chore(deps): update github actions (major) by ferrlabs-renovate[bot] · Pull Request #4 · FerrLabs/FerrFleet-Runner

ferrlabs-renovate · 2026-09-07T04:14:12Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	`v6` → `v7`
docker/build-push-action	action	major	`v6` → `v7`
docker/login-action	action	major	`v3` → `v4`
docker/metadata-action	action	major	`v5` → `v6`
docker/setup-buildx-action	action	major	`v3` → `v4`
sigstore/cosign-installer	action	major	`v3` → `v4.1.2`

Release Notes

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Skip running unsafe pr check if input is default by @aiqiaoy in #2518
Trim only ascii whitespace for branch by @aiqiaoy in #2521
Escape values passed to --unset by @aiqiaoy in #2530
Various dependency updates

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Various dependency updates

docker/build-push-action (docker/build-push-action)

`v7.3.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #1567
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #1545 #1572
Bump @sigstore/core from 3.1.0 to 3.2.1 in #1568
Bump js-yaml from 4.1.1 to 4.3.0 in #1566
Bump tmp from 0.2.5 to 0.2.7 in #1547
Bump undici from 6.24.1 to 6.27.0 in #1564
Bump vite from 7.3.2 to 7.3.6 in #1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

`v7.2.0`

Compare Source

Bump @actions/core from 3.0.0 to 3.0.1 in #1525
Bump @docker/actions-toolkit from 0.87.0 to 0.90.0 in #1517
Bump brace-expansion from 2.0.2 to 5.0.6 in #1534
Bump fast-xml-builder from 1.1.4 to 1.2.0 in #1529
Bump fast-xml-parser from 5.5.7 to 5.8.0 in #1521
Bump postcss from 8.5.6 to 8.5.10 in #1526
Bump tar from 6.2.1 to 7.5.15 in #1533

Full Changelog: docker/build-push-action@v7.1.0...v7.2.0

`v7.1.0`

Compare Source

Git context query format support by @crazy-max in #1505
Bump @docker/actions-toolkit from 0.79.0 to 0.87.0 by @crazy-max in #1505
Bump brace-expansion from 1.1.12 to 1.1.13 in #1500
Bump fast-xml-parser from 5.4.2 to 5.5.7 in #1489
Bump flatted from 3.3.3 to 3.4.2 in #1491
Bump glob from 10.3.12 to 10.5.0 in #1490
Bump handlebars from 4.7.8 to 4.7.9 in #1497
Bump lodash from 4.17.23 to 4.18.1 in #1510
Bump picomatch from 4.0.3 to 4.0.4 in #1496
Bump undici from 6.23.0 to 6.24.1 in #1486
Bump vite from 7.3.1 to 7.3.2 in #1509

Full Changelog: docker/build-push-action@v7.0.0...v7.1.0

`v7.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #1470
Remove deprecated DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS envs by @crazy-max in #1473
Remove legacy export-build tool support for build summary by @crazy-max in #1474
Switch to ESM and update config/test wiring by @crazy-max in #1466
Bump @actions/core from 1.11.1 to 3.0.0 in #1454
Bump @docker/actions-toolkit from 0.62.1 to 0.79.0 in #1453 #1472 #1479
Bump minimatch from 3.1.2 to 3.1.5 in #1463

Full Changelog: docker/build-push-action@v6.19.2...v7.0.0

docker/login-action (docker/login-action)

`v4.6.0`

Compare Source

Harden buildx scoped config path handling by @crazy-max in #1059
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1095.0 in #1051
Bump js-yaml from 5.2.1 to 5.2.2 in #1057
Bump postcss from 8.5.10 to 8.5.22 in #1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

`v4.5.2`

Compare Source

Surface Docker Hub OIDC error responses by @crazy-max in #1058

Full Changelog: docker/login-action@v4.5.1...v4.5.2

`v4.5.1`

Compare Source

Support dhi.io as Docker Hub OIDC registry by @crazy-max in #1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

`v4.5.0`

Compare Source

Docker Hub OIDC login support by @crazy-max in #1048
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1091.0 in #1037
Bump @docker/actions-toolkit from 0.92.0 to 0.94.0 in #1044 #1050
Bump brace-expansion from 1.1.13 to 1.1.16 in #1046
Bump js-yaml from 5.2.0 to 5.2.1 in #1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

`v4.4.0`

Compare Source

Skip empty registry-auth secret mask by @crazy-max in #1035
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1077.0 #1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

`v4.3.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #1022
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1076.0 #999 #1030
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #1004 #1027
Bump @sigstore/core from 3.1.0 to 3.2.1 in #1023
Bump @sigstore/verify from 3.1.0 to 3.1.1 in #1029
Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #1017
Bump js-yaml from 4.1.1 to 5.2.0 in #1028
Bump sigstore from 4.1.0 to 4.1.1 in #1031
Bump tmp from 0.2.5 to 0.2.7 in #1002
Bump undici from 6.24.1 to 6.27.0 in #1020
Bump vite from 7.3.3 to 7.3.6 in #1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

`v4.2.0`

Compare Source

Bump @actions/core from 3.0.0 to 3.0.1 in #976
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1050.0 in #960
Bump @docker/actions-toolkit from 0.86.0 to 0.90.0 in #970
Bump brace-expansion from 2.0.1 to 5.0.6 in #993
Bump fast-xml-builder from 1.1.4 to 1.2.0 in #985
Bump fast-xml-parser from 5.3.6 to 5.8.0 in #963
Bump http-proxy-agent and https-proxy-agent to 9.0.0 in #961
Bump postcss from 8.5.6 to 8.5.10 in #979
Bump tar from 6.2.1 to 7.5.15 in #991
Bump vite from 7.3.1 to 7.3.3 in #986

Full Changelog: docker/login-action@v4.1.0...v4.2.0

`v4.1.0`

Compare Source

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in #945
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in #930
Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in #932 #936
Bump brace-expansion from 1.1.12 to 1.1.13 in #952
Bump fast-xml-parser from 5.3.4 to 5.3.6 in #942
Bump flatted from 3.3.3 to 3.4.2 in #944
Bump glob from 10.3.12 to 10.5.0 in #940
Bump handlebars from 4.7.8 to 4.7.9 in #949
Bump http-proxy-agent and https-proxy-agent to 8.0.0 in #937
Bump lodash from 4.17.23 to 4.18.1 in #958
Bump minimatch from 3.1.2 to 3.1.5 in #941
Bump picomatch from 4.0.3 to 4.0.4 in #948
Bump undici from 6.23.0 to 6.24.1 in #938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

`v4.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #929
Switch to ESM and update config/test wiring by @crazy-max in #927
Bump @actions/core from 1.11.1 to 3.0.0 in #919
Bump @aws-sdk/client-ecr from 3.890.0 to 3.1000.0 in #909 #920
Bump @aws-sdk/client-ecr-public from 3.890.0 to 3.1000.0 in #909 #920
Bump @docker/actions-toolkit from 0.63.0 to 0.77.0 in #910 #928
Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in #921
Bump js-yaml from 4.1.0 to 4.1.1 in #901

Full Changelog: docker/login-action@v3.7.0...v4.0.0

docker/metadata-action (docker/metadata-action)

`v6.2.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #689
Bump @actions/core from 3.0.0 to 3.0.1 in #663
Bump @actions/github from 9.0.0 to 9.1.1 in #666
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #672 #696
Bump @sigstore/core from 3.1.0 to 3.2.1 in #690
Bump @sigstore/verify from 3.1.0 to 3.1.1 in #693
Bump csv-parse from 6.2.1 to 7.0.0 in #683
Bump js-yaml from 4.1.1 to 4.3.0 in #688
Bump moment-timezone from 0.6.1 to 0.6.2 in #664
Bump semver from 7.7.4 to 7.8.5 in #665 #695
Bump sigstore from 4.1.0 to 4.1.1 in #694
Bump tmp from 0.2.5 to 0.2.7 in #673
Bump undici from 6.25.0 to 6.27.0 in #686
Bump vite from 7.3.2 to 7.3.6 in #685

Full Changelog: docker/metadata-action@v6.1.0...v6.2.0

`v6.1.0`

Compare Source

Bump @docker/actions-toolkit from 0.79.0 to 0.90.0 in #613
Bump brace-expansion from 1.1.12 to 5.0.6 in #658 #630
Bump csv-parse from 6.1.0 to 6.2.1 in #617
Bump fast-xml-parser from 5.4.2 to 5.8.0 in #620
Bump flatted from 3.3.3 to 3.4.2 in #623
Bump glob from 10.3.15 to 10.5.0 in #621
Bump handlebars from 4.7.8 to 4.7.9 in #629
Bump lodash from 4.17.23 to 4.18.1 in #639
Bump moment-timezone from 0.6.0 to 0.6.1 in #619
Bump picomatch from 4.0.3 to 4.0.4 in #626
Bump postcss from 8.5.6 to 8.5.10 in #649
Bump tar from 6.2.1 to 7.5.15 in #657
Bump undici from 6.23.0 to 6.25.0 in #614
Bump vite from 7.3.1 to 7.3.2 in #637

Full Changelog: docker/metadata-action@v6.0.0...v6.1.0

`v6.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #605
List inputs now preserve # inside values while still supporting full-line # comments by @crazy-max in #607
Switch to ESM and update config/test wiring by @crazy-max in #602
Bump lodash from 4.17.21 to 4.17.23 in #588
Bump @actions/core from 1.11.1 to 3.0.0 in #599
Bump @actions/github from 6.0.1 to 9.0.0 in #597
Bump @docker/actions-toolkit from 0.68.0 to 0.79.0 in #604
Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 in #600
Bump semver from 7.7.3 to 7.7.4 in #603

Full Changelog: docker/metadata-action@v5.10.0...v6.0.0

docker/setup-buildx-action (docker/setup-buildx-action)

`v4.3.0`

Compare Source

Bump @docker/actions-toolkit from 0.92.0 to 0.95.0 in #595
Bump brace-expansion from 1.1.13 to 1.1.18 in #600
Bump js-yaml from 5.2.0 to 5.3.0 in #585
Bump postcss from 8.5.10 to 8.5.25 in #598
Bump undici from 6.27.0 to 6.28.0 in #601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

`v4.2.0`

Compare Source

Preserve names in esbuild bundle by @crazy-max in #572
Bump @actions/core from 3.0.0 to 3.0.1 in #551
Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in #557 #580
Bump @sigstore/core from 3.1.0 to 3.2.1 in #573
Bump @sigstore/verify from 3.1.0 to 3.1.1 in #576
Bump js-yaml from 4.1.1 to 5.2.0 in #562
Bump sigstore from 4.1.0 to 4.1.1 in #577
Bump tmp from 0.2.5 to 0.2.7 in #556
Bump undici from 6.25.0 to 6.27.0 in #570
Bump vite from 7.3.2 to 7.3.6 in #569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

`v4.1.0`

Compare Source

Bump @docker/actions-toolkit from 0.79.0 to 0.90.0 in #489
Bump brace-expansion from 1.1.12 to 5.0.6 in #547 #508
Bump fast-xml-builder from 1.0.0 to 1.2.0 in #540
Bump fast-xml-parser from 5.4.2 to 5.8.0 in #496
Bump flatted from 3.3.3 to 3.4.2 in #499
Bump glob from 10.3.12 to 13.0.6 in #495
Bump handlebars from 4.7.8 to 4.7.9 in #504
Bump lodash from 4.17.23 to 4.18.1 in #523
Bump picomatch from 4.0.3 to 4.0.4 in #503
Bump postcss from 8.5.6 to 8.5.10 in #537
Bump tar from 6.2.1 to 7.5.15 in #545
Bump undici from 6.23.0 to 6.25.0 in #492
Bump vite from 7.3.1 to 7.3.2 in #520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

