ci: bump docker/setup-buildx-action from 3 to 4

[dependabot]

Bumps docker/setup-buildx-action from 3 to 4.

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.0.0

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in docker/setup-buildx-action#483
• Remove deprecated inputs/outputs by @​crazy-max in docker/setup-buildx-action#464
• Switch to ESM and update config/test wiring by @​crazy-max in docker/setup-buildx-action#481
• Bump @​actions/core from 1.11.1 to 3.0.0 in docker/setup-buildx-action#475
• Bump @​docker/actions-toolkit from 0.63.0 to 0.79.0 in docker/setup-buildx-action#482 docker/setup-buildx-action#485
• Bump js-yaml from 4.1.0 to 4.1.1 in docker/setup-buildx-action#452
• Bump lodash from 4.17.21 to 4.17.23 in docker/setup-buildx-action#472
• Bump minimatch from 3.1.2 to 3.1.5 in docker/setup-buildx-action#480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

v3.12.0

• Deprecate install input by @​crazy-max in docker/setup-buildx-action#455
• Bump @​docker/actions-toolkit from 0.62.1 to 0.63.0 in docker/setup-buildx-action#434
• Bump brace-expansion from 1.1.11 to 1.1.12 in docker/setup-buildx-action#436
• Bump form-data from 2.5.1 to 2.5.5 in docker/setup-buildx-action#432
• Bump undici from 5.28.4 to 5.29.0 in docker/setup-buildx-action#435

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

v3.11.1

• Fix keep-state not being respected by @​crazy-max in docker/setup-buildx-action#429

Full Changelog: docker/setup-buildx-action@v3.11.0...v3.11.1

v3.11.0

• Keep BuildKit state support by @​crazy-max in docker/setup-buildx-action#427
• Remove aliases created when installing by default by @​hashhar in docker/setup-buildx-action#139
• Bump @​docker/actions-toolkit from 0.56.0 to 0.62.1 in docker/setup-buildx-action#422 docker/setup-buildx-action#425

Full Changelog: docker/setup-buildx-action@v3.10.0...v3.11.0

v3.10.0

• Bump @​docker/actions-toolkit from 0.54.0 to 0.56.0 in docker/setup-buildx-action#408

Full Changelog: docker/setup-buildx-action@v3.9.0...v3.10.0

v3.9.0

• Bump @​docker/actions-toolkit from 0.48.0 to 0.54.0 in docker/setup-buildx-action#402 docker/setup-buildx-action#404

Full Changelog: docker/setup-buildx-action@v3.8.0...v3.9.0

v3.8.0

• Make cloud prefix optional to download buildx if driver is cloud by @​crazy-max in docker/setup-buildx-action#390
• Bump @​actions/core from 1.10.1 to 1.11.1 in docker/setup-buildx-action#370
• Bump @​docker/actions-toolkit from 0.39.0 to 0.48.0 in docker/setup-buildx-action#389
• Bump cross-spawn from 7.0.3 to 7.0.6 in docker/setup-buildx-action#382

Full Changelog: docker/setup-buildx-action@v3.7.1...v3.8.0

... (truncated)

Commits

• 4d04d5d Merge pull request #485 from docker/dependabot/npm_and_yarn/docker/actions-to...
• cd74e05 chore: update generated content
• eee38ec build(deps): bump @​docker/actions-toolkit from 0.77.0 to 0.79.0
• 7a83f65 Merge pull request #484 from docker/dependabot/github_actions/docker/setup-qe...
• a5aa967 Merge pull request #464 from crazy-max/rm-deprecated
• e73d53f build(deps): bump docker/setup-qemu-action from 3 to 4
• 28a438e Merge pull request #483 from crazy-max/node24
• 034e9d3 chore: update generated content
• b4664d8 remove deprecated inputs/outputs
• a8257de node 24 as default runtime
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[claude]

PR Review: Bump docker/setup-buildx-action from 3 to 4

This is a routine Dependabot dependency update — a single line bump in .github/workflows/docker.yml.

Change

docker/setup-buildx-action@v3 → docker/setup-buildx-action@v4

Review

Code quality / correctness: OK

The action is used without any explicit inputs, so the breaking change in v4 (removal of deprecated inputs/outputs) has no impact on this workflow.

Node 24 runtime requirement: OK

v4 switches to Node 24 as its default runtime, requiring Actions Runner v2.327.1 or later. GitHub-hosted ubuntu-latest runners satisfy this requirement, so no changes to the runner configuration are needed.

Security: OK

Dependabot reports a high compatibility score. The v3 → v4 range also includes security-relevant dependency patches (e.g. lodash, minimatch, cross-spawn bumps), making this a worthwhile update.

Verdict: No concerns. Safe to merge.

[claude]

PR Review: Bump docker/setup-buildx-action from v3 to v4

This is a straightforward Dependabot dependency bump for the Docker CI workflow. Here's my assessment:

Summary

• Change: Single-line update in .github/workflows/docker.yml bumping docker/setup-buildx-action from v3 to v4
• Impact: Low risk — the workflow uses no inputs/outputs for this action, so the breaking changes in v4 (removal of deprecated inputs/outputs) do not affect this usage

Key changes in v4.0.0

• Node 24 as default runtime (requires Actions Runner v2.327.1+)
• Removed deprecated install input and related outputs — not used here, no impact
• Updated @actions/core from 1.11.1 to 3.0.0 and other dependency updates

Assessment

No issues found. The workflow invokes this action with no custom inputs:

- uses: docker/setup-buildx-action@v4

This means none of the removed deprecated inputs affect the workflow.

Minor observation (pre-existing, not introduced by this PR)

Actions are pinned to floating version tags (e.g., @v4) rather than specific commit SHAs. Pinning to a full commit SHA is a GitHub security hardening best practice to prevent supply chain attacks. Worth considering for the repository as a whole, but out of scope for this PR.

Verdict

This PR is safe to merge.