build(deps): bump the docker-actions group across 1 directory with 4 updates

[dependabot]

Bumps the docker-actions group with 4 updates in the / directory: docker/setup-buildx-action, docker/github-builder/.github/workflows/bake.yml, docker/bake-action and docker/docker-agent-action/.github/workflows/review-pr.yml.

Updates docker/setup-buildx-action from 4.2.0 to 4.4.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.0

• Use official Buildx releases for cloud driver by @​crazy-max in docker/setup-buildx-action#606
• Pull BuildKit image before builder creation by @​crazy-max in docker/setup-buildx-action#609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in docker/setup-buildx-action#620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614
• Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

v4.3.0

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in docker/setup-buildx-action#595
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/setup-buildx-action#600
• Bump js-yaml from 5.2.0 to 5.3.0 in docker/setup-buildx-action#585
• Bump postcss from 8.5.10 to 8.5.25 in docker/setup-buildx-action#598
• Bump undici from 6.27.0 to 6.28.0 in docker/setup-buildx-action#601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

Commits

• 594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
• bd6e702 chore: update generated content
• 6268c9d pull BuildKit image before builder creation
• e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
• 533ed8e build(deps): bump the codeql-actions group with 2 updates
• bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
• d5079fb chore: update generated content
• 226a616 use shared error helpers for Buildx and Docker commands
• 77ce7f4 Merge pull request #619 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 0dc1dc9 [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates docker/github-builder/.github/workflows/bake.yml from 1.16.0 to 1.17.0

Release notes

Sourced from docker/github-builder/.github/workflows/bake.yml's releases.

v1.17.0

• bake: allow the default target input to apply by @​crazy-max in docker/github-builder#275
• bake: fix missing privateRepo output by @​crazy-max in docker/github-builder#274
• update github-builder-runtime module to 0.95.0 in docker/github-builder#279
• update cosign to v3.1.3 in docker/github-builder#232
• update BuildKit Syft Scanner image to 1.12.0 in docker/github-builder#278
• update docker/setup-buildx-action from 4.2.0 to 4.3.0 in docker/github-builder#281

Full Changelog: docker/github-builder@v1.16.0...v1.17.0

Commits

• 58cb9f5 Merge pull request #276 from docker/dependabot/github_actions/crazy-max-dot-g...
• db901a8 build(deps): Bump the crazy-max-dot-github group across 1 directory with 2 up...
• 4ce32a4 Merge pull request #281 from docker/dependabot/github_actions/docker/setup-bu...
• 6f3b6a7 build(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0
• 825a075 Merge pull request #279 from docker/deps/docker-github-builder-runtime-module
• 99e180f chore(deps): update github-builder-runtime module to 0.95.0
• 543520a Merge pull request #278 from docker/deps/sbom-image
• 5e30673 chore(deps): update BuildKit Syft Scanner image to 1.12.0
• e338501 Merge pull request #232 from docker/deps/cosign-version
• e7776b8 chore(deps): update Cosign version to v3.1.3
• Additional commits viewable in compare view

Updates docker/bake-action from 7.3.0 to 7.4.0

Release notes

Sourced from docker/bake-action's releases.

v7.4.0

• Use the shared error helper for Buildx commands by @​crazy-max in docker/bake-action#511
• Prevent workflow command injection in metadata logs by @​crazy-max in docker/bake-action#509
• Bump @​docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/bake-action#502 docker/bake-action#510 docker/bake-action#513
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/bake-action#498
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/bake-action#491
• Bump csv-parse from 7.0.0 to 7.0.2 in docker/bake-action#500
• Bump js-yaml from 4.3.0 to 4.3.2 in docker/bake-action#496 docker/bake-action#508
• Bump nanoid from 3.3.16 to 3.3.18 in docker/bake-action#499
• Bump postcss from 8.5.10 to 8.5.25 in docker/bake-action#489
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/bake-action#497
• Bump sigstore from 4.1.0 to 4.1.1 in docker/bake-action#476
• Bump undici from 6.27.0 to 6.28.1 in docker/bake-action#492

Full Changelog: docker/bake-action@v7.3.0...v7.4.0

Commits

• 018cb64 Merge pull request #512 from docker/dependabot/github_actions/codeql-actions-...
• 68e5dfc Merge pull request #513 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 67548ed chore(deps): Bump the codeql-actions group across 1 directory with 2 updates
• ad1760d [dependabot skip] chore: update generated content
• a2262a0 chore(deps): Bump @​docker/actions-toolkit from 0.99.0 to 0.100.0
• e04a701 Merge pull request #511 from crazy-max/buildx-error-message
• 0b5e3e4 chore: update generated content
• b0aab10 use the shared Buildx error summary helper
• c86773a Merge pull request #510 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 70f5dd8 [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates docker/docker-agent-action/.github/workflows/review-pr.yml from 2.0.3 to 2.0.9

