bump docker/distribution to v2.8.1

[mihaibuzgau]

Bump docker/distribution to address CWE-843

[shizhMSFT]

LGTM

[mihaibuzgau]

thanks @shizhMSFT for merging this!

Are you still planning to release v1? if so, when can we get a new tag?

[shizhMSFT]

@FeynmanZhou Could you help with the next release of v1?

[FeynmanZhou]

Hi @mihaibuzgau ,

Thanks for contributing to ORAS-go. Considering ORAS-go v2 is still experimental, ORAS-go v1 will be maintained by the ORAS community until ORAS v2 GA. Currently, ORAS-go v1 is not under active development, thus the ORAS community will only publish new releases to include necessary fixes at a low rate.

This CWE-843 fix is significant and it is only existing in v1. ORAS v2 has no dependency on the docker/distribution. We can prepare a new release for v1 to include this fix.

As ORAS-go v1 was released quarterly and the latest release was Jun 15, do you accept planning the next release of v1 in the mid of Sep?

[mihaibuzgau]

sounds good. Thanks @FeynmanZhou and @shizhMSFT !