Vote for the release of `v2.6.1`

[TerryHowe]

At least 3 approvals are needed from the 4 owners for tagging 3c2e884 from the v2 branch as v2.6.1.

• Andrew Block (@sabre1041)
• Shiwei Zhang (@shizhMSFT)
• Sylvia Lei (@Wwwsylvia)
• Terry Howe (@TerryHowe)

See the change log for more details.
Please respond LGTM or REJECT (with reasoning).

---

Draft Release Notes

What's Changed

• fix: Support empty credentials file by @TerryHowe in fix: Support empty credentials file #959
• fix: credentials key for docker registry-1 by @TerryHowe in fix: credentials key for docker registry-1 #966
• build(deps): bump golang.org/x/sync from 0.14.0 to 0.15.0 by @dependabot[bot] in build(deps): bump golang.org/x/sync from 0.14.0 to 0.15.0 #971
• chore: remove scripts reference from Makefile by @TerryHowe in chore: remove scripts reference from Makefile #960
• build(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 by @dependabot[bot] in build(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 #978
• build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in build(deps): bump actions/checkout from 4 to 5 #989
• build(go): shift Go support window to [1.24, 1.25] by @Wwwsylvia in build(go): shift Go support window to [1.24, 1.25] #991
• build(deps): bump actions/stale from 9 to 10 by @dependabot[bot] in build(deps): bump actions/stale from 9 to 10 #997
• build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in build(deps): bump actions/setup-go from 5 to 6 #998
• build(deps): bump golang.org/x/sync from 0.16.0 to 0.17.0 by @dependabot[bot] in build(deps): bump golang.org/x/sync from 0.16.0 to 0.17.0 #1001
• build(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in build(deps): bump github/codeql-action from 3 to 4 #1016
• refactor: run go modernize by @TerryHowe in refactor: run go modernize #1005
• build(deps): bump golang.org/x/sync from 0.17.0 to 0.18.0 by @dependabot[bot] in build(deps): bump golang.org/x/sync from 0.17.0 to 0.18.0 #1037
• build(deps): bump golang.org/x/sync from 0.18.0 to 0.19.0 by @dependabot[bot] in build(deps): bump golang.org/x/sync from 0.18.0 to 0.19.0 #1078
• fix: graph.Memory should use digest as map key by @TerryHowe in fix: graph.Memory should use digest as map key #1095
• chore: sync CODEOWNERS and OWNERS.md from main to v2 by @TerryHowe in chore: sync CODEOWNERS and OWNERS.md from main to v2 #1122
• build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 by @dependabot[bot] in build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 #1121
• fix: validate Location host before blob upload to prevent credential leak by @TerryHowe in fix: validate Location host before blob upload to prevent credential leak #1152
• fix(content): reject descriptor sizes exceeding 32 MiB in ReadAll by @TerryHowe in fix(content): reject descriptor sizes exceeding 32 MiB in ReadAll #1153
• feat: add gitops release workflow with goreleaser by @TerryHowe in feat: add gitops release workflow with goreleaser #1161

Full Changelog: v2.6.0...v2.6.1

[sabre1041]

LGTM

[TerryHowe]

LGTM

[shizhMSFT]

LGTM

[TerryHowe]

Done. https://github.com/oras-project/oras-go/releases/tag/v2.6.1