From b9690d7edb4848f0e70554bdf10e10be945bb2f6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 09:10:38 +0000
Subject: [PATCH] chore: bump outdated tool versions and pinned Actions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Bump traefik feature default image from v3.3 to v3.7 — v3.3 is
  several minor releases behind and misses security fixes backported
  to the 3.6/3.7 lines (CVE-2026-54763, CVE-2026-54764, CVE-2026-54765,
  fixed in v3.6.22/v3.7.6). Bumped feature version 1.3.1 -> 1.3.2 per
  this repo's per-feature semver convention.
- Bump actions/checkout v4 -> v7 across all workflows. v4 runs on the
  deprecated Node 20 runtime and predates the fix for the "pwn request"
  fork-checkout issue; v7 requires no runtime changes for our simple
  checkout usage.
- Bump docker/login-action v3 -> v4, docker/metadata-action v5 -> v6,
  docker/setup-buildx-action v3 -> v4, docker/build-push-action v6 -> v7
  in publish.yml to pick up Node 24 runtime support and current
  dependency/security patches.
---
 .github/workflows/claude-code-review.yml |  2 +-
 .github/workflows/claude.yml             |  2 +-
 .github/workflows/publish-features.yml   |  2 +-
 .github/workflows/publish.yml            | 10 +++++-----
 src/traefik/devcontainer-feature.json    |  2 +-
 src/traefik/install.sh                   |  2 +-
 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index b5e8cfd..e8340e0 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index d300267..2b8ccc2 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/publish-features.yml b/.github/workflows/publish-features.yml
index 38e401e..5c6eaa5 100644
--- a/.github/workflows/publish-features.yml
+++ b/.github/workflows/publish-features.yml
@@ -13,7 +13,7 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Login to GHCR
         env:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e9ae2a2..cd77349 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -13,17 +13,17 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/metadata-action@v5
+      - uses: docker/metadata-action@v6
         id: meta
         with:
           images: ghcr.io/${{ github.repository }}
@@ -33,9 +33,9 @@ jobs:
             type=semver,pattern={{major}}
             type=raw,value=latest
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@v7
         with:
           context: .
           push: true
diff --git a/src/traefik/devcontainer-feature.json b/src/traefik/devcontainer-feature.json
index 2eb98ba..67fde9f 100644
--- a/src/traefik/devcontainer-feature.json
+++ b/src/traefik/devcontainer-feature.json
@@ -1,6 +1,6 @@
 {
   "id": "traefik",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "name": "Traefik Reverse Proxy",
   "description": "Traefik reverse proxy with subdomain routing to local services",
   "documentationURL": "https://doc.traefik.io/traefik/",
diff --git a/src/traefik/install.sh b/src/traefik/install.sh
index 717846f..5423603 100644
--- a/src/traefik/install.sh
+++ b/src/traefik/install.sh
@@ -49,7 +49,7 @@ chmod 666 "$CONFIG_DIR/traefik.yml"
 cat > "$CONFIG_DIR/docker-compose.yml" <<YAML
 services:
   traefik:
-    image: traefik:v3.3
+    image: traefik:v3.7
     container_name: devcontainer-traefik
     restart: unless-stopped
     ports: