjust CLI to TempFolder & WorkingDiretory being pointers (#​3492)
  • (cli) Use exact-identity-first matching for resource lookups (#​3482)
  • (controller) Requeue with backoff when a referenced object is not ready (#​3531)
📚 Dependencies
  • (deps) Update module github.com/hashicorp/golang-lru/v2 to v2.0.7 (#​3447)
  • (deps) Update module ocm.software/open-component-model/cli to v0.14.0 (#​3474)
  • (deps) Update module ocm.software/open-component-model/bindings/go to v0.0.9 (#​3488)
  • (deps) Update module go.yaml.in/yaml/v3 to v3.0.5 (#​3506)
  • (deps) Update module github.com/moby/go-archive to v0.3.2 (#​3501)
  • (deps) Update module github.com/moby/moby/client to v0.5.1 (#​3502)
  • (deps) Update go-openapi packages to v0.28.0 (#​3508)
  • (deps) Update module github.com/buger/jsonparser to v1.6.1 (#​3509)
  • (deps) Update kubernetes controller dependencies (non-major) (#​3510)
  • (deps) Update module github.com/shirou/gopsutil/v4 to v4.26.7 (#​3503)
⚙️ Miscellaneous Tasks
  • Integrate the verifier spec as an ocm config as well (#​3471)
  • Request scoped ocm configuration for the controller (#​3515)
  • [breaking] Move CLI & Controller into bindings/go (#​3522)
  • Fix creator string referencing old path (#​3537)
📚 Documentation
  • (docs) Add tutorial for SBOM (#​3525)

Get This Release

Install the OCM CLI
curl -sfL https://ocm.software/install-cli.sh | OCM_VERSION=0.16.0 bash

For alternative installation options, see the installation guide.

You can also run the OCM CLI in a container without installing it:

docker run --rm -t ghcr.io/open-component-model/cli:0.16.0 --help

See the container image guide for more details.

Deploy the OCM Controller

Install into a Kubernetes cluster via Helm:

helm install ocm-k8s-toolkit oci://ghcr.io/open-component-model/kubernetes/controller/chart \
--version 0.16.0 \
--namespace ocm-k8s-toolkit-system \
--create-namespace

See the controller setup guide for full configuration options.

OCM Component Distribution (for existing OCM users)

Every OCM release is published as OCM component versions to ghcr.io/open-component-model - the same distribution mechanism OCM enables for your own software. Components in this release:

Component Contents
ocm.software/ocm:0.16.0 Product wrapper referencing CLI + controller
ocm.software/cli:0.16.0 CLI binaries and OCI image
ocm.software/kubernetes/controller:0.16.0 Controller image and Helm chart

Inspect the full product component:

ocm get component-version ghcr.io/open-component-model//ocm.software/ocm:0.16.0 -o yaml

Download a CLI binary directly via OCM (requires OCM CLI already installed; replace os and architecture as needed — e.g. linux/amd64, darwin/arm64):

ocm download resource ghcr.io/open-component-model//ocm.software/cli:0.16.0 \
--identity os=linux,architecture=amd64
Community & Contributors

This release we had a total of 3 contributors!
If you want to engage with us, check our community page!

ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

  • The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
    @​justaugustus in #​1716
  • The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
    recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
  • The Scorecard version in results now always matches the Scorecard release the action is built
    with. by @​justaugustus in #​1718
  • The action no longer prints the GitHub token variable while validating its options. by
    @​arpitjain099 in #​1709
  • results_format accepts intoto, which wraps the JSON results in an in-toto attestation
    statement. by @​puerco in #​1702
Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

zizmorcore/zizmor-action

v0.8.0

Compare Source

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version
of zizmor or version: prerelease to get whatever latest
prerelease the action knows about.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

v0.7.1

[Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.7.0

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 5am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the ok-to-image PR is allowed to run container build label Sep 14, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 2 times, most recently from 2de4ba4 to 1b479a9 Compare September 21, 2026 22:32
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 2 times, most recently from 568ebd7 to 7878726 Compare September 28, 2026 21:46
@renovate renovate Bot added the ok-to-e2e label Oct 2, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from 7878726 to 488892f Compare October 2, 2026 12:52
@Perseus985

Perseus985 commented Oct 8, 2026

Copy link
Copy Markdown
Collaborator

Waiting on 0.19.0 because it has bugfixes with the digest transfer that we should definetly have

@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from 488892f to cdb1192 Compare October 9, 2026 13:40
Perseus985
Perseus985 previously approved these changes Oct 11, 2026
View reviewed changes

@Perseus985 Perseus985 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With 019.0 it should be good. But we have to look at:
https://ocm.software/docs/how-to/migrate-from-upload-as/

@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from cdb1192 to 38859c1 Compare October 11, 2026 10:46
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 5 times, most recently from 02c5850 to dbb2d4b Compare October 18, 2026 13:05
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch 2 times, most recently from 26957f7 to bcfe1f8 Compare October 24, 2026 17:59
@renovate
renovate Bot force-pushed the renovate/all-minor-updates branch from bcfe1f8 to ba0e6ac Compare October 26, 2026 09:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Perseus985 Perseus985 Perseus985 left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

ok-to-e2e ok-to-image PR is allowed to run container build

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Perseus985