The OCI image spec did a v1.0.2 security release for CVE-2021-41190, however commit09c9270fee, depends on MediaTypes that have not yet been released by the OCI image-spec, so using current "main" instead. full diff:5ad6f50d62...693428a734Signed-off-by: Sebastiaan van Stijn <github@gone.nl>