chore(deps): update docker/setup-buildx-action action to v4.1.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
docker/setup-buildx-action	action	minor	v4.0.0 → v4.1.0	v4.2.0

---

Release Notes

docker/setup-buildx-action (docker/setup-buildx-action)

v4.1.0

Compare Source

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in #​489
• Bump brace-expansion from 1.1.12 to 5.0.6 in #​547 #​508
• Bump fast-xml-builder from 1.0.0 to 1.2.0 in #​540
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in #​496
• Bump flatted from 3.3.3 to 3.4.2 in #​499
• Bump glob from 10.3.12 to 13.0.6 in #​495
• Bump handlebars from 4.7.8 to 4.7.9 in #​504
• Bump lodash from 4.17.23 to 4.18.1 in #​523
• Bump picomatch from 4.0.3 to 4.0.4 in #​503
• Bump postcss from 8.5.6 to 8.5.10 in #​537
• Bump tar from 6.2.1 to 7.5.15 in #​545
• Bump undici from 6.23.0 to 6.25.0 in #​492
• Bump vite from 7.3.1 to 7.3.2 in #​520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Version Change: docker/setup-buildx-action v4.0.0 → v4.1.0

Release Type: Minor version update (maintenance release)

Key Changes:

• Dependency Updates Only: This release consists entirely of dependency bumps with no functional changes to the action's API, inputs, or outputs
• Security Patches Included: Multiple security vulnerabilities addressed through dependency updates:
  • brace-expansion (1.1.12 → 5.0.6): Fixes CVE-2026-33750, CVE-2026-25547, CVE-2026-13149 - exponential DoS and uncontrolled resource consumption vulnerabilities
  • tar (6.2.1 → 7.5.15): Addresses CVE-2026-23745 (arbitrary file overwrite), CVE-2026-24842, and CVE-2024-28863 (DoS)
  • undici (6.23.0 → 6.25.0): Mitigates CVE-2026-22036 (decompression bomb DoS) and other high-severity vulnerabilities
• Docker Actions Toolkit: Upgraded from 0.79.0 to 0.90.0
• Build Tool Updates: vite (7.3.1 → 7.3.2), postcss (8.5.6 → 8.5.10), handlebars (4.7.8 → 4.7.9)
• Utility Updates: lodash (4.17.23 → 4.18.1), glob (10.3.12 → 13.0.6), picomatch (4.0.3 → 4.0.4), flatted (3.3.3 → 3.4.2)
• XML Processing: fast-xml-parser (5.4.2 → 5.8.0), fast-xml-builder (1.0.0 → 1.2.0)

Breaking Changes: None

API Stability: The action interface (inputs/outputs) remains unchanged from v4.0.0. All action inputs and outputs are backward compatible.

Reference: The v4.0.0 release removed deprecated inputs/outputs, but v4.1.0 maintains full backward compatibility with v4.0.0.

🎯 Impact Scope Investigation

Usage Locations in Codebase:

1. .github/workflows/ci.yml:82 - E2E test job

   • Used with docker/build-push-action for building Docker images with cache
   • No custom inputs configured (uses default settings)

2. .github/workflows/release-please.yml:56 - Release/publish job

   • Used with docker/build-push-action for multi-platform builds
   • No custom inputs configured (uses default settings)

Current Usage Pattern:

- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

Impact Analysis:

• No Configuration Required: The action is used with default settings in both workflows
• No Input/Output Changes: The update does not modify the action's interface
• Downstream Dependencies: Works with docker/build-push-action@v7.2.0 without issues
• Platform Compatibility: Tested on ubuntu-latest and ubuntu-24.04-arm (matrix strategy in CI)
• Build Cache Compatibility: GitHub Actions cache (type=gha) integration remains unchanged

Dependencies Not Affected:

• docker/build-push-action@v7.2.0 - continues to work without changes
• docker/setup-qemu-action@v4.0.0 - no interaction with setup-buildx-action update
• docker/login-action@v4.1.0 - no interaction with setup-buildx-action update

💡 Recommended Actions

Immediate Actions:

1. ✅ Approve and merge this PR - This is a safe, backward-compatible security update
2. ✅ No code changes required - The action is used with default settings
3. ✅ No configuration updates needed - All existing workflow configurations remain valid

Post-Merge Validation:

1. Monitor the CI workflow execution after merge to confirm successful buildx setup
2. Verify E2E tests continue to pass with the updated action
3. Confirm release workflow builds complete successfully for multi-platform images

Security Benefits:

• Eliminates multiple high-severity CVEs (7.5 CVSS score) in dependencies
• Improves build environment security posture
• Addresses DoS, arbitrary file overwrite, and resource exhaustion vulnerabilities

Future Considerations:

• Note that v4.2.0 is pending (mentioned in PR description) - monitor for additional improvements
• The action follows semantic versioning - minor updates like this are designed to be backward compatible

🔗 Reference Links

Release Information:

• v4.1.0 Release Notes
• Full Changelog: v4.0.0...v4.1.0
• docker/setup-buildx-action Repository

Security References:

• CVE-2026-33750: brace-expansion DoS
• CVE-2026-23745: node-tar Arbitrary File Overwrite
• CVE-2026-22036: Undici Decompression DoS
• Node.js June 2026 Security Releases

Generated by koki-develop/claude-renovate-review