Skip to content

chore: sync from upstream docker/bake-action master - #45

Merged
abhijit-hota merged 74 commits into
masterfrom
ah-upstream-sync-20260925
Sep 27, 2026
Merged

abhijit-hota merged 74 commits into
masterfrom
ah-upstream-sync-20260925

Conversation

@abhijit-hota

@abhijit-hota abhijit-hota commented Sep 25, 2026 •

Copy link
Copy Markdown
Member

Merges docker/bake-action master (cac84ca, 71 commits) into the fork. This is the bottom PR of the stack. #44 (Dependabot fixes) sits on top of it.

  1. Adds upstream's new subaction/matrix workspace and bumps @docker/actions-toolkit from ^0.92.0 to ^0.100.0.
  2. Keeps the WarpBuilds remote builder code in src/warpbuild.ts.
  3. Replaces the uuid package with Node's built-in crypto.randomUUID() for the builder idempotency key. The output is the same, because uuid v11's v4() already calls crypto.randomUUID() when called without arguments. uuid is removed from package.json, yarn.lock and dist/licenses.txt.
  4. Removes the undici, fast-xml-parser, lodash, flatted and uuid yarn resolutions. Without them every package resolves to the same version, and all are at or above their patched versions.
  5. Keeps only the tar resolution. Without it, tar 6.2.1 comes back through the dev-only path vitest → vite → fsevents (Yarn's built-in patch) → node-gyp@10 and cacache@18, and tar 6.2.1 is inside several tar advisories.
  6. Regenerates yarn.lock and rebuilds dist/ and subaction/matrix/dist/.

The sync alone fixes the js-yaml, nanoid, postcss, csv-parse, @humanfs/node, postcss-selector-parser and brace-expansion 1.x alerts.

The ci workflow jobs that fail with "Profile name is required" also fail on master. This PR does not change that.

🤖 Generated with Claude Code

https://claude.ai/code/session_017uNkb5GuQRPMyJA2WDbH8B

dependabot Bot and others added 30 commits July 3, 2026 23:43
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 7.2.0 to 7.3.0.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](docker/bake-action@6614cfa...d3418bd)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@0611638...96fe6ef)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@d7f5e7f...bb05f3f)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@80c7e94...dc80280)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
…updates

Bumps the codeql-actions group with 2 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@8aad20d...54f647b)

Updates `github/codeql-action/analyze` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@8aad20d...54f647b)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to 8.5.25.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.10...8.5.25)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) from 7.1.1 to 7.1.5.
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.5)

---
updated-dependencies:
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8.
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

---
updated-dependencies:
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse) from 7.0.0 to 7.0.2.
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@7.0.2/packages/csv-parse)

---
updated-dependencies:
- dependency-name: csv-parse
  dependency-version: 7.0.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
…odeql-actions-af2beed448

chore(deps): Bump the codeql-actions group across 1 directory with 2 updates
…ocker/metadata-action-6.2.0

chore(deps): Bump docker/metadata-action from 6.1.0 to 6.2.0
…ocker/setup-buildx-action-4.2.0

chore(deps): Bump docker/setup-buildx-action from 4.1.0 to 4.2.0
…ocker/setup-qemu-action-4.2.0

chore(deps): Bump docker/setup-qemu-action from 4.1.0 to 4.2.0
…ocker/bake-action-7.3.0

chore(deps): Bump docker/bake-action from 7.2.0 to 7.3.0
…tcss-8.5.25

chore(deps): Bump postcss from 8.5.10 to 8.5.25
…yaml-4.3.1

chore(deps): Bump js-yaml from 4.3.0 to 4.3.1
…tcss-selector-parser-7.1.5

chore(deps): Bump postcss-selector-parser from 7.1.1 to 7.1.5
…anfs/node-0.16.8

chore(deps): Bump @humanfs/node from 0.16.7 to 0.16.8
…-parse-7.0.2

chore(deps): Bump csv-parse from 7.0.0 to 7.0.2
…ith 2 updates

Bumps the crazy-max-dot-github group with 2 updates in the / directory: [crazy-max/.github/.github/workflows/pr-assign-author.yml](https://github.com/crazy-max/.github) and [crazy-max/.github/.github/workflows/zizmor.yml](https://github.com/crazy-max/.github).


Updates `crazy-max/.github/.github/workflows/pr-assign-author.yml` from 1.10.1 to 1.11.0
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](crazy-max/.github@46267a6...f91220c)

Updates `crazy-max/.github/.github/workflows/zizmor.yml` from 1.10.1 to 1.11.0
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](crazy-max/.github@46267a6...f91220c)

---
updated-dependencies:
- dependency-name: crazy-max/.github/.github/workflows/pr-assign-author.yml
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crazy-max-dot-github
- dependency-name: crazy-max/.github/.github/workflows/zizmor.yml
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crazy-max-dot-github
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.16 to 3.3.18.
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.16...3.3.18)

---
updated-dependencies:
- dependency-name: nanoid
  dependency-version: 3.3.18
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
…updates

Bumps the codeql-actions group with 2 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.36.3 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@54f647b...cdf488f)

Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@54f647b...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
…oid-3.3.18

chore(deps): Bump nanoid from 3.3.16 to 3.3.18
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.2.0 to 4.3.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@96fe6ef...1f40c72)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…razy-max-dot-github-6f52f8ed50

chore(deps): Bump the crazy-max-dot-github group across 1 directory with 2 updates
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@48b55a0...8207627)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.2.0 to 4.3.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@bb05f3f...37fe631)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
github-actions Bot and others added 22 commits September 11, 2026 11:40
…ker/actions-toolkit-0.99.0

chore(deps): Bump @docker/actions-toolkit from 0.98.0 to 0.99.0
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
use the shared Buildx error summary helper
Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.99.0 to 0.100.0.
- [Release notes](https://github.com/docker/actions-toolkit/releases)
- [Commits](docker/actions-toolkit@v0.99.0...v0.100.0)

---
updated-dependencies:
- dependency-name: "@docker/actions-toolkit"
  dependency-version: 0.100.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
…updates

Bumps the codeql-actions group with 2 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...b96794f)

Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...b96794f)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
…ker/actions-toolkit-0.100.0

chore(deps): Bump @docker/actions-toolkit from 0.99.0 to 0.100.0
…odeql-actions-03ad6eec6c

chore(deps): Bump the codeql-actions group across 1 directory with 2 updates
Signed-off-by: Julian Liebig <julian.liebig@tudock.de>
Signed-off-by: Julian Liebig <julian.liebig@tudock.de>
Signed-off-by: Julian Liebig <julian.liebig@tudock.de>
Signed-off-by: Julian Liebig <julian.liebig@tudock.de>
Dependabot does not yet support updating Yarn catalog definitions in .yarnrc.yml. Keep explicit version ranges in both workspace manifests so Dependabot can continue updating shared dependencies.

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 7.0.0 to 7.1.0.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@fb8b358...0b35c9e)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
…odecov/codecov-action-7.1.0

chore(deps): Bump codecov/codecov-action from 7.0.0 to 7.1.0
Sync with docker/bake-action master (cac84ca). Keep the WarpBuilds
uuid dependency and yarn resolutions in package.json. Regenerate
yarn.lock and rebuild dist.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@abhijit-hota
abhijit-hota added this pull request to stack #46 September 25, 2026 13:18
@abhijit-hota abhijit-hota changed the title ah upstream sync 20260925 chore: sync from upstream docker/bake-action master Sep 25, 2026
abhijit-hota and others added 2 commits September 25, 2026 21:19
The undici, fast-xml-parser, lodash, flatted and uuid resolutions
resolve to the same versions without the override, and all of them are
at or above their patched versions. Keep the tar resolution. Without it
tar 6.2.1 comes back through the dev-only fsevents to node-gyp path.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uNkb5GuQRPMyJA2WDbH8B
Drop the uuid package. uuid v11's v4() already returns
crypto.randomUUID() when called without arguments, so the key format
does not change. Rebuild dist.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uNkb5GuQRPMyJA2WDbH8B
@abhijit-hota
abhijit-hota marked this pull request as ready for review September 25, 2026 16:56
@abhijit-hota
abhijit-hota merged commit 767af58 into master Sep 27, 2026
22 of 58 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants