chore(deps): update docker/setup-qemu-action action to v4.1.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/setup-qemu-action	action	minor	v4.0.0 → v4.1.0

---

Release Notes

docker/setup-qemu-action (docker/setup-qemu-action)

v4.1.0

Compare Source

• Add reset input to uninstall current emulators by @​crazy-max in #​21
• Bump @​docker/actions-toolkit from 0.77.0 to 0.91.0 in #​250 #​247
• Bump brace-expansion from 1.1.12 to 1.1.15 in #​265
• Bump fast-xml-builder from 1.0.0 to 1.2.0 in #​286
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in #​255
• Bump flatted from 3.3.3 to 3.4.2 in #​257
• Bump glob from 10.3.15 to 10.5.0 in #​254
• Bump handlebars from 4.7.8 to 4.7.9 in #​262
• Bump lodash from 4.17.23 to 4.18.1 in #​273
• Bump postcss from 8.5.6 to 8.5.10 in #​285
• Bump tar from 6.2.1 to 7.5.15 in #​287
• Bump tmp from 0.2.5 to 0.2.6 in #​291
• Bump undici from 6.23.0 to 6.26.0 in #​251
• Bump vite from 7.3.1 to 7.3.2 in #​271

Full Changelog: docker/setup-qemu-action@v4.0.0...v4.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

New Features:

• Added optional reset input to uninstall currently installed QEMU emulators before setting up new ones. This is purely additive — no existing workflows are affected since the input is opt-in.

Dependency & Security Updates (bundled in action's node_modules):

• handlebars 4.7.8 → 4.7.9 (security fix)
• brace-expansion 1.1.12 → 1.1.15 (security fix)
• tar 6.2.1 → 7.5.15 (major version, security hardening)
• undici 6.23.0 → 6.26.0 (security/bug fixes)
• fast-xml-parser 5.4.2 → 5.8.0
• lodash 4.17.23 → 4.18.1
• postcss, flatted, glob, vite, fast-xml-builder, tmp — minor/patch bumps

Breaking Changes: None. This is a minor version release (v4.0.0 → v4.1.0) with full backward compatibility.

🎯 Impact Scope Investigation

Usage Location:

• Exactly one usage in .github/workflows/release-please.yml (line 105), in the docker-push job.
• The action is invoked bare (no custom inputs), so the new reset input has zero impact on existing behavior.
• The job uses QEMU to support multi-platform Docker builds (linux/amd64,linux/arm64). The v4.1.0 update does not change default behavior of QEMU setup.

Commit Pinning:

• The PR correctly updates the pinned SHA from ce360397dd3f832beb865e1373c09c0e9f86d70a to 06116385d9baf250c9f4dcb4858b16962ea869c3, maintaining the security posture of SHA-pinned actions.

Impact on Other Dependencies: None. The action's internal dependency upgrades (handlebars, brace-expansion, tar, etc.) are self-contained within the action's bundled node_modules and do not affect ghasec's own Go dependencies.

💡 Recommended Actions

• No code changes, configuration changes, or migration steps are required.
• Merge as-is. The update is strictly additive and includes beneficial security fixes in the action's bundled dependencies.

🔗 Reference Links

• docker/setup-qemu-action v4.1.0 Release Notes
• v4.0.0 → v4.1.0 Full Diff
• PR #21 — Add reset input

Generated by koki-develop/claude-renovate-review