chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v3.0.2 → v3.7.0
actions/setup-node	action	minor	v3.4.1 → v3.9.1
docker/build-push-action	action	minor	v3.1.1 → v3.3.1
docker/login-action	action	minor	v2.0.0 → v2.2.0
docker/metadata-action	action	minor	v4.0.1 → v4.6.0
docker/setup-buildx-action	action	minor	v2.0.0 → v2.10.0
docker/setup-qemu-action	action	minor	v2.0.0 → v2.2.0
rust (source)	final	minor	1.63.0-slim → 1.97.1-slim
rust (source)	final	minor	1.63.0-alpine → 1.97.1-alpine
rust (source)	final	minor	1.62.0-slim → 1.97.1-slim
rust (source)	final	minor	1.62.0-alpine → 1.97.1-alpine
rust (source)	final	minor	1.61.0-slim → 1.97.1-slim
rust (source)	final	minor	1.61.0-alpine → 1.97.1-alpine

---

Release Notes

actions/checkout (actions/checkout)

v3.7.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v3 by @​aiqiaoy in #​2503
• backport fixes to releases-v3 by @​aiqiaoy in #​2525

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v3.6.0...v3.7.0

v3.6.0

Compare Source

• Fix: Mark test scripts with Bash'isms to be run via Bash
• Add option to fetch tags even if fetch-depth > 0

v3.5.3

Compare Source

• Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in
• Fix typos found by codespell
• Add support for sparse checkouts

v3.5.2

Compare Source

• Fix api endpoint for GHES

v3.5.1

Compare Source

• Fix slow checkout on Windows

v3.5.0

Compare Source

• Add new public key for known_hosts

v3.4.0

Compare Source

• Upgrade codeql actions to v2
• Upgrade dependencies
• Upgrade @​actions/io

v3.3.0

Compare Source

• Implement branch list using callbacks from exec function
• Add in explicit reference to private checkout options
• Fix comment typos (that got added in #​770)

v3.2.0

Compare Source

• Add GitHub Action to perform release
• Fix status badge
• Replace datadog/squid with ubuntu/squid Docker image
• Wrap pipeline commands for submoduleForeach in quotes
• Update @​actions/io to 1.1.2
• Upgrading version to 3.2.0

v3.1.0

Compare Source

• Use @​actions/core saveState and getState
• Add github-server-url input

actions/setup-node (actions/setup-node)

v3.9.1

Compare Source

What's Changed

• Add workflow file for publishing releases to immutable action package by @​aparnajyothi-y in #​1281

Full Changelog: actions/setup-node@v3...v3.9.1

v3.9.0

Compare Source

What's Changed

• Upgrade @​actions/cache to 4.0.3 by @​gowridurgad in #​1270
  In scope of this release we updated actions/cache package to ensure continued support and compatibility, as older versions of the package are now deprecated. For more information please refer to the toolkit/cache.

Full Changelog: actions/setup-node@v3...v3.9.0

v3.8.2

Compare Source

What's Changed

• Update semver by @​dmitry-shibanov in #​861
• Update temp directory creation by @​nikolai-laevskii in #​859
• Bump @​babel/traverse from 7.15.4 to 7.23.2 by @​dependabot in #​870
• Add notice about binaries not being updated yet by @​nikolai-laevskii in #​872
• Update toolkit cache and core by @​dmitry-shibanov and @​seongwon-privatenote in #​875

Full Changelog: actions/setup-node@v3...v3.8.2

v3.8.1

Compare Source

What's Changed

In scope of this release, the filter was removed within the cache-save step by @​dmitry-shibanov in #​831. It is filtered and checked in the toolkit/cache library.

Full Changelog: actions/setup-node@v3...v3.8.1

v3.8.0

Compare Source

What's Changed

Bug fixes:

• Add check for existing paths by @​dmitry-shibanov in #​803
• Resolve SymbolicLink by @​dmitry-shibanov in #​809
• Change passing logic for cache input by @​dmitry-shibanov in #​816
• Fix armv7 cache issue by @​louislam in #​794
• Update check-dist workflow name by @​sinchang in #​710

Feature implementations:

• feat: handling the case where "node" is used for tool-versions file. by @​xytis in #​812

Documentation changes:

• Refer to semver package name in README.md by @​olleolleolle in #​808

Update dependencies:

• Update toolkit cache to fix zstd by @​dmitry-shibanov in #​804
• Bump tough-cookie and @​azure/ms-rest-js by @​dependabot in #​802
• Bump semver from 6.1.2 to 6.3.1 by @​dependabot in #​807
• Bump word-wrap from 1.2.3 to 1.2.4 by @​dependabot in #​815

New Contributors

• @​olleolleolle made their first contribution in #​808
• @​louislam made their first contribution in #​794
• @​sinchang made their first contribution in #​710
• @​xytis made their first contribution in #​812

Full Changelog: actions/setup-node@v3...v3.8.0

v3.7.0

Compare Source

What's Changed

In scope of this release we added a logic to save an additional cache path for yarn 3 (related pull request and feature request). Moreover, we added functionality to use all the sub directories derived from cache-dependency-path input and add detect all dependencies directories to cache (related pull request and feature request).

Besides, we made such changes as:

• Replace workflow badge with new badge by @​jongwooo in #​653
• Fix a minor typo by @​phanan in #​662
• docs: fix typo in advanced-usage.md by @​remarkablemark in #​697
• bugfix: Don't attempt to use Windows fallbacks on non-Windows OSes by @​domdomegg in #​718
• Update to node 18.x by @​feelepxyz in #​751
• Remove implicit dependencies by @​nikolai-laevskii in #​758
• Fix description about ensuring workflow access to private package by @​x86chi in #​704

New Contributors

• @​jongwooo made their first contribution in #​653
• @​phanan made their first contribution in #​662
• @​remarkablemark made their first contribution in #​697
• @​domdomegg made their first contribution in #​718
• @​feelepxyz made their first contribution in #​751
• @​nikolai-laevskii made their first contribution in #​758
• @​x86chi made their first contribution in #​704

Full Changelog: actions/setup-node@v3...v3.7.0

v3.6.0: Add Support for Nightly, Canary and RC builds for Node.js

Compare Source

In scope of this release we added support to download nightly, rc (#​611) and canary (#​619) Node.js distributions.

For nightly versions:

jobs:
  build:
    runs-on: ubuntu-latest
    name: Node sample
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: '16-nightly'
      - run: npm ci
      - run: npm test

For canary versions:

jobs:
  build:
    runs-on: ubuntu-latest
    name: Node sample
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: '16-v8-canary’
      - run: npm ci
      - run: npm test

For rc versions:

jobs:
  build:
    runs-on: ubuntu-latest
    name: Node sample
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: '16.0.0-rc.1’
      - run: npm ci
      - run: npm test

Note: For more examples please refer to documentation.

Besides, we added the following changes as:

• Updated minimatch: #​608
• Fixed extra newline character in version output when reading from a file: #​625
• Passed the token input through on GHES: #​595
• Fixed issue with scoped registries are duplicated in npmrc: #​637

v3.5.1: Update @​actions/core and Print Node, Npm, Yarn versions

Compare Source

In scope of this release we updated actions/core to 1.10.0. Moreover, we added logic to print Nodejs, Npm, Yarn versions after installation.

v3.5.0: Add support for engines.node and Volta

Compare Source

In scope of this release we add support for engines.node. The action will be able to grab the version form package.json#engines.node. #​485. Moreover, we added support for Volta

Besides, we updated @​actions/core to 1.9.1 and @​actions/cache to 3.0.4

docker/build-push-action (docker/build-push-action)

v3.3.1

Compare Source

• Disable provenance by default if not set by @​crazy-max (#​781)

Full Changelog: docker/build-push-action@v3.3.0...v3.3.1

v3.3.0

Compare Source

Note

Buildx v0.10 enables support for a minimal SLSA Provenance attestation, which requires support for OCI-compliant multi-platform images. This may introduce issues with registry and runtime support (e.g. Google Cloud Run and AWS Lambda). You can optionally disable the default provenance attestation functionality using provenance: false.

• Add attests, provenance and sbom inputs by @​crazy-max (#​746 #​759)
• Log GitHub Actions runtime token access controls by @​crazy-max (#​707)
• Examples moved to docs website by @​crazy-max (#​718)
• Bump minimatch from 3.0.4 to 3.1.2 (#​732)
• Bump csv-parse from 5.3.0 to 5.3.3 (#​729)
• Bump json5 from 2.2.0 to 2.2.3 (#​749)

Full Changelog: docker/build-push-action@v3.2.0...v3.3.0

v3.2.0

Compare Source

• Remove workaround for setOutput by @​crazy-max (#​704)
• Docs: fix Git context link and add more details about subdir support by @​crazy-max (#​685)
• Docs: named context by @​baibaratsky and @​crazy-max (#​665)
• Bump @​actions/core from 1.9.0 to 1.10.0 (#​667 #​695)
• Bump @​actions/github from 5.0.3 to 5.1.1 (#​696)

Full Changelog: docker/build-push-action@v3.1.1...v3.2.0

docker/login-action (docker/login-action)

v2.2.0

Compare Source

• Switch to actions-toolkit implementation by @​crazy-max in #​409 #​470 #​476
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.347.1 in #​524 #​364 #​363
• Bump minimatch from 3.0.4 to 3.1.2 in #​354
• Bump json5 from 2.2.0 to 2.2.3 in #​378
• Bump http-proxy-agent from 5.0.0 to 7.0.0 in #​509
• Bump https-proxy-agent from 5.0.1 to 7.0.0 in #​508

Full Changelog: docker/login-action@v2.1.0...v2.2.0

v2.1.0

Compare Source

• Ensure AWS temp credentials are redacted in workflow logs by @​crazy-max (#​275)
• Bump @​actions/core from 1.6.0 to 1.10.0 (#​252 #​292)
• Bump @​aws-sdk/client-ecr from 3.53.0 to 3.186.0 (#​298)
• Bump @​aws-sdk/client-ecr-public from 3.53.0 to 3.186.0 (#​299)

Full Changelog: docker/login-action@v2.0.0...v2.1.0

docker/metadata-action (docker/metadata-action)

v4.6.0

Compare Source

• Dedup and sort labels by @​crazy-max in #​301
• Bump @​docker/actions-toolkit from 0.3.0 to 0.5.0 in #​302

Full Changelog: docker/metadata-action@v4.5.0...v4.6.0

v4.5.0

Compare Source

• Bump @​docker/actions-toolkit from 0.1.0 to 0.3.0 in #​296
• Bump csv-parse from 5.3.8 to 5.4.0 in #​294

Full Changelog: docker/metadata-action@v4.4.0...v4.5.0

v4.4.0

Compare Source

• Add context input to define the metadata provider by @​neilime in #​248
• Switch to actions-toolkit implementation by @​crazy-max in #​266 #​273 #​284
• Bump csv-parse from 5.3.3 to 5.3.8 in #​271 #​286
• Bump moment-timezone from 0.5.40 to 0.5.43 in #​268 #​278 #​281
• Bump semver from 7.4.0 to 7.5.0 in #​285

Full Changelog: docker/metadata-action@v4.3.0...v4.4.0

v4.3.0

Compare Source

• Provide outputs as env vars by @​crazy-max (#​257)

Full Changelog: docker/metadata-action@v4.2.0...v4.3.0

v4.2.0

Compare Source

• Add tz attribute to handlebar date function by @​chroju (#​251)
• Bump minimatch from 3.0.4 to 3.1.2 (#​242)
• Bump csv-parse from 5.3.1 to 5.3.3 (#​245)
• Bump json5 from 2.2.0 to 2.2.3 (#​252)

Full Changelog: docker/metadata-action@v4.1.1...v4.2.0

v4.1.1

Compare Source

• Revert changes to set associated head sha on pull request event by @​crazy-max (#​239)
  • User can still set associated head sha on PR by setting the env var DOCKER_METADATA_PR_HEAD_SHA=true
• Bump csv-parse from 5.3.0 to 5.3.1 (#​237)

Full Changelog: docker/metadata-action@v4.1.0...v4.1.1

v4.1.0

Compare Source

• Do not trim whitespace for sep-tags and sep-labels inputs by @​crazy-max (#​233)
• Set associated head sha on pull request event by @​crazy-max (#​234)
• Remove workaround for setOutput by @​crazy-max (#​236)
• Bump @​actions/github from 5.0.1 to 5.1.1 (#​208 #​232)
• Bump @​actions/core from 1.6.0 to 1.10.0 (#​209 #​216 #​226 #​231)
• Bump csv-parse from 5.0.4 to 5.3.0 (#​210 #​221)
• Bump moment from 2.29.3 to 2.29.4 (#​220)

Full Changelog: docker/metadata-action@v4.0.1...v4.1.0

docker/setup-buildx-action (docker/setup-buildx-action)

v2.10.0

Compare Source

• Bump @​docker/actions-toolkit from 0.7.1 to 0.10.0 by @​crazy-max in #​258
• Bump word-wrap from 1.2.3 to 1.2.5 in #​253

Full Changelog: docker/setup-buildx-action@v2.9.1...v2.10.0

v2.9.1

Compare Source

• Bump @​docker/actions-toolkit from 0.7.0 to 0.7.1 in #​248
  • Fixes an issue where building Buildx does not match the local platform (docker/actions-toolkit#135)

Full Changelog: docker/setup-buildx-action@v2.9.0...v2.9.1

v2.9.0

Compare Source

• Bump @​docker/actions-toolkit from 0.6.0 to 0.7.0 in #​246
  • Adds support to cache Buildx binary to hosted tool cache and GHA cache backend

Full Changelog: docker/setup-buildx-action@v2.8.0...v2.9.0

v2.8.0

Compare Source

• Only set specific flags for drivers supporting them by @​nicks in #​241
• Bump @​docker/actions-toolkit from 0.5.0 to 0.6.0 in #​242

Full Changelog: docker/setup-buildx-action@v2.7.0...v2.8.0

v2.7.0

Compare Source

• Bump @​docker/actions-toolkit from 0.3.0 to 0.5.0 in #​237 #​238

Full Changelog: docker/setup-buildx-action@v2.6.0...v2.7.0

v2.6.0

Compare Source

• Set node name for k8s driver when appending nodes by @​crazy-max in #​219
• Bump @​docker/actions-toolkit from 0.1.0-beta.18 to 0.3.0 in #​220 #​229 #​231 #​236

Full Changelog: docker/setup-buildx-action@v2.5.0...v2.6.0

v2.5.0

Compare Source

• cleanup input to remove builder and temp files by @​crazy-max in #​213
• do not remove builder using the docker driver by @​crazy-max in #​218
• fix current context as builder name for docker driver by @​crazy-max in #​209

Full Changelog: docker/setup-buildx-action@v2.4.1...v2.5.0

v2.4.1

Compare Source

• Get releases from actions toolkit by @​crazy-max (#​200)
• Bump csv-parse from 5.3.3 to 5.3.4 (#​199)

Full Changelog: docker/setup-buildx-action@v2.4.0...v2.4.1

v2.4.0

Compare Source

• Don't depend on the GitHub API to check release by @​crazy-max (#​196)

Full Changelog: docker/setup-buildx-action@v2.3.0...v2.4.0

v2.3.0

Compare Source

• Use Octokit to check Buildx release on GitHub by @​crazy-max (#​191 #​192)
• Add version pinning information to the README by @​jedevc (#​189)
• Bump minimatch from 3.0.4 to 3.1.2 (#​182)
• Bump csv-parse from 5.3.1 to 5.3.3 (#​181)
• Bump json5 from 2.2.0 to 2.2.3 (#​184)

Full Changelog: docker/setup-buildx-action@v2.2.1...v2.3.0

v2.2.1

Compare Source

• Preserve quotes surrounding fields in input list by @​crazy-max (#​174)
• Escape surrounding quotes for platforms input by @​crazy-max (#​175)

Full Changelog: docker/setup-buildx-action@v2.2.0...v2.2.1

v2.2.0

Compare Source

• Append nodes to builder support by @​crazy-max (#​165)
• Bump csv-parse from 5.3.0 to 5.3.1 (#​172)

Full Changelog: docker/setup-buildx-action@v2.1.0...v2.2.0

v2.1.0

Compare Source

• Auth support for tls endpoint by @​crazy-max (#​164)
• Nodes metadata JSON ouput by @​crazy-max (#​162)
  • endpoint, status and flags outputs are deprecated. Use nodes output instead.
• Skip setting buildkitd flags and config for remote driver by @​crazy-max (#​161)
• Move args logic to context module and add tests by @​crazy-max (#​169)
• Remove workaround for setOutput by @​crazy-max (#​170)
• Fix deprecated fs.rmdir by @​crazy-max (#​171)
• Docs: clarify install option by @​rodrigc in (#​152)
• Bump @​actions/core from 1.6.0 to 1.10.0 (#​151 #​157 #​167)
• Bump @​actions/tool-cache from 1.7.2 to 2.0.1 (#​150)
• Bump @​actions/http-client from 1.0.11 to 2.0.1 (#​149)
• Bump uuid from 8.3.2 to 9.0.0 (#​159)

Full Changelog: docker/setup-buildx-action@v2.0.0...v2.1.0

docker/setup-qemu-action (docker/setup-qemu-action)

v2.2.0

Compare Source

• Trim off spaces in platforms input by @​Chocobo1 in #​64
• Switch to actions-toolkit implementation by @​crazy-max in #​70 #​80 #​83

Full Changelog: docker/setup-qemu-action@v2.1.0...v2.2.0

v2.1.0

Compare Source

• Use context for inputs by @​crazy-max (#​62)
• Use built-in getExecOutput by @​crazy-max (#​61)
• Remove workaround for setOutput by @​crazy-max (#​63)
• Bump @​actions/core from 1.6.0 to 1.10.0 (#​54 #​58 #​59)

Full Changelog: docker/setup-qemu-action@v2.0.0...v2.1.0

---

Configuration

📅 Schedule: (in timezone Asia/Jakarta)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.