oras: Add reference to recent CVEs

[Leonardo Taccari (via pkgsrc-wip) <commit-notify%pkgsrc.org@localhost>]

Module Name:	pkgsrc-wip
Committed By:	Leonardo Taccari <leot%NetBSD.org@localhost>
Pushed By:	leot
Date:		Thu Sep 17 23:24:51 2026 +0200
Changeset:	1466125a82596d7f6ca0fdb42cb0495971a4e4b0

Modified Files:
	oras/TODO

Log Message:
oras: Add reference to recent CVEs

To see a diff of this commit:
https://wip.pkgsrc.org/cgi-bin/gitweb.cgi?p=pkgsrc-wip.git;a=commitdiff;h=1466125a82596d7f6ca0fdb42cb0495971a4e4b0

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

diffstat:
 oras/TODO | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diffs:
diff --git a/oras/TODO b/oras/TODO
index b45ebf0e2b..b460e6165a 100644
--- a/oras/TODO
+++ b/oras/TODO
@@ -1,2 +1,2 @@
 This package has known vulnerabilities, please investigate and fix if possible:
-  CVE-2026-55588
+  CVE-2026-55588, CVE-2026-85731, CVE-2026-85732