surface Docker Hub OIDC error responses - #1058
Merged
crazy-max merged 2 commits intoJul 27, 2026
Merged
Conversation
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
vvoland
approved these changes
Jul 27, 2026
mergify Bot
added a commit
to ArcadeData/arcadedb
that referenced
this pull request
Jul 29, 2026
…ub-actions group [skip ci] Bumps the github-actions group with 1 update: [docker/login-action](https://github.com/docker/login-action). Updates `docker/login-action` from 4.5.1 to 4.5.2 Release notes *Sourced from [docker/login-action's releases](https://github.com/docker/login-action/releases).* > v4.5.2 > ------ > > * Surface Docker Hub OIDC error responses by [`@crazy-max`](https://github.com/crazy-max) in [docker/login-action#1058](https://redirect.github.com/docker/login-action/pull/1058) > > **Full Changelog**: <docker/login-action@v4.5.1...v4.5.2> Commits * [`371161b`](docker/login-action@371161b) Merge pull request [#1058](https://redirect.github.com/docker/login-action/issues/1058) from crazy-max/fix-dockerhub-oidc-error-handling * [`5dc73df`](docker/login-action@5dc73df) chore: update generated content * [`2aa1ede`](docker/login-action@2aa1ede) surface Docker Hub OIDC error responses * See full diff in [compare view](docker/login-action@abd2ef4...371161b) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
mergify Bot
added a commit
to ArcadeData/arcadedb
that referenced
this pull request
Jul 29, 2026
Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [docker/login-action](https://github.com/docker/login-action). Updates `actions/checkout` from 7.0.0 to 7.0.1 Release notes *Sourced from [actions/checkout's releases](https://github.com/actions/checkout/releases).* > v7.0.1 > ------ > > What's Changed > -------------- > > * skip running unsafe pr check if input is default by [`@aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2518](https://redirect.github.com/actions/checkout/pull/2518) > * trim only ascii whitespace for branch by [`@aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2521](https://redirect.github.com/actions/checkout/pull/2521) > * escape values passed to --unset by [`@aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2530](https://redirect.github.com/actions/checkout/pull/2530) > * Various dependency updates > > **Full Changelog**: <actions/checkout@v7...v7.0.1> Changelog *Sourced from [actions/checkout's changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md).* > Changelog > ========= > > v7.0.1 > ------ > > * Skip running unsafe pr check if input is default by [`@aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2518](https://redirect.github.com/actions/checkout/pull/2518) > * Trim only ascii whitespace for branch by [`@aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2521](https://redirect.github.com/actions/checkout/pull/2521) > * Escape values passed to --unset by [`@aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2530](https://redirect.github.com/actions/checkout/pull/2530) > * Various dependency updates > > v7.0.0 > ------ > > * Block checking out fork PR for pull\_request\_target and workflow\_run by [`@aiqiaoy`](https://github.com/aiqiaoy) in [actions/checkout#2454](https://redirect.github.com/actions/checkout/pull/2454) > * Various dependency updates > > v6.0.3 > ------ > > * Fix checkout init for SHA-256 repositories by [`@yaananth`](https://github.com/yaananth) in [actions/checkout#2439](https://redirect.github.com/actions/checkout/pull/2439) > * fix: expand merge commit SHA regex and add SHA-256 test cases by [`@yaananth`](https://github.com/yaananth) in [actions/checkout#2414](https://redirect.github.com/actions/checkout/pull/2414) > > v6.0.2 > ------ > > * Fix tag handling: preserve annotations and explicit fetch-tags by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2356](https://redirect.github.com/actions/checkout/pull/2356) > > v6.0.1 > ------ > > * Add worktree support for persist-credentials includeIf by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2327](https://redirect.github.com/actions/checkout/pull/2327) > > v6.0.0 > ------ > > * Persist creds to a separate file by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2286](https://redirect.github.com/actions/checkout/pull/2286) > * Update README to include Node.js 24 support details and requirements by [`@salmanmkc`](https://github.com/salmanmkc) in [actions/checkout#2248](https://redirect.github.com/actions/checkout/pull/2248) > > v5.0.1 > ------ > > * Port v6 cleanup to v5 by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2301](https://redirect.github.com/actions/checkout/pull/2301) > > v5.0.0 > ------ > > * Update actions checkout to use node 24 by [`@salmanmkc`](https://github.com/salmanmkc) in [actions/checkout#2226](https://redirect.github.com/actions/checkout/pull/2226) > > v4.3.1 > ------ > > * Port v6 cleanup to v4 by [`@ericsciple`](https://github.com/ericsciple) in [actions/checkout#2305](https://redirect.github.com/actions/checkout/pull/2305) > > v4.3.0 > ------ > > * docs: update README.md by [`@motss`](https://github.com/motss) in [actions/checkout#1971](https://redirect.github.com/actions/checkout/pull/1971) > * Add internal repos for checking out multiple repositories by [`@mouismail`](https://github.com/mouismail) in [actions/checkout#1977](https://redirect.github.com/actions/checkout/pull/1977) > * Documentation update - add recommended permissions to Readme by [`@benwells`](https://github.com/benwells) in [actions/checkout#2043](https://redirect.github.com/actions/checkout/pull/2043) > * Adjust positioning of user email note and permissions heading by [`@joshmgross`](https://github.com/joshmgross) in [actions/checkout#2044](https://redirect.github.com/actions/checkout/pull/2044) > * Update README.md by [`@nebuk89`](https://github.com/nebuk89) in [actions/checkout#2194](https://redirect.github.com/actions/checkout/pull/2194) > * Update CODEOWNERS for actions by [`@TingluoHuang`](https://github.com/TingluoHuang) in [actions/checkout#2224](https://redirect.github.com/actions/checkout/pull/2224) > * Update package dependencies by [`@salmanmkc`](https://github.com/salmanmkc) in [actions/checkout#2236](https://redirect.github.com/actions/checkout/pull/2236) > > v4.2.2 > ------ > > * `url-helper.ts` now leverages well-known environment variables by [`@jww3`](https://github.com/jww3) in [actions/checkout#1941](https://redirect.github.com/actions/checkout/pull/1941) > * Expand unit test coverage for `isGhes` by [`@jww3`](https://github.com/jww3) in [actions/checkout#1946](https://redirect.github.com/actions/checkout/pull/1946) > > v4.2.1 > ------ > > * Check out other refs/\* by commit if provided, fall back to ref by [`@orhantoy`](https://github.com/orhantoy) in [actions/checkout#1924](https://redirect.github.com/actions/checkout/pull/1924) ... (truncated) Commits * See full diff in [compare view](actions/checkout@v7...3d3c42e) Updates `docker/login-action` from 4.4.0 to 4.6.0 Release notes *Sourced from [docker/login-action's releases](https://github.com/docker/login-action/releases).* > v4.6.0 > ------ > > * Harden buildx scoped config path handling by [`@crazy-max`](https://github.com/crazy-max) in [docker/login-action#1059](https://redirect.github.com/docker/login-action/pull/1059) > * Bump `@aws-sdk/client-ecr` and `@aws-sdk/client-ecr-public` to 3.1095.0 in [docker/login-action#1051](https://redirect.github.com/docker/login-action/pull/1051) > * Bump js-yaml from 5.2.1 to 5.2.2 in [docker/login-action#1057](https://redirect.github.com/docker/login-action/pull/1057) > * Bump postcss from 8.5.10 to 8.5.22 in [docker/login-action#1056](https://redirect.github.com/docker/login-action/pull/1056) > > **Full Changelog**: <docker/login-action@v4.5.2...v4.6.0> > > v4.5.2 > ------ > > * Surface Docker Hub OIDC error responses by [`@crazy-max`](https://github.com/crazy-max) in [docker/login-action#1058](https://redirect.github.com/docker/login-action/pull/1058) > > **Full Changelog**: <docker/login-action@v4.5.1...v4.5.2> > > v4.5.1 > ------ > > * Support `dhi.io` as Docker Hub OIDC registry by [`@crazy-max`](https://github.com/crazy-max) in [docker/login-action#1054](https://redirect.github.com/docker/login-action/pull/1054) > > **Full Changelog**: <docker/login-action@v4.5.0...v4.5.1> > > v4.5.0 > ------ > > * [Docker Hub OIDC](https://github.com/docker/login-action#docker-hub) login support by [`@crazy-max`](https://github.com/crazy-max) in [docker/login-action#1048](https://redirect.github.com/docker/login-action/pull/1048) > * Bump `@aws-sdk/client-ecr` and `@aws-sdk/client-ecr-public` to 3.1091.0 in [docker/login-action#1037](https://redirect.github.com/docker/login-action/pull/1037) > * Bump `@docker/actions-toolkit` from 0.92.0 to 0.94.0 in [docker/login-action#1044](https://redirect.github.com/docker/login-action/pull/1044) [docker/login-action#1050](https://redirect.github.com/docker/login-action/pull/1050) > * Bump brace-expansion from 1.1.13 to 1.1.16 in [docker/login-action#1046](https://redirect.github.com/docker/login-action/pull/1046) > * Bump js-yaml from 5.2.0 to 5.2.1 in [docker/login-action#1038](https://redirect.github.com/docker/login-action/pull/1038) > > **Full Changelog**: <docker/login-action@v4.4.0...v4.5.0> Commits * [`dbcb813`](docker/login-action@dbcb813) Merge pull request [#1051](https://redirect.github.com/docker/login-action/issues/1051) from docker/dependabot/npm\_and\_yarn/aws-sdk-dependen... * [`5bcb015`](docker/login-action@5bcb015) [dependabot skip] chore: update generated content * [`b30b2f2`](docker/login-action@b30b2f2) build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up... * [`9087f1e`](docker/login-action@9087f1e) Merge pull request [#1057](https://redirect.github.com/docker/login-action/issues/1057) from docker/dependabot/npm\_and\_yarn/js-yaml-5.2.2 * [`0009830`](docker/login-action@0009830) [dependabot skip] chore: update generated content * [`2325523`](docker/login-action@2325523) build(deps): bump js-yaml from 5.2.1 to 5.2.2 * [`4ec1d4a`](docker/login-action@4ec1d4a) Merge pull request [#1056](https://redirect.github.com/docker/login-action/issues/1056) from docker/dependabot/npm\_and\_yarn/postcss-8.5.22 * [`5fc99ba`](docker/login-action@5fc99ba) Merge pull request [#1053](https://redirect.github.com/docker/login-action/issues/1053) from docker/dependabot/github\_actions/aws-actions/co... * [`e512bd5`](docker/login-action@e512bd5) Merge pull request [#1052](https://redirect.github.com/docker/login-action/issues/1052) from docker/dependabot/github\_actions/codeql-actions... * [`a146c91`](docker/login-action@a146c91) Merge pull request [#1059](https://redirect.github.com/docker/login-action/issues/1059) from crazy-max/harden-buildx-scope-paths * Additional commits viewable in [compare view](docker/login-action@v4.4.0...dbcb813) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
umati-bot
added a commit
to umati/Sample-Server
that referenced
this pull request
Jul 31, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker/login-action](https://github.com/docker/login-action) | action | minor | `v4.4.0` → `v4.6.0` | --- ### Release Notes <details> <summary>docker/login-action (docker/login-action)</summary> ### [`v4.6.0`](https://github.com/docker/login-action/releases/tag/v4.6.0) [Compare Source](docker/login-action@v4.5.2...v4.6.0) - Harden buildx scoped config path handling by [@​crazy-max](https://github.com/crazy-max) in [#​1059](docker/login-action#1059) - Bump [@​aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) to 3.1095.0 in [#​1051](docker/login-action#1051) - Bump js-yaml from 5.2.1 to 5.2.2 in [#​1057](docker/login-action#1057) - Bump postcss from 8.5.10 to 8.5.22 in [#​1056](docker/login-action#1056) **Full Changelog**: <docker/login-action@v4.5.2...v4.6.0> ### [`v4.5.2`](https://github.com/docker/login-action/releases/tag/v4.5.2) [Compare Source](docker/login-action@v4.5.1...v4.5.2) - Surface Docker Hub OIDC error responses by [@​crazy-max](https://github.com/crazy-max) in [#​1058](docker/login-action#1058) **Full Changelog**: <docker/login-action@v4.5.1...v4.5.2> ### [`v4.5.1`](https://github.com/docker/login-action/releases/tag/v4.5.1) [Compare Source](docker/login-action@v4.5.0...v4.5.1) - Support `dhi.io` as Docker Hub OIDC registry by [@​crazy-max](https://github.com/crazy-max) in [#​1054](docker/login-action#1054) **Full Changelog**: <docker/login-action@v4.5.0...v4.5.1> ### [`v4.5.0`](https://github.com/docker/login-action/releases/tag/v4.5.0) [Compare Source](docker/login-action@v4.4.0...v4.5.0) - [Docker Hub OIDC](https://github.com/docker/login-action#docker-hub) login support by [@​crazy-max](https://github.com/crazy-max) in [#​1048](docker/login-action#1048) - Bump [@​aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) to 3.1091.0 in [#​1037](docker/login-action#1037) - Bump [@​docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.92.0 to 0.94.0 in [#​1044](docker/login-action#1044) [#​1050](docker/login-action#1050) - Bump brace-expansion from 1.1.13 to 1.1.16 in [#​1046](docker/login-action#1046) - Bump js-yaml from 5.2.0 to 5.2.1 in [#​1038](docker/login-action#1038) **Full Changelog**: <docker/login-action@v4.4.0...v4.5.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI4Ni4wIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6W119--> Reviewed-on: https://codeberg.org/umati/Sample-Server/pulls/1737
1 task
tyler-rich
added a commit
to tyler-rich/Scrye
that referenced
this pull request
Aug 2, 2026
* backend: bump fastapi 0.140.0 -> 0.140.13 and regenerate requirements.lock Reapplies the bump Dependabot proposed in #127, which could not merge as opened: Dependabot edits pyproject.toml without touching backend/requirements.lock, so CI's drift gate rejects it. The lock is regenerated with the pinned command from CONTRIBUTING.md § Backend dependency lock (uv 0.8.17, --group build --generate-hashes --python-version 3.14) and moves three lines: fastapi's version and its two wheel hashes. starlette stays at the explicitly-pinned 1.3.1. All thirteen patch releases are internal dependency-tree/OpenAPI refactors (0.140.1-0.140.7) or fixes to paths this backend does not use - SSE/JSONL streaming, response_model_* on Iterable returns, jsonable_encoder's exclude_defaults, and nested-Annotated sequence params. Verified by grep: no jsonable_encoder, no StreamingResponse, no SSE helper, no response_model_* anywhere in backend/app. Confirmed against the regenerated lock rather than the version pin: a venv on CPython 3.14.6 built the way the image builds (pip install --require-hashes -r requirements.lock, then pip install --no-deps --no-build-isolation .) runs the full suite green - 666 passed, 5 skipped, identical to the pre-bump baseline. * ci: bump docker/login-action 4.5.1 -> 4.5.2 Reapplies what Dependabot proposed in #128, SHA-pinned per the repo's Actions convention with the tag as a trailing comment. The commit SHA was resolved from upstream with git ls-remote --tags against docker/login-action rather than read off the bump description - refs/tags/v4.5.2 maps to 371161bbe7024a29a25c5e19bfcbc0804fe9ad2c. Trusting a rendered SHA is the substitution a SHA pin exists to prevent. v4.5.2 contains one substantive commit, "surface Docker Hub OIDC error responses" (docker/login-action#1058): it improves the error text when a Docker Hub OIDC login fails. All three call sites here log in to ghcr.io with the built-in GITHUB_TOKEN as username/password - not Docker Hub, not OIDC - so the changed path is never entered. No input, output, or breaking changes. This matters because these workflows run only on the tag-gated publish path and the nightly, which CI cannot exercise. * ci(dependabot): ignore node majors and the local scrye build tag Two ignore entries, both closing a recurring failure. node majors, on the docker entry. #126 proposed node 22-bookworm-slim -> 25-bookworm-slim. Node's odd-numbered lines never become LTS: v25 reached end-of-life on 2026-06-01, before that PR was opened and years before the 22 line's 2027-04-30, so it would have moved the frontend builder onto an unsupported runtime. The wanted move is 22 -> 24 (Active LTS, 2028-04-30) and is tracked in docs/ROADMAP.md because it spans the Dockerfile, ci.yml and CONTRIBUTING.md together. The ignore is scoped to version-update:semver-major so digest refreshes of the pinned 22 tag still come through - declining a major previously left Dependabot offering nothing for this image and the digest went stale until #107 refreshed it by hand. dependency-name: scrye, on both docker entries. docker/docker-compose.yml pins image: scrye:0.2.0, Scrye's own locally-built tag; Dependabot resolves the unqualified name as Docker Hub's library/scrye, gets a 401, and fails the run with private_source_authentication_failure. Reading the files confirms the compose file carries the only such reference and docker/Dockerfile carries none, so the substantive entry is on the docker-compose ecosystem; it is repeated on the docker entry because the failing run's ecosystem is visible only in the Dependabot UI, and suppressing a name the Dockerfile never mentions costs nothing. The image tag itself is unchanged: qualifying it as ghcr.io/tyler-rich/scrye:0.2.0 would make the compose file pull a published image instead of building locally, changing what the documented quick start does. * docs: record the post-v0.2.0 dependency cleanup and the base-branch diagnosis A version update sitting on main is not the documented security-update case. #126, #127 and #128 were all opened against dev correctly - their head branches carry the /dev/ target-branch segment - and each records an automatic_base_change_succeeded event 2-3 seconds after the v0.2.0 promotion (#122) merged. GitHub retargets open PRs whose base branch is deleted to the merged PR's base, and auto-delete-on-merge deleted dev as the promotion's head branch. dependabot.yml was not involved, and neither was grouped security updates: all three are version updates across three different ecosystems. The remedy is already in place (auto-delete disabled on 2026-08-02); target-branch and the grouping setting stay as they are. CLAUDE.md § Dependency hygiene and a new CONTRIBUTING.md subsection carry the rule and a two-signal table for telling the two causes apart. docs/ROADMAP.md: the Node 22 -> 24 item rewritten to state that it must be its own PR with a registry-verified digest pin, and to name the three files that have to move together - bumping the Dockerfile alone would leave CI on 22 while the image builds on 24. New item for enabling GitHub code scanning (CodeQL) on Python and TypeScript: free for public repos, default setup adds a workflow running on every push and PR, and the first run surfaces a triage backlog, so it wants its own session. docs/ARCHIVE.md gains the dated §14 entry covering all of it, including the correction to #125: GHSA-mh99-v99m-4gvg was re-scoped per major on 2026-07-31 and 1.1.18 / 2.1.4 are both above their line's first patched version, so the #121 bump did clear it. Verified at the source - 1.1.17 and 2.1.3 introduce EXPANSION_MAX_LENGTH and name CVE-2026-14257 in their comments - not from the advisory metadata that produced the wrong claim in the first place. #125 closed on its own stated criterion; #123 and #124 re-verified and still accurate. * docs: distinguish base_ref_changed from automatic_base_change_succeeded The retarget diagnosis said #110 and #120 have "no such event", which is true of automatic_base_change_succeeded but reads as though their timelines are bare. #120 carries two ordinary base_ref_changed events - the manual retarget-to-dev-and-back already documented on 2026-07-31 - so a reader checking a timeline needs the event types told apart, not just the presence of a base change. * docs: state the evidence for the node digest-refresh assumption The ignore is scoped to version-update:semver-major so digest refreshes of the pinned 22 tag keep arriving, but that rests on documented update-types semantics plus reported updater behaviour - not on an observed run in this repository. Says so, names the first scheduled docker run as the test, and records the fallback if it is wrong (refresh the digest by hand, as #107 did). * ci: pin docker/login-action to v4.6.0 rather than v4.5.2 Supersedes the 4.5.2 applied earlier in this branch. 