chore(deps): bump the github-actions group with 5 updates

[dependabot]

Bumps the github-actions group with 5 updates:

Package	From	To
dependabot/fetch-metadata	15c49302c4a0a37e326ec87971fba5d1e4322d97	0960109a4dd6d503321a0abfa87b9768962ddd12
azure/login	3.0.1	3.1.0
docker/setup-buildx-action	4.3.0	4.4.1
docker/setup-qemu-action	4.2.0	4.4.0
cachix/cachix-action	5f2d7c5294214f71b873db4b969586b980625e71	38b082610b782e7e93e209c35fd730d399dee866

Updates dependabot/fetch-metadata from 15c49302c4a0a37e326ec87971fba5d1e4322d97 to 0960109a4dd6d503321a0abfa87b9768962ddd12

Commits

• 0960109 Merge pull request #757 from dependabot/dependabot/npm_and_yarn/octokit/reque...
• e477b7d build(deps): bump @​octokit/request-error from 7.1.1 to 7.1.2
• 4242ac4 build(deps-dev): bump the dev-dependencies group across 1 directory with 15 u...
• 3d564b9 fix: use current PR head commit metadata (#729)
• 19e7709 Merge pull request #745 from dependabot/dependabot/npm_and_yarn/globals-17.11.0
• cb7fd33 build(deps-dev): bump globals from 17.9.0 to 17.12.0
• 4622783 Merge pull request #746 from dependabot/dependabot/npm_and_yarn/esbuild-0.28.2
• 2f083dd build(deps-dev): bump esbuild from 0.28.1 to 0.28.2
• f391ec5 Merge pull request #755 from dependabot/dependabot/npm_and_yarn/babel/core-7....
• f330da1 build(deps-dev): bump @​babel/core from 7.22.9 to 7.29.7
• Additional commits viewable in compare view

Updates azure/login from 3.0.1 to 3.1.0

Release notes

Sourced from azure/login's releases.

Azure Login Action v3.1.0

What's Changed

• Pin GitHub Actions to full-length commit SHAs by @​danfiedler-msft in Azure/login#636
• Add the ability to prevent the masking of clientId by @​the-coding-cuzzy in Azure/login#634
• Automate release tagging via deploy key + self-pin bump by @​MaddyMicrosoft in Azure/login#638
• docs: document immutable release model and correct branch reference by @​MaddyMicrosoft in Azure/login#640
• ci: reduce scheduled test frequency and clarify workflow names by @​MaddyMicrosoft in Azure/login#639
• Bump js-yaml from 3.14.2 to 3.15.2 by @​dependabot[bot] in Azure/login#643
• Bump browserslist from 4.21.4 to 4.28.8 by @​dependabot[bot] in Azure/login#637
• Add max-context-population input to override Azure PowerShell MaxCont… by @​MaddyMicrosoft in Azure/login#642

New Contributors

• @​danfiedler-msft made their first contribution in Azure/login#636
• @​the-coding-cuzzy made their first contribution in Azure/login#634

Full Changelog: Azure/login@v3.0.2...v3.1.0

Azure Login Action v3.0.2

What's Changed

Security & hardening

• Refactor PowerShell login to a static param()-bound script — eliminates string-interpolation in the AzPS login path so credential/config values can never be re-parsed as PowerShell (injection-safe by construction) by @​MaddyMicrosoft in Azure/login#607
• Pin third-party GitHub Actions to commit SHAs — supply-chain hardening for the CI/release workflows by @​MaddyMicrosoft in Azure/login#615
• Add admin-gated Release workflow — reproducible, approval-gated release + rollback pipeline by @​MaddyMicrosoft in Azure/login#610

Telemetry

• Emit the real action ref in telemetry via GITHUB_ACTION_REF — corrects the previously stale hard-coded value so usage reports the version consumers actually pin by @​MaddyMicrosoft in Azure/login#614

Dependencies

• Cap @actions/exec and @actions/core below the ESM-only 3.x majors (keeps the CommonJS ncc build working) by @​MaddyMicrosoft in Azure/login#628
• Harden Dependabot config for the CommonJS ncc build by @​MaddyMicrosoft in Azure/login#622
• Bump the github-actions group across 1 directory with 7 updates by @​MaddyMicrosoft in Azure/login#621
• Bump uuid and @actions/core by @​dependabot in Azure/login#589
• Bump brace-expansion from 1.1.12 to 1.1.18 by @​dependabot in Azure/login#616
• Bump picomatch from 2.3.1 to 2.3.2 by @​dependabot in Azure/login#582

Maintenance & docs

• Cleanup package.json and Dependabot config by @​MaddyMicrosoft in Azure/login#608
• Workflows/CI hygiene by @​MaddyMicrosoft in Azure/login#609
• Docs uplift by @​MaddyMicrosoft in Azure/login#620
• Add version support policy and security update guidance by @​Alex-AZPS in Azure/login#604

Full Changelog: Azure/login@v3.0.1...v3.1.0

Commits

• a641126 prepare release v3.1.0
• 3c5b5ce Add max-context-population input to override Azure PowerShell MaxCont… (#642)
• fcd0340 Bump browserslist from 4.21.4 to 4.28.8 (#637)
• 5a8018f Bump js-yaml from 3.14.2 to 3.15.2 (#643)
• a23dddf ci: reduce scheduled test frequency and clarify workflow names (#639)
• 4c016e0 docs: document immutable release model and correct branch reference (#640)
• 63f3c38 Automate release tagging via deploy key + self-pin bump (#638)
• 92a0b67 Add the ability to prevent the masking of clientId (#634)
• 5cb857d Pin GitHub Actions to full-length commit SHAs (#636)
• d90bae5 Cap @​actions/exec and @​actions/core below the ESM-only 3.x majors (#628)
• Additional commits viewable in compare view

Updates docker/setup-buildx-action from 4.3.0 to 4.4.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.1

• Skip BuildKit image pre-pulls for explicit endpoints by @​crazy-max in docker/setup-buildx-action#624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

• Use official Buildx releases for cloud driver by @​crazy-max in docker/setup-buildx-action#606
• Pull BuildKit image before builder creation by @​crazy-max in docker/setup-buildx-action#609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in docker/setup-buildx-action#620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614
• Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

Commits

• f87e599 Merge pull request #624 from crazy-max/skip-pull-with-endpoint
• e700274 chore: update generated content
• 3061c91 skip BuildKit image pre-pulls for explicit endpoints
• 594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
• bd6e702 chore: update generated content
• 6268c9d pull BuildKit image before builder creation
• e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
• 533ed8e build(deps): bump the codeql-actions group with 2 updates
• bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
• d5079fb chore: update generated content
• Additional commits viewable in compare view

Updates docker/setup-qemu-action from 4.2.0 to 4.4.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.4.0

• Use the shared error helper for Docker commands by @​crazy-max in docker/setup-qemu-action#345
• Bump @​docker/actions-toolkit from 0.96.0 to 0.100.0 in docker/setup-qemu-action#344
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-qemu-action#340
• Bump js-yaml from 4.3.1 to 4.3.2 in docker/setup-qemu-action#342
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-qemu-action#337

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

v4.3.0

• Bump @​docker/actions-toolkit from 0.92.0 to 0.96.0 in docker/setup-qemu-action#336
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-qemu-action#316
• Bump brace-expansion from 1.1.15 to 1.1.18 in docker/setup-qemu-action#332
• Bump js-yaml from 4.2.0 to 4.3.1 in docker/setup-qemu-action#334
• Bump postcss from 8.5.10 to 8.5.25 in docker/setup-qemu-action#331
• Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-qemu-action#317
• Bump undici from 6.27.0 to 6.28.0 in docker/setup-qemu-action#333

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

Commits

• 9901266 Merge pull request #342 from docker/dependabot/npm_and_yarn/js-yaml-4.3.2
• 9364d8b Merge pull request #340 from docker/dependabot/npm_and_yarn/humanfs/node-0.16.8
• 95c3240 Merge pull request #337 from docker/dependabot/npm_and_yarn/postcss-selector-...
• c24671a Merge pull request #338 from docker/dependabot/github_actions/codeql-actions-...
• fa83965 Merge pull request #345 from crazy-max/shared-error-helpers
• f396a65 build(deps): bump the codeql-actions group across 1 directory with 2 updates
• a63df2f chore: update generated content
• 3e4165f use the shared error helper for Docker commands
• 18c52d9 Merge pull request #344 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 896cbed [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates cachix/cachix-action from 5f2d7c5294214f71b873db4b969586b980625e71 to 38b082610b782e7e93e209c35fd730d399dee866

Changelog

Sourced from cachix/cachix-action's changelog.

Release

1. Create and push a new tag:

   git tag v17
   git push origin v17

2. Wait for CI to pass.

3. Create a release for the new tag.

4. Move the major version tag to the latest release:

   git tag -fa v17
   git push origin v17 --force

Commits

• 38b0826 dev: cleanup tests and dev files
• 0fe030c dist
• 792dafc deps: bump dependencies
• b690244 ci: improve Nix compatibility test coverage
• f495f3f Merge pull request #217 from cachix/dependabot/github_actions/actions/checkout-7
• 9ee3c77 chore(deps): bump actions/checkout from 6 to 7
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 0a4b343e-45d0-4834-bc39-a4fe79f502d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[defangdevs]

Routine GitHub Actions group bump (azure/login, docker/setup-buildx-action, docker/setup-qemu-action, dependabot/fetch-metadata, cachix/cachix-action). Workflow-only diff, no app code. The repo's own dependabot-automerge.yml didn't auto-approve this one because some of these are SHA-pinned rather than semver-tagged, so fetch-metadata couldn't classify the update type. Approving manually; enabling auto-merge to land once go-test is green.