The NuGet package is available at nuget.org.

New Features

• .NET 10 support via multi-targeting (net8.0;net10.0) (#427).
  The package now ships both lib/net8.0/ and lib/net10.0/, and NuGet selects the best match for
  the consuming project. net10.0 was added alongside net8.0 rather than replacing it, so
  .NET 8 (and .NET 9) applications resolve lib/net8.0/ exactly as before and need no SDK,
  runtime, or code change. Dependencies are pinned per target framework, so a net8.0 consumer's
  dependency closure is unchanged. net8.0 will only be removed in a future MAJOR release.

Behavioral Changes

• Graph copy now waits for a shared dependency to finish copying before treating it as done (#454).
  When the same descriptor is reached more than once during a copy (for example, a layer shared by
  several platform manifests in an index), every parent now awaits the single in-flight copy of that
  descriptor instead of returning immediately. This affects CopyAsync, CopyGraphAsync, and
  extended copy, and has the following observable effects for callers that supply
  CopyGraphOptions callbacks:
  • OnCopySkippedAsync for a duplicate is now invoked only after the shared copy completes
    successfully. Previously it was invoked as soon as the duplicate was encountered, while the
    upload could still be in flight.
  • If the shared copy fails or is canceled — including a failure in FindSuccessorsAsync,
    PreCopyAsync, or PostCopyAsync — the exception now propagates to every parent that depends
    on it, and those parents do not push their manifests. Previously a duplicate was reported as
    skipped regardless of whether the original copy succeeded.
  • Copy graphs must be acyclic. A custom FindSuccessorsAsync that produces a cycle was never
    supported, but could previously complete; it may now wait indefinitely.
• net10.0 applications now resolve Microsoft.Extensions.Caching.* 10.0.0 (#427).
  The net10.0 asset depends on Microsoft.Extensions.Caching.Abstractions and
  Microsoft.Extensions.Caching.Memory 10.0.0. A net10.0 project that directly references an
  older version of either package (for example 9.0.0) will fail restore with NU1605 (package
  downgrade) after upgrading; update the direct reference to 10.0.0 or later. net8.0 and net9.0
  projects are unaffected and continue to resolve 8.0.x.
• The explicit System.Text.Json dependency was removed (#427).
  0.8.0 declared System.Text.Json 8.0.6 for net8.0. That assembly is part of the shared
  framework on net8.0 and later, and the .NET 10 SDK flags the reference as prunable (NU1510), so
  it was removed per Microsoft guidance.
  No code change is required. Keep your .NET runtime patched to receive System.Text.Json security
  fixes.

Bug Fixes

• Await shared dependencies before pushing parent manifests (#454).
  Fixes #453. A single recursive copy of an
  OCI index whose platform manifests share a layer could push a manifest before that shared layer had
  committed to the destination, failing with MANIFEST_BLOB_UNKNOWN. Copy work is now deduplicated
  per descriptor with a single shared task that every parent awaits, while waiting parents do not
  hold concurrency slots, so bounded parallelism is preserved.

Other Changes

• build(deps): bump github/codeql-action from 4.37.4 to 4.37.7 by @dependabot in #425
• build(deps): bump apache/skywalking-eyes from 0.8.0 to 0.9.0 by @dependabot in #431
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.400 to 10.0.401 by @dependabot in #432
• build(deps): bump github/codeql-action from 4.37.7 to 4.38.0 by @dependabot in #435
• Bump Microsoft.NET.Test.Sdk from 18.9.0 to 18.10.1 by @dependabot in #436
• Bump Moq from 4.20.72 to 4.21.0 by @dependabot in #440
• Bump coverlet.msbuild from 10.0.1 to 10.1.0 by @dependabot in #442
• build(deps): bump super-linter/super-linter from 8 to 9 by @dependabot in #443
• Bump Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0 by @dependabot in #446
• Bump xunit.runner.visualstudio from 4.0.0 to 4.0.1 by @dependabot in #447
• build(deps): bump github/codeql-action from 4.38.0 to 4.39.1 by @dependabot in #450
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.401 to 10.0.403 by @dependabot in #451
• build(deps): bump dotnet-sdk from 10.0.100 to 10.0.401 by @dependabot in #452
• build(deps): bump github/codeql-action from 4.39.1 to 4.39.2 by @dependabot in #456

All Changes

• build(deps): bump github/codeql-action from 4.37.4 to 4.37.7 by @dependabot in #425
• feat: support .NET 10 via multi-targeting (net8.0;net10.0) by @akashsinghal in #427
• build(deps): bump apache/skywalking-eyes from 0.8.0 to 0.9.0 by @dependabot in #431
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.400 to 10.0.401 by @dependabot in #432
• build(deps): bump github/codeql-action from 4.37.7 to 4.38.0 by @dependabot in #435
• Bump Microsoft.NET.Test.Sdk from 18.9.0 to 18.10.1 by @dependabot in #436
• Bump Moq from 4.20.72 to 4.21.0 by @dependabot in #440
• Bump coverlet.msbuild from 10.0.1 to 10.1.0 by @dependabot in #442
• build(deps): bump super-linter/super-linter from 8 to 9 by @dependabot in #443
• Bump Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0 by @dependabot in #446
• Bump xunit.runner.visualstudio from 4.0.0 to 4.0.1 by @dependabot in #447
• build(deps): bump github/codeql-action from 4.38.0 to 4.39.1 by @dependabot in #450
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.401 to 10.0.403 by @dependabot in #451
• build(deps): bump dotnet-sdk from 10.0.100 to 10.0.401 by @dependabot in #452
• fix: await shared dependencies before pushing parent manifests by @kichalla in #454
• build(deps): bump github/codeql-action from 4.39.1 to 4.39.2 by @dependabot in #456

Full Changelog: v0.8.0...v0.9.0

The NuGet package is available at nuget.org.

Behavioral Changes

• A relative redirect Location is now resolved instead of rejected (#423).
  BlobStore.GetBlobLocationAsync previously threw
  HttpIOException("redirect Location header must be an absolute URI") for any redirect whose
  Location header was a relative reference. It now resolves the reference against the effective
  request URI, per RFC 9110 §10.2.2,
  matching what this library already does for upload sessions in PushAsync and MountAsync. No
  API signatures changed — a path that used to throw now returns a value. Note that a relative
  location resolves onto the registry host, so the returned URL may require registry credentials
  rather than being the direct storage-backend URL this API is normally used for; the XML docs on
  BlobStore and IBlobLocationProvider now state this.
• The redirect target's scheme is now validated even when PlainHttp is enabled (#423).
  The scheme check previously ran only when PlainHttp was disabled, so with PlainHttp = true a
  Location such as file:///c:/secret, javascript:alert(1), or \\host\share was returned to
  the caller unvalidated. The resolved location must now be HTTPS, or HTTP when PlainHttp is
  enabled. The check lives in the remote BlobStore rather than in the IBlobLocationProvider
  contract, so local and third-party implementations remain free to return other schemes.

Bug Fixes

• Resolve relative redirect Location headers in GetBlobLocationAsync
  (#423). Registries that emit a relative or
  protocol-relative Location on a blob-pull redirect — including the common pre-signed-token form
  such as ?token=xyz — no longer fail with HttpIOException. The redirect is resolved against the
  request URI and then scheme-validated, and the redirect target itself is never contacted while
  obtaining the location.
• Remove unnecessary async from the TrustedHosts_IsReadOnly test
  (#417). The test method had no await
  operators, producing CS1998 (async method lacks await), which is an error under
  warnings-as-errors.

Other Changes

• build(deps): bump github/codeql-action from 4 to 4.37.4 by @dependabot in #419
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.302 to 10.0.400 by @dependabot in #420
• Bump Microsoft.NET.Test.Sdk from 18.8.1 to 18.9.0 by @dependabot in #421
• Bump xunit.runner.visualstudio from 3.1.5 to 4.0.0 by @dependabot in #422

All Changes

• fix: remove unnecessary async from TrustedHosts_IsReadOnly test by @sajayantony in #417
• build(deps): bump github/codeql-action from 4 to 4.37.4 by @dependabot in #419
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.302 to 10.0.400 by @dependabot in #420
• Bump Microsoft.NET.Test.Sdk from 18.8.1 to 18.9.0 by @dependabot in #421
• Bump xunit.runner.visualstudio from 3.1.5 to 4.0.0 by @dependabot in #422
• fix(registry): resolve relative redirect Location in GetBlobLocationAsync by @akashsinghal in #423

Full Changelog: v0.7.0...v0.8.0

The NuGet package is available at nuget.org.

Breaking Changes

• The nested Challenge.Scheme enum is now the top-level ChallengeScheme (#415). The
  Basic / Bearer / Unknown values moved from Challenge.Scheme to a new top-level
  public enum ChallengeScheme in OrasProject.Oras.Registry.Remote.Auth. Replace every
  Challenge.Scheme reference with ChallengeScheme (e.g. Challenge.Scheme.Bearer →
  ChallengeScheme.Bearer).
• Challenge is now a readonly record struct, and ParseChallenge is replaced by Parse / TryParse (#415).
  Challenge changed from a static helper class to a readonly record struct carrying
  ChallengeScheme Scheme and IReadOnlyDictionary<string, string>? Parameters. The
  ParseChallenge(string?) method that returned a (Scheme, Dictionary<string, string>?) tuple was
  removed. Use Challenge.Parse(header) (throws FormatException on a malformed challenge) or
  Challenge.TryParse(header, out var challenge) (non-throwing).
• ICache implementations must switch to ChallengeScheme (#415). ICache.TryGetScheme,
  ICache.SetCache, and ICache.TryGetToken now take (or emit) ChallengeScheme instead of
  Challenge.Scheme. Any custom ICache implementation must update these signatures to compile.
• Malformed-challenge parsing no longer throws, and duplicate parameters no longer fail (#415).
  An unterminated quoted parameter value now makes Challenge.TryParse return false (instead of
  throwing), and a repeated parameter key keeps its last value instead of throwing. Challenge.Parse
  still throws FormatException for a malformed challenge.
• Stale cached-token challenge recovery is now built into the default auth flow (#415). See
  Bug Fixes below. This only changes behavior when a request carried an SDK-cached bearer token
  and standard challenge handling dead-ends; conformant registries are unaffected, and a caller that
  sets its own Authorization header opts out of recovery.

Migration Guide (v0.6.0 → v0.7.0)

1. Replace Challenge.Scheme with ChallengeScheme — the enum is now top-level:

   // before
   if (scheme == Challenge.Scheme.Bearer) { /* ... */ }
   
   // after
   if (scheme == ChallengeScheme.Bearer) { /* ... */ }

2. Update custom ICache implementations to the new enum type on all three members:

   // before
   public bool TryGetScheme(string registry, out Challenge.Scheme scheme, string? partitionId = null) { /* ... */ }
   public void SetCache(string registry, Challenge.Scheme scheme, string scopeKey, string token, string? partitionId = null) { /* ... */ }
   public bool TryGetToken(string registry, Challenge.Scheme scheme, string scopeKey, out string token, string? partitionId = null) { /* ... */ }
   
   // after
   public bool TryGetScheme(string registry, out ChallengeScheme scheme, string? partitionId = null) { /* ... */ }
   public void SetCache(string registry, ChallengeScheme scheme, string scopeKey, string token, string? partitionId = null) { /* ... */ }
   public bool TryGetToken(string registry, ChallengeScheme scheme, string scopeKey, out string token, string? partitionId = null) { /* ... */ }

3. Replace Challenge.ParseChallenge with Challenge.Parse / Challenge.TryParse — read
   Scheme and Parameters off the returned Challenge:

   // before
   var (scheme, parameters) = Challenge.ParseChallenge(header);
   
   // after — throwing on a malformed challenge
   var challenge = Challenge.Parse(header);
   var scheme = challenge.Scheme;
   var parameters = challenge.Parameters;
   
   // after — non-throwing (returns false on a malformed challenge)
   if (Challenge.TryParse(header, out var challenge))
   {
       var scheme = challenge.Scheme;
       var parameters = challenge.Parameters;
   }

4. (Optional) Opt out of stale-token recovery — if you do not want the one-shot credential-free
   probe for a given request, set an explicit Authorization header; the SDK skips recovery whenever
   the caller supplies authorization.

Bug Fixes

• Recover unusable stale-token bearer challenges with a one-shot, credential-free cold probe
  (#415). Some registries return an unusable 401 when an expired SDK-cached
  anonymous/bearer token is presented — for example nvcr.io points the stale-token challenge at
  authn.nvidia.com, which cannot mint an anonymous token, while a credential-free request returns
  the usable nvcr.io/proxy_auth challenge. After standard 401 handling dead-ends, the client now
  replays a single safe GET/HEAD without authorization to surface the usable challenge and feeds
  it back through the existing realm-validation, credential-lookup, token-exchange, caching, and
  retry path. Recovery is bounded (exactly one probe, replayable GET/HEAD only), runs only when
  attempt one attached an SDK-cached bearer token, and is bypassed when the caller sets its own
  Authorization header. Conformant registries add no extra request.

Other Changes

• docs: add XML documentation comments and enable doc generation by @cshung in #411

All Changes

• docs: add XML documentation comments and enable doc generation by @cshung in #411
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.301 to 10.0.302 by @dependabot in #412
• Bump Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1 by @dependabot in #413
• build(deps): bump actions/setup-dotnet from 5 to 6 by @dependabot in #414
• fix(auth)!: recover unusable stale-token challenges with a cold probe by @akashsinghal in #415

Full Changelog: v0.6.0...v0.7.0

The NuGet package is available at nuget.org.

Breaking Changes

• Auth realm validation is now enabled by default and is least-permissive (#393, #403). A
  freshly constructed auth Client now validates the bearer-challenge realm and, by default, only
  allows realms on the same host as the registry (HTTPS; scheme-default or matching port; no
  built-in trusted hosts). Registries whose token realm lives on a different host (e.g. Docker Hub:
  registry-1.docker.io → auth.docker.io) now require explicit opt-in:

  new Client(httpClient)
  {
      RealmValidator = new DefaultRealmValidator
      {
          TrustedRealmHosts = ImmutableHashSet.Create("auth.docker.io")
      }
  };

• ScopeManager scope state is now partitioned by partitionId (#404). Six public methods
  (GetScopesForHost, GetScopesStringForHost, both SetActionsForRepository overloads, and both
  SetScopeForRegistry overloads) gained a required string? partitionId parameter. Pass null
  to preserve the previous unpartitioned behavior.
• OCI manifests now use Go-compatible JSON encoding (#348). Serialized manifest bytes are now
  byte-for-byte compatible with oras-go / Go encoding/json (+ is no longer escaped; <, >,
  &, U+2028 and U+2029 are escaped as Go does). This changes the digest of any manifest whose
  fields contain those characters — recompute or re-push any digests cached from earlier versions.
• Manifest serialization now enforces a 4 MiB limit (#348). Packing a manifest that serializes
  to more than 4 MiB now throws SizeLimitExceededException.
• Stricter auth scope parsing (#396, #404). Scope.TryParse now rejects malformed scope
  strings that were previously accepted (empty resource type/name/action segments).

Migration Guide (v0.5.0 → v0.6.0)

1. Update ScopeManager calls — the six methods now take a partitionId. Pass null for the
   previous behavior (or a non-null id to isolate scope state per tenant/identity):

   // before
   scopeManager.SetActionsForRepository(reference, Scope.Action.Pull);
   var scopes = scopeManager.GetScopesForHost("registry.example.com");
   // after
   scopeManager.SetActionsForRepository(reference, partitionId: null, Scope.Action.Pull);
   var scopes = scopeManager.GetScopesForHost("registry.example.com", partitionId: null);

2. Opt into cross-host auth realms — if a registry's token realm is on a different host from the
   registry (Docker Hub, GitLab, NVIDIA NGC, …), add the realm host to TrustedRealmHosts or supply
   a custom IRealmValidator. Same-host realms (e.g. GHCR, MCR) need no change; for local/insecure
   registries set AllowInsecureHttp = true:

   var client = new Client(httpClient)
   {
       RealmValidator = new DefaultRealmValidator
       {
           TrustedRealmHosts = ImmutableHashSet.Create("auth.docker.io")
       }
   };

   See the runnable realm-validation sample
   and the realm-validation guide
   for TrustedRealmHosts, a custom IRealmValidator, and AllowInsecureHttp usage.
3. Recompute cached manifest digests — digests you persisted from v0.5.0 for content containing
   +, <, >, &, U+2028 or U+2029 will differ in v0.6.0 (now Go/oras-go-compatible). Re-pack /
   re-push or recompute those digests.
4. Handle the 4 MiB manifest limit — packing a manifest that serializes to more than 4 MiB now
   throws SizeLimitExceededException; reduce annotation/config size or split the content.
5. Fix malformed scope strings — Scope.TryParse now returns false for inputs such as
   repository::pull, repository:myrepo:, or repository:repo:pull,,push. Use well-formed scopes
   of the form resourceType:resourceName:action[,action…].

Runnable samples added in this release demonstrate the new auth surface end-to-end:
realm validation,
external token broker,
and Azure Container Registry authentication.
See the full examples/ directory
and the ACR authentication guide.

New Features

• Add IRealmValidator and DefaultRealmValidator for configurable auth-realm validation that
  prevents forwarding credentials to untrusted hosts (#393). See the
  realm-validation sample.
• Add IAccessTokenProvider for external / broker-based access-token resolution without supplying
  raw credentials to the SDK (#382). See the
  external-token-broker sample.

Bug Fixes

• Tolerate null manifests in referrers / index responses on the consumer side (#408;
  co-authored by @renshao, original fix in #399).
• Preserve opaque bearer-challenge scopes on the token request (#396).
• Buffer non-seekable request content before an auth retry so pushes from non-seekable streams
  succeed after a 401 (#372).
• Handle null repositories and tags in catalog / tag-list responses (#361).

Other Changes

• docs: add an example of authentication with Azure Container Registry by @wangxiaoxuan273 in #321
• test: reorganize manifest serialization tests with OCI spec fixtures by @sajayantony in #366
• chore: add Akash Singhal as maintainer by @sajayantony in #367
• Dependency & CI bumps by @dependabot in #350, #358, #359, #360, #362, #363, #364, #368, #369,
  #370, #373, #374, #376, #379, #380, #387, #390, #391, #392, #397

All Changes

• docs: add an example of authentication with Azure Container Registry by @wangxiaoxuan273 in #321
• Bump Microsoft.NET.Test.Sdk from 18.0.1 to 18.3.0 by @dependabot in #350
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.103 to 10.0.200 by @dependabot in #358
• fix: handle null repositories and tags in catalog/tag list responses by @cshung in #361
• build(deps): bump actions/configure-pages from 5 to 6 by @dependabot in #364
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.200 to 10.0.201 by @dependabot in #359
• Bump coverlet.msbuild from 8.0.0 to 8.0.1 by @dependabot in #360
• build(deps): bump codecov/codecov-action from 4 to 6 by @dependabot in #363
• build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot in #362
• Bump Microsoft.NET.Test.Sdk from 18.3.0 to 18.4.0 by @dependabot in #368
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.201 to 10.0.202 by @dependabot in #370
• build(deps): bump actions/upload-pages-artifact from 4 to 5 by @dependabot in #369
• chore: add Akash Singhal as maintainer by @sajayantony in #367
• fix: use Go-compatible JSON encoding for OCI manifests by @sajayantony in #348
• test: reorganize manifest serialization tests with OCI spec fixtures by @sajayantony in #366
• Bump coverlet.msbuild from 8.0.1 to 10.0.0 by @dependabot in #373
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.202 to 10.0.203 by @dependabot in #374
• Bump Microsoft.NET.Test.Sdk from 18.4.0 to 18.5.1 by @dependabot in #376
• Bump coverlet.msbuild from 10.0.0 to 10.0.1 by @dependabot in #380
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.203 to 10.0.300 by @dependabot in #379
• fix: buffer non-seekable request content before auth retry by @cshung in #372
• feat(auth): add IAccessTokenProvider for external token resolution by @cshung in #382
• Bump Microsoft.NET.Test.Sdk from 18.5.1 to 18.6.0 by @dependabot in #387
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.300 to 10.0.301 by @dependabot in #391
• build(deps): bump actions/checkout from 6 to 7 by @dependabot in #392
• build(deps): bump codecov/codecov-action from 6 to 7 by @dependabot in #390
• feat(auth): add realm URL validation to prevent credential forwarding by @cshung in #393
• fix: preserve opaque bearer challenge scopes by @akashsinghal in #396
• Bump Microsoft.NET.Test.Sdk from 18.6.0 to 18.7.0 by @dependabot in #397
• fix(auth)!: least-permissive realm validation (no built-in trusted hosts) by @akashsinghal in #403
• fix(auth)!: partition ScopeManager scope state by partitionId by @akashsinghal in #404
• fix: tolerate null referrers manifests on the consumer side by @akashsinghal in #408

New Contributors

• @renshao made their first contribution in #408 (original fix in #399, merged as co-author)

Full Changelog: v0.5.0...v0.6.0

The NuGet package is available at nuget.org.

Breaking Changes

• Change Copy and CopyGraph source parameter from ITarget to IReadOnlyTarget (#306)
• Change CopyGraph destination parameter from ITarget to IStorage (#311)
• Move CopyGraphOptions to the OrasProject.Oras namespace (#311)
• Extend IRepository to include IBlobLocationProvider (#319)
• Extend IRepository to include FetchReferrersAsync overloads (#322)
• Add new overloads to IReferenceFetchable and IResolvable for custom headers support (#325)
• Add new SendAsync overload to IClient for partition and redirect control (#319, #331)
• Expand auth Cache method signatures with optional partitionId parameter (#331)

New Features

• Add PreCopy, PostCopy, and OnCopySkipped callbacks to CopyGraphOptions (#256)
• Add CopyOptions class with proxy improvements (#262)
• Standardize CancellationToken default values across all public APIs (#290)
• Split Proxy into Proxy and ReferenceProxy for clearer separation of concerns (#305)
• Add ExtendedCopyGraphAsync for referrer-aware content graph copy (#311)
• Add GetBlobLocationAsync API for retrieving blob redirect URLs from registries (#319)
• Expose FetchReferrersAsync on IRepository for polymorphic usage and DI scenarios (#322)
• Add FetchOptions and ResolveOptions for passing custom HTTP headers (#325)
• Add authentication cache partitioning for multi-tenant scenarios (#331)

Bug Fixes

• Fix stream exhaustion when computing digest from response body without Docker-Content-Digest header (#339)

Other Changes

• Bump xunit.runner.visualstudio from 3.1.4 to 3.1.5 by @app/dependabot in #276
• Bump Microsoft.NET.Test.Sdk from 17.14.1 to 18.0.0 by @app/dependabot in #277
• build(deps): Bump github/codeql-action from 3 to 4 by @app/dependabot in #278
• build(deps): downgrade dependencies to 8.* versions for max compatibility by @Wwwsylvia in #279
• build(deps): Bump apache/skywalking-eyes from 0.7.0 to 0.8.0 by @app/dependabot in #293
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 9.0.0 to 10.0.100 by @app/dependabot in #295
• Bump Microsoft.NET.Test.Sdk from 18.0.0 to 18.0.1 by @app/dependabot in #299
• tests: improve code coverage for LimitedReadStream by @sajayantony in #307
• build(deps): Bump actions/checkout from 5 to 6 by @app/dependabot in #308
• docs: add Sajay Antony as a maintainer by @shizhMSFT in #309
• chore: remove unused using directives by @sajayantony in #310
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.100 to 10.0.101 by @app/dependabot in #312
• docs: improve contributing guide by @wangxiaoxuan273 in #314
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.101 to 10.0.102 by @app/dependabot in #320
• Add FetchReferrersAsync methods to IRepository interface by @ridhoq in #322
• docs: add interface testing and line length guidance by @sajayantony in #323
• docs: add missing XML documentation for FetchReferrersAsync methods by @sajayantony in #324
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.102 to 10.0.103 by @app/dependabot in #337
• chore: fix trailing whitespace lint errors by @akashsinghal in #341
• Bump coverlet.msbuild from 6.0.4 to 8.0.0 by @app/dependabot in #345

All Changes

• feat!: add more fields to CopyGraphOptions by @wangxiaoxuan273 in #256
• feat: improve proxy and enable CopyOptions by @wangxiaoxuan273 in #262
• Bump xunit.runner.visualstudio from 3.1.4 to 3.1.5 by @app/dependabot in #276
• Bump Microsoft.NET.Test.Sdk from 17.14.1 to 18.0.0 by @app/dependabot in #277
• build(deps): Bump github/codeql-action from 3 to 4 by @app/dependabot in #278
• build(deps): downgrade dependencies to 8.* versions for max compatibility by @Wwwsylvia in #279
• feat: make default value argument for cancellation token consistent across all APIs by @cshung in #290
• build(deps): Bump apache/skywalking-eyes from 0.7.0 to 0.8.0 by @app/dependabot in #293
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 9.0.0 to 10.0.100 by @app/dependabot in #295
• Bump Microsoft.NET.Test.Sdk from 18.0.0 to 18.0.1 by @app/dependabot in #299
• feat: split Proxy into Proxy and ReferenceProxy by @wangxiaoxuan273 in #305
• fix!: change the src of Copy methods to readonly types by @wangxiaoxuan273 in #306
• tests: improve code coverage for LimitedReadStream by @sajayantony in #307
• build(deps): Bump actions/checkout from 5 to 6 by @app/dependabot in #308
• docs: add Sajay Antony as a maintainer by @shizhMSFT in #309
• chore: remove unused using directives by @sajayantony in #310
• feat!: add ExtendedCopyGraph and ExtendedCopyGraphOptions by @wangxiaoxuan273 in #311
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.100 to 10.0.101 by @app/dependabot in #312
• docs: improve contributing guide by @wangxiaoxuan273 in #314
• feat!: support returning blob location by @lizMSFT in #319
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.101 to 10.0.102 by @app/dependabot in #320
• Add FetchReferrersAsync methods to IRepository interface by @ridhoq in #322
• docs: add interface testing and line length guidance by @sajayantony in #323
• docs: add missing XML documentation for FetchReferrersAsync methods by @sajayantony in #324
• feat!: add custom headers support to fetch/resolve APIs by @akashsinghal in #325
• feat!: add authentication cache partitioning by @akashsinghal in #331
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.102 to 10.0.103 by @app/dependabot in #337
• fix: buffer response body in CalculateDigestFromResponseAsync to preserve stream readability by @akashsinghal in #339
• chore: fix trailing whitespace lint errors by @akashsinghal in #341
• feat: add release automation workflows by @akashsinghal in #344
• Bump coverlet.msbuild from 6.0.4 to 8.0.0 by @app/dependabot in #345

Full Changelog: v0.4.0...v0.5.0

The NuGet package is available at nuget.org.

Breaking Changes

• DescriptorExtension is no longer publicly accessible
• Move OrasProject.Oras.Registry.Remote.ResponseException.Error to OrasProject.Oras.Registry.Remote.Error
• Move exception types into dedicated namespaces (see #247 for details)
• Rename extension classes for API consistency (see #246 for details)

New Features

• Add IMemoryCache injection support to AuthClient for configurable caching
• Improve ResponseException message formatting for clearer diagnostics

Bug Fixes

• No longer throw an exception when service is missing in the Www-Authenticate header

Other Changes

• Add example usages to documentation
• Update dependencies

Detailed Commits

• build(deps): Bump Microsoft.NET.Test.Sdk and xunit.runner.visualstudio by @dependabot[bot] in #223
• Bump System.Text.Json from 9.0.5 to 9.0.6 by @dependabot[bot] in #224
• Bump System.Text.Json from 9.0.6 to 9.0.7 by @dependabot[bot] in #229
• docs: add sample usages by @pat-pan in #227
• Bump xunit.runner.visualstudio from 3.1.1 to 3.1.2 by @dependabot[bot] in #231
• docs(oci): add documentation with OCI image spec v1.1.0 references by @sajayantony in #230
• chore: fix lint errors in the code base by @wangxiaoxuan273 in #236
• build: configure centralized code analysis with Directory.Build.props by @sajayantony in #237
• feat!: make DescriptorExtension internal by @sajayantony in #239
• Bump xunit.runner.visualstudio from 3.1.2 to 3.1.3 by @dependabot[bot] in #240
• chore: add superlinter by @wangxiaoxuan273 in #235
• Bump Microsoft.CodeAnalysis.NetAnalyzers from 8.0.0 to 9.0.0 by @dependabot[bot] in #242
• build(deps): Bump super-linter/super-linter from 6 to 7 by @dependabot[bot] in #243
• build(deps): Bump super-linter/super-linter from 7 to 8 by @dependabot[bot] in #245
• chore: fix editoconfig and disallow consecutive blank lines by @sajayantony in #238
• refactor!: move Error type out from nested class by @wangxiaoxuan273 in #244
• refactor!: move Exceptions into separate namespaces by @wangxiaoxuan273 in #247
• refactor!: rename extension classes by @wangxiaoxuan273 in #246
• Bump System.Text.Json from 9.0.7 to 9.0.8 by @dependabot[bot] in #248
• build(deps): Bump actions/checkout from 4 to 5 by @dependabot[bot] in #250
• Bump xunit.runner.visualstudio from 3.1.3 to 3.1.4 by @dependabot[bot] in #251
• build(deps): Bump actions/upload-pages-artifact from 3 to 4 by @dependabot[bot] in #254
• refactor: use IMemoryCache for auth client cache by @Wwwsylvia in #255
• build(deps): Bump actions/setup-dotnet from 4 to 5 by @dependabot[bot] in #257
• Bump Microsoft.Extensions.Caching.Abstractions and Microsoft.Extensions.Caching.Memory by @dependabot[bot] in #260
• Bump System.Text.Json from 9.0.8 to 9.0.9 by @dependabot[bot] in #261
• docs: demonstrate how to use SingleRegistryCredentialProvider in examples by @Wwwsylvia in #258
• docs: fix toc links by @Wwwsylvia in #264
• docs: fix toc links again by @Wwwsylvia in #269
• docs: add copilot knowledge base by @shizhMSFT in #271
• fix: do not throw exception when service is missing in Www-Authenticate header by @Wwwsylvia in #273
• feat: format the exception message for ResponseException by @Wwwsylvia in #274

Full Changelog: v0.3.0...v0.4.0

The NuGet package is available at here.

Breaking Changes

• Refactor several API signatures to align with .NET conventions
• Remove HttpClientWithBasicAuth

New Features

• Conform to image-spec v1.1.1 and distribution-spec v1.1.1
  • Support mounting a blob from one repository to another in the same remote registry
  • Support Referrers API and Referrers Tag Schema
• Add PackManifestAsync for packing OCI manifests
• Introduce a comprehensive authentication client supporting both basic auth and bearer auth
• Enable concurrency control via CopyGraphOptions.MaxConcurrency for for copy operations and enhance performance
• Add a repository option MaxMetadataBytes for limiting the maximum size of response that can be loaded into memory

Bug Fixes

• Fix #205: Null tag list was not handled in ListTagsAsync

Other Changes

• Clean up code
• Update dependencies

Detailed Commits

• build(deps): Bump xunit from 2.9.1 to 2.9.2 in /tests/OrasProject.Oras.Tests by @dependabot in #146
• build(deps): Bump System.Text.Json from 8.0.4 to 8.0.5 in /tests/OrasProject.Oras.Tests by @dependabot in #148
• build(deps): Bump System.Text.Json from 8.0.4 to 8.0.5 in /src/OrasProject.Oras by @dependabot in #147
• chore(workflow): set code coverage threshold to 80% by @Wwwsylvia in #151
• feat: Implement Pack Manifests by @nhu1997 in #149
• feat(repository): mounting support by @leonardochaia in #152
• build(deps): Bump System.Text.Json from 8.0.5 to 9.0.0 in /src/OrasProject.Oras by @dependabot in #156
• build(deps): Bump Microsoft.NET.Test.Sdk from 17.11.1 to 17.12.0 in /tests/OrasProject.Oras.Tests by @dependabot in #166
• refactor: overload DoPushAsync by @Wwwsylvia in #165
• ci(codecov): change codecov argument due to upgrade to v5 by @pat-pan in #169
• chore: adds CA2007 warning by @leonardochaia in #170
• build(deps): Bump xunit.runner.visualstudio from 2.8.2 to 3.0.0 in /tests/OrasProject.Oras.Tests by @dependabot in #172
• build(deps): Bump coverlet.msbuild from 6.0.2 to 6.0.3 in /tests/OrasProject.Oras.Tests by @dependabot in #173
• feat(referrers): push manifest with subject by @pat-pan in #163
• build(deps): Bump xunit from 2.9.2 to 2.9.3 in /tests/OrasProject.Oras.Tests by @dependabot in #175
• build(deps): Bump xunit.runner.visualstudio from 3.0.0 to 3.0.1 in /tests/OrasProject.Oras.Tests by @dependabot in #176
• build(deps): Bump System.Text.Json from 9.0.0 to 9.0.1 in /src/OrasProject.Oras by @dependabot in #177
• build(deps): Bump System.Text.Json from 9.0.0 to 9.0.1 in /tests/OrasProject.Oras.Tests by @dependabot in #178
• build(deps): Bump coverlet.msbuild from 6.0.3 to 6.0.4 in /tests/OrasProject.Oras.Tests by @dependabot in #179
• build(deps): Bump xunit.runner.visualstudio from 3.0.1 to 3.0.2 in /tests/OrasProject.Oras.Tests by @dependabot in #181
• build(deps): Bump Microsoft.NET.Test.Sdk from 17.12.0 to 17.13.0 in /tests/OrasProject.Oras.Tests by @dependabot in #183
• build(deps): Bump System.Text.Json from 9.0.1 to 9.0.2 in /tests/OrasProject.Oras.Tests by @dependabot in #185
• build(deps): Bump apache/skywalking-eyes from 0.6.0 to 0.7.0 by @dependabot in #182
• feat(referrers): delete manifest with subject by @pat-pan in #174
• feat(referrers): support referrers API by @pat-pan in #180
• build(deps): Bump System.Text.Json from 9.0.2 to 9.0.3 in /src/OrasProject.Oras by @dependabot in #186
• refactor!: refactor code to align with dotnet standards by @pat-pan in #190
• chore(tests): clean up compiler warnings by @sajayantony in #191
• chore(refactor): removed warnings and minor refactoring by @sajayantony in #195
• chore: fix line endings and bom by @sajayantony in #198
• build(deps): Bump System.Text.Json from 9.0.3 to 9.0.4 in /tests/OrasProject.Oras.Tests by @dependabot in #201
• refactor: fix and reduce reference parsing exceptions by @sajayantony in #197
• build(deps): Bump xunit.runner.visualstudio from 3.0.2 to 3.1.0 in /tests/OrasProject.Oras.Tests by @dependabot in #208
• docs: add auth model design by @pat-pan in #188
• fix: support image spec and distribution spec v1.1.1 by @pat-pan in #211
• feat(auth): implement bearer token authentication client by @pat-pan in #200
• chore: clean up code to fix warnings by @Wwwsylvia in #214
• feat(repository): implement MaxMetadataBytes by @wju-MSFT in #216
• feat(copy): improve copy performance by @pat-pan in #213
• refactor: refactor credential resolver for auth client by @Wwwsylvia in #217
• refactor: optimize stream usage by @Wwwsylvia in #215
• build(deps): Bump System.Text.Json from 9.0.4 to 9.0.5 by @dependabot in #220
• fix: test null tags that may be return for repo without tags by @Fassino in #206

New Contributors

• @Wwwsylvia made their first contribution in #151
• @nhu1997 made their first contribution in #149
• @leonardochaia made their first contribution in #152
• @pat-pan made their first contribution in #169
• @wju-MSFT made their first contribution in #216
• @Fassino made their first contribution in #206

Full Changelog: v0.2.1...v0.3.0

NuGet package is available at nuget.org.

Bug Fixes

• Fix #132: The _state query parameter from the blob upload response was accidentally discarded
• Fix #133, #143: The Docker-Content-Digest header was not properly checked

Detailed Commits

• build(deps): Bump xunit from 2.6.5 to 2.6.6 in /tests/OrasProject.Oras.Tests by @dependabot in #107
• build(deps): Bump codecov/codecov-action from 3 to 4 by @dependabot in #108
• build(deps): Bump Microsoft.NET.Test.Sdk from 17.8.0 to 17.9.0 in /tests/OrasProject.Oras.Tests by @dependabot in #109
• build(deps): Bump xunit.runner.visualstudio from 2.5.6 to 2.5.7 in /tests/OrasProject.Oras.Tests by @dependabot in #113
• build(deps): Bump coverlet.msbuild from 6.0.0 to 6.0.1 in /tests/OrasProject.Oras.Tests by @dependabot in #114
• build(deps): Bump xunit from 2.6.6 to 2.7.0 in /tests/OrasProject.Oras.Tests by @dependabot in #112
• build(deps): Bump System.Text.Json from 8.0.1 to 8.0.2 in /tests/OrasProject.Oras.Tests by @dependabot in #110
• build(deps): Bump actions/configure-pages from 4 to 5 by @dependabot in #118
• build(deps): Bump coverlet.msbuild from 6.0.1 to 6.0.2 in /tests/OrasProject.Oras.Tests by @dependabot in #117
• build(deps): Bump System.Text.Json from 8.0.2 to 8.0.3 in /tests/OrasProject.Oras.Tests by @dependabot in #115
• bump(ci): add codecov token by @wangxiaoxuan273 in #120
• build(deps): Bump xunit from 2.7.0 to 2.7.1 in /tests/OrasProject.Oras.Tests by @dependabot in #121
• build(deps): Bump apache/skywalking-eyes from 0.5.0 to 0.6.0 by @dependabot in #119
• build(deps): Bump xunit.runner.visualstudio from 2.5.7 to 2.5.8 in /tests/OrasProject.Oras.Tests by @dependabot in #122
• build(deps): Bump xunit.runner.visualstudio from 2.5.8 to 2.8.0 in /tests/OrasProject.Oras.Tests by @dependabot in #123
• build(deps): Bump xunit from 2.7.1 to 2.8.0 in /tests/OrasProject.Oras.Tests by @dependabot in #124
• build(deps): Bump xunit from 2.8.0 to 2.8.1 in /tests/OrasProject.Oras.Tests by @dependabot in #127
• build(deps): Bump xunit.runner.visualstudio from 2.8.0 to 2.8.1 in /tests/OrasProject.Oras.Tests by @dependabot in #126
• build(deps): Bump Microsoft.NET.Test.Sdk from 17.9.0 to 17.10.0 in /tests/OrasProject.Oras.Tests by @dependabot in #125
• build(deps): Bump System.Text.Json from 8.0.3 to 8.0.4 in /src/OrasProject.Oras by @dependabot in #130
• build(deps): Bump xunit from 2.8.1 to 2.9.0 in /tests/OrasProject.Oras.Tests by @dependabot in #128
• build(deps): Bump xunit.runner.visualstudio from 2.8.1 to 2.8.2 in /tests/OrasProject.Oras.Tests by @dependabot in #129
• fix: use existing query params from blobstore response by @daniel-pebble in #136
• chore: add editorconfig to enforce private and public member naming convention by @daniel-pebble in #137
• build(deps): Bump Microsoft.NET.Test.Sdk from 17.10.0 to 17.11.0 in /tests/OrasProject.Oras.Tests by @dependabot in #138
• build(deps): Bump Moq from 4.20.70 to 4.20.71 in /tests/OrasProject.Oras.Tests by @dependabot in #139
• build(deps): Bump Microsoft.NET.Test.Sdk from 17.11.0 to 17.11.1 in /tests/OrasProject.Oras.Tests by @dependabot in #140
• build(deps): Bump Moq from 4.20.71 to 4.20.72 in /tests/OrasProject.Oras.Tests by @dependabot in #141
• build(deps): Bump xunit from 2.9.0 to 2.9.1 in /tests/OrasProject.Oras.Tests by @dependabot in #142

New Contributors

• @wangxiaoxuan273 made their first contribution in #120
• @daniel-pebble made their first contribution in #136

Full Changelog: v0.2.0...v0.2.1

NuGet Package is available at nuget.org.

New Features

• BREAKING CHANGE: Reshaped oras-dotnet.
  • Classes are refactored to the namespace OrasProject.Oras and kept the similar structure as oras-go.
  • .NET Target framework is bumped to net8.0.
  • Code is upgraded to leverage the C# 12.0 language features.
  • Interfaces are re-designed to match dotnet / C# convention.
• New Registry target implementation, interacting with the remote repository.
  • Only basic auth is supported in this release.
  • Token auth will be supported in future releases and is tracked in #36.

Other Changes

• API documentation is available.
• Improved general performance on the digest utility.

Detailed Commits

• feat: Added IRepository by @sammychinedu2ky in #20
• feat: Registry by @sammychinedu2ky in #21
• feat: added support for basic auth by @sammychinedu2ky in #23
• fix: resolved digest retrieval issue by @sammychinedu2ky in #28
• feat: Added docs using DocFx by @sammychinedu2ky in #29
• docs: Added reference for API docs by @sammychinedu2ky in #30
• docs: fixed logo link and typo by @sammychinedu2ky in #31
• refactor: removed test warnings and minor refactor by @sajayantony in #32
• refactor: Update GenerateDescriptor with Async suffix by @sajayantony in #33
• chore: use compiled regex by @sajayantony in #67
• docs: add code of conduct by @shizhMSFT in #68
• docs: add security policy by @shizhMSFT in #69
• docs: add PR template by @shizhMSFT in #70
• docs: add issue templates by @shizhMSFT in #71
• refactor: package publishing building blocks by @sajayantony in #34
• bump!: target .net 8.0 by @shizhMSFT in #75
• refactor!: rename namespaces to prefix OrasProject.Oras by @shizhMSFT in #76
• fix: fix doc generation by @shizhMSFT in #77
• build: build check with code coverage uploaded by @shizhMSFT in #78
• build: add dependabot by @shizhMSFT in #79
• build(deps): bump action versions in generating docs by @shizhMSFT in #85
• build: add CodeQL check by @shizhMSFT in #84
• build: add license checker and missing license headers by @shizhMSFT in #86
• build: add codecov config by @shizhMSFT in #88
• refactor!: modernize base types and interfaces by @shizhMSFT in #87
• refactor!: modernize memory store and copy by @shizhMSFT in #89
• docs: update README.md for badges by @shizhMSFT in #90
• refactor!: modernize registry interface by @shizhMSFT in #92
• refactor!: modernize Reference by @shizhMSFT in #93
• build(deps): Bump xunit from 2.6.4 to 2.6.5 in /tests/OrasProject.Oras.Tests by @dependabot in #95
• refactor!: modernize Registry.Remote by @shizhMSFT in #94
• build(deps): Bump System.Text.Json from 8.0.0 to 8.0.1 in /src/OrasProject.Oras by @dependabot in #97
• build(deps): Bump System.Text.Json from 8.0.0 to 8.0.1 in /tests/OrasProject.Oras.Tests by @dependabot in #96
• refactor!: modernize exceptions by @shizhMSFT in #98
• feat: make ReadAllAsync public by @shizhMSFT in #99
• build: auto publish to nuget on tag by @shizhMSFT in #100
• docs: add contributing guide by @shizhMSFT in #101
• build: clean version for dev by @shizhMSFT in #102
• docs: add release checklist by @shizhMSFT in #104
• docs: prefer commit to branch by @shizhMSFT in #105

New Contributors

• @sajayantony made their first contribution in #32
• @dependabot made their first contribution in #95

Full Changelog: v0.1.0...v0.2.0

Features

oras-dotnet is the DotNet SDK for ORAS, enabling you to transfer artifacts from one place to another.

In the SDK, artifacts are modelled as Directed Acyclic Graphs (DAGs) stored in Content-Addressable Storages (CASs). Copying artifacts across repositories or generic targets is implemented as copying single-rooted DAGs across CASs.

The SDK provides the following features:

• Interfaces
  • Content-Addressable Storage (CAS)
  • Tagging and resolving interfaces
  • Target
• MemoryTarget which enables the retrieval and storage of artifacts in memory
• Copy function which enables the copying of artifacts from one target implementation to another

Detailed Commits

• chore: add CODEOWNERS and MAINTAINERS by @shizhMSFT in #1
• chore: update README.md by @shizhMSFT in #2
• feat : created interfaces by @sammychinedu2ky in #10
• feat: MemoryTarget Implemented by @sammychinedu2ky in #13
• feat: Support Copy by @sammychinedu2ky in #16

New Contributors

• @shizhMSFT made their first contribution in #1

Full Changelog: https://github.com/oras-project/oras-dotnet/commits/v0.1.0