4.5.2's only substantive commit improves Docker Hub OIDC error text, a path none of the three call sites can reach - all three log in to ghcr.io with the built-in GITHUB_TOKEN as username/password. 4.6.0 lands a day later and its change is at least adjacent to what this repo does: it hardens the buildx-scoped config path used by the login -> buildx -> push chain, and carries the action's own bundled dependency bumps. SHA resolved from upstream with git ls-remote --tags, not from a changelog: refs/tags/v4.6.0 -> dbcb813823bdd20940b903addbd779551569679f. The moving v4 tag currently points at the same commit; the pin is the immutable v4.6.0 commit, not the alias. Read at the source by diffing v4.5.2...v4.6.0 rather than from the release notes, because these workflows run only on the tag-gated publish path and the nightly, which CI cannot exercise. action.yml is byte-identical, src/main.ts and src/docker.ts are unchanged, and the whole change is in src/context.ts's buildx scoped-config-dir helper - path.resolve containment on the registry and scope inputs behind a new isChildPath() helper. Behaviourally a no-op here: that helper returns early on 'if (scopeDisabled() || !scope || scope === "")', and no call site passes a scope input. Currency plus defence-in-depth, not a fix for anything reachable. * frontend: bump postcss 8.5.16 -> 8.5.25 (GHSA-r28c-9q8g-f849) Applied by hand rather than waiting for Dependabot: it has not proposed this, and after closing #126/#127/#128 there are no open Dependabot PRs at all, so a HIGH advisory was waiting on a bot that was not going to act. Which version actually clears it was verified in the published source, not taken from the advisory range - GHSA-mh99-v99m-4gvg was re-scoped mid-flight and #125 was wrong because of it. postcss 8.5.18's lib/previous-map.js loadFile() gains the containment check the advisory describes (relative(dirname(cssFile), path) rejected when it is '..', starts with '../', or is absolute); 8.5.17 has none of it. So 8.5.18 is the real floor. The same check is still present in 8.5.25, which is what is pinned - current release on the pinned 8.5 line, per CLAUDE.md § Dependency hygiene. No overrides entry needed and no parent bumped: postcss is a direct devDependency here, and every package that also reaches it declares a peer/caret range 8.5.25 satisfies (vite's ^8.5.3 included), so raising the single pin lifts the tree and npm ls shows one deduped copy. Regenerated with npm pkg set + npm install --package-lock-only, not by editing version strings, so resolved URLs and integrity hashes moved with the version. Diff is postcss 8.5.16 -> 8.5.25, its nanoid floor ^3.3.12 -> ^3.3.16, and nanoid 3.3.15 -> 3.3.16 - all dev-only, no new packages. npm ci installs 8.5.25 with the containment check present; ESLint, Prettier, the 20-file/69-test Vitest suite and npm run build all pass; npm audit no longer reports postcss. Nothing ships either way - postcss runs during vite build and the image copies only dist/. * docs: record the 4.6.0 pin and the postcss bump in the dated entry The §14 entry's login-action item now covers 4.6.0 and why it was taken over the 4.5.2 that #128 proposed, including the source-level diff and the honest note that the hardened path is gated on a scope input this repo never passes. The advisory-issues item gains the full postcss treatment: why it was applied by hand, the 8.5.18 fix floor verified in the published source rather than read off the advisory range, why no overrides entry or parent bump was needed, and the post-bump verification. #124 closed on its own stated criterion, the same standard applied to #125. CHANGELOG [Unreleased] gains a Security entry for the postcss advisory - and says explicitly that unlike the brace-expansion bump in 0.2.0, this one does clear its advisory - plus Changed entries for the login-action and fastapi pins.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
follow-up docker/oidc-action#105