build(deps): Bump docker/metadata-action from 6.1.0 to 6.2.0

[dependabot]

Bumps docker/metadata-action from 6.1.0 to 6.2.0.

Release notes

Sourced from docker/metadata-action's releases.

v6.2.0

• Preserve names in esbuild bundle by @​crazy-max in docker/metadata-action#689
• Bump @​actions/core from 3.0.0 to 3.0.1 in docker/metadata-action#663
• Bump @​actions/github from 9.0.0 to 9.1.1 in docker/metadata-action#666
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/metadata-action#672 docker/metadata-action#696
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in docker/metadata-action#690
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/metadata-action#693
• Bump csv-parse from 6.2.1 to 7.0.0 in docker/metadata-action#683
• Bump js-yaml from 4.1.1 to 4.3.0 in docker/metadata-action#688
• Bump moment-timezone from 0.6.1 to 0.6.2 in docker/metadata-action#664
• Bump semver from 7.7.4 to 7.8.5 in docker/metadata-action#665 docker/metadata-action#695
• Bump sigstore from 4.1.0 to 4.1.1 in docker/metadata-action#694
• Bump tmp from 0.2.5 to 0.2.7 in docker/metadata-action#673
• Bump undici from 6.25.0 to 6.27.0 in docker/metadata-action#686
• Bump vite from 7.3.2 to 7.3.6 in docker/metadata-action#685

Full Changelog: docker/metadata-action@v6.1.0...v6.2.0

Commits

• dc80280 Merge pull request #696 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 2b9fe83 [dependabot skip] chore: update generated content
• 8128ce3 chore(deps): Bump @​docker/actions-toolkit from 0.91.0 to 0.92.0
• 1d1c895 Merge pull request #695 from docker/dependabot/npm_and_yarn/semver-7.8.5
• 7f0c2dd Merge pull request #694 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
• 025f8c5 [dependabot skip] chore: update generated content
• e98d63c chore(deps): Bump semver from 7.8.1 to 7.8.5
• 37d9379 chore(deps): Bump sigstore from 4.1.0 to 4.1.1
• a1b8072 Merge pull request #690 from docker/dependabot/npm_and_yarn/sigstore/core-3.2.1
• e0e3381 [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Single CI dependency pin bump with no application or deployment config changes beyond the action version.

Overview
Bumps docker/metadata-action from v6.1.0 to v6.2.0 in the Deploy Review App on PR workflow (.github/workflows/deploy-review.yml).

The Docker meta step is unchanged aside from the action version; it still sets GHCR image names and type=sha,format=long tags for the review image build/push.

^{Reviewed by Cursor Bugbot for commit ca9a63a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream diff, package manifests, and malware-scan findings for compromise indicators.Verdict: benign

Minor bump of official docker/metadata-action (6.1.0 → 6.2.0). No malware indicators found.

Evidence

• No action source changes under src/ or action.yml; delta is dependency bumps, esbuild --keep-names, regenerated dist/, Yarn/yarn.lock, and upstream CI pin updates.
• Scanner hard signals clean: unicode 0, confusable 0, IOC 0. Status warn is from 142 heuristics almost entirely in minified dist/index.cjs / map (e.g. charCodeAt, base64, child_process, Azure/GitHub SDK strings)—expected false positives in a bundled GitHub Action, not GlassWorm/obfuscated payloads.
• No install-time hooks: package.json scripts remain build/lint/format/test/license only (no preinstall/install/postinstall).
• Integrity looks normal: tags v6.1.0/v6.2.0 match scanned SHAs; authors are Dependabot, crazy-max, and Docker CI bots; URLs in the bundle point at GitHub/Docker/Sigstore/Azure—not unknown C2 hosts.
• Consumer impact: this repo only pins docker/metadata-action@v6.2.0 in .github/workflows/deploy-review.yml. Upstream .github/workflows/* changes do not run in consumers.

Scanner disagreement: I disagree with treating the heuristic warn as compromise—those hits are consistent with a rebuilt minified bundle after routine dependency updates, not supply-chain malware.

Compatibility Analysis

I'll inspect local usage of docker/metadata-action and compare it against the upstream 6.1.0→6.2.0 changes for compatibility.## Compatibility analysis: docker/metadata-action 6.1.0 → 6.2.0

Recommendation: merge

1) Local usage

Single consumer: .github/workflows/deploy-review.yml (Docker meta step → build/push).

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6.2.0
        with:
          images: |
            ghcr.io/${{ github.repository }}
          tags: |
            type=sha,format=long
      - name: Build Docker Container
        uses: docker/build-push-action@v7.2.0
        with:
          ...
          tags: ${{ steps.meta.outputs.tags }}

Inputs used: images, tags (type=sha,format=long). Output used: steps.meta.outputs.tags.

2) API intersection with upstream changes

None. Between v6.1.0 and v6.2.0:

• action.yml — unchanged
• src/ — unchanged
• Functional delta — dependency bumps + esbuild --keep-names + regenerated dist/ (plus upstream CI/tooling)

No input/output/contract changes touch this workflow’s usage.

3) Risks / unknowns

• Low residual risk from transitive bumps inside the bundled action (csv-parse major, toolkit/sigstore/etc.); not exposed as consumer APIs.
• Runtime verification only via the review-deploy workflow succeeding after merge (or on this PR’s CI if it runs that path).

