[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
docker/build-push-action	action	minor	v7.3.0 → v7.4.0
docker/setup-buildx-action	action	minor	v4.3.0 → v4.4.1
docker/setup-qemu-action	action	minor	v4.3.0 → v4.4.0
github/codeql-action	action	minor	v4.37.9 → v4.38.2	v4.39.0 (+1)
qltysh/qlty-action	action	minor	v2.3.0 → v2.4.0

---

Release Notes

docker/build-push-action

v7.4.0

Compare Source

• Use the shared error helper for Buildx commands by @​crazy-max in #​1620
• Prevent workflow command injection in metadata logs by @​crazy-max in #​1617
• Bump @​docker/actions-toolkit from 0.92.0 to 0.100.0 in #​1614 #​1618 #​1621
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​1609
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​1592
• Bump csv-parse from 7.0.0 to 7.0.2 in #​1613
• Bump js-yaml from 4.3.0 to 4.3.2 in #​1605 #​1615
• Bump nanoid from 3.3.16 to 3.3.18 in #​1611
• Bump postcss from 8.5.10 to 8.5.25 in #​1590
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #​1606
• Bump sigstore from 4.1.0 to 4.1.1 in #​1577
• Bump undici from 6.27.0 to 6.28.0 in #​1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

docker/setup-buildx-action

v4.4.1

Compare Source

• Skip BuildKit image pre-pulls for explicit endpoints by @​crazy-max in #​624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

Compare Source

• Use official Buildx releases for cloud driver by @​crazy-max in #​606
• Pull BuildKit image before builder creation by @​crazy-max in #​609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in #​620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in #​610 #​618 #​619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​614
• Bump js-yaml from 5.3.0 to 5.4.2 in #​608 #​617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #​611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

docker/setup-qemu-action

v4.4.0

Compare Source

• Use the shared error helper for Docker commands by @​crazy-max in #​345
• Bump @​docker/actions-toolkit from 0.96.0 to 0.100.0 in #​344
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​340
• Bump js-yaml from 4.3.1 to 4.3.2 in #​342
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #​337

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

github/codeql-action

v4.38.2

Compare Source

• Update default CodeQL bundle version to 2.27.1. #​4160

v4.38.1

Compare Source

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

v4.38.0

Compare Source

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
• Update default CodeQL bundle version to 2.27.0. #​4129

qltysh/qlty-action

v2.4.0

Compare Source

Fixed

• Security updates to bundled dependencies (#​207, #​208, #​209)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
drydock-website	Ready	Preview	Oct 13, 2026 2:23pm UTC
drydockdemo-website	Ready	Preview	Oct 13, 2026 2:23pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: CodesWhat/drydock/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3946d9d6-2fd7-4792-a5e0-5bbda0bb4d80

📥 Commits

Reviewing files that changed from the base of the PR and between b6b3a33 and ab3e4c2.

📒 Files selected for processing: 6

• .github/workflows/ci-verify.yml
• .github/workflows/e2e-playwright.yml
• .github/workflows/release-cut.yml
• .github/workflows/security-dast-web.yml
• .github/workflows/security-grype.yml
• .github/workflows/security-scorecard.yml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📝 Walkthrough

The workflows update pinned versions of CodeQL, Qlty, Docker Buildx, Docker build-push, and QEMU actions. Workflow logic, triggers, conditions, and build configuration remain unchanged.

Priority: ⬇️ Low

Change: Other

Merge Risk: ⚪ Minimal · up to ab3e4

The PR updates CI, build, and security action versions without a reported workflow behavior change. No actionable merge risk is established from the supplied evidence.

Pre-merge checks: 2

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[scttbnsn]

First source pass is done. The workflow changes only replace pinned action SHAs and their version comments. Permissions, event filters, checkout settings, inputs and release arguments are unchanged, and the current checks are green.

Holding this with the other dependency updates while rc.24 soaks. It still needs the normal review before merging.

[scttbnsn]

@coderabbitai review

First source pass on current head ab3e4c28a5e09ff97d7c8abf1c96b109fb9f0c2e, against dev/v1.7. Review the six workflow files' action-pin updates. Independently checked all five upstream release tags and peeled annotated tags to their commit objects: every new SHA matches its stated upstream release. Normalized source comparison confirms only uses pins and version comments changed, preserving triggers, permissions, inputs and release arguments. Current-head required hosted checks pass.

Threat model: trusted maintainers updating pinned third-party CI/build/security actions. Check provenance and accidental workflow-permission or release-contract changes; deliberately malicious maintainers are out of scope. Merge remains held for the existing rc.24 release gate. Maximum three review passes.

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[scttbnsn]

Source review and current-head checks pass on ab3e4c2. CodeRabbit covered all six workflow files; the upstream action pins were also checked against their release tags. Merge remains HELD for rc.24. Renovate automerge is disabled and GitHub has no auto-merge request.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[scttbnsn]

Closing since 1.7.0 shipped and dev/v1.7 isn't getting another release. Renovate targets dev/v1.8 now, so these bumps land there.