build(deps): bump the github-actions group across 1 directory with 8 updates

[dependabot]

Bumps the github-actions group with 8 updates in the / directory:

Package	From	To
actions/checkout	4	7
astral-sh/setup-uv	8.2.0	9.0.0
ilammy/msvc-dev-cmd	a102174a2b586eec2ea151a69e6fd14404a8ce7c	0b201ec74fa43914dc39ae48a89fd1d8cb592756
docker/setup-buildx-action	4.1.0	4.2.0
docker/login-action	4.2.0	4.6.0
docker/metadata-action	6.1.0	6.2.0
docker/bake-action	7.2.0	7.3.0
actions/upload-artifact	4	7

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates astral-sh/setup-uv from 8.2.0 to 9.0.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v9.0.0 🌈 Change prune-cache default to false

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure. Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes

• Change prune-cache default to false @​charliermarsh (#967)

🐛 Bug fixes

• fix: fall back to distribution ID when os-release has no version field @​cxzhong (#961)

🚀 Enhancements

• Speed up version client by partial response reads @​eifinger (#807)

🧰 Maintenance

• chore: update known checksums for 0.11.30 @github-actions[bot] (#968)
• chore: update known checksums for 0.11.29 @github-actions[bot] (#960)

📚 Documentation

• docs: update version references to v8.3.2 @github-actions[bot] (#949)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#970)
• chore(deps): roll up Dependabot updates @​eifinger (#962)

Commits

• c771a70 chore(deps): roll up Dependabot updates (#970)
• 2f537ca chore: update known checksums for 0.11.30 (#968)
• 2269552 Speed up version client by partial response reads (#807)
• 47a7f4f Change prune-cache default to false (#967)
• 71966ef chore(deps): roll up Dependabot updates (#962)
• f12b1f0 fix: fall back to distribution ID when os-release has no version field (#961)
• ecd24dd chore: update known checksums for 0.11.29 (#960)
• 6a19136 docs: update version references to v8.3.2 (#949)
• 11f9893 chore: roll up Dependabot updates (#948)
• f798556 docs: update version references to v8.3.1 (#946)
• Additional commits viewable in compare view

Updates ilammy/msvc-dev-cmd from a102174a2b586eec2ea151a69e6fd14404a8ce7c to 0b201ec74fa43914dc39ae48a89fd1d8cb592756

Commits

• See full diff in compare view

Updates docker/setup-buildx-action from 4.1.0 to 4.2.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.2.0

• Preserve names in esbuild bundle by @​crazy-max in docker/setup-buildx-action#572
• Bump @​actions/core from 3.0.0 to 3.0.1 in docker/setup-buildx-action#551
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/setup-buildx-action#557 docker/setup-buildx-action#580
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in docker/setup-buildx-action#573
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-buildx-action#576
• Bump js-yaml from 4.1.1 to 5.2.0 in docker/setup-buildx-action#562
• Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-buildx-action#577
• Bump tmp from 0.2.5 to 0.2.7 in docker/setup-buildx-action#556
• Bump undici from 6.25.0 to 6.27.0 in docker/setup-buildx-action#570
• Bump vite from 7.3.2 to 7.3.6 in docker/setup-buildx-action#569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

Commits

• bb05f3f Merge pull request #580 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 321c814 [dependabot skip] chore: update generated content
• b9a36ef build(deps): bump @​docker/actions-toolkit from 0.91.0 to 0.92.0
• ebeab24 Merge pull request #570 from docker/dependabot/npm_and_yarn/undici-6.27.0
• 5c7b8ae [dependabot skip] chore: update generated content
• 037e618 build(deps): bump undici from 6.25.0 to 6.27.0
• 66080e5 Merge pull request #577 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
• 409aef0 Merge pull request #562 from docker/dependabot/npm_and_yarn/js-yaml-4.2.0
• 49c6e42 build(deps): bump sigstore from 4.1.0 to 4.1.1
• 2211273 [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates docker/login-action from 4.2.0 to 4.6.0

Release notes

Sourced from docker/login-action's releases.

v4.6.0

• Harden buildx scoped config path handling by @​crazy-max in docker/login-action#1059
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1095.0 in docker/login-action#1051
• Bump js-yaml from 5.2.1 to 5.2.2 in docker/login-action#1057
• Bump postcss from 8.5.10 to 8.5.22 in docker/login-action#1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

• Surface Docker Hub OIDC error responses by @​crazy-max in docker/login-action#1058

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

• Support dhi.io as Docker Hub OIDC registry by @​crazy-max in docker/login-action#1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

• Docker Hub OIDC login support by @​crazy-max in docker/login-action#1048
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1091.0 in docker/login-action#1037
• Bump @​docker/actions-toolkit from 0.92.0 to 0.94.0 in docker/login-action#1044 docker/login-action#1050
• Bump brace-expansion from 1.1.13 to 1.1.16 in docker/login-action#1046
• Bump js-yaml from 5.2.0 to 5.2.1 in docker/login-action#1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

v4.4.0

• Skip empty registry-auth secret mask by @​crazy-max in docker/login-action#1035
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1077.0 docker/login-action#1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

• Preserve names in esbuild bundle by @​crazy-max in docker/login-action#1022
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1076.0 docker/login-action#999 docker/login-action#1030
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/login-action#1004 docker/login-action#1027
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in docker/login-action#1023
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/login-action#1029
• Bump http-proxy-agent and https-proxy-agent to 9.1.0 in docker/login-action#1017
• Bump js-yaml from 4.1.1 to 5.2.0 in docker/login-action#1028
• Bump sigstore from 4.1.0 to 4.1.1 in docker/login-action#1031
• Bump tmp from 0.2.5 to 0.2.7 in docker/login-action#1002
• Bump undici from 6.24.1 to 6.27.0 in docker/login-action#1020
• Bump vite from 7.3.3 to 7.3.6 in docker/login-action#1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

Commits

• dbcb813 Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
• 5bcb015 [dependabot skip] chore: update generated content
• b30b2f2 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
• 9087f1e Merge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.2
• 0009830 [dependabot skip] chore: update generated content
• 2325523 build(deps): bump js-yaml from 5.2.1 to 5.2.2
• 4ec1d4a Merge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.22
• 5fc99ba Merge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...
• e512bd5 Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...
• a146c91 Merge pull request #1059 from crazy-max/harden-buildx-scope-paths
• Additional commits viewable in compare view

Updates docker/metadata-action from 6.1.0 to 6.2.0

Release notes

Sourced from docker/metadata-action's releases.

v6.2.0

• Preserve names in esbuild bundle by @​crazy-max in docker/metadata-action#689
• Bump @​actions/core from 3.0.0 to 3.0.1 in docker/metadata-action#663
• Bump @​actions/github from 9.0.0 to 9.1.1 in docker/metadata-action#666
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/metadata-action#672 docker/metadata-action#696
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in docker/metadata-action#690
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/metadata-action#693
• Bump csv-parse from 6.2.1 to 7.0.0 in docker/metadata-action#683
• Bump js-yaml from 4.1.1 to 4.3.0 in docker/metadata-action#688
• Bump moment-timezone from 0.6.1 to 0.6.2 in docker/metadata-action#664
• Bump semver from 7.7.4 to 7.8.5 in docker/metadata-action#665 docker/metadata-action#695
• Bump sigstore from 4.1.0 to 4.1.1 in docker/metadata-action#694
• Bump tmp from 0.2.5 to 0.2.7 in docker/metadata-action#673
• Bump undici from 6.25.0 to 6.27.0 in docker/metadata-action#686
• Bump vite from 7.3.2 to 7.3.6 in docker/metadata-action#685

Full Changelog: docker/metadata-action@v6.1.0...v6.2.0

Commits

• dc80280 Merge pull request #696 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 2b9fe83 [dependabot skip] chore: update generated content
• 8128ce3 chore(deps): Bump @​docker/actions-toolkit from 0.91.0 to 0.92.0
• 1d1c895 Merge pull request #695 from docker/dependabot/npm_and_yarn/semver-7.8.5
• 7f0c2dd Merge pull request #694 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
• 025f8c5 [dependabot skip] chore: update generated content
• e98d63c chore(deps): Bump semver from 7.8.1 to 7.8.5
• 37d9379 chore(deps): Bump sigstore from 4.1.0 to 4.1.1
• a1b8072 Merge pull request #690 from docker/dependabot/npm_and_yarn/sigstore/core-3.2.1
• e0e3381 [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates docker/bake-action from 7.2.0 to 7.3.0

Release notes

Sourced from docker/bake-action's releases.

v7.3.0

• Preserve names in esbuild bundle by @​crazy-max in docker/bake-action#468
• Bump actions/github-script from 8.0.0 to 9.0.0 in /subaction/matrix in docker/bake-action#449
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/bake-action#451 docker/bake-action#473
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in docker/bake-action#469
• Bump js-yaml from 4.1.1 to 4.3.0 in docker/bake-action#467
• Bump tmp from 0.2.5 to 0.2.7 in docker/bake-action#452
• Bump undici from 6.24.1 to 6.27.0 in docker/bake-action#465
• Bump vite from 7.3.2 to 7.3.6 in docker/bake-action#464

Full Changelog: docker/bake-action@v7.2.0...v7.3.0

Commits

• d3418bd Merge pull request #473 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 14b9ede [dependabot skip] chore: update generated content
• 20a016d chore(deps): Bump @​docker/actions-toolkit from 0.91.0 to 0.92.0
• 539a713 Merge pull request #465 from docker/dependabot/npm_and_yarn/undici-6.27.0
• 7a0af00 Merge pull request #474 from docker/dependabot/github_actions/actions/checkou...
• 3a2aa8c chore(deps): Bump actions/checkout from 6.0.3 to 7.0.0
• 9d351e5 [dependabot skip] chore: update generated content
• 88756c1 chore(deps): Bump undici from 6.24.1 to 6.27.0
• b960649 Merge pull request #464 from docker/dependabot/npm_and_yarn/vite-7.3.5
• 0a1e034 Merge pull request #456 from docker/dependabot/github_actions/actions/checkou...
• Additional commits viewable in compare view

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in actions/upload-artifact#754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in actions/upload-artifact#762
• Support direct file uploads by @​danwkennedy in actions/upload-artifact#764

New Contributors

• @​Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

• Upload Artifact Node 24 support by @​salmanmkc in actions/upload-artifact#719
• fix: update @​actions/artifact for Node.js 24 punycode deprecation by @​salmanmkc in actions/upload-artifact#744
• prepare release v6.0.0 for Node.js 24 support by @​salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

• Update README.md by @​GhadimiR in actions/upload-artifact#681
• Update README.md by @​nebuk89 in actions/upload-artifact#712
• Readme: spell out the first use of GHES by @​danwkennedy in actions/upload-artifact#727
• Update GHES guidance to include reference to Node 20 version by @​patrikpolyak in actions/upload-artifact#725
• Bump @actions/artifact to v4.0.0
• Prepare v5.0.0 by @​danwkennedy in actions/upload-artifact#734

... (truncated)

Commits

• 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
• 634250c Include changes in typespec/ts-http-runtime 0.3.5
• e454baa Readme: bump all the example versions to v7 (#796)
• 74fad66 Update the readme with direct upload details (#795)
• bbbca2d Support direct file uploads (#764)
• 589182c Upgrade the module to ESM and bump dependencies (#762)
• 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
• 02a8460 Add proxy integration test
• b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
• e516bc8 docs: correct description of Node.js 24 support in README
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.