chore(deps): update docker/setup-buildx-action action to v4.2.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/setup-buildx-action	action	minor	v4.0.0 → v4.2.0

---

Release Notes

docker/setup-buildx-action (docker/setup-buildx-action)

v4.2.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​572
• Bump @​actions/core from 3.0.0 to 3.0.1 in #​551
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​557 #​580
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​573
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​576
• Bump js-yaml from 4.1.1 to 5.2.0 in #​562
• Bump sigstore from 4.1.0 to 4.1.1 in #​577
• Bump tmp from 0.2.5 to 0.2.7 in #​556
• Bump undici from 6.25.0 to 6.27.0 in #​570
• Bump vite from 7.3.2 to 7.3.6 in #​569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

v4.1.0

Compare Source

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in #​489
• Bump brace-expansion from 1.1.12 to 5.0.6 in #​547 #​508
• Bump fast-xml-builder from 1.0.0 to 1.2.0 in #​540
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in #​496
• Bump flatted from 3.3.3 to 3.4.2 in #​499
• Bump glob from 10.3.12 to 13.0.6 in #​495
• Bump handlebars from 4.7.8 to 4.7.9 in #​504
• Bump lodash from 4.17.23 to 4.18.1 in #​523
• Bump picomatch from 4.0.3 to 4.0.4 in #​503
• Bump postcss from 8.5.6 to 8.5.10 in #​537
• Bump tar from 6.2.1 to 7.5.15 in #​545
• Bump undici from 6.23.0 to 6.25.0 in #​492
• Bump vite from 7.3.1 to 7.3.2 in #​520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Version Update Path: v4.0.0 → v4.1.0 → v4.2.0

v4.2.0 Changes (July 2025):

• Build optimization: Preserve names in esbuild bundle
• Dependency updates:
  • @actions/core: 3.0.0 → 3.0.1
  • @docker/actions-toolkit: 0.90.0 → 0.92.0
  • @sigstore/core: 3.1.0 → 3.2.1
  • @sigstore/verify: 3.1.0 → 3.1.1
  • js-yaml: 4.1.1 → 5.2.0 (major version bump)
  • sigstore: 4.1.0 → 4.1.1
  • tmp: 0.2.5 → 0.2.7
  • undici: 6.25.0 → 6.27.0
  • vite: 7.3.2 → 7.3.6

v4.1.0 Changes:

• Pure dependency maintenance release
• Notable updates: brace-expansion (1.1.12 → 5.0.6), tar (6.2.1 → 7.5.15), lodash (4.17.23 → 4.18.1), glob (10.3.12 → 13.0.6)

Breaking Changes:

• None documented in release notes
• Action API interface remains unchanged (inputs/outputs compatibility maintained)
• No configuration migration required

Security Considerations:

• Multiple dependency security patches included (particularly js-yaml, lodash, tar, undici)
• Addresses known vulnerabilities through transitive dependency updates

🎯 Impact Scope Investigation

Usage Locations Identified:

1. .github/workflows/ci.yml:82 - E2E Test job

   • Used to set up Docker Buildx for building test images
   • No custom inputs specified (using defaults)
   • Followed by docker/build-push-action@v7.2.0 with cache configuration

2. .github/workflows/release-please.yml:56 - Publish job

   • Used to set up Docker Buildx for multi-platform releases
   • No custom inputs specified (using defaults)
   • Followed by docker/build-push-action@v7.2.0 for publishing to ghcr.io

Configuration Analysis:
Both usages rely on default behavior:

• No custom version, driver, buildkitd-flags, or other inputs specified
• Default driver (docker-container) is used
• Default cleanup behavior (true) is maintained
• Action outputs are not consumed by subsequent steps

Dependency Impact:

• No changes required to docker/build-push-action@v7.2.0 (already compatible)
• No changes required to docker/setup-qemu-action@v4.0.0 (independent)
• Docker Compose usage in tests is unaffected

CI Status:

• Build, Lint, Unit Test: Passing
• E2E Tests: Currently pending execution
• hadolint: Passing

💡 Recommended Actions

Immediate Action:
✅ Safe to merge - This is a backward-compatible minor version update with no breaking changes.

No Code Changes Required:

• Both workflow usages employ default configuration
• No API-breaking changes between v4.0.0 and v4.2.0
• Existing cache configurations remain compatible

Validation:

• Monitor E2E test results to confirm Docker image builds function correctly
• Verify multi-platform builds in release workflow continue to work as expected

Post-Merge:

• No manual migration steps needed
• No configuration file updates required

🔗 Reference Links

• v4.2.0 Release Notes
• v4.1.0 Release Notes
• Full Changelog v4.0.0...v4.2.0
• Known vulnerabilities discussion
• StepSecurity Action Advisor

Generated by koki-develop/claude-renovate-review