`v4.0.0`

Compare Source

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in #483
Remove deprecated inputs/outputs by @crazy-max in #464
Switch to ESM and update config/test wiring by @crazy-max in #481
Bump @actions/core from 1.11.1 to 3.0.0 in #475
Bump @docker/actions-toolkit from 0.63.0 to 0.79.0 in #482 #485
Bump js-yaml from 4.1.0 to 4.1.1 in #452
Bump lodash from 4.17.21 to 4.17.23 in #472
Bump minimatch from 3.1.2 to 3.1.5 in #480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

sigstore/cosign-installer (sigstore/cosign-installer)

`v4.1.2`

Compare Source

What's Changed

Bump cosign to 3.0.6 in #232

`v4.1.1`

Compare Source

What's Changed

chore: update default cosign-release to v3.0.5 in #223

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

`v4.1.0`

Compare Source

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

Bump cosign to 3.0.5 in #220
fix: add retry to curl downloads for transient network failures in #210

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

`v4.0.0`

Compare Source

What's Changed?

Note: You must upgrade to cosign-installer v4 if you want to install Cosign v3+. You may still install Cosign v2.x with cosign-installer v4.

In version v3+, using cosign sign-blob requires adding the --bundle flag which may require you to update your signing command.

Add support for Cosign v3 releases (#201)

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

ferrfleet

Six GitHub Actions majors, all uneventful for this repo.

actions/checkout v6→v7: breaking changes are about blocking fork checkout under pull_request_target/workflow_run. Neither trigger is used here (ci.yml uses push/pull_request, release.yml uses push: tags/workflow_dispatch).
docker/build-push-action v6→v7: drops DOCKER_BUILD_NO_SUMMARY/DOCKER_BUILD_EXPORT_RETENTION_DAYS envs and legacy export-tool summary support. Neither is set in release.yml.
docker/login-action v3→v4, docker/metadata-action v5→v6, docker/setup-buildx-action v3→v4: all Node 24 runtime bumps (fine on ubuntu-latest) plus internal ESM rewrites. metadata-action's only behavioral change (# handling in list inputs) doesn't apply — the tag patterns (type=semver,pattern={{version}} / {{major}}) contain no #. setup-buildx-action v4's removed inputs aren't used since the step passes no with: block at all.
sigstore/cosign-installer v3→v4: the only breaking note is that cosign v3's sign-blob now requires --bundle. release.yml uses cosign sign on an OCI digest, not sign-blob, so this doesn't apply.

Both CI jobs (Check, Image builds) pass on this commit. Nothing blocking.

ferrlabs-renovate Bot added the dependencies label Sep 7, 2026

ferrfleet Bot approved these changes Sep 7, 2026

View reviewed changes

ferrlabs-renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from cbae2f6 to 1be04bc Compare September 7, 2026 12:26

chore(deps): update github actions

9fba1ea

ferrlabs-renovate Bot force-pushed the renovate/major-github-actions branch from 1be04bc to 9fba1ea Compare September 11, 2026 11:12

Navigation Menu

Uh oh!

chore(deps): update github actions (major) - #4

chore(deps): update github actions (major)#4
ferrlabs-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-github-actions

ferrlabs-renovate Bot commented Sep 7, 2026

Uh oh!

ferrfleet Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

ferrlabs-renovate Bot commented Sep 7, 2026

Release Notes

What's Changed

What's Changed

What's Changed

What's Changed?

Configuration

Uh oh!

ferrfleet Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants