build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0

[dependabot]

Bumps docker/build-push-action from 7.0.0 to 7.1.0.

Release notes

Sourced from docker/build-push-action's releases.

v7.1.0

• Git context query format support by @​crazy-max in docker/build-push-action#1505
• Bump @​docker/actions-toolkit from 0.79.0 to 0.87.0 by @​crazy-max in docker/build-push-action#1505
• Bump brace-expansion from 1.1.12 to 1.1.13 in docker/build-push-action#1500
• Bump fast-xml-parser from 5.4.2 to 5.5.7 in docker/build-push-action#1489
• Bump flatted from 3.3.3 to 3.4.2 in docker/build-push-action#1491
• Bump glob from 10.3.12 to 10.5.0 in docker/build-push-action#1490
• Bump handlebars from 4.7.8 to 4.7.9 in docker/build-push-action#1497
• Bump lodash from 4.17.23 to 4.18.1 in docker/build-push-action#1510
• Bump picomatch from 4.0.3 to 4.0.4 in docker/build-push-action#1496
• Bump undici from 6.23.0 to 6.24.1 in docker/build-push-action#1486
• Bump vite from 7.3.1 to 7.3.2 in docker/build-push-action#1509

Full Changelog: docker/build-push-action@v7.0.0...v7.1.0

Commits

• bcafcac Merge pull request #1509 from docker/dependabot/npm_and_yarn/vite-7.3.2
• 18e62f1 Merge pull request #1510 from docker/dependabot/npm_and_yarn/lodash-4.18.1
• 46580d2 chore: update generated content
• 3f80b25 chore(deps): Bump lodash from 4.17.23 to 4.18.1
• efeec95 Merge pull request #1505 from crazy-max/refactor-git-context
• ddf04b0 Merge pull request #1511 from docker/dependabot/github_actions/crazy-max-dot-...
• db08d97 chore(deps): Bump the crazy-max-dot-github group with 2 updates
• ef1fb96 Merge pull request #1508 from docker/dependabot/github_actions/docker/login-a...
• 2d8f2a1 chore: update generated content
• 919ac7b fix test since secrets are not written to temp path anymore
• Additional commits viewable in compare view

[Claudius-Maginificent]

Security Audit — Sergeant Major Smythe

Verdict: SAFE

One-line diff in .github/workflows/docker.yml:45, bumping docker/build-push-action from v7.0.0 to v7.1.0 on the build-args step used for Dockerfile-alpine and Dockerfile-debian sample images. Minor version, single file, no workflow logic change. I verified it twice.

Release verification

• Tag v7.1.0 resolves to commit bcafcacb16a39f128d818304e6c9c0c18556b85f, published 2026-04-10 by crazy-max (official Docker maintainer). Legitimate upstream release.
• Action is pinned by tag (@v7.1.0) — consistent with the rest of this workflow (actions/checkout@v6, docker/setup-buildx-action@v4.0.0). No regression in pinning posture. SHA-pinning would be stricter but is out of scope for this bump.
• Same action family that was just bumped 6.18.0 → 7.0.0 in build(deps): bump docker/build-push-action from 6.18.0 to 7.0.0 #186 — upstream shows no published security advisories (GitHub Advisory DB, OSV.dev) for docker/build-push-action at either version.

Changes in v7.1.0

• New feature: Git context query format support (PR refactor: use new gitContext for build context resolution docker/build-push-action#1505) — only relevant when using a remote Git URL as build context. This workflow uses context: . (local checkout), so the new Git-context parsing path is not exercised. No new attack surface reachable from this workflow.
• Dependency bumps inside the action's bundled JS: @docker/actions-toolkit 0.79.0→0.87.0, lodash 4.17.23→4.18.1, handlebars 4.7.8→4.7.9, undici 6.23.0→6.24.1, brace-expansion, fast-xml-parser, flatted, glob, picomatch, vite. These are transitive to the action itself; direction is forward (patch/minor), several pick up published security patches. Net supply-chain exposure improves or stays flat.
• No breaking changes called out in the v7.0.0...v7.1.0 changelog. No input/output schema changes that would affect the with: block in this workflow.

Cross-reference with audited workflow

Reviewed .github/workflows/docker.yml against the research findings:

• push: false — no registry credentials in play, so the credential-exposure class of Buildkit/build-push issues is not applicable regardless.
• build-args: REVISION=${{ github.ref }} — github.ref is a trusted, sanitized ref string; no untrusted input flowing into the new Git-context query parser (which isn't used here anyway).
• Build runs on pull_request with push: false and cache-from/cache-to: type=gha — standard pattern, no escalation from the version bump.

Risks / notes

• Conflict risk (MEDIUM): build(deps): bump docker/build-push-action from 6.18.0 to 7.0.0 #186 recently bumped this same line from 6.18.0 → 7.0.0 on develop. PR build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 #194 targets the same line in .github/workflows/docker.yml:45. A rebase will conflict. Dependabot will auto-resolve on @dependabot rebase, but the human reviewer should expect it.
• CI red is pre-existing (fmt + test-all), unrelated to this bump; both Docker build matrix legs (alpine, debian) pass, which is exactly what this PR actually exercises. Expected to clear after rebase once build(deps): update zip requirement from 7.0 to 8.5 #193 merges.
• No hardcoded secrets introduced. No new permissions. No shell interpolation. Nothing leaks.

Research summary

Source	Finding
GitHub Security Advisories	No advisories for docker/build-push-action
OSV.dev (GitHub Actions ecosystem)	No entries for docker/build-push-action
CISA KEV	Not listed
Upstream release notes v7.1.0	No breaking changes; dependency security patches forward

Score tally

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM	1 (rebase conflict with #186 — operational, not security)
LOW	0
INFO	1 (tag-pinning vs SHA-pinning — project-wide pattern, out of scope)

Recommendation: Approve and merge after rebase once #193 lands. Watch for the conflict on line 45.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[lklimek]

@dependabot rebase