chore(deps): bump docker/login-action from 4 to 4.5.1 - #6064
Conversation
Bumps [docker/login-action](https://github.com/docker/login-action) from 4 to 4.5.1. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v4...v4.5.1) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.5.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
🔵 Review postedLast updated: 2026-08-01 00:18 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #6064 bumps docker/login-action from the floating @v4 tag to the exact @v4.5.1 in .github/workflows/containerbuild.yml — a CI-only (development) dependency, within-major.
Semver risk: minor, within v4.x. Breaking changes: none. Security fixes: none advertised for the action in this range. Peer/code changes required: none — the step passes only registry/username/password, and the one notable addition in range (v4.5.0 Docker Hub OIDC login) is opt-in and irrelevant to a ghcr.io username/password login. CI: passing.
The catch is the pin, not the version range. @v4 currently resolves to the same commit as v4.6.0:
tags/v4 -> dbcb813823bdd20940b903addbd779551569679f
tags/v4.6.0 -> dbcb813823bdd20940b903addbd779551569679f
tags/v4.5.1 -> abd2ef45e78c5afb21d64d4ca52ee8550d9572c7
So merging moves CI backwards two releases — away from v4.5.2 (surface Docker Hub OIDC error responses) and v4.6.0 (harden buildx scoped config path handling, docker/login-action#1059). Dependabot chose 4.5.1 because .github/dependabot.yml sets cooldown: default-days: 7 and v4.6.0 landed 2026-07-29, inside that window.
Recommendation: close and leave @v4 in place. Detail inline.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
| - name: Log in to Docker Hub | ||
| if: github.event_name != 'pull_request' | ||
| uses: docker/login-action@v4 | ||
| uses: docker/login-action@v4.5.1 |
There was a problem hiding this comment.
suggestion: This narrows a floating major into an exact pin, which has two effects beyond the version change.
First, it's a downgrade: @v4 resolves to v4.6.0 today, so this moves CI back two releases. Second, future 4.x patches — including security patches — stop arriving automatically and need a fresh Dependabot PR each time. Neither is signalled by the title "bump ... from 4 to 4.5.1".
It's also the only exact pin among the Docker actions here: docker/setup-qemu-action@v4 (42, 98), docker/setup-buildx-action@v4 (45, 101), docker/metadata-action@v6 (57), docker/build-push-action@v7 (64, 104) all float.
Suggest closing this and keeping @v4. If exact/SHA pinning is wanted for supply-chain reasons, that's worth doing deliberately across all actions rather than landing on one step.
Worth noting the green CI isn't evidence here — this step is guarded by if: github.event_name != 'pull_request', so it was skipped on the PR build. v4.5.1 would first execute on the post-merge push to unstable.
rtibbles
left a comment
rtibbles
left a comment
There was a problem hiding this comment.
Going for the patch pin here, "downgrade" will be resolved in future upgrades.
2 participants
Bumps docker/login-action from 4 to 4.5.1.
Release notes
Sourced from docker/login-action's releases.
... (truncated)
Commits
a5e9150Merge pull request #1048 from docker/dockerhub-oidc-supporta482ba4build(deps): bump the codeql-actions group with 2 updates9e3d36echore: update generated content14d6a79docker hub oidc support03c8510Merge pull request #1044 from docker/dependabot/npm_and_yarn/docker/actions-t...ad8a81fMerge pull request #1046 from docker/dependabot/npm_and_yarn/brace-expansion-...6d219a4[dependabot skip] chore: update generated contentb320069build(deps): bump@docker/actions-toolkitfrom 0.92.0 to 0.93.008d3680[dependabot skip] chore: update generated content381f5a4Merge pull request #1042 from docker/dependabot/github_actions/codeql-actions...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)