4) Verdict

Safe minor bump; public action surface is identical. Merge.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 15
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 1
• Resolved upstream range: 80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9..dc802804100637a589fabce1cb79ff13a1411302
• Resolved refs: from=80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 to=dc802804100637a589fabce1cb79ff13a1411302
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 142

Top findings

• dist/index.cjs:2 codepoint_decoder :: ,l.message,l.stack);var b=new Error("tunneling socket could not be established, cause="+l.message);b.code="ECONNRESET",e.request.emit("error",b),n.removeSocket(o)}i(A,"onError")},"createSocket");zi.prototype.removeSocket=i(function(e){var r=this.sockets.indexOf(e);if(r!==-1){this.sockets.splice(r,1);var n=this.requests.shift();n&&this.createSocket(n,function(o){n.request.onSocket(o)})}},"removeSocket");function Q9(t,e){var r=this;zi.prototype.createSocket.call(r,t,function(n){var o=t.request.ge...[truncated]
• dist/index.cjs:3 codepoint_decoder :: )||t.includes("\r")||t.includes("\0"))===!1}i(DG,"isValidHeaderValue");function PRe(t,e){let{headersList:r}=e,n=(r.get("referrer-policy",!0)??"").split(","),o="";if(n.length>0)for(let s=n.length;s!==0;s--){let a=n[s-1].trim();if(BRe.has(a)){o=a;break}}o!==""&&(t.referrerPolicy=o)}i(PRe,"setRequestReferrerPolicyOnRedirect");function kRe(){return"allowed"}i(kRe,"crossOriginResourcePolicyCheck");function URe(){return"success"}i(URe,"corsCheck");function GRe(){return"success"}i(GRe,"TAOCheck");func...[truncated]
• dist/index.cjs:4 codepoint_decoder :: );function QNe(t){for(let e=0;e<t.length;++e)if((t.charCodeAt(e)&-128)!==0)return!1;return!0}i(QNe,"isAsciiString");function _Ne(t){let e=t.length;if(e<27||e>70)return!1;for(let r=0;r<e;++r){let n=t.charCodeAt(r);if(!(n>=48&&n<=57||n>=65&&n<=90||n>=97&&n<=122||n===39||n===45||n===95))return!1}return!0}i(_Ne,"validateBoundary");function PNe(t,e){xz(e!=="failure"&&e.essence==="multipart/form-data");let r=e.parameters.get("boundary");if(r===void 0)return"failure";let n=Buffer.from(--${r},"utf8")...[truncated]
• dist/index.cjs:45 codepoint_decoder :: .trim())}};iY.exports=IR});var hO=m(($q0,AY)=>{"use strict";var cY=Symbol.for("undici.globalDispatcher.1"),{InvalidArgumentError:yWe}=i0(),BWe=WA();pY()===void 0&&uY(new BWe);function uY(t){if(!t||typeof t.dispatch!="function")throw new yWe("Argument agent must implement Agent");Object.defineProperty(globalThis,cY,{value:t,writable:!0,enumerable:!1,configurable:!1})}i(uY,"setGlobalDispatcher");function pY(){return globalThis[cY]}i(pY,"getGlobalDispatcher");AY.exports={setGlobalDispatcher:uY,get...[truncated]
• dist/index.cjs:46 codepoint_decoder :: ${s};break;case"retry":e$(s)&&(r[o]=s);break;case"id":t$(s)&&(r[o]=s);break;case"event":s.length>0&&(r[o]=s);break}}processEvent(e){e.retry&&e$(e.retry)&&(this.state.reconnectionTime=parseInt(e.retry,10)),e.id&&t$(e.id)&&(this.state.lastEventId=e.id),e.data!==void 0&&this.push({type:e.event||"message",options:{data:e.data,lastEventId:this.state.lastEventId,origin:this.state.origin}})}clearEvent(){this.event={data:void 0,event:void 0,id:void 0,retry:void 0}}};r$.exports={EventSourceStream:hN}});...[truncated]
• dist/index.cjs:49 codepoint_decoder :: >>> no match, partial?,t,A,e,l),A===a))}var f;if(typeof u=="string"?(f=p===u,this.debug("string match",u,p,f)):(f=p.match(u),this.debug("pattern match",u,p,f)),!f)return!1}if(o===a&&s===c)return!0;if(o===a)return r;if(s===c)return o===a-1&&t[o]==="";throw new Error("wtf?")};function wke(t){return t.replace(/\\(.)/g,"$1")}i(wke,"globUnescape");function Ske(t){return t.replace(/[-[\]{}()*+?.,\\^$|#\s]/g,"\\$&")}i(Ske,"regExpEscape")});var ml=m((Uw0,qee)=>{"use strict";var _ke="2.0.0",Pke=Number.M...[truncated]
• dist/index.cjs:66 codepoint_decoder :: Polling status: ${use.includes(A)?"Stopped":"Running"}),A==="succeeded"){let l=a(p,r);if(l!==void 0)return{response:await e(l).catch(ase({state:r,stateProxy:n,isOperationError:c})),status:A}}return{response:p,status:A}}i(L$e,"pollOperationHelper");async function dse(t){let{poll:e,state:r,stateProxy:n,options:o,getOperationStatus:s,getResourceLocation:a,getOperationLocation:c,isOperationError:u,withOperationLocation:p,getPollingInterval:A,processResