Skip to content

chore(deps): bump docker/build-push-action from 6 to 7#3502

Merged
snopoke merged 1 commit into
mainfrom
dependabot/github_actions/docker/build-push-action-7
Jun 2, 2026
Merged

chore(deps): bump docker/build-push-action from 6 to 7#3502
snopoke merged 1 commit into
mainfrom
dependabot/github_actions/docker/build-push-action-7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 2, 2026

Copy link
Copy Markdown
Contributor

Bumps docker/build-push-action from 6 to 7.

Release notes

Sourced from docker/build-push-action's releases.

v7.0.0

Full Changelog: docker/build-push-action@v6.19.2...v7.0.0

v6.19.2

Full Changelog: docker/build-push-action@v6.19.1...v6.19.2

v6.19.1

Full Changelog: docker/build-push-action@v6.19.0...v6.19.1

v6.19.0

Full Changelog: docker/build-push-action@v6.18.0...v6.19.0

v6.18.0

[!NOTE] Build summary is now supported with Docker Build Cloud.

Full Changelog: docker/build-push-action@v6.17.0...v6.18.0

v6.17.0

[!NOTE] Build record is now exported using the buildx history export command instead of the legacy export-build tool.

Full Changelog: docker/build-push-action@v6.16.0...v6.17.0

v6.16.0

... (truncated)

Commits
  • f9f3042 Merge pull request #1517 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • 812d5fd chore: update generated content
  • b6f6693 chore(deps): Bump @​docker/actions-toolkit from 0.87.0 to 0.90.0
  • c1c626e Merge pull request #1525 from docker/dependabot/npm_and_yarn/actions/core-3.0.1
  • 51bb284 chore: update generated content
  • 5f7884d chore(deps): Bump @​actions/core from 3.0.0 to 3.0.1
  • e01deff Merge pull request #1521 from docker/dependabot/npm_and_yarn/fast-xml-parser-...
  • 3804d49 chore: update generated content
  • 71e8947 chore(deps): Bump fast-xml-parser from 5.5.7 to 5.8.0
  • 4925ad2 Merge pull request #1526 from docker/dependabot/npm_and_yarn/postcss-8.5.10
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v6...v7)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 2, 2026
@claude

claude Bot commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

🔍 Dependency Analysis Summary

Package Old New Type
docker/build-push-action v6 (6.19.2) v7 (7.0.0) GitHub Action — major

Overall risk: LOW. Single-line workflow change in .github/workflows/deploy.yml:111. The v7 release is small and mostly internal modernization (Node 24 runtime, ESM, dep bumps). The two removed envs (DOCKER_BUILD_NO_SUMMARY, DOCKER_BUILD_EXPORT_RETENTION_DAYS) are not used anywhere in this repo (verified via grep).

📋 Detailed Changelog Review

docker/build-push-action v6 → v7

Source: v7.0.0 release notes · v6...v7 diff

Key changes in v7.0.0:

  • Node 24 as default runtime — requires Actions Runner v2.327.1 or later. ubuntu-latest runners are well past this minimum, so no impact.
  • Removed deprecated envs: DOCKER_BUILD_NO_SUMMARY, DOCKER_BUILD_EXPORT_RETENTION_DAYS (#1473).
  • Removed legacy export-build tool for build summary (#1474) — internal; the action now uses buildx history export.
  • Switch to ESM (#1466) — internal packaging change.
  • Dependency bumps: @actions/core 1.11.1 → 3.0.0, @docker/actions-toolkit 0.62.1 → 0.79.0+, etc.

Action inputs/outputs: No documented changes — all inputs used in this workflow (tags, file, cache-from, cache-to, outputs) remain supported and unchanged.

Security: Transitive bumps include security-relevant deps (form-data 2.5.1 → 2.5.5, undici 5.28.4 → 5.29.0, brace-expansion 1.1.11 → 1.1.12, tmp 0.2.3 → 0.2.4).

⚠️ Impact Assessment

  • Breaking changes that affect OCS: None detected.
  • Affected files: Only .github/workflows/deploy.yml:111 (the single line bumped).
  • Repo grep for deprecated envs: DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS are not referenced anywhere in the repo — confirmed safe.
  • Runner compatibility: Workflow uses ubuntu-latest (line 43), which ships a runner version well above v2.327.1, so the Node 24 requirement is satisfied.
  • Buildx step: docker/setup-buildx-action@v3 (line 99) is compatible with build-push-action v7.
  • Test impact: None — no test files touch this action.
  • Config changes: None required.

🛠️ Recommendations

  • Action required: None beyond merge.
  • Testing focus: First run after merge will exercise the deploy workflow on main. Since the workflow only triggers on workflow_dispatch or after Lint and Test succeeds on main, the first real validation happens at the next merge to main. Watch the Build and push step in that run for any unexpected failures.
  • Follow-up tasks: None.
  • Merge recommendation:APPROVE — low-risk, drop-in major bump. No deprecated APIs in use, no runner incompatibility, no consumer-side changes needed.

📚 Useful Links

@snopoke
snopoke merged commit 47cfc83 into main Jun 2, 2026
13 checks passed
@snopoke
snopoke deleted the dependabot/github_actions/docker/build-push-action-7 branch June 2, 2026 08:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant