This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://github.com/actions/checkout) | action | major | `v4.4.0` → `v7.0.1` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | action | major | `v6.19.2` → `v7.3.0` |
| [docker/login-action](https://github.com/docker/login-action) | action | major | `v3.7.0` → `v4.6.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | action | major | `v5.10.0` → `v6.2.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | action | major | `v3.12.0` → `v4.2.0` |
---
### Release Notes
<details>
<summary>actions/checkout (actions/checkout)</summary>
### [`v7.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701)
[Compare Source](https://github.com/actions/checkout/compare/v7...v7.0.1)
- Skip running unsafe pr check if input is default by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2518](https://github.com/actions/checkout/pull/2518)
- Trim only ascii whitespace for branch by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2521](https://github.com/actions/checkout/pull/2521)
- Escape values passed to --unset by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2530](https://github.com/actions/checkout/pull/2530)
- Various dependency updates
### [`v7.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700)
[Compare Source](https://github.com/actions/checkout/compare/v7...v7)
- Block checking out fork PR for pull\_request\_target and workflow\_run by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2454](https://github.com/actions/checkout/pull/2454)
- Various dependency updates
### [`v7`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701)
[Compare Source](https://github.com/actions/checkout/compare/v6.1.0...v7)
- Skip running unsafe pr check if input is default by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2518](https://github.com/actions/checkout/pull/2518)
- Trim only ascii whitespace for branch by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2521](https://github.com/actions/checkout/pull/2521)
- Escape values passed to --unset by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2530](https://github.com/actions/checkout/pull/2530)
- Various dependency updates
### [`v6.1.0`](https://github.com/actions/checkout/releases/tag/v6.1.0)
[Compare Source](https://github.com/actions/checkout/compare/v6.0.3...v6.1.0)
##### What's Changed
- **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v6 by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2500](https://github.com/actions/checkout/pull/2500)
- backport fixes to releases-v6 by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2527](https://github.com/actions/checkout/pull/2527)
<https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change
**Full Changelog**: <https://github.com/actions/checkout/compare/v6.0.3...v6.1.0>
### [`v6.0.3`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)
[Compare Source](https://github.com/actions/checkout/compare/v6.0.2...v6.0.3)
- Fix checkout init for SHA-256 repositories by [@​yaananth](https://github.com/yaananth) in [#​2439](https://github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by [@​yaananth](https://github.com/yaananth) in [#​2414](https://github.com/actions/checkout/pull/2414)
### [`v6.0.2`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v602)
[Compare Source](https://github.com/actions/checkout/compare/v6.0.1...v6.0.2)
- Fix tag handling: preserve annotations and explicit fetch-tags by [@​ericsciple](https://github.com/ericsciple) in [#​2356](https://github.com/actions/checkout/pull/2356)
### [`v6.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v601)
[Compare Source](https://github.com/actions/checkout/compare/v6...v6.0.1)
- Add worktree support for persist-credentials includeIf by [@​ericsciple](https://github.com/ericsciple) in [#​2327](https://github.com/actions/checkout/pull/2327)
### [`v6.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v600)
[Compare Source](https://github.com/actions/checkout/compare/v6...v6)
- Persist creds to a separate file by [@​ericsciple](https://github.com/ericsciple) in [#​2286](https://github.com/actions/checkout/pull/2286)
- Update README to include Node.js 24 support details and requirements by [@​salmanmkc](https://github.com/salmanmkc) in [#​2248](https://github.com/actions/checkout/pull/2248)
### [`v6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v603)
[Compare Source](https://github.com/actions/checkout/compare/v5.1.0...v6)
- Fix checkout init for SHA-256 repositories by [@​yaananth](https://github.com/yaananth) in [#​2439](https://github.com/actions/checkout/pull/2439)
- fix: expand merge commit SHA regex and add SHA-256 test cases by [@​yaananth](https://github.com/yaananth) in [#​2414](https://github.com/actions/checkout/pull/2414)
### [`v5.1.0`](https://github.com/actions/checkout/releases/tag/v5.1.0)
[Compare Source](https://github.com/actions/checkout/compare/v5.0.1...v5.1.0)
##### What's Changed
- **\[BREAKING]** backport `allow-unsafe-pr-checkout` to v5 by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2501](https://github.com/actions/checkout/pull/2501)
- backport fixes to releases-v5 by [@​aiqiaoy](https://github.com/aiqiaoy) in [#​2523](https://github.com/actions/checkout/pull/2523)
<https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/> for more details about this breaking change
**Full Changelog**: <https://github.com/actions/checkout/compare/v5.0.1...v5.1.0>
### [`v5.0.1`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501)
[Compare Source](https://github.com/actions/checkout/compare/v5...v5.0.1)
- Port v6 cleanup to v5 by [@​ericsciple](https://github.com/ericsciple) in [#​2301](https://github.com/actions/checkout/pull/2301)
### [`v5.0.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v500)
[Compare Source](https://github.com/actions/checkout/compare/v5...v5)
- Update actions checkout to use node 24 by [@​salmanmkc](https://github.com/salmanmkc) in [#​2226](https://github.com/actions/checkout/pull/2226)
### [`v5`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v501)
[Compare Source](https://github.com/actions/checkout/compare/v4.4.0...v5)
- Port v6 cleanup to v5 by [@​ericsciple](https://github.com/ericsciple) in [#​2301](https://github.com/actions/checkout/pull/2301)
</details>
<details>
<summary>docker/build-push-action (docker/build-push-action)</summary>
### [`v7.3.0`](https://github.com/docker/build-push-action/releases/tag/v7.3.0)
[Compare Source](https://github.com/docker/build-push-action/compare/v7.2.0...v7.3.0)
- Preserve names in esbuild bundle by [@​crazy-max](https://github.com/crazy-max) in [#​1567](https://github.com/docker/build-push-action/pull/1567)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.90.0 to 0.92.0 in [#​1545](https://github.com/docker/build-push-action/pull/1545) [#​1572](https://github.com/docker/build-push-action/pull/1572)
- Bump [@​sigstore/core](https://github.com/sigstore/core) from 3.1.0 to 3.2.1 in [#​1568](https://github.com/docker/build-push-action/pull/1568)
- Bump js-yaml from 4.1.1 to 4.3.0 in [#​1566](https://github.com/docker/build-push-action/pull/1566)
- Bump tmp from 0.2.5 to 0.2.7 in [#​1547](https://github.com/docker/build-push-action/pull/1547)
- Bump undici from 6.24.1 to 6.27.0 in [#​1564](https://github.com/docker/build-push-action/pull/1564)
- Bump vite from 7.3.2 to 7.3.6 in [#​1563](https://github.com/docker/build-push-action/pull/1563)
**Full Changelog**: <https://github.com/docker/build-push-action/compare/v7.2.0...v7.3.0>
### [`v7.2.0`](https://github.com/docker/build-push-action/releases/tag/v7.2.0)
[Compare Source](https://github.com/docker/build-push-action/compare/v7.1.0...v7.2.0)
- Bump [@​actions/core](https://github.com/actions/core) from 3.0.0 to 3.0.1 in [#​1525](https://github.com/docker/build-push-action/pull/1525)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.87.0 to 0.90.0 in [#​1517](https://github.com/docker/build-push-action/pull/1517)
- Bump brace-expansion from 2.0.2 to 5.0.6 in [#​1534](https://github.com/docker/build-push-action/pull/1534)
- Bump fast-xml-builder from 1.1.4 to 1.2.0 in [#​1529](https://github.com/docker/build-push-action/pull/1529)
- Bump fast-xml-parser from 5.5.7 to 5.8.0 in [#​1521](https://github.com/docker/build-push-action/pull/1521)
- Bump postcss from 8.5.6 to 8.5.10 in [#​1526](https://github.com/docker/build-push-action/pull/1526)
- Bump tar from 6.2.1 to 7.5.15 in [#​1533](https://github.com/docker/build-push-action/pull/1533)
**Full Changelog**: <https://github.com/docker/build-push-action/compare/v7.1.0...v7.2.0>
### [`v7.1.0`](https://github.com/docker/build-push-action/releases/tag/v7.1.0)
[Compare Source](https://github.com/docker/build-push-action/compare/v7...v7.1.0)
- Git context [query format](https://docs.docker.com/build/concepts/context/#url-queries) support by [@​crazy-max](https://github.com/crazy-max) in [#​1505](https://github.com/docker/build-push-action/pull/1505)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.79.0 to 0.87.0 by [@​crazy-max](https://github.com/crazy-max) in [#​1505](https://github.com/docker/build-push-action/pull/1505)
- Bump brace-expansion from 1.1.12 to 1.1.13 in [#​1500](https://github.com/docker/build-push-action/pull/1500)
- Bump fast-xml-parser from 5.4.2 to 5.5.7 in [#​1489](https://github.com/docker/build-push-action/pull/1489)
- Bump flatted from 3.3.3 to 3.4.2 in [#​1491](https://github.com/docker/build-push-action/pull/1491)
- Bump glob from 10.3.12 to 10.5.0 in [#​1490](https://github.com/docker/build-push-action/pull/1490)
- Bump handlebars from 4.7.8 to 4.7.9 in [#​1497](https://github.com/docker/build-push-action/pull/1497)
- Bump lodash from 4.17.23 to 4.18.1 in [#​1510](https://github.com/docker/build-push-action/pull/1510)
- Bump picomatch from 4.0.3 to 4.0.4 in [#​1496](https://github.com/docker/build-push-action/pull/1496)
- Bump undici from 6.23.0 to 6.24.1 in [#​1486](https://github.com/docker/build-push-action/pull/1486)
- Bump vite from 7.3.1 to 7.3.2 in [#​1509](https://github.com/docker/build-push-action/pull/1509)
**Full Changelog**: <https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0>
### [`v7.0.0`](https://github.com/docker/build-push-action/releases/tag/v7.0.0)
[Compare Source](https://github.com/docker/build-push-action/compare/v7...v7)
- Node 24 as default runtime (requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later) by [@​crazy-max](https://github.com/crazy-max) in [#​1470](https://github.com/docker/build-push-action/pull/1470)
- Remove deprecated `DOCKER_BUILD_NO_SUMMARY` and `DOCKER_BUILD_EXPORT_RETENTION_DAYS` envs by [@​crazy-max](https://github.com/crazy-max) in [#​1473](https://github.com/docker/build-push-action/pull/1473)
- Remove legacy export-build tool support for build summary by [@​crazy-max](https://github.com/crazy-max) in [#​1474](https://github.com/docker/build-push-action/pull/1474)
- Switch to ESM and update config/test wiring by [@​crazy-max](https://github.com/crazy-max) in [#​1466](https://github.com/docker/build-push-action/pull/1466)
- Bump [@​actions/core](https://github.com/actions/core) from 1.11.1 to 3.0.0 in [#​1454](https://github.com/docker/build-push-action/pull/1454)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.62.1 to 0.79.0 in [#​1453](https://github.com/docker/build-push-action/pull/1453) [#​1472](https://github.com/docker/build-push-action/pull/1472) [#​1479](https://github.com/docker/build-push-action/pull/1479)
- Bump minimatch from 3.1.2 to 3.1.5 in [#​1463](https://github.com/docker/build-push-action/pull/1463)
**Full Changelog**: <https://github.com/docker/build-push-action/compare/v6.19.2...v7.0.0>
### [`v7`](https://github.com/docker/build-push-action/compare/v6.19.2...v7)
[Compare Source](https://github.com/docker/build-push-action/compare/v6.19.2...v7)
</details>
<details>
<summary>docker/login-action (docker/login-action)</summary>
### [`v4.6.0`](https://github.com/docker/login-action/releases/tag/v4.6.0)
[Compare Source](https://github.com/docker/login-action/compare/v4.5.2...v4.6.0)
- Harden buildx scoped config path handling by [@​crazy-max](https://github.com/crazy-max) in [#​1059](https://github.com/docker/login-action/pull/1059)
- Bump [@​aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) to 3.1095.0 in [#​1051](https://github.com/docker/login-action/pull/1051)
- Bump js-yaml from 5.2.1 to 5.2.2 in [#​1057](https://github.com/docker/login-action/pull/1057)
- Bump postcss from 8.5.10 to 8.5.22 in [#​1056](https://github.com/docker/login-action/pull/1056)
**Full Changelog**: <https://github.com/docker/login-action/compare/v4.5.2...v4.6.0>
### [`v4.5.2`](https://github.com/docker/login-action/releases/tag/v4.5.2)
[Compare Source](https://github.com/docker/login-action/compare/v4.5.1...v4.5.2)
- Surface Docker Hub OIDC error responses by [@​crazy-max](https://github.com/crazy-max) in [#​1058](https://github.com/docker/login-action/pull/1058)
**Full Changelog**: <https://github.com/docker/login-action/compare/v4.5.1...v4.5.2>
### [`v4.5.1`](https://github.com/docker/login-action/releases/tag/v4.5.1)
[Compare Source](https://github.com/docker/login-action/compare/v4.5.0...v4.5.1)
- Support `dhi.io` as Docker Hub OIDC registry by [@​crazy-max](https://github.com/crazy-max) in [#​1054](https://github.com/docker/login-action/pull/1054)
**Full Changelog**: <https://github.com/docker/login-action/compare/v4.5.0...v4.5.1>
### [`v4.5.0`](https://github.com/docker/login-action/releases/tag/v4.5.0)
[Compare Source](https://github.com/docker/login-action/compare/v4.4.0...v4.5.0)
- [Docker Hub OIDC](https://github.com/docker/login-action#docker-hub) login support by [@​crazy-max](https://github.com/crazy-max) in [#​1048](https://github.com/docker/login-action/pull/1048)
- Bump [@​aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) to 3.1091.0 in [#​1037](https://github.com/docker/login-action/pull/1037)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.92.0 to 0.94.0 in [#​1044](https://github.com/docker/login-action/pull/1044) [#​1050](https://github.com/docker/login-action/pull/1050)
- Bump brace-expansion from 1.1.13 to 1.1.16 in [#​1046](https://github.com/docker/login-action/pull/1046)
- Bump js-yaml from 5.2.0 to 5.2.1 in [#​1038](https://github.com/docker/login-action/pull/1038)
**Full Changelog**: <https://github.com/docker/login-action/compare/v4.4.0...v4.5.0>
### [`v4.4.0`](https://github.com/docker/login-action/releases/tag/v4.4.0)
[Compare Source](https://github.com/docker/login-action/compare/v4.3.0...v4.4.0)
- Skip empty `registry-auth` secret mask by [@​crazy-max](https://github.com/crazy-max) in [#​1035](https://github.com/docker/login-action/pull/1035)
- Bump [@​aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) to 3.1077.0 [#​1034](https://github.com/docker/login-action/pull/1034)
**Full Changelog**: <https://github.com/docker/login-action/compare/v4.3.0...v4.4.0>
### [`v4.3.0`](https://github.com/docker/login-action/releases/tag/v4.3.0)
[Compare Source](https://github.com/docker/login-action/compare/v4.2.0...v4.3.0)
- Preserve names in esbuild bundle by [@​crazy-max](https://github.com/crazy-max) in [#​1022](https://github.com/docker/login-action/pull/1022)
- Bump [@​aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) to 3.1076.0 [#​999](https://github.com/docker/login-action/pull/999) [#​1030](https://github.com/docker/login-action/pull/1030)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.90.0 to 0.92.0 in [#​1004](https://github.com/docker/login-action/pull/1004) [#​1027](https://github.com/docker/login-action/pull/1027)
- Bump [@​sigstore/core](https://github.com/sigstore/core) from 3.1.0 to 3.2.1 in [#​1023](https://github.com/docker/login-action/pull/1023)
- Bump [@​sigstore/verify](https://github.com/sigstore/verify) from 3.1.0 to 3.1.1 in [#​1029](https://github.com/docker/login-action/pull/1029)
- Bump http-proxy-agent and https-proxy-agent to 9.1.0 in [#​1017](https://github.com/docker/login-action/pull/1017)
- Bump js-yaml from 4.1.1 to 5.2.0 in [#​1028](https://github.com/docker/login-action/pull/1028)
- Bump sigstore from 4.1.0 to 4.1.1 in [#​1031](https://github.com/docker/login-action/pull/1031)
- Bump tmp from 0.2.5 to 0.2.7 in [#​1002](https://github.com/docker/login-action/pull/1002)
- Bump undici from 6.24.1 to 6.27.0 in [#​1020](https://github.com/docker/login-action/pull/1020)
- Bump vite from 7.3.3 to 7.3.6 in [#​1019](https://github.com/docker/login-action/pull/1019)
**Full Changelog**: <https://github.com/docker/login-action/compare/v4.2.0...v4.3.0>
### [`v4.2.0`](https://github.com/docker/login-action/releases/tag/v4.2.0)
[Compare Source](https://github.com/docker/login-action/compare/v4.1.0...v4.2.0)
- Bump [@​actions/core](https://github.com/actions/core) from 3.0.0 to 3.0.1 in [#​976](https://github.com/docker/login-action/pull/976)
- Bump [@​aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) to 3.1050.0 in [#​960](https://github.com/docker/login-action/pull/960)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.86.0 to 0.90.0 in [#​970](https://github.com/docker/login-action/pull/970)
- Bump brace-expansion from 2.0.1 to 5.0.6 in [#​993](https://github.com/docker/login-action/pull/993)
- Bump fast-xml-builder from 1.1.4 to 1.2.0 in [#​985](https://github.com/docker/login-action/pull/985)
- Bump fast-xml-parser from 5.3.6 to 5.8.0 in [#​963](https://github.com/docker/login-action/pull/963)
- Bump http-proxy-agent and https-proxy-agent to 9.0.0 in [#​961](https://github.com/docker/login-action/pull/961)
- Bump postcss from 8.5.6 to 8.5.10 in [#​979](https://github.com/docker/login-action/pull/979)
- Bump tar from 6.2.1 to 7.5.15 in [#​991](https://github.com/docker/login-action/pull/991)
- Bump vite from 7.3.1 to 7.3.3 in [#​986](https://github.com/docker/login-action/pull/986)
**Full Changelog**: <https://github.com/docker/login-action/compare/v4.1.0...v4.2.0>
### [`v4.1.0`](https://github.com/docker/login-action/releases/tag/v4.1.0)
[Compare Source](https://github.com/docker/login-action/compare/v4...v4.1.0)
- Fix scoped Docker Hub cleanup path when registry is omitted by [@​crazy-max](https://github.com/crazy-max) in [#​945](https://github.com/docker/login-action/pull/945)
- Bump [@​aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) to 3.1020.0 in [#​930](https://github.com/docker/login-action/pull/930)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.77.0 to 0.86.0 in [#​932](https://github.com/docker/login-action/pull/932) [#​936](https://github.com/docker/login-action/pull/936)
- Bump brace-expansion from 1.1.12 to 1.1.13 in [#​952](https://github.com/docker/login-action/pull/952)
- Bump fast-xml-parser from 5.3.4 to 5.3.6 in [#​942](https://github.com/docker/login-action/pull/942)
- Bump flatted from 3.3.3 to 3.4.2 in [#​944](https://github.com/docker/login-action/pull/944)
- Bump glob from 10.3.12 to 10.5.0 in [#​940](https://github.com/docker/login-action/pull/940)
- Bump handlebars from 4.7.8 to 4.7.9 in [#​949](https://github.com/docker/login-action/pull/949)
- Bump http-proxy-agent and https-proxy-agent to 8.0.0 in [#​937](https://github.com/docker/login-action/pull/937)
- Bump lodash from 4.17.23 to 4.18.1 in [#​958](https://github.com/docker/login-action/pull/958)
- Bump minimatch from 3.1.2 to 3.1.5 in [#​941](https://github.com/docker/login-action/pull/941)
- Bump picomatch from 4.0.3 to 4.0.4 in [#​948](https://github.com/docker/login-action/pull/948)
- Bump undici from 6.23.0 to 6.24.1 in [#​938](https://github.com/docker/login-action/pull/938)
**Full Changelog**: <https://github.com/docker/login-action/compare/v4.0.0...v4.1.0>
### [`v4.0.0`](https://github.com/docker/login-action/releases/tag/v4.0.0)
[Compare Source](https://github.com/docker/login-action/compare/v4...v4)
- Node 24 as default runtime (requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later) by [@​crazy-max](https://github.com/crazy-max) in [#​929](https://github.com/docker/login-action/pull/929)
- Switch to ESM and update config/test wiring by [@​crazy-max](https://github.com/crazy-max) in [#​927](https://github.com/docker/login-action/pull/927)
- Bump [@​actions/core](https://github.com/actions/core) from 1.11.1 to 3.0.0 in [#​919](https://github.com/docker/login-action/pull/919)
- Bump [@​aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) from 3.890.0 to 3.1000.0 in [#​909](https://github.com/docker/login-action/pull/909) [#​920](https://github.com/docker/login-action/pull/920)
- Bump [@​aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) from 3.890.0 to 3.1000.0 in [#​909](https://github.com/docker/login-action/pull/909) [#​920](https://github.com/docker/login-action/pull/920)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.63.0 to 0.77.0 in [#​910](https://github.com/docker/login-action/pull/910) [#​928](https://github.com/docker/login-action/pull/928)
- Bump [@​isaacs/brace-expansion](https://github.com/isaacs/brace-expansion) from 5.0.0 to 5.0.1 in [#​921](https://github.com/docker/login-action/pull/921)
- Bump js-yaml from 4.1.0 to 4.1.1 in [#​901](https://github.com/docker/login-action/pull/901)
**Full Changelog**: <https://github.com/docker/login-action/compare/v3.7.0...v4.0.0>
### [`v4`](https://github.com/docker/login-action/compare/v3.7.0...v4)
[Compare Source](https://github.com/docker/login-action/compare/v3.7.0...v4)
</details>
<details>
<summary>docker/metadata-action (docker/metadata-action)</summary>
### [`v6.2.0`](https://github.com/docker/metadata-action/releases/tag/v6.2.0)
[Compare Source](https://github.com/docker/metadata-action/compare/v6.1.0...v6.2.0)
- Preserve names in esbuild bundle by [@​crazy-max](https://github.com/crazy-max) in [#​689](https://github.com/docker/metadata-action/pull/689)
- Bump [@​actions/core](https://github.com/actions/core) from 3.0.0 to 3.0.1 in [#​663](https://github.com/docker/metadata-action/pull/663)
- Bump [@​actions/github](https://github.com/actions/github) from 9.0.0 to 9.1.1 in [#​666](https://github.com/docker/metadata-action/pull/666)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.90.0 to 0.92.0 in [#​672](https://github.com/docker/metadata-action/pull/672) [#​696](https://github.com/docker/metadata-action/pull/696)
- Bump [@​sigstore/core](https://github.com/sigstore/core) from 3.1.0 to 3.2.1 in [#​690](https://github.com/docker/metadata-action/pull/690)
- Bump [@​sigstore/verify](https://github.com/sigstore/verify) from 3.1.0 to 3.1.1 in [#​693](https://github.com/docker/metadata-action/pull/693)
- Bump csv-parse from 6.2.1 to 7.0.0 in [#​683](https://github.com/docker/metadata-action/pull/683)
- Bump js-yaml from 4.1.1 to 4.3.0 in [#​688](https://github.com/docker/metadata-action/pull/688)
- Bump moment-timezone from 0.6.1 to 0.6.2 in [#​664](https://github.com/docker/metadata-action/pull/664)
- Bump semver from 7.7.4 to 7.8.5 in [#​665](https://github.com/docker/metadata-action/pull/665) [#​695](https://github.com/docker/metadata-action/pull/695)
- Bump sigstore from 4.1.0 to 4.1.1 in [#​694](https://github.com/docker/metadata-action/pull/694)
- Bump tmp from 0.2.5 to 0.2.7 in [#​673](https://github.com/docker/metadata-action/pull/673)
- Bump undici from 6.25.0 to 6.27.0 in [#​686](https://github.com/docker/metadata-action/pull/686)
- Bump vite from 7.3.2 to 7.3.6 in [#​685](https://github.com/docker/metadata-action/pull/685)
**Full Changelog**: <https://github.com/docker/metadata-action/compare/v6.1.0...v6.2.0>
### [`v6.1.0`](https://github.com/docker/metadata-action/releases/tag/v6.1.0)
[Compare Source](https://github.com/docker/metadata-action/compare/v6...v6.1.0)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.79.0 to 0.90.0 in [#​613](https://github.com/docker/metadata-action/pull/613)
- Bump brace-expansion from 1.1.12 to 5.0.6 in [#​658](https://github.com/docker/metadata-action/pull/658) [#​630](https://github.com/docker/metadata-action/pull/630)
- Bump csv-parse from 6.1.0 to 6.2.1 in [#​617](https://github.com/docker/metadata-action/pull/617)
- Bump fast-xml-parser from 5.4.2 to 5.8.0 in [#​620](https://github.com/docker/metadata-action/pull/620)
- Bump flatted from 3.3.3 to 3.4.2 in [#​623](https://github.com/docker/metadata-action/pull/623)
- Bump glob from 10.3.15 to 10.5.0 in [#​621](https://github.com/docker/metadata-action/pull/621)
- Bump handlebars from 4.7.8 to 4.7.9 in [#​629](https://github.com/docker/metadata-action/pull/629)
- Bump lodash from 4.17.23 to 4.18.1 in [#​639](https://github.com/docker/metadata-action/pull/639)
- Bump moment-timezone from 0.6.0 to 0.6.1 in [#​619](https://github.com/docker/metadata-action/pull/619)
- Bump picomatch from 4.0.3 to 4.0.4 in [#​626](https://github.com/docker/metadata-action/pull/626)
- Bump postcss from 8.5.6 to 8.5.10 in [#​649](https://github.com/docker/metadata-action/pull/649)
- Bump tar from 6.2.1 to 7.5.15 in [#​657](https://github.com/docker/metadata-action/pull/657)
- Bump undici from 6.23.0 to 6.25.0 in [#​614](https://github.com/docker/metadata-action/pull/614)
- Bump vite from 7.3.1 to 7.3.2 in [#​637](https://github.com/docker/metadata-action/pull/637)
**Full Changelog**: <https://github.com/docker/metadata-action/compare/v6.0.0...v6.1.0>
### [`v6.0.0`](https://github.com/docker/metadata-action/releases/tag/v6.0.0)
[Compare Source](https://github.com/docker/metadata-action/compare/v6...v6)
- Node 24 as default runtime (requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later) by [@​crazy-max](https://github.com/crazy-max) in [#​605](https://github.com/docker/metadata-action/pull/605)
- List inputs now preserve `#` inside values while still supporting full-line `#` comments by [@​crazy-max](https://github.com/crazy-max) in [#​607](https://github.com/docker/metadata-action/pull/607)
- Switch to ESM and update config/test wiring by [@​crazy-max](https://github.com/crazy-max) in [#​602](https://github.com/docker/metadata-action/pull/602)
- Bump lodash from 4.17.21 to 4.17.23 in [#​588](https://github.com/docker/metadata-action/pull/588)
- Bump [@​actions/core](https://github.com/actions/core) from 1.11.1 to 3.0.0 in [#​599](https://github.com/docker/metadata-action/pull/599)
- Bump [@​actions/github](https://github.com/actions/github) from 6.0.1 to 9.0.0 in [#​597](https://github.com/docker/metadata-action/pull/597)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.68.0 to 0.79.0 in [#​604](https://github.com/docker/metadata-action/pull/604)
- Bump [@​isaacs/brace-expansion](https://github.com/isaacs/brace-expansion) from 5.0.0 to 5.0.1 in [#​600](https://github.com/docker/metadata-action/pull/600)
- Bump semver from 7.7.3 to 7.7.4 in [#​603](https://github.com/docker/metadata-action/pull/603)
**Full Changelog**: <https://github.com/docker/metadata-action/compare/v5.10.0...v6.0.0>
### [`v6`](https://github.com/docker/metadata-action/compare/v5.10.0...v6)
[Compare Source](https://github.com/docker/metadata-action/compare/v5.10.0...v6)
</details>
<details>
<summary>docker/setup-buildx-action (docker/setup-buildx-action)</summary>
### [`v4.2.0`](https://github.com/docker/setup-buildx-action/releases/tag/v4.2.0)
[Compare Source](https://github.com/docker/setup-buildx-action/compare/v4.1.0...v4.2.0)
- Preserve names in esbuild bundle by [@​crazy-max](https://github.com/crazy-max) in [#​572](https://github.com/docker/setup-buildx-action/pull/572)
- Bump [@​actions/core](https://github.com/actions/core) from 3.0.0 to 3.0.1 in [#​551](https://github.com/docker/setup-buildx-action/pull/551)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.90.0 to 0.92.0 in [#​557](https://github.com/docker/setup-buildx-action/pull/557) [#​580](https://github.com/docker/setup-buildx-action/pull/580)
- Bump [@​sigstore/core](https://github.com/sigstore/core) from 3.1.0 to 3.2.1 in [#​573](https://github.com/docker/setup-buildx-action/pull/573)
- Bump [@​sigstore/verify](https://github.com/sigstore/verify) from 3.1.0 to 3.1.1 in [#​576](https://github.com/docker/setup-buildx-action/pull/576)
- Bump js-yaml from 4.1.1 to 5.2.0 in [#​562](https://github.com/docker/setup-buildx-action/pull/562)
- Bump sigstore from 4.1.0 to 4.1.1 in [#​577](https://github.com/docker/setup-buildx-action/pull/577)
- Bump tmp from 0.2.5 to 0.2.7 in [#​556](https://github.com/docker/setup-buildx-action/pull/556)
- Bump undici from 6.25.0 to 6.27.0 in [#​570](https://github.com/docker/setup-buildx-action/pull/570)
- Bump vite from 7.3.2 to 7.3.6 in [#​569](https://github.com/docker/setup-buildx-action/pull/569)
**Full Changelog**: <https://github.com/docker/setup-buildx-action/compare/v4.1.0...v4.2.0>
### [`v4.1.0`](https://github.com/docker/setup-buildx-action/releases/tag/v4.1.0)
[Compare Source](https://github.com/docker/setup-buildx-action/compare/v4...v4.1.0)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.79.0 to 0.90.0 in [#​489](https://github.com/docker/setup-buildx-action/pull/489)
- Bump brace-expansion from 1.1.12 to 5.0.6 in [#​547](https://github.com/docker/setup-buildx-action/pull/547) [#​508](https://github.com/docker/setup-buildx-action/pull/508)
- Bump fast-xml-builder from 1.0.0 to 1.2.0 in [#​540](https://github.com/docker/setup-buildx-action/pull/540)
- Bump fast-xml-parser from 5.4.2 to 5.8.0 in [#​496](https://github.com/docker/setup-buildx-action/pull/496)
- Bump flatted from 3.3.3 to 3.4.2 in [#​499](https://github.com/docker/setup-buildx-action/pull/499)
- Bump glob from 10.3.12 to 13.0.6 in [#​495](https://github.com/docker/setup-buildx-action/pull/495)
- Bump handlebars from 4.7.8 to 4.7.9 in [#​504](https://github.com/docker/setup-buildx-action/pull/504)
- Bump lodash from 4.17.23 to 4.18.1 in [#​523](https://github.com/docker/setup-buildx-action/pull/523)
- Bump picomatch from 4.0.3 to 4.0.4 in [#​503](https://github.com/docker/setup-buildx-action/pull/503)
- Bump postcss from 8.5.6 to 8.5.10 in [#​537](https://github.com/docker/setup-buildx-action/pull/537)
- Bump tar from 6.2.1 to 7.5.15 in [#​545](https://github.com/docker/setup-buildx-action/pull/545)
- Bump undici from 6.23.0 to 6.25.0 in [#​492](https://github.com/docker/setup-buildx-action/pull/492)
- Bump vite from 7.3.1 to 7.3.2 in [#​520](https://github.com/docker/setup-buildx-action/pull/520)
**Full Changelog**: <https://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0>
### [`v4.0.0`](https://github.com/docker/setup-buildx-action/releases/tag/v4.0.0)
[Compare Source](https://github.com/docker/setup-buildx-action/compare/v4...v4)
- Node 24 as default runtime (requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later) by [@​crazy-max](https://github.com/crazy-max) in [#​483](https://github.com/docker/setup-buildx-action/pull/483)
- Remove deprecated inputs/outputs by [@​crazy-max](https://github.com/crazy-max) in [#​464](https://github.com/docker/setup-buildx-action/pull/464)
- Switch to ESM and update config/test wiring by [@​crazy-max](https://github.com/crazy-max) in [#​481](https://github.com/docker/setup-buildx-action/pull/481)
- Bump [@​actions/core](https://github.com/actions/core) from 1.11.1 to 3.0.0 in [#​475](https://github.com/docker/setup-buildx-action/pull/475)
- Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.63.0 to 0.79.0 in [#​482](https://github.com/docker/setup-buildx-action/pull/482) [#​485](https://github.com/docker/setup-buildx-action/pull/485)
- Bump js-yaml from 4.1.0 to 4.1.1 in [#​452](https://github.com/docker/setup-buildx-action/pull/452)
- Bump lodash from 4.17.21 to 4.17.23 in [#​472](https://github.com/docker/setup-buildx-action/pull/472)
- Bump minimatch from 3.1.2 to 3.1.5 in [#​480](https://github.com/docker/setup-buildx-action/pull/480)
**Full Changelog**: <https://github.com/docker/setup-buildx-action/compare/v3.12.0...v4.0.0>
### [`v4`](https://github.com/docker/setup-buildx-action/compare/v3.12.0...v4)
[Compare Source](https://github.com/docker/setup-buildx-action/compare/v3.12.0...v4)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNTQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
renovate
changed title from Update actions/checkout action to v5 #none major (main) to Update actions/checkout action to v6 #none major (main)2025-11-20 19:06:33 +02:00
renovate
changed title from Update actions/checkout action to v6 #none major (main) to Update Github Actions #none major (main) (major)2026-03-04 11:06:10 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v4.4.0→v7.0.1v6.19.2→v7.3.0v3.7.0→v4.6.0v5.10.0→v6.2.0v3.12.0→v4.2.0Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v6 by @aiqiaoy in #2500https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v6.1.0
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v5 by @aiqiaoy in #2501https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: https://github.com/actions/checkout/compare/v5.0.1...v5.1.0
v5.0.1Compare Source
v5.0.0Compare Source
v5Compare Source
docker/build-push-action (docker/build-push-action)
v7.3.0Compare Source
Full Changelog: https://github.com/docker/build-push-action/compare/v7.2.0...v7.3.0
v7.2.0Compare Source
Full Changelog: https://github.com/docker/build-push-action/compare/v7.1.0...v7.2.0
v7.1.0Compare Source
Full Changelog: https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0
v7.0.0Compare Source
DOCKER_BUILD_NO_SUMMARYandDOCKER_BUILD_EXPORT_RETENTION_DAYSenvs by @crazy-max in #1473Full Changelog: https://github.com/docker/build-push-action/compare/v6.19.2...v7.0.0
v7Compare Source
docker/login-action (docker/login-action)
v4.6.0Compare Source
Full Changelog: https://github.com/docker/login-action/compare/v4.5.2...v4.6.0
v4.5.2Compare Source
Full Changelog: https://github.com/docker/login-action/compare/v4.5.1...v4.5.2
v4.5.1Compare Source
dhi.ioas Docker Hub OIDC registry by @crazy-max in #1054Full Changelog: https://github.com/docker/login-action/compare/v4.5.0...v4.5.1
v4.5.0Compare Source
Full Changelog: https://github.com/docker/login-action/compare/v4.4.0...v4.5.0
v4.4.0Compare Source
registry-authsecret mask by @crazy-max in #1035Full Changelog: https://github.com/docker/login-action/compare/v4.3.0...v4.4.0
v4.3.0Compare Source
Full Changelog: https://github.com/docker/login-action/compare/v4.2.0...v4.3.0
v4.2.0Compare Source
Full Changelog: https://github.com/docker/login-action/compare/v4.1.0...v4.2.0
v4.1.0Compare Source
Full Changelog: https://github.com/docker/login-action/compare/v4.0.0...v4.1.0
v4.0.0Compare Source
Full Changelog: https://github.com/docker/login-action/compare/v3.7.0...v4.0.0
v4Compare Source
docker/metadata-action (docker/metadata-action)
v6.2.0Compare Source
Full Changelog: https://github.com/docker/metadata-action/compare/v6.1.0...v6.2.0
v6.1.0Compare Source
Full Changelog: https://github.com/docker/metadata-action/compare/v6.0.0...v6.1.0
v6.0.0Compare Source
#inside values while still supporting full-line#comments by @crazy-max in #607Full Changelog: https://github.com/docker/metadata-action/compare/v5.10.0...v6.0.0
v6Compare Source
docker/setup-buildx-action (docker/setup-buildx-action)
v4.2.0Compare Source
Full Changelog: https://github.com/docker/setup-buildx-action/compare/v4.1.0...v4.2.0
v4.1.0Compare Source
Full Changelog: https://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0
v4.0.0Compare Source
Full Changelog: https://github.com/docker/setup-buildx-action/compare/v3.12.0...v4.0.0
v4Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.
429ac7ba11to9497af3ed89497af3ed8toe21a90a6cbUpdate actions/checkout action to v5 #none major (main)to Update actions/checkout action to v6 #none major (main)e21a90a6cbtod1864b5430d1864b5430toacf95830efacf95830eftodcaf4fe2f0dcaf4fe2f0tob02fd36bf9Update actions/checkout action to v6 #none major (main)to Update Github Actions #none major (main) (major)b02fd36bf9toeb6f903d22eb6f903d22toc167feeb61c167feeb61to6b34a0212b6b34a0212bto4cc2c92ac94cc2c92ac9to51ab68c00b51ab68c00bto6857a14f886857a14f88to17b4e64d0717b4e64d07tocbafa97b11cbafa97b11toa4b64ff42ba4b64ff42bto669e0e367e669e0e367etoaab4075da9aab4075da9to6c62e1bb2f6c62e1bb2fto61d1e64bee61d1e64beetoddd6306a74ddd6306a74tod6f0dbeb2ad6f0dbeb2atof17d97d071f17d97d071to8685be27568685be2756to8b2ec180558b2ec18055to52636a163052636a1630to5e2a65b26f5e2a65b26fto27a922d3e027a922d3e0to94b725bd1494b725bd14to7761fbd16b7761fbd16btoa3da62aa70a3da62aa70tofaeeb312cafaeeb312catod07631ea4dd07631ea4dto59c8f57ab2View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.