Bump oras-go to v2.6.2 for CVE fix (release-v1.42)

[skoryk-oleksandr]

Bumps oras-go on release-v1.42 to clear the flagged CVE on the operator images.

Changes

• oras.land/oras-go/v2 v2.6.0 -> v2.6.2

Notes

• Transitive indirect dependency; no operator code imports oras-go directly, so this is a clean version bump (go get + go mod tidy).

Note on containerd

The containerd criticals (GO-2026-5064, GO-2026-5338) flagged alongside this have no fix in the containerd v1.x line (the operator uses v1.7.33). The fix exists only in the github.com/containerd/containerd/v2 module, which would require a major migration not appropriate for a patch release. Tracking separately.

Bump oras-go to v2.6.2 to remediate a CVE.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Pull request overview

This PR updates the indirect Go module dependency oras.land/oras-go/v2 on the release-v1.42 branch to remediate a flagged CVE in the operator images, without changing operator source code.

Changes:

• Bump oras.land/oras-go/v2 from v2.6.0 to v2.6.2 in go.mod.
• Update corresponding go.sum entries to match the new module version and checksums.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
go.mod	Updates the indirect oras-go requirement to v2.6.2.
go.sum	Refreshes checksums for oras-go v2.6.2 to align with the module bump.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dimitri-nicolo]

Superseded — release-v1.42 already carries oras.land/oras-go/v2 v2.6.2, so this PR's diff is now a no-op against its own base.

#5172 landed in 9b1de07 and moved helm 3.20.2 -> 3.21.3. helm 3.21 replaced containerd's remotes with oras-go/v2 in its registry client, which pulled oras-go forward to v2.6.2 as a side effect. Current tip:

helm.sh/helm/v3 v3.21.3
oras.land/oras-go/v2 v2.6.2 // indirect

That covers everything this PR was opened for — CVE-2026-50151, CVE-2026-50162, CVE-2026-50163 and GHSA-vh4v-2xq2-g5cg are all fixed at v2.6.1/v2.6.2.

It also resolves the containerd caveat in the description. You were right that there is no fix on the containerd v1.x line, but the operator never actually used containerd — it arrived only through helm/pkg/action -> helm/pkg/registry, so dropping it was possible without a v2 migration. github.com/containerd/containerd and google.golang.org/grpc are both gone from go.mod entirely, which clears CVE-2026-53492, CVE-2026-53489, CVE-2026-50195 and GHSA-hrxh-6v49-42gf.

The remaining findings against the operator image from the same scan are the two stdlib ones (CVE-2026-39821, CVE-2026-46600), handled in #5202.

Suggest closing as superseded — and thanks for the writeup on the containerd line, it matched what we found.