Skip to content

build(deps): Bump docker/setup-buildx-action from 3 to 4 - #3148

Merged
julienrbrt merged 2 commits into
mainfrom
dependabot/github_actions/main/docker/setup-buildx-action-4
Mar 10, 2026
Merged

build(deps): Bump docker/setup-buildx-action from 3 to 4#3148
julienrbrt merged 2 commits into
mainfrom
dependabot/github_actions/main/docker/setup-buildx-action-4

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubMar 9, 2026

Copy link
Copy Markdown
Contributor

Bumps docker/setup-buildx-action from 3 to 4.

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.0.0

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

v3.12.0

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

v3.11.1

Full Changelog: docker/setup-buildx-action@v3.11.0...v3.11.1

v3.11.0

Full Changelog: docker/setup-buildx-action@v3.10.0...v3.11.0

v3.10.0

Full Changelog: docker/setup-buildx-action@v3.9.0...v3.10.0

v3.9.0

Full Changelog: docker/setup-buildx-action@v3.8.0...v3.9.0

v3.8.0

Full Changelog: docker/setup-buildx-action@v3.7.1...v3.8.0

... (truncated)

Commits
  • 4d04d5d Merge pull request #485 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • cd74e05 chore: update generated content
  • eee38ec build(deps): bump @​docker/actions-toolkit from 0.77.0 to 0.79.0
  • 7a83f65 Merge pull request #484 from docker/dependabot/github_actions/docker/setup-qe...
  • a5aa967 Merge pull request #464 from crazy-max/rm-deprecated
  • e73d53f build(deps): bump docker/setup-qemu-action from 3 to 4
  • 28a438e Merge pull request #483 from crazy-max/node24
  • 034e9d3 chore: update generated content
  • b4664d8 remove deprecated inputs/outputs
  • a8257de node 24 as default runtime
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@v3...v4)
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabotBotforce-pushed the dependabot/github_actions/main/docker/setup-buildx-action-4 branch from 1d8ba85 to d0d864eCompareMarch 10, 2026 08:04
@github-actions

Copy link
Copy Markdown
Contributor

The latest Buf updates on your PR. Results from workflow CI / buf-check (pull_request).

BuildFormatLintBreakingUpdated (UTC)
✅ passed⏩ skipped✅ passed✅ passedMar 10, 2026, 1:39 PM

@julienrbrt
julienrbrt enabled auto-merge March 10, 2026 13:39
@claude

claudeBot commented Mar 10, 2026

Copy link
Copy Markdown
Contributor

Claude finished @julienrbrt's task in 56s —— View job


Code Review: Bump docker/setup-buildx-action from 3 to 4

  • Gather context and analyze PR
  • Review changed workflow files
  • Check CI status
  • Provide review summary

Summary

This is a straightforward dependabot dependency bump updating docker/setup-buildx-action from v3 to v4 across 4 workflow files. The PR is already approved by @julienrbrt.

Key v4.0.0 Changes

  • Node 24 runtime — requires Actions Runner v2.327.1 or later (GitHub-hosted runners already meet this requirement)
  • Removed deprecated inputs/outputs — the install input (deprecated in v3.12.0) is removed; none of the workflows in this repo use it, so no breaking changes
  • Security/dependency bumps: lodash, minimatch, js-yaml, @actions/core 1.11.1 → 3.0.0

Workflow Changes

All 4 files correctly bump the action version:

  • .github/workflows/benchmark.yml — 3 occurrences, SHA-pinned with version comment (@4d04d5d...# v4.0.0) ✅
  • .github/workflows/docker-build-push.yml — uses floating tag @v4
  • .github/workflows/release-apps.yml — uses floating tag @v4
  • .github/workflows/test.yml — uses floating tag @v4

Minor Observation

There is a pre-existing inconsistency in pinning strategy across workflow files: benchmark.yml uses full SHA pinning (best practice for security), while the other three use floating version tags (@v4). This inconsistency is not introduced by this PR — it was already present — and is out of scope for this bump. It could be addressed in a separate cleanup PR if desired.

CI Status

CI is currently in-progress/queued with no failures. The Buf check passed. This is a low-risk infrastructure dependency update.

Verdict: ✅ Looks good to merge. The changes are correct, minimal, and consistent with each file's existing pinning strategy.


- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v4

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Build Docker Images' step
Uses Step
uses 'docker/setup-buildx-action' with ref 'v4', not a pinned commit hash

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v4

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Apps release' step
Uses Step
uses 'docker/setup-buildx-action' with ref 'v4', not a pinned commit hash
Comment thread.github/workflows/test.yml Dismissed
@codecov

codecovBot commented Mar 10, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.22%. Comparing base (c588547) to head (69203b3).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@ Coverage Diff @@## main #3148 +/- ##
==========================================
- Coverage 60.24% 60.22% -0.03% 
==========================================
Files 115 115 Lines 11899 11899 ==========================================
- Hits 7169 7166 -3 - Misses 3920 3924 +4 + Partials 810 809 -1 
FlagCoverage Δ
combined60.22% <ø> (-0.03%)⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@julienrbrt
julienrbrt added this pull request to the merge queueMar 10, 2026
Merged via the queue into main with commit ba25ea8Mar 10, 2026
36 of 38 checks passed
@julienrbrt
julienrbrt deleted the dependabot/github_actions/main/docker/setup-buildx-action-4 branch March 10, 2026 14:13
alpe added a commit that referenced this pull request Mar 11, 2026
* main:
fix: persist snapshot once for avoiding badger vlog (#3153)
build(deps): Bump docker/setup-buildx-action from 3 to 4 (#3148)
build(deps): Bump the all-go group across 5 directories with 8 updates (#3147)
build(deps): Bump docker/login-action from 3 to 4 (#3149)
build(deps): Bump docker/build-push-action from 6 to 7 (#3151)
build(deps): Bump actions/setup-go from 6.2.0 to 6.3.0 (#3150)
alpe added a commit that referenced this pull request Mar 16, 2026
* main:
fix(syncer): include in-flight and pending-cache work in PendingCount (#3162)
chore: re-add replaces for development (#3161)
build(deps): Bump quinn-proto from 0.11.13 to 0.11.14 in the cargo group across 1 directory (#3155)
build(deps): bump execution/evm (#3160)
build(deps): bump ev-node (#3159)
chore: remove replaces from ev-node (#3158)
chore: fix some function names in comment (#3156)
fix: persist snapshot once for avoiding badger vlog (#3153)
build(deps): Bump docker/setup-buildx-action from 3 to 4 (#3148)
build(deps): Bump the all-go group across 5 directories with 8 updates (#3147)
build(deps): Bump docker/login-action from 3 to 4 (#3149)
build(deps): Bump docker/build-push-action from 6 to 7 (#3151)
build(deps): Bump actions/setup-go from 6.2.0 to 6.3.0 (#3150)
chore: prep evm rc.5 (#3145)
build(deps): bump ev-node (#3144)
feat(block): Event-Driven DA Follower with WebSocket Subscriptions (#3131)
build(deps): Bump dompurify from 3.2.6 to 3.3.2 in /docs in the npm_and_yarn group across 1 directory (#3140)
feat(benchmarking): adding gas burner test (#3115)
chore: minor deduplication (#3139)
refactor(store,cache)!: optimize cache restore as O(1) (#3134)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@julienrbrt@github-advanced-security