Release notes

Sourced from docker/docker-agent-action/.github/workflows/review-pr.yml's releases.

v2.0.9

What's Changed

• chore: update Docker Agent to v1.140.0 by @​docker-agent in docker/docker-agent-action#116
• Prevent premature drafter structured output by @​aheritier in docker/docker-agent-action#117

Full Changelog: docker/docker-agent-action@v2.0.8...v2.0.9

v2.0.8

What's Changed

• chore: update Docker Agent to v1.139.0 by @​docker-agent in docker/docker-agent-action#114
• fix: substitute {pr} in posting-format.md and log html_url by @​derekmisler in docker/docker-agent-action#111

Full Changelog: docker/docker-agent-action@v2.0.7...v2.0.8

v2.0.7

What's Changed

Bug fixes

• fix: "Review incomplete" regression (concurrent transfer_task race) — Fixes the ~19% "Review incomplete" spike introduced in v2.0.6. When the root agent emitted multiple transfer_task calls in one LLM response, docker-agent's parallel tool dispatcher raced on the shared current-agent pointer, causing validation to fail with Agent drafter cannot transfer task to drafter: target agent not in sub-agents list. Two complementary mitigations:

  • parallel_tool_calls: false on the sonnet model config (API-level guarantee — the model never returns two tool calls in one response)
  • "Sequential delegation (REQUIRED)" prompt instruction (defense-in-depth — one transfer_task per response, wait for the result before the next chunk)
  • fix: disable parallel tool calls in pr-review; bump docker-agent to v1.131.0 by @​derekmisler in docker/docker-agent-action#99

• fix: false LGTM fallback replaced with incomplete-run notice — When a transfer_task delegation failed, the post-summary defense-in-depth fallback was posting a synthetic "No issues found — LGTM" review, masking a broken pipeline as an approval. Replaced with an explicit ⚠️ Review did not complete notice. The transfer_task failure path in pr-review.yaml is also made unambiguous: on any delegation error, post the incomplete-review COMMENT immediately and stop (no self-reviewing by reading diff files directly).

  • fix(review-pr): replace false LGTM fallback; harden transfer_task failure path by @​derekmisler in docker/docker-agent-action#98

• fix: review timeout bumped 2700 → 3600 s — Sequential chunk delegation takes longer than batched on 4-6 chunk PRs. Budget increased from 45 to 60 min; job timeout-minutes 60 → 75; lock TTL 3600 → 4500 s.

Other changes

• chore: update Docker Agent to v1.136.0 by @​docker-agent in docker/docker-agent-action#105
• chore: removes .github/workflows/update-consumers.yml by @​mpailloncy in docker/docker-agent-action#106

Full Changelog: docker/docker-agent-action@v2.0.6...v2.0.7

v2.0.6

What's Changed

• feat(update-consumers): fork-PR fallback, caller-permissions sync, dry-run by @​Sayt-0 in docker/docker-agent-action#92
• fix(update-consumers): exclude the action repos from discovery by @​Sayt-0 in docker/docker-agent-action#93
• chore: update Docker Agent to v1.131.0 by @​docker-agent in docker/docker-agent-action#97
• fix: missing pr-number input on review-pr reusable workflow by @​mpailloncy in docker/docker-agent-action#102

New Contributors

• @​mpailloncy made their first contribution in docker/docker-agent-action#102

Full Changelog: docker/docker-agent-action@v2.0.5...v2.0.6

... (truncated)

Commits

• 3654ec3 release: v2.0.9
• a00adae release(temp): pin self-refs to 90ca7668ff0493ea8cf6ec51fa702f443b7af546 for ...
• 90ca766 release(prep): stage dist/ for v2.0.9
• cb05915 Prevent premature drafter structured output (#117)
• 0e56bcd chore: update docker-agent-action to v2.0.8 (#115)
• 2a654bd chore: update Docker Agent to v1.140.0 (#116)
• 16952b9 fix: substitute {pr} in posting-format.md and log html_url (#111)
• 8462040 chore: update docker-agent-action to v2.0.7 (#108)
• 3e7cfa8 chore: update Docker Agent to v1.139.0 (#114)
• 8048e1d fix(review-pr): replace false LGTM fallback; harden transfer_task failure pat...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions