Skip to content

build(deps): Bump docker/login-action from 4.2.0 to 4.5.2 - #1084

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/docker/login-action-4.5.2
Open

build(deps): Bump docker/login-action from 4.2.0 to 4.5.2#1084
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/docker/login-action-4.5.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps docker/login-action from 4.2.0 to 4.5.2.

Release notes

Sourced from docker/login-action's releases.

v4.5.2

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Full Changelog: docker/login-action@v4.4.0...v4.5.0

v4.4.0

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Full Changelog: docker/login-action@v4.2.0...v4.3.0

Commits
  • 371161b Merge pull request #1058 from crazy-max/fix-dockerhub-oidc-error-handling
  • 5dc73df chore: update generated content
  • 2aa1ede surface Docker Hub OIDC error responses
  • abd2ef4 Merge pull request #1055 from crazy-max/test-registry-auth-oidc
  • d49d3a9 Merge pull request #1054 from crazy-max/oidc-missing-dhi
  • b58b17c test: cover Docker Hub OIDC with registry-auth
  • be646c2 chore: update generated content
  • d77c059 support dhi.io as Docker Hub OIDC registry
  • 06fb636 Merge pull request #1037 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
  • a8bc953 [dependabot skip] chore: update generated content
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Low Risk
Single CI dependency pin with no workflow input changes; low impact on review deploys.

Overview
Bumps docker/login-action from v4.2.0 to v4.5.2 in the review deploy workflow’s package job, on the step that logs into ghcr.io before the image build/push.

Registry, username, and token inputs are unchanged; only the action pin moves. Upstream adds Docker Hub OIDC support and dependency/security fixes that do not alter how this workflow authenticates to GHCR.

Reviewed by Cursor Bugbot for commit 621c9a9. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
build(deps): Bump docker/login-action from 4.2.0 to 4.5.2
621c9a9 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.5.2.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v4.2.0...v4.5.2)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added Changed Required label for PR that categorizes merge commit message as "Changed" for changelog dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Aug 4, 2026
@dependabot dependabot Bot mentioned this pull request Aug 4, 2026
Closed
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream docker/login-action 4.2.0→4.5.2 changes against the malware checklist and scanner findings.Next I'll inspect the new OIDC source, package.json scripts, and whether the scanner heuristics are false positives in the bundled dist.Verdict: benign

Supply-chain review of docker/login-action 4.2.0 → 4.5.2 shows a normal, intentional feature/deps bump — not compromise.

Top evidence

  • Functional delta matches release notes: Docker Hub OIDC (src/dockerhub.ts), dhi.io registry support, empty registry-auth secret-mask fix, and dependency bumps (@actions/http-client, uuid, AWS SDK / toolkit). Network calls target identity.docker.com / identity-stage.docker.com only.
  • No classic malware signals in source: no install/lifecycle scripts, no eval/obfuscated payloads, no unexpected hosts, no persistence/exfil patterns. Tags v4.2.0…v4.5.2 exist; commits are from historical maintainer CrazyMax + Dependabot.
  • Local consumer impact is inert for this repo’s usage: deploy-review.yml logs into ghcr.io with github.actor / github.token, so the new OIDC path is unused unless DOCKERHUB_OIDC_CONNECTIONID is set with an empty password.
  • Scanner disagreement (explicit): status is warn with 173 heuristics, but 0 unicode / 0 confusable / 0 IOC. Those hits are false positives in bundled dist/index.cjs, lockfile/@actions/exec/base64-js strings, README token docs, path-traversal test fixtures, and upstream’s own workflow files — not evidence of malice. maintainer_drift is a version-range heuristic, not a new publisher identity.

Compatibility Analysis

I'll analyze local usage of docker/login-action and compare it against upstream API changes between 4.2.0 and 4.5.2.## Compatibility verdict: merge

1) Local usage

Only usage site: .github/workflows/deploy-review.yml (package job).

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4.5.2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

Classic GHCR username/token login. No Docker Hub, ECR, registry-auth, or OIDC login via this action.

2) Intersection with changed APIs

None for this repo’s call site.

  • action.yml inputs are unchanged from v4.2.0 → v4.5.2 (registry, username, password, ecr, scope, logout, registry-auth).
  • Notable changes are additive: Docker Hub OIDC (DOCKERHUB_OIDC_CONNECTIONID), dhi.io OIDC registry, better OIDC error surfacing, empty registry-auth mask skip, dependency bumps.
  • Source delta is mostly new src/dockerhub.ts OIDC path; GHCR password login path is untouched in intent.

3) Risks / unknowns

  • Low: transitive dep bumps inside the action (@docker/actions-toolkit, aws-sdk, js-yaml, etc.) could theoretically affect runtime, but not via new required inputs.
  • Workflow already has id-token: write, but that is unused by this GHCR login step and does not change behavior for username/password auth.
  • Residual unknown is only whether Dependabot’s PR CI for the review-app package job still succeeds (same inputs as before).

4) Recommendation

merge — same major (v4), no breaking input changes, and local usage does not touch the new OIDC/Docker Hub paths.

Malware Scan Summary

  • Status: warn
  • Warn only mode: true
  • Changed upstream files scanned: 23
  • Resolution strategy: tag_range
  • Changed node/vendor paths: 0
  • Changed lockfiles: 1
  • Resolved upstream range: 650006c6eb7dba73a995cc03b0b2d7f5ca915bee..371161bbe7024a29a25c5e19bfcbc0804fe9ad2c
  • Resolved refs: from=650006c6eb7dba73a995cc03b0b2d7f5ca915bee to=371161bbe7024a29a25c5e19bfcbc0804fe9ad2c
  • Unicode findings (post-allowlist): 0
  • Confusable findings (post-allowlist): 0
  • IOC findings (post-allowlist): 0
  • Heuristic findings (post-allowlist): 173

Top findings

  • dist/index.cjs:2 codepoint_decoder :: ,p.message,p.stack);var m=new Error("tunneling socket could not be established, cause="+p.message);m.code="ECONNRESET",e.request.emit("error",m),n.removeSocket(s)}i(d,"onError")},"createSocket");ul.prototype.removeSocket=i(function(e){var r=this.sockets.indexOf(e);if(r!==-1){this.sockets.splice(r,1);var n=this.requests.shift();n&&this.createSocket(n,function(s){n.request.onSocket(s)})}},"removeSocket");function fK(t,e){var r=this;ul.prototype.createSocket.call(r,t,function(n){var s=t.request.ge...[truncated]
  • dist/index.cjs:3 codepoint_decoder :: )||t.includes("\r")||t.includes("\0"))===!1}i(r7,"isValidHeaderValue");function oze(t,e){let{headersList:r}=e,n=(r.get("referrer-policy",!0)??"").split(","),s="";if(n.length>0)for(let o=n.length;o!==0;o--){let a=n[o-1].trim();if(H$e.has(a)){s=a;break}}s!==""&&(t.referrerPolicy=s)}i(oze,"setRequestReferrerPolicyOnRedirect");function ize(){return"allowed"}i(ize,"crossOriginResourcePolicyCheck");function aze(){return"success"}i(aze,"corsCheck");function cze(){return"success"}i(cze,"TAOCheck");func...[truncated]
  • dist/index.cjs:4 codepoint_decoder :: );function n3e(t){for(let e=0;e<t.length;++e)if((t.charCodeAt(e)&-128)!==0)return!1;return!0}i(n3e,"isAsciiString");function s3e(t){let e=t.length;if(e<27||e>70)return!1;for(let r=0;r<e;++r){let n=t.charCodeAt(r);if(!(n>=48&&n<=57||n>=65&&n<=90||n>=97&&n<=122||n===39||n===45||n===95))return!1}return!0}i(s3e,"validateBoundary");function o3e(t,e){cb(e!=="failure"&&e.essence==="multipart/form-data");let r=e.parameters.get("boundary");if(r===void 0)return"failure";let n=Buffer.from(--${r},"utf8")...[truncated]
  • dist/index.cjs:45 codepoint_decoder :: .trim())}};kte.exports=sU});var zb=I((Fzt,Ute)=>{"use strict";var Ote=Symbol.for("undici.globalDispatcher.1"),{InvalidArgumentError:GYe}=rt(),HYe=oA();Fte()===void 0&&Mte(new HYe);function Mte(t){if(!t||typeof t.dispatch!="function")throw new GYe("Argument agent must implement Agent");Object.defineProperty(globalThis,Ote,{value:t,writable:!0,enumerable:!1,configurable:!1})}i(Mte,"setGlobalDispatcher");function Fte(){return globalThis[Ote]}i(Fte,"getGlobalDispatcher");Ute.exports={setGlobalDispa...[truncated]
  • dist/index.cjs:46 codepoint_decoder :: ${o};break;case"retry":Tse(o)&&(r[s]=o);break;case"id":vse(o)&&(r[s]=o);break;case"event":o.length>0&&(r[s]=o);break}}processEvent(e){e.retry&&Tse(e.retry)&&(this.state.reconnectionTime=parseInt(e.retry,10)),e.id&&vse(e.id)&&(this.state.lastEventId=e.id),e.data!==void 0&&this.push({type:e.event||"message",options:{data:e.data,lastEventId:this.state.lastEventId,origin:this.state.origin}})}clearEvent(){this.event={data:void 0,event:void 0,id:void 0,retry:void 0}}};Pse.exports={EventSourceStream:Y...[truncated]
  • dist/index.cjs:47 codepoint_decoder :: %s,N,N,w,n);var P=w.type==="*"?W2:w.type==="?"?V2:"\\"+w.type;s=!0,n=n.slice(0,w.reStart)+P+"\\("+N}A(),o&&(n+="\\\\");var _=!1;switch(n.charAt(0)){case"[":case".":case"(":_=!0}for(var re=c.length-1;re>-1;re--){var ye=c[re],ae=n.slice(0,ye.reStart),qe=n.slice(ye.reStart,ye.reEnd-8),ne=n.slice(ye.reEnd-8,ye.reEnd),X=n.slice(ye.reEnd);ne+=X;var U=ae.split("(").length-1,wt=X;for(h=0;h<U;h++)wt=wt.replace(/\)[+*?]?/,"");X=wt;var Z="";X===""&&e!==sB&&(Z="$");var lt=ae+qe+X+Z+ne;n=lt}if(n!==""&&s&...[truncated]
  • dist/index.cjs:64 codepoint_decoder :: Polling status: ${Ofe.includes(d)?"Stopped":"Running"}),d==="succeeded"){let p=a(u,r);if(p!==void 0)return{response:await e(p).catch(kfe({state:r,stateProxy:n,isOperationError:c})),status:d}}return{response:u,status:d}}i(Ylt,"pollOperationHelper");async function qfe(t){let{poll:e,state:r,stateProxy:n,options:s,getOperationStatus:o,getResourceLocation:a,getOperationLocation:c,isOperationError:l,withOperationLocation:u,getPollingInterval:d,processResult:p,getError:m,updateState:f,setDelay:A,isDo...[truncated]
  • dist/index.cjs:74 codepoint_decoder :: +this.showPosition(),{text:"",token:null,line:this.yylineno})},"next"),lex:i(function(){var o=this.next();return typeof o<"u"?o:this.lex()},"lex"),begin:i(function(o){this.conditionStack.push(o)},"begin"),popState:i(function(){return this.conditionStack.pop()},"popState"),_currentRules:i(function(){return this.conditions[this.conditionStack[this.conditionStack.length-1]].rules},"_currentRules"),topState:i(function(){return this.conditionStack[this.conditionStack.length-2]},"topState"),pushState...[truncated]
  • dist/index.cjs:99 codepoint_decoder :: +c}catch{!n.logger||n.logger?.constructor?.name==="NoOpLogger"?console.warn(c):n.logger?.warn?.(c)}typeof a.$responseBodyText<"u"&&a.$response&&(a.$response.body=a.$responseBodyText);try{if(tn.isInstance(o)){let{headers:l={}}=o,u=Object.entries(l);a.$metadata={httpStatusCode:o.statusCode,requestId:cJ(/^x-[\w-]+-request-?id$/,u),extendedRequestId:cJ(/^x-[\w-]+-id-2$/,u),cfId:cJ(/^x-[\w-]+-cf-id$/,u)}}}catch{}}throw a}},"deserializerMiddleware"),cJ=i((t,e)=>(e.find(([r])=>r.match(t))||[void 0,v...[truncated]
  • dist/index.cjs:110 codepoint_decoder :: If you are using React Native, this API is not yet supported, see: https://react-native.canny.io/feature-requests/p/fetch-streaming-body);return s.stream()},"blobToWebStream");return Object.assign(t,{transformToByteArray:r,transformToString:i(async s=>{let o=await r();if(s==="base64")return RQ(o);if(s==="hex")return ui(o);if(s===void 0||s==="utf8"||s==="utf-8")return gBe(o);if(typeof TextDecoder=="function")return new TextDecoder(s).decode(o);throw new Error("TextDecoder is not available, pleas...[truncated]
  • dist/index.cjs:130 codepoint_decoder :: ))throw new of("Authorization token contains invalid \\r\\n sequence.");return t},"validateToken");cve.fromHttp=jbt});function Kbt(t){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"sso-oauth",region:t.region},propertiesExtractor:i((e,r)=>({signingProperties:{config:e,context:r}}),"propertiesExtractor")}}function Xbt(t){return{schemeId:"smithy.api#noAuth"}}var lve,uve,dve,xj=g(()=>{On();we();lve=i(async(t,e,r)=>({operation:Bt(e).operation,region:await gt(t.region)()||(()=>{throw new E...[truncated]
  • dist/index.cjs:163 codepoint_decoder :: ||t==="\r"}i(dpe,"isWhiteSpace");function ppe(t,e){let r=e;for(;e<t.length;e++)if(t[e]=="?"||t[e]==" "){let n=t.substr(r,e-r);if(e>5&&n==="xml")return gr("InvalidXml","XML declaration allowed only at the start of the document.",Zn(t,e));if(t[e]=="?"&&t[e+1]==">"){e++;break}else continue}return e}i(ppe,"readPI");function mpe(t,e){if(t.length>e+5&&t[e+1]==="-"&&t[e+2]==="-"){for(e+=3;e<t.length;e++)if(t[e]==="-"&&t[e+1]==="-"&&t[e+2]===">"){e+=2;break}}else if(t.length>e+8&&t[e+1]==="D"&&t[e+2]==...[truncated]
  • dist/index.cjs:164 codepoint_decoder :: );let e=new Bs("!xml"),r=e,n="";this.matcher.reset(),this.entityDecoder.reset(),this.entityExpansionCount=0,this.currentExpandedLength=0;let s=this.options,o=new FC(s.processEntities),a=t.length;for(let c=0;c<a;c++)if(t[c]==="<"){let u=t.charCodeAt(c+1);if(u===47){let d=sh(t,">",c,"Closing Tag is not closed."),p=t.substring(c+2,d).trim();if(s.removeNSPrefix){let f=p.indexOf(":");f!==-1&&(p=p.substr(f+1))}p=FG(s.transformTagName,p,"",s).tagName,r&&(n=this.saveTextToParentTag(n,r,this.readonlyMat...[truncated]
  • dist/index.cjs:167 codepoint_decoder :: ):(this.indentate=function(){return""},this.tagEndChar=">",this.newLine="")}i(Ns,"Builder");function Jit(t,e){let r=t["?xml"];if(r&&typeof r=="object"){if(e.attributesGroupName&&r[e.attributesGroupName]){let s=r[e.attributesGroupName][e.attributeNamePrefix+"version"];if(s)return s}let n=r[e.attributeNamePrefix+"version"];if(n)return n}return"1.0"}i(Jit,"detectXmlVersionFromObj");function YG(t,e,r,n,s){return!r.sanitizeName||om(t,{xmlVersion:s})?t:r.sanitizeName(t,{isAttribute:e,matcher:n.readOn...[truncated]
  • dist/index.cjs:187 codepoint_decoder :: ));let n=yield o4(r,"create");yield i4(n,t)})}i(c4,"createTar");var Lh=function(t,e,r,n){function s(o){return o instanceof r?o:new r(function(a){a(o)})}return i(s,"adopt"),new(r||(r=Promise))(function(o,a){function c(d){try{u(n.next(d))}catch(p){a(p)}}i(c,"fulfilled");function l(d){try{u(n.throw(d))}catch(p){a(p)}}i(l,"rejected");function u(d){d.done?o(d.value):s(d.value).then(c,l)}i(u,"step"),u((n=n.apply(t,e||[])).next())})},zi=class t extends Error{static{i(this,"ValidationError")}constructo...[truncated]
  • dist/index.cjs:193 codepoint_decoder :: ${t.mark.snippet}),${t.reason} ${r}):t.reason}i(khe,"formatError");var YT=class extends Error{static{i(this,"YAMLException")}reason;mark;constructor(t,e){super(),this.name="YAMLException",this.reason=t,this.mark=e,this.message=khe(this,!1),Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor)}toString(t){return${this.name}: ${khe(this,t)}}};function tv(t,e,r,n=""){let s=0,o=0;for(let c=0;c<e;c++){let l=t.charCodeAt(c);l===10?(s++,o=c+1):l===13&&(s++,t.charCodeAt(c+1)===10&...[truncated]
  • dist/index.cjs:194 codepoint_decoder :: `;case 118:return"\v";case 102:return"\f";case 114:return"\r";case 101:return"\x1B";case 32:return" ";case 34:return'"';case 47:return"/";case 92:return"\";case 78:return"\x85";case 95:return"\xA0";case 76:return"\u2028";case 80:return"\u2029";default:return""}}i(Lhe,"simpleEscapeSequence");var Whe=new Array(256),Yhe=new Array(256);for(let t=0;t<256;t++)Whe[t]=Lhe(t)?1:0,Yhe[t]=Lhe(t);function ift(t){

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Changed Required label for PR that categorizes merge commit message as "Changed" for changelog dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants