Skip to content

build(deps): Bump docker/login-action from 4.2.0 to 4.4.0 - #1050

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/docker/login-action-4.2.0
Closed

build(deps): Bump docker/login-action from 4.2.0 to 4.4.0#1050
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/docker/login-action-4.2.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 7, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps docker/login-action from 4.2.0 to 4.4.0.

Release notes

Sourced from docker/login-action's releases.

v4.4.0

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Full Changelog: docker/login-action@v4.2.0...v4.3.0

Commits
  • af1e73f Merge pull request #1034 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
  • da722bd [dependabot skip] chore: update generated content
  • 2916ad6 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
  • ca0a662 Merge pull request #1035 from crazy-max/fix-registry-auth-empty-mask
  • c455755 chore: update generated content
  • 4835190 skip empty registry-auth secret mask
  • 992421c Merge pull request #1033 from docker/dependabot/github_actions/docker/bake-ac...
  • b249b43 Merge pull request #1032 from docker/dependabot/github_actions/docker/bake-ac...
  • 1b67977 build(deps): bump docker/bake-action from 7.2.0 to 7.3.0
  • 9d49d6a build(deps): bump docker/bake-action/subaction/matrix
  • Additional commits viewable in compare view

Note

Low Risk
Routine CI dependency bump with no application or secret-handling logic changes in this repo.

Overview
Bumps docker/login-action from v4.2.0 to v4.4.0 in the review deploy workflow’s package job, on the step that logs into ghcr.io before the image build/push. No inputs or surrounding steps change—only the action pin.

Reviewed by Cursor Bugbot for commit f8e4c23. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot dependabot Bot added Changed Required label for PR that categorizes merge commit message as "Changed" for changelog dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Jul 7, 2026
@github-actions

github-actions Bot commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream docker/login-action 4.2.0→4.4.0 diff for supply-chain compromise indicators against the malware checklist.Checking source for obfuscation patterns, local PR diff, and the maintainer-drift heuristic.Verdict: benign

Minor, intentional upstream update (v4.2.0 → v4.4.0) with no supply-chain compromise indicators.

Evidence

  • Functional source change is only skipping core.setSecret when registry-auth password is empty (src/context.ts + tests) — matches release notes / Update Managed Files #1035.
  • Remaining changes are routine: dependency bumps (AWS SDK, actions-toolkit, js-yaml, etc.), --keep-names in esbuild, Yarn hardening (enableScripts: false, age gate), docs/CI updates in the upstream repo (not consumer payload).
  • No install/postinstall lifecycle scripts; no invisible Unicode/bidi/homoglyph hits; IOC/confusable counts are 0.
  • Tags v4.2.0 / v4.4.0 resolve cleanly; authors are expected (crazy-max, Dependabot, Docker bots).
  • Consumer usage is a normal pin bump in .github/workflows/deploy-review.yml.

Scanner disagreement: status is warn with 167 heuristics (mostly codepoint_decoder / obfuscation_indicator / spawn / credential patterns in bundled dist/index.cjs, plus upstream workflow touches and maintainer_drift). Those are expected false positives for a minified Action bundle that talks to registries/AWS — not evidence of malware.

Compatibility Analysis

I'll analyze local usage of docker/login-action and compare it against upstream API changes from 4.2.0 → 4.4.0.Recommendation: merge

1) Local usage

Single consumer site: .github/workflows/deploy-review.yml (package job → “Login to GitHub Container Registry”).

Inputs used:

  • registry: ghcr.io
  • username: ${{ github.actor }}
  • password: ${{ github.token }}

Not used: registry-auth, ecr, scope, logout.

2) API / behavior intersection

  • action.yml inputs are unchanged between v4.2.0 and v4.4.0.
  • Only functional source change is in src/context.ts: skip core.setSecret when a registry-auth password is empty (Update Managed Files #1035). That path is unused here.
  • Remaining release notes are dependency/build bumps (AWS ECR SDKs, actions-toolkit, sigstore, js-yaml, etc.) and esbuild --keep-names — no public input/output changes affecting this workflow.

3) Risks / unknowns

  • Low: GHCR username/token login path is untouched by the sole behavior fix.
  • Residual unknown is transitive runtime deps inside the action bundle (always true for action bumps); no local API migration needed.
  • ECR SDK bumps are irrelevant to this GHCR usage.

4) Verdict

Safe minor bump for this repo’s usage pattern. Merge.

Malware Scan Summary

  • Status: warn
  • Warn only mode: true
  • Changed upstream files scanned: 18
  • Resolution strategy: tag_range
  • Changed node/vendor paths: 0
  • Changed lockfiles: 1
  • Resolved upstream range: 650006c6eb7dba73a995cc03b0b2d7f5ca915bee..af1e73f918a031802d376d3c8bbc3fe56130a9b0
  • Resolved refs: from=650006c6eb7dba73a995cc03b0b2d7f5ca915bee to=af1e73f918a031802d376d3c8bbc3fe56130a9b0
  • Unicode findings (post-allowlist): 0
  • Confusable findings (post-allowlist): 0
  • IOC findings (post-allowlist): 0
  • Heuristic findings (post-allowlist): 167

Top findings

  • dist/index.cjs:2 codepoint_decoder :: ,p.message,p.stack);var m=new Error("tunneling socket could not be established, cause="+p.message);m.code="ECONNRESET",e.request.emit("error",m),n.removeSocket(s)}i(d,"onError")},"createSocket");ul.prototype.removeSocket=i(function(e){var r=this.sockets.indexOf(e);if(r!==-1){this.sockets.splice(r,1);var n=this.requests.shift();n&&this.createSocket(n,function(s){n.request.onSocket(s)})}},"removeSocket");function nK(t,e){var r=this;ul.prototype.createSocket.call(r,t,function(n){var s=t.request.ge...[truncated]
  • dist/index.cjs:3 codepoint_decoder :: )||t.includes("\r")||t.includes("\0"))===!1}i(zX,"isValidHeaderValue");function $$e(t,e){let{headersList:r}=e,n=(r.get("referrer-policy",!0)??"").split(","),s="";if(n.length>0)for(let o=n.length;o!==0;o--){let a=n[o-1].trim();if(N$e.has(a)){s=a;break}}s!==""&&(t.referrerPolicy=s)}i($$e,"setRequestReferrerPolicyOnRedirect");function z$e(){return"allowed"}i(z$e,"crossOriginResourcePolicyCheck");function V$e(){return"success"}i(V$e,"corsCheck");function W$e(){return"success"}i(W$e,"TAOCheck");func...[truncated]
  • dist/index.cjs:4 codepoint_decoder :: );function Gze(t){for(let e=0;e<t.length;++e)if((t.charCodeAt(e)&-128)!==0)return!1;return!0}i(Gze,"isAsciiString");function Hze(t){let e=t.length;if(e<27||e>70)return!1;for(let r=0;r<e;++r){let n=t.charCodeAt(r);if(!(n>=48&&n<=57||n>=65&&n<=90||n>=97&&n<=122||n===39||n===45||n===95))return!1}return!0}i(Hze,"validateBoundary");function $ze(t,e){ib(e!=="failure"&&e.essence==="multipart/form-data");let r=e.parameters.get("boundary");if(r===void 0)return"failure";let n=Buffer.from(--${r},"utf8")...[truncated]
  • dist/index.cjs:45 codepoint_decoder :: .trim())}};xte.exports=K1});var Hb=I((Czt,Tte)=>{"use strict";var Bte=Symbol.for("undici.globalDispatcher.1"),{InvalidArgumentError:RYe}=rt(),NYe=aA();Nte()===void 0&&Rte(new NYe);function Rte(t){if(!t||typeof t.dispatch!="function")throw new RYe("Argument agent must implement Agent");Object.defineProperty(globalThis,Bte,{value:t,writable:!0,enumerable:!1,configurable:!1})}i(Rte,"setGlobalDispatcher");function Nte(){return globalThis[Bte]}i(Nte,"getGlobalDispatcher");Tte.exports={setGlobalDispa...[truncated]
  • dist/index.cjs:46 codepoint_decoder :: ${o};break;case"retry":yse(o)&&(r[s]=o);break;case"id":Ese(o)&&(r[s]=o);break;case"event":o.length>0&&(r[s]=o);break}}processEvent(e){e.retry&&yse(e.retry)&&(this.state.reconnectionTime=parseInt(e.retry,10)),e.id&&Ese(e.id)&&(this.state.lastEventId=e.id),e.data!==void 0&&this.push({type:e.event||"message",options:{data:e.data,lastEventId:this.state.lastEventId,origin:this.state.origin}})}clearEvent(){this.event={data:void 0,event:void 0,id:void 0,retry:void 0}}};Cse.exports={EventSourceStream:q...[truncated]
  • dist/index.cjs:47 codepoint_decoder :: %s,N,N,w,n);var P=w.type==="*"?U2:w.type==="?"?F2:"\\"+w.type;s=!0,n=n.slice(0,w.reStart)+P+"\\("+N}A(),o&&(n+="\\\\");var _=!1;switch(n.charAt(0)){case"[":case".":case"(":_=!0}for(var re=c.length-1;re>-1;re--){var ye=c[re],ae=n.slice(0,ye.reStart),qe=n.slice(ye.reStart,ye.reEnd-8),ne=n.slice(ye.reEnd-8,ye.reEnd),K=n.slice(ye.reEnd);ne+=K;var U=ae.split("(").length-1,wt=K;for(h=0;h<U;h++)wt=wt.replace(/\)[+*?]?/,"");K=wt;var X="";K===""&&e!==rB&&(X="$");var lt=ae+qe+K+X+ne;n=lt}if(n!==""&&s&...[truncated]
  • dist/index.cjs:64 codepoint_decoder :: Polling status: ${Bfe.includes(d)?"Stopped":"Running"}),d==="succeeded"){let p=a(u,r);if(p!==void 0)return{response:await e(p).catch(xfe({state:r,stateProxy:n,isOperationError:c})),status:d}}return{response:u,status:d}}i(_lt,"pollOperationHelper");async function vfe(t){let{poll:e,state:r,stateProxy:n,options:s,getOperationStatus:o,getResourceLocation:a,getOperationLocation:c,isOperationError:l,withOperationLocation:u,getPollingInterval:d,processResult:p,getError:m,updateState:f,setDelay:A,isDo...[truncated]
  • dist/index.cjs:74 codepoint_decoder :: +this.showPosition(),{text:"",token:null,line:this.yylineno})},"next"),lex:i(function(){var o=this.next();return typeof o<"u"?o:this.lex()},"lex"),begin:i(function(o){this.conditionStack.push(o)},"begin"),popState:i(function(){return this.conditionStack.pop()},"popState"),_currentRules:i(function(){return this.conditions[this.conditionStack[this.conditionStack.length-1]].rules},"_currentRules"),topState:i(function(){return this.conditionStack[this.conditionStack.length-2]},"topState"),pushState...[truncated]
  • dist/index.cjs:99 codepoint_decoder :: +c}catch{!n.logger||n.logger?.constructor?.name==="NoOpLogger"?console.warn(c):n.logger?.warn?.(c)}typeof a.$responseBodyText<"u"&&a.$response&&(a.$response.body=a.$responseBodyText);try{if(pn.isInstance(o)){let{headers:l={}}=o,u=Object.entries(l);a.$metadata={httpStatusCode:o.statusCode,requestId:tJ(/^x-[\w-]+-request-?id$/,u),extendedRequestId:tJ(/^x-[\w-]+-id-2$/,u),cfId:tJ(/^x-[\w-]+-cf-id$/,u)}}}catch{}}throw a}},"deserializerMiddleware"),tJ=i((t,e)=>(e.find(([r])=>r.match(t))||[void 0,v...[truncated]
  • dist/index.cjs:110 codepoint_decoder :: If you are using React Native, this API is not yet supported, see: https://react-native.canny.io/feature-requests/p/fetch-streaming-body);return s.stream()},"blobToWebStream");return Object.assign(t,{transformToByteArray:r,transformToString:i(async s=>{let o=await r();if(s==="base64")return bQ(o);if(s==="hex")return ui(o);if(s===void 0||s==="utf8"||s==="utf-8")return sBe(o);if(typeof TextDecoder=="function")return new TextDecoder(s).decode(o);throw new Error("TextDecoder is not available, pleas...[truncated]
  • dist/index.cjs:130 codepoint_decoder :: ))throw new cf("Authorization token contains invalid \\r\\n sequence.");return t},"validateToken");WTe.fromHttp=Qbt});function _bt(t){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"sso-oauth",region:t.region},propertiesExtractor:i((e,r)=>({signingProperties:{config:e,context:r}}),"propertiesExtractor")}}function Dbt(t){return{schemeId:"smithy.api#noAuth"}}var YTe,JTe,jTe,gj=g(()=>{kn();we();YTe=i(async(t,e,r)=>({operation:Bt(e).operation,region:await ht(t.region)()||(()=>{throw new E...[truncated]
  • dist/index.cjs:163 codepoint_decoder :: ||t==="\r"}i(epe,"isWhiteSpace");function tpe(t,e){let r=e;for(;e<t.length;e++)if(t[e]=="?"||t[e]==" "){let n=t.substr(r,e-r);if(e>5&&n==="xml")return gr("InvalidXml","XML declaration allowed only at the start of the document.",Kn(t,e));if(t[e]=="?"&&t[e+1]==">"){e++;break}else continue}return e}i(tpe,"readPI");function rpe(t,e){if(t.length>e+5&&t[e+1]==="-"&&t[e+2]==="-"){for(e+=3;e<t.length;e++)if(t[e]==="-"&&t[e+1]==="-"&&t[e+2]===">"){e+=2;break}}else if(t.length>e+8&&t[e+1]==="D"&&t[e+2]==...[truncated]
  • dist/index.cjs:164 codepoint_decoder :: );let e=new bs("!xml"),r=e,n="";this.matcher.reset(),this.entityDecoder.reset(),this.entityExpansionCount=0,this.currentExpandedLength=0;let s=this.options,o=new FC(s.processEntities),a=t.length;for(let c=0;c<a;c++)if(t[c]==="<"){let u=t.charCodeAt(c+1);if(u===47){let d=ih(t,">",c,"Closing Tag is not closed."),p=t.substring(c+2,d).trim();if(s.removeNSPrefix){let f=p.indexOf(":");f!==-1&&(p=p.substr(f+1))}p=QG(s.transformTagName,p,"",s).tagName,r&&(n=this.saveTextToParentTag(n,r,this.readonlyMat...[truncated]
  • dist/index.cjs:167 codepoint_decoder :: ):(this.indentate=function(){return""},this.tagEndChar=">",this.newLine="")}i(Rs,"Builder");function Dit(t,e){let r=t["?xml"];if(r&&typeof r=="object"){if(e.attributesGroupName&&r[e.attributesGroupName]){let s=r[e.attributesGroupName][e.attributeNamePrefix+"version"];if(s)return s}let n=r[e.attributeNamePrefix+"version"];if(n)return n}return"1.0"}i(Dit,"detectXmlVersionFromObj");function qG(t,e,r,n,s){return!r.sanitizeName||am(t,{xmlVersion:s})?t:r.sanitizeName(t,{isAttribute:e,matcher:n.readOn...[truncated]
  • dist/index.cjs:187 codepoint_decoder :: ));let n=yield XV(r,"create");yield ZV(n,t)})}i(t4,"createTar");var Mh=function(t,e,r,n){function s(o){return o instanceof r?o:new r(function(a){a(o)})}return i(s,"adopt"),new(r||(r=Promise))(function(o,a){function c(d){try{u(n.next(d))}catch(p){a(p)}}i(c,"fulfilled");function l(d){try{u(n.throw(d))}catch(p){a(p)}}i(l,"rejected");function u(d){d.done?o(d.value):s(d.value).then(c,l)}i(u,"step"),u((n=n.apply(t,e||[])).next())})},zi=class t extends Error{static{i(this,"ValidationError")}constructo...[truncated]
  • dist/index.cjs:193 codepoint_decoder :: ${t.mark.snippet}),${t.reason} ${r}):t.reason}i(xhe,"formatError");var VT=class extends Error{static{i(this,"YAMLException")}reason;mark;constructor(t,e){super(),this.name="YAMLException",this.reason=t,this.mark=e,this.message=xhe(this,!1),Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor)}toString(t){return${this.name}: ${xhe(this,t)}}};function ZT(t,e,r,n=""){let s=0,o=0;for(let c=0;c<e;c++){let l=t.charCodeAt(c);l===10?(s++,o=c+1):l===13&&(s++,t.charCodeAt(c+1)===10&...[truncated]
  • dist/index.cjs:194 codepoint_decoder :: `;case 118:return"\v";case 102:return"\f";case 114:return"\r";case 101:return"\x1B";case 32:return" ";case 34:return'"';case 47:return"/";case 92:return"\";case 78:return"\x85";case 95:return"\xA0";case 76:return"\u2028";case 80:return"\u2029";default:return""}}i(bhe,"simpleEscapeSequence");var khe=new Array(256),Lhe=new Array(256);for(let t=0;t<256;t++)khe[t]=bhe(t)?1:0,Lhe[t]=bhe(t);function zmt(t){

@dependabot
build(deps): Bump docker/login-action from 4.2.0 to 4.4.0
f8e4c23 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v4.2.0...v4.4.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): Bump docker/login-action from 4 to 4.2.0 build(deps): Bump docker/login-action from 4.2.0 to 4.4.0 Jul 28, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/docker/login-action-4.2.0 branch from a6569c5 to f8e4c23 Compare July 28, 2026 16:05
@dependabot @github

dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1078.

@dependabot dependabot Bot closed this Jul 28, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/docker/login-action-4.2.0 branch July 28, 2026 22:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Changed Required label for PR that categorizes merge commit message as "Changed" for changelog dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants