james/carol
james/carol
1
1
Fork 0
Code Issues 44 Pull requests 7 Projects Releases 25 Packages 1 Wiki Activity Actions

chore(deps): update docker/login-action action to v4 #168

Open
renovate-bot wants to merge 1 commit from renovate-docker-login-action-4.x into main
pull from: renovate-docker-login-action-4.x
merge into: james:main
Conversation 2 Commits 1 Files changed 2 +3 -3
renovate-bot commented 2026-06-20 03:03:02 +00:00
Collaborator
Copy link

This PR contains the following updates:

Package Type Update Change Pending
docker/login-action action major v3.7.0 → v4.2.0 v4.4.0 (+1)

Release Notes

docker/login-action (docker/login-action)

v4.2.0

Compare Source

Full Changelog: https://github.com/docker/login-action/compare/v4.1.0...v4.2.0

v4.1.0

Compare Source

Full Changelog: https://github.com/docker/login-action/compare/v4.0.0...v4.1.0

v4.0.0

Compare Source

Full Changelog: https://github.com/docker/login-action/compare/v3.7.0...v4.0.0

v4

Compare Source

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • Between 12:00 AM and 06:59 AM (* 0-6 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [docker/login-action](https://github.com/docker/login-action) | action | major | `v3.7.0` → `v4.2.0` | `v4.4.0` (+1) | --- ### Release Notes <details> <summary>docker/login-action (docker/login-action)</summary> ### [`v4.2.0`](https://github.com/docker/login-action/releases/tag/v4.2.0) [Compare Source](https://github.com/docker/login-action/compare/v4.1.0...v4.2.0) - Bump [@&#8203;actions/core](https://github.com/actions/core) from 3.0.0 to 3.0.1 in [#&#8203;976](https://github.com/docker/login-action/pull/976) - Bump [@&#8203;aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) and [@&#8203;aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) to 3.1050.0 in [#&#8203;960](https://github.com/docker/login-action/pull/960) - Bump [@&#8203;docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.86.0 to 0.90.0 in [#&#8203;970](https://github.com/docker/login-action/pull/970) - Bump brace-expansion from 2.0.1 to 5.0.6 in [#&#8203;993](https://github.com/docker/login-action/pull/993) - Bump fast-xml-builder from 1.1.4 to 1.2.0 in [#&#8203;985](https://github.com/docker/login-action/pull/985) - Bump fast-xml-parser from 5.3.6 to 5.8.0 in [#&#8203;963](https://github.com/docker/login-action/pull/963) - Bump http-proxy-agent and https-proxy-agent to 9.0.0 in [#&#8203;961](https://github.com/docker/login-action/pull/961) - Bump postcss from 8.5.6 to 8.5.10 in [#&#8203;979](https://github.com/docker/login-action/pull/979) - Bump tar from 6.2.1 to 7.5.15 in [#&#8203;991](https://github.com/docker/login-action/pull/991) - Bump vite from 7.3.1 to 7.3.3 in [#&#8203;986](https://github.com/docker/login-action/pull/986) **Full Changelog**: <https://github.com/docker/login-action/compare/v4.1.0...v4.2.0> ### [`v4.1.0`](https://github.com/docker/login-action/releases/tag/v4.1.0) [Compare Source](https://github.com/docker/login-action/compare/v4...v4.1.0) - Fix scoped Docker Hub cleanup path when registry is omitted by [@&#8203;crazy-max](https://github.com/crazy-max) in [#&#8203;945](https://github.com/docker/login-action/pull/945) - Bump [@&#8203;aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) and [@&#8203;aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) to 3.1020.0 in [#&#8203;930](https://github.com/docker/login-action/pull/930) - Bump [@&#8203;docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.77.0 to 0.86.0 in [#&#8203;932](https://github.com/docker/login-action/pull/932) [#&#8203;936](https://github.com/docker/login-action/pull/936) - Bump brace-expansion from 1.1.12 to 1.1.13 in [#&#8203;952](https://github.com/docker/login-action/pull/952) - Bump fast-xml-parser from 5.3.4 to 5.3.6 in [#&#8203;942](https://github.com/docker/login-action/pull/942) - Bump flatted from 3.3.3 to 3.4.2 in [#&#8203;944](https://github.com/docker/login-action/pull/944) - Bump glob from 10.3.12 to 10.5.0 in [#&#8203;940](https://github.com/docker/login-action/pull/940) - Bump handlebars from 4.7.8 to 4.7.9 in [#&#8203;949](https://github.com/docker/login-action/pull/949) - Bump http-proxy-agent and https-proxy-agent to 8.0.0 in [#&#8203;937](https://github.com/docker/login-action/pull/937) - Bump lodash from 4.17.23 to 4.18.1 in [#&#8203;958](https://github.com/docker/login-action/pull/958) - Bump minimatch from 3.1.2 to 3.1.5 in [#&#8203;941](https://github.com/docker/login-action/pull/941) - Bump picomatch from 4.0.3 to 4.0.4 in [#&#8203;948](https://github.com/docker/login-action/pull/948) - Bump undici from 6.23.0 to 6.24.1 in [#&#8203;938](https://github.com/docker/login-action/pull/938) **Full Changelog**: <https://github.com/docker/login-action/compare/v4.0.0...v4.1.0> ### [`v4.0.0`](https://github.com/docker/login-action/releases/tag/v4.0.0) [Compare Source](https://github.com/docker/login-action/compare/v4...v4) - Node 24 as default runtime (requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later) by [@&#8203;crazy-max](https://github.com/crazy-max) in [#&#8203;929](https://github.com/docker/login-action/pull/929) - Switch to ESM and update config/test wiring by [@&#8203;crazy-max](https://github.com/crazy-max) in [#&#8203;927](https://github.com/docker/login-action/pull/927) - Bump [@&#8203;actions/core](https://github.com/actions/core) from 1.11.1 to 3.0.0 in [#&#8203;919](https://github.com/docker/login-action/pull/919) - Bump [@&#8203;aws-sdk/client-ecr](https://github.com/aws-sdk/client-ecr) from 3.890.0 to 3.1000.0 in [#&#8203;909](https://github.com/docker/login-action/pull/909) [#&#8203;920](https://github.com/docker/login-action/pull/920) - Bump [@&#8203;aws-sdk/client-ecr-public](https://github.com/aws-sdk/client-ecr-public) from 3.890.0 to 3.1000.0 in [#&#8203;909](https://github.com/docker/login-action/pull/909) [#&#8203;920](https://github.com/docker/login-action/pull/920) - Bump [@&#8203;docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.63.0 to 0.77.0 in [#&#8203;910](https://github.com/docker/login-action/pull/910) [#&#8203;928](https://github.com/docker/login-action/pull/928) - Bump [@&#8203;isaacs/brace-expansion](https://github.com/isaacs/brace-expansion) from 5.0.0 to 5.0.1 in [#&#8203;921](https://github.com/docker/login-action/pull/921) - Bump js-yaml from 4.1.0 to 4.1.1 in [#&#8203;901](https://github.com/docker/login-action/pull/901) **Full Changelog**: <https://github.com/docker/login-action/compare/v3.7.0...v4.0.0> ### [`v4`](https://github.com/docker/login-action/compare/v3.7.0...v4) [Compare Source](https://github.com/docker/login-action/compare/v3.7.0...v4) </details> --- ### Configuration 📅 **Schedule**: (in timezone UTC) - Branch creation - Between 12:00 AM and 06:59 AM (`* 0-6 * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzMuMyIsInVwZGF0ZWRJblZlciI6IjQzLjI1MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJuZWVkcy1odW1hbi1yZXZpZXciXX0=-->
chore(deps): update docker/login-action action to v4
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Details
Commits / Conventional Commits (pull_request) Successful in 14s
Details
PR / OSV-Scanner (pull_request) Successful in 30s
Details
PR / Trivy (image) (pull_request) Failing after 39s
Details
PR / Package age policy (soft) (pull_request) Successful in 18s
Details
PR / Static analysis (pull_request) Successful in 51s
Details
Secrets / gitleaks (pull_request) Successful in 16s
Details
PR / npm audit (pull_request) Successful in 3m54s
Details
PR / Test (postgres) (pull_request) Successful in 4m17s
Details
PR / Lint (pull_request) Successful in 4m31s
Details
PR / Build (pull_request) Successful in 4m44s
Details
PR / Coverage (soft) (pull_request) Successful in 4m39s
Details
PR / Typecheck (pull_request) Successful in 5m20s
Details
PR / Test (sqlite) (pull_request) Successful in 5m33s
Details
4b1e20fbc6
forgejo-actions commented 2026-06-20 03:03:42 +00:00
Copy link

Trivy (container image)

Threshold: high  ·  Total findings: 138  ·  At/above threshold: 4

critical high medium low
0 4 63 71
severity id package installed / range fix
high CVE-2026-41992 gzip 1.12-1 none
high CVE-2026-54369 libacl1 2.3.1-3 none
high CVE-2026-54371 libattr1 1:2.5.1-4 none
high CVE-2026-48815 sigstore 4.1.0 4.1.1
<!-- scanner-comment: trivy --> ### Trivy (container image) **Threshold:** `high` &nbsp;·&nbsp; **Total findings:** 138 &nbsp;·&nbsp; **At/above threshold:** 4 | critical | high | medium | low | |---:|---:|---:|---:| | 0 | 4 | 63 | 71 | | severity | id | package | installed / range | fix | |---|---|---|---|---| | high | [CVE-2026-41992](https://avd.aquasec.com/nvd/cve-2026-41992) | gzip | 1.12-1 | none | | high | [CVE-2026-54369](https://avd.aquasec.com/nvd/cve-2026-54369) | libacl1 | 2.3.1-3 | none | | high | [CVE-2026-54371](https://avd.aquasec.com/nvd/cve-2026-54371) | libattr1 | 1:2.5.1-4 | none | | high | [CVE-2026-48815](https://avd.aquasec.com/nvd/cve-2026-48815) | sigstore | 4.1.0 | `4.1.1` |
forgejo-actions commented 2026-06-20 03:07:52 +00:00
Copy link

📊 Test coverage

Patch coverage: no testable lines changed.

Overall (app/, lib/, db/, excluding UI per ADR-0019):

Metric Value Soft target
Lines 79.7% ✅ ≥ 50%
Branches 71.6% ⚠️ ≥ 75%
Functions 81.2% informational

Soft thresholds per ADR-0019. Coverage is informational and does not block merge.

<!-- coverage-comment --> ## 📊 Test coverage **Patch coverage:** no testable lines changed. **Overall** (`app/`, `lib/`, `db/`, excluding UI per ADR-0019): | Metric | Value | Soft target | |---|---|---| | Lines | 79.7% ✅ | ≥ 50% | | Branches | 71.6% ⚠️ | ≥ 75% | | Functions | 81.2% | informational | Soft thresholds per [ADR-0019](docs/adr/0019-coverage-soft-targets.md). Coverage is informational and does not block merge.
renovate-bot force-pushed renovate-docker-login-action-4.x from 4b1e20fbc6
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Details
Commits / Conventional Commits (pull_request) Successful in 14s
Details
PR / OSV-Scanner (pull_request) Successful in 30s
Details
PR / Trivy (image) (pull_request) Failing after 39s
Details
PR / Package age policy (soft) (pull_request) Successful in 18s
Details
PR / Static analysis (pull_request) Successful in 51s
Details
Secrets / gitleaks (pull_request) Successful in 16s
Details
PR / npm audit (pull_request) Successful in 3m54s
Details
PR / Test (postgres) (pull_request) Successful in 4m17s
Details
PR / Lint (pull_request) Successful in 4m31s
Details
PR / Build (pull_request) Successful in 4m44s
Details
PR / Coverage (soft) (pull_request) Successful in 4m39s
Details
PR / Typecheck (pull_request) Successful in 5m20s
Details
PR / Test (sqlite) (pull_request) Successful in 5m33s
Details
to ca212a69e6
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Details
Commits / Conventional Commits (pull_request) Successful in 7s
Details
PR / Typecheck (pull_request) Successful in 1m20s
Details
PR / OpenAPI (pull_request) Successful in 1m48s
Details
PR / Lint (pull_request) Successful in 2m6s
Details
PR / Static analysis (pull_request) Successful in 3m6s
Details
PR / Client (web export smoke) (pull_request) Successful in 2m48s
Details
Secrets / gitleaks (pull_request) Successful in 41s
Details
PR / Package age policy (soft) (pull_request) Successful in 1m7s
Details
PR / OSV-Scanner (pull_request) Successful in 1m11s
Details
PR / Build (pull_request) Successful in 3m53s
Details
PR / Trivy (image) (pull_request) Failing after 1m17s
Details
PR / pnpm audit (pull_request) Successful in 1m29s
Details
PR / Test (postgres) (pull_request) Successful in 3m41s
Details
PR / Test (sqlite) (pull_request) Successful in 2m42s
Details
PR / Coverage (soft) (pull_request) Successful in 2m9s
Details
PR / E2E (Playwright) (pull_request) Successful in 4m59s
Details
2026-07-02 15:02:40 +00:00 Compare
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Details
Commits / Conventional Commits (pull_request) Successful in 7s
Details
PR / Typecheck (pull_request) Successful in 1m20s
Details
PR / OpenAPI (pull_request) Successful in 1m48s
Details
PR / Lint (pull_request) Successful in 2m6s
Details
PR / Static analysis (pull_request) Successful in 3m6s
Details
PR / Client (web export smoke) (pull_request) Successful in 2m48s
Details
Secrets / gitleaks (pull_request) Successful in 41s
Details
PR / Package age policy (soft) (pull_request) Successful in 1m7s
Details
PR / OSV-Scanner (pull_request) Successful in 1m11s
Details
PR / Build (pull_request) Successful in 3m53s
Details
PR / Trivy (image) (pull_request) Failing after 1m17s
Details
PR / pnpm audit (pull_request) Successful in 1m29s
Details
PR / Test (postgres) (pull_request) Successful in 3m41s
Details
PR / Test (sqlite) (pull_request) Successful in 2m42s
Details
PR / Coverage (soft) (pull_request) Successful in 2m9s
Details
PR / E2E (Playwright) (pull_request) Successful in 4m59s
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate-docker-login-action-4.x:renovate-docker-login-action-4.x
git switch renovate-docker-login-action-4.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate-docker-login-action-4.x
git switch renovate-docker-login-action-4.x
git rebase main
git switch main
git merge --ff-only renovate-docker-login-action-4.x
git switch renovate-docker-login-action-4.x
git rebase main
git switch main
git merge --no-ff renovate-docker-login-action-4.x
git switch main
git merge --squash renovate-docker-login-action-4.x
git switch main
git merge --ff-only renovate-docker-login-action-4.x
git switch main
git merge renovate-docker-login-action-4.x
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
area:auth
Authentication and authorization

  
area:ci
Forgejo Actions, build, test, security, release

  
area:db
Database abstraction, migrations, persistence

  
area:infra
Containerization, deployment, foundational tooling

  
area:native
React Native app (Android + Linux Flatpak)

  
area:pwa
PWA / web frontend

  
area:service
Backend service, API routes, persistence

  
epic
High-level tracker; links several feature tickets

  
feature
A user-facing feature

  
foundation
Foundational work that other tickets build on

No labels
area:auth
area:ci
area:db
area:infra
area:native
area:pwa
area:service
epic
feature
foundation
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
james/carol!168
No description provided.