build(deps): Bump docker/setup-buildx-action from 4.1.0 to 4.2.0

[dependabot]

Bumps docker/setup-buildx-action from 4.1.0 to 4.2.0.

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.2.0

• Preserve names in esbuild bundle by @​crazy-max in docker/setup-buildx-action#572
• Bump @​actions/core from 3.0.0 to 3.0.1 in docker/setup-buildx-action#551
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/setup-buildx-action#557 docker/setup-buildx-action#580
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in docker/setup-buildx-action#573
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-buildx-action#576
• Bump js-yaml from 4.1.1 to 5.2.0 in docker/setup-buildx-action#562
• Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-buildx-action#577
• Bump tmp from 0.2.5 to 0.2.7 in docker/setup-buildx-action#556
• Bump undici from 6.25.0 to 6.27.0 in docker/setup-buildx-action#570
• Bump vite from 7.3.2 to 7.3.6 in docker/setup-buildx-action#569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

Commits

• bb05f3f Merge pull request #580 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 321c814 [dependabot skip] chore: update generated content
• b9a36ef build(deps): bump @​docker/actions-toolkit from 0.91.0 to 0.92.0
• ebeab24 Merge pull request #570 from docker/dependabot/npm_and_yarn/undici-6.27.0
• 5c7b8ae [dependabot skip] chore: update generated content
• 037e618 build(deps): bump undici from 6.25.0 to 6.27.0
• 66080e5 Merge pull request #577 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
• 409aef0 Merge pull request #562 from docker/dependabot/npm_and_yarn/js-yaml-4.2.0
• 49c6e42 build(deps): bump sigstore from 4.1.0 to 4.1.1
• 2211273 [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

[lklimek]

Dependency security review — docker/setup-buildx-action 4.1.0 → 4.2.0

Verdict: SAFE — this bump is a net security improvement.

Call sites: .github/workflows/docker.yml:39, .github/workflows/e2e.yml:31.

Change summary

71 commits, but zero changes to src/. Everything is dependency bumps, CI hardening, and a rebuilt dist/. The build script gained --keep-names, so dist/index.cjs is a full rebundle — the textual diff is large but almost entirely noise.

Direct deps: @actions/core 3.0.0→3.0.1, @docker/actions-toolkit 0.90.0→0.92.0, js-yaml 4.1.1→5.2.0. Yarn 4.9.2→4.15.0.

Known vulnerabilities — this bump fixes seven

Advisory	Package	Fixed in
GHSA-p88m-4jfj-68fv	undici — Set-Cookie header injection	6.27.0 ✅
GHSA-vxpw-j846-p89q	undici — WebSocket fragment-count DoS	6.27.0 ✅
GHSA-ph9p-34f9-6g65	tmp — path traversal via prefix/postfix	0.2.6 ✅
GHSA-7c78-jf6q-g5cm	tmp — type-confusion _assertPath bypass	0.2.7 ✅
GHSA-52v5-jr5w-gjxr	sigstore — certificateOIDs constraints silently dropped	4.1.1 ✅
GHSA-jfc7-64v2-mr8c	@sigstore/core — DSSE payloadType binding failure	3.2.1 ✅
GHSA-xgjw-pm74-86q4	@sigstore/verify — insufficient data-authenticity verification	3.1.1 ✅

No advisories exist against docker/setup-buildx-action or @docker/actions-toolkit themselves (OSV, both ecosystems, empty).

Bundle integrity — verified clean

The shipped dist/index.cjs sourcemaps were set-diffed between tags (the raw text diff is useless due to --keep-names):

• 1043 → 833 source files; 35 packages removed, 0 packages added.
• The removed set is the entire make-fetch-happen/cacache/minipass/socks-proxy-agent/ip-address npm-fetch stack plus @sigstore/sign — actions-toolkit 0.92.0 dropped the sigstore signing path and kept only verification. Bundle shrank 2.73 MB → 1.85 MB. This explains the 98 dropped dist/licenses.txt entries and is a genuine attack-surface reduction.
• Tag v4.2.0 = commit bb05f3f5519dd87d3ba754cc423b652a5edd6d2c, GPG-verified, authored and released by crazy-max (long-standing Docker maintainer), published 2026-07-02 (26 days of soak time).
• Upstream added supply-chain hardening in this range: enableScripts: false (no postinstall scripts), yarn install --immutable, npmMinimalAgeGate: 2d. The one narrow exception — npmPreapprovedPackages: ["@docker/actions-toolkit"] bypassing the age gate — applies only to Docker's own first-party package. Acceptable.

One residual, non-applicable finding

LOW — js-yaml 5.2.0 still carries two open DoS advisories (GHSA-724g-mxrg-4qvm, fixed 5.2.1; GHSA-pm4m-ph32-ghv5, fixed 5.2.2), both quadratic/exponential YAML parsing. Not reachable in our usage: the action's only call is yaml.load(inputs.append) (src/main.ts:156), and both our workflows invoke setup-buildx-action with no with: inputs at all, so the parser never runs. Even if it did, the YAML would come from our own workflow file, not an attacker. v4.1.0's js-yaml 4.1.1 was equally affected by two analogous advisories — no regression.

Codebase impact

• e2e.yml — triggers on pull_request, no secrets in the job. No pull_request_target anywhere in the repo. Low risk.
• docker.yml — triggers on release: published / workflow_dispatch, and the same job holds secrets.DOCKERHUB_USERNAME / secrets.DOCKERHUB_TOKEN. A compromised action here would mean DockerHub push-credential theft and poisoned dashpay/tenderdash images. That elevates the importance of pinning — see below.

Pre-existing issues (not caused by this PR)

1. HIGH — docker/setup-qemu-action@master at .github/workflows/docker.yml:33 is a floating branch ref, in the same job as the DockerHub secrets. Whatever master points to at run time executes with those secrets in scope (currently 288220e; latest release is v4.2.0). Dependabot cannot track a branch ref, so this is the one action in the repo that silently never gets an update PR. Should be pinned to v4.2.0 or a commit SHA. CWE-1357.
2. MEDIUM — no permissions: block in either docker.yml or e2e.yml, so GITHUB_TOKEN gets the repo default. repos/dashpay/tenderdash/actions/permissions/workflow returns 403 for the tokens available here, so this needs an admin to verify. Add explicit least-privilege permissions: blocks regardless.
3. Blind spot worth stating: Dependabot/OSV track the action tag only. The ~600 npm packages vendored inside dist/index.cjs are invisible to ecosystem scanning — the seven fixes above only reached us because Docker happened to cut a release. Nothing to do here, but "no Dependabot alert" is not evidence of safety for bundled JS actions.

Unrelated CI failure blocking this PR

govulncheck is red, but not because of this PR: GO-2026-6061 in google.golang.org/grpc v1.82.0 (needs v1.82.1), reachable from abci/types/types.pb.go:4777, cmd/priv_val_server/main.go:136, internal/p2p/transport_mconn.go:505. It is present on base branch v1.6-dev (go.mod:40) and is already red on v1.6-dev itself — it will block every PR until fixed. #1392 is the unblocker (Bump google.golang.org/grpc from 1.82.0 to 1.82.1). All other checks pass.

Security-wise this PR is approved, but I am deliberately not using --admin to bypass a failing required vulnerability scan. Merge once #1392 has landed on v1.6-dev and this branch is updated.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}