From 7432223138f8d26c68daa53a1a64203b10627831 Mon Sep 17 00:00:00 2001
From: Sylvester Damgaard <sn@cbox.dk>
Date: Tue, 13 Oct 2026 21:03:32 +0200
Subject: [PATCH] chore(deps): bump checkout, cache, setup-buildx, login and
 build-push actions

Supersedes dependabot #1-#5, which were 29 commits behind main.

Claude-Session: https://claude.ai/code/session_01LtsaMBeethcCYvKx8PTBYL
---
 .github/workflows/docker.yml | 8 ++++----
 .github/workflows/fuzz.yml   | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 45bfbf1..ca6299e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -69,7 +69,7 @@ jobs:
       # The tag's own Dockerfile and scripts, not whatever main holds by the time this
       # runs: a `workflow_run` checks out the default branch unless told otherwise, so
       # an image could be built for one release by the next one's recipe.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: refs/tags/${{ steps.tag.outputs.tag }}
 
@@ -81,8 +81,8 @@ jobs:
         run: python3 scripts/docker-context.py release "$TAG"
 
       - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -90,7 +90,7 @@ jobs:
 
       - name: build and push
         id: push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ./docker
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index fc0021d..955c1ae 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -40,7 +40,7 @@ jobs:
       #
       # A unique key per run so each one saves, with a prefix restore so it picks up the
       # newest. GitHub evicts by age and size on its own; these corpora are a few MB.
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: fuzz/corpus/${{ matrix.target }}
           key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}