v2.0.0

Highlights

• Support ORAS CLI v1.3.1
• Migrate action runtime from node20 to node24 (#153)
• Pin undici to >=6.24.1 to address 5 CVEs: GHSA-f269-vfmq-vjvj, GHSA-2mjp-6q6p-2qxm, GHSA-vrm6-8vpv-qv8q, GHSA-v9p9-hfj2-hcw8, GHSA-4992-7rv2-5pvq
• Bump @actions/core from ^2.x to ^3.0.0 (ESM-only)
• Bump @actions/tool-cache from ^3.x to ^4.0.0 (ESM-only)
• Replace @vercel/ncc with esbuild as the build bundler

What's Changed

• Add version 1.3.1 with checksums (#150)
• feat: migrate action runtime from node20 to node24 (#153)
• fix: pin undici to >=6.24.1 to address CVEs (#157)
• chore(deps): bump @actions/core to 3.x and @actions/tool-cache to 4.x (#159)
• chore(deps): Bump @actions/core from 1.11.1 to 2.0.1 (#130)
• chore(deps): Bump typescript from 5.9.2 to 6.0.2 (#151)
• chore(deps): Bump actions/checkout from 5 to 6 (#128)
• chore(deps): Bump actions/setup-node from 5 to 6 (#123)
• chore(deps): Bump @types/node from 24.12.0 to 25.5.2 (multiple PRs)

Full Changelog: v1.2.4...v2.0.0

v1.2.4

Highlights

• Support oras v1.3.0

Other Changes

• Update dependencies

What's Changed

• chore(deps): Bump @types/node from 22.15.2 to 22.15.17 by @dependabot[bot] in #97
• chore(deps): Bump @types/node from 22.15.17 to 22.15.19 by @dependabot[bot] in #98
• chore(deps): Bump @types/node from 22.15.19 to 22.15.21 by @dependabot[bot] in #99
• chore(deps): Bump @types/node from 22.15.21 to 22.15.29 by @dependabot[bot] in #100
• chore(deps): Bump @types/node from 22.15.29 to 22.15.30 by @dependabot[bot] in #101
• chore(deps): Bump @types/node from 22.15.30 to 24.0.1 by @dependabot[bot] in #102
• chore(deps): Bump @types/node from 24.0.1 to 24.0.3 by @dependabot[bot] in #103
• chore(deps): Bump @types/node from 24.0.3 to 24.0.7 by @dependabot[bot] in #104
• chore(deps): Bump @types/node from 24.0.7 to 24.0.13 by @dependabot[bot] in #106
• chore(deps): Bump @types/node from 24.0.13 to 24.0.15 by @dependabot[bot] in #107
• chore(deps): Bump @types/node from 24.0.15 to 24.1.0 by @dependabot[bot] in #108
• chore(deps): Bump typescript from 5.8.3 to 5.9.2 by @dependabot[bot] in #109
• chore(deps): Bump @types/node from 24.1.0 to 24.2.1 by @dependabot[bot] in #110
• chore(deps): Bump @types/node from 24.2.1 to 24.3.0 by @dependabot[bot] in #111
• chore(deps): Bump actions/checkout from 4 to 5 by @dependabot[bot] in #112
• chore(deps): Bump @types/node from 24.3.0 to 24.3.1 by @dependabot[bot] in #113
• chore(deps): Bump actions/setup-node from 4 to 5 by @dependabot[bot] in #114
• bump: add oras v1.3.0 to setup-oras by @wangxiaoxuan273 in #115

Full Changelog: v1.2.3...v1.2.4

v1.2.3

Highlights

• Support oras v1.2.3

Other Changes

• Update dependencies

What's Changed

• chore(deps): Bump @types/node from 22.10.7 to 22.10.10 by @dependabot in #79
• chore(deps): Bump @types/node from 22.10.10 to 22.13.0 by @dependabot in #80
• chore(deps): Bump @types/node from 22.13.0 to 22.13.1 by @dependabot in #81
• chore(deps): Bump apache/skywalking-eyes from 0.6.0 to 0.7.0 by @dependabot in #82
• chore(deps): Bump @types/node from 22.13.1 to 22.13.4 by @dependabot in #83
• chore(deps): Bump @types/node from 22.13.4 to 22.13.5 by @dependabot in #84
• chore(deps): Bump @types/node from 22.13.5 to 22.13.8 by @dependabot in #86
• chore(deps): Bump typescript from 5.7.3 to 5.8.2 by @dependabot in #85
• chore(deps): Bump @types/node from 22.13.8 to 22.13.11 by @dependabot in #89
• docs: add Xiaoxuan Wang as a maintainer by @shizhMSFT in #87
• chore(deps): Bump @types/node from 22.13.11 to 22.13.14 by @dependabot in #90
• chore(deps): Bump typescript from 5.8.2 to 5.8.3 by @dependabot in #91
• chore(deps): Bump @types/node from 22.13.14 to 22.14.0 by @dependabot in #92
• chore(deps): Bump @types/node from 22.14.0 to 22.14.1 by @dependabot in #93
• chore(deps): Bump @types/node from 22.14.1 to 22.15.2 by @dependabot in #94
• bump: add oras v1.2.3 to setup-oras by @wangxiaoxuan273 in #95

Full Changelog: v1.2.2...v1.2.3

v1.2.2

Highlights

• Support oras v1.2.1 and oras v1.2.2

Other Changes

• Update dependencies

What's Changed

• chore(deps): Bump @types/node from 22.7.7 to 22.10.2 by @dependabot in #70
• chore(deps): Bump @vercel/ncc from 0.38.2 to 0.38.3 by @dependabot in #66
• chore(deps): Bump @types/node from 22.10.2 to 22.10.5 by @dependabot in #71
• chore(deps): Bump typescript from 5.6.3 to 5.7.2 by @wangxiaoxuan273 in #72
• chore(deps): Bump typescript from 5.7.2 to 5.7.3 by @dependabot in #73
• chore(deps): Bump @types/node from 22.10.5 to 22.10.7 by @dependabot in #74
• chore(deps): bump @actions/tool-cache from 2.0.1 to 2.0.2 by @wangxiaoxuan273 in #76
• bump: add oras v1.2.1, v1.2.2 to setup-oras by @wangxiaoxuan273 in #77

Full Changelog: v1.2.1...v1.2.2

v1.2.1

Bug Fixes

• Fix: s390x architecture is not properly handled (#57)

Other Changes

• Update dependencies

What's Changed

• build(ci): enable dependabot by @qweeah in #32
• chore(deps): Bump @vercel/ncc from 0.36.1 to 0.38.1 by @dependabot in #38
• chore(deps): Bump actions/setup-node from 3 to 4 by @dependabot in #37
• chore(deps): Bump apache/skywalking-eyes from 0.4.0 to 0.6.0 by @dependabot in #34
• chore(deps): Bump actions/checkout from 3 to 4 by @dependabot in #36
• chore(deps): Bump @types/node from 20.5.9 to 20.14.9 by @dependabot in #35
• build(ci): make dependabot run weekly by @qweeah in #40
• chore(deps): Bump by @qweeah in #41
• chore(deps): Bump @types/node from 20.14.9 to 20.14.10 by @dependabot in #42
• chore: update README CLI docs website by @t3hmrman in #43
• chore(deps): Bump @types/node from 20.14.10 to 20.14.11 by @dependabot in #44
• chore(deps): Bump @types/node from 20.14.11 to 22.0.0 by @dependabot in #46
• chore(deps): Bump typescript from 5.5.3 to 5.5.4 by @dependabot in #45
• chore(deps): Bump @types/node from 22.0.0 to 22.5.0 by @dependabot in #50
• chore(deps): Bump @types/node from 22.5.0 to 22.5.2 by @dependabot in #51
• chore(deps): Bump @types/node from 22.5.2 to 22.5.4 by @dependabot in #52
• chore(deps): Bump typescript from 5.5.4 to 5.6.2 by @dependabot in #54
• chore(deps): Bump @types/node from 22.5.4 to 22.7.4 by @dependabot in #55
• chore(deps): Bump typescript from 5.6.2 to 5.6.3 by @dependabot in #60
• chore(deps): Bump @types/node from 22.7.4 to 22.7.7 by @dependabot in #61
• fix: s390x architecture is not handled by @mkulke in #57
• chore(deps): bump @actions/core and @vercel/ncc by @qweeah in #62

New Contributors

• @t3hmrman made their first contribution in #43
• @mkulke made their first contribution in #57

Full Changelog: v1.2.0...v1.2.1

v1.2.0

New Features

• Support oras v1.2.0
• Support installing custom versions of ORAS by specifying url for downloading and checksum for integration check

Other Changes

• Upgrade to Node 20

What's Changed

• bump: run with node20 by @liangyuanpeng in #25
• feat: support downloading from customized url by @wangxiaoxuan273 in #27
• bump: add oras v1.2.0 to setup-oras by @wangxiaoxuan273 in #28
• chore: update README to add an example by @wangxiaoxuan273 in #30

New Contributors

• @liangyuanpeng made their first contribution in #25

Full Changelog: v1.1.0...v1.2.0

v1.1.0

New Features

• Re-implementation of setup-oras using TypeScript
• More secure oras CLI binary acquisition by verifying checksums
• Supporting more oras CLI versions: v1.0.1 and v1.1.0

What's Changed

• doc: update doc to use released tag v1 by @qweeah in #10
• chore: update icon on marketplace by @qweeah in #11
• fix broken logo link by @FeynmanZhou in #12
• docs: fix broken link in README by @wangxiaoxuan273 in #13
• doc: add SECURITY.md file by @TerryHowe in #16
• chore(deps): Bump semver from 6.3.0 to 6.3.1 by @dependabot in #15
• refactor: revamp setup action with typescript by @qweeah in #18
• chore: add 1.0.0 as a viable version by @qweeah in #20
• build: update major and minor tags update publishing by @qweeah in #22

New Contributors

• @FeynmanZhou made their first contribution in #12
• @wangxiaoxuan273 made their first contribution in #13
• @TerryHowe made their first contribution in #16
• @dependabot made their first contribution in #15

Full Changelog: v1.0.0...v1.1.0

v1.0.0

What's Changed

• feat: implement setup-oras by @shizhMSFT in #1
• chore: add shizhMSFT to CODEOWNERS and OWNERS.md by @shizhMSFT in #3
• bump!: update default version to 1.0.0 by @qweeah in #6

New Contributors

• @shizhMSFT made their first contribution in #1
• @qweeah made their first contribution in #6

Full Changelog: https://github.com/oras-project/setup-oras/commits/v1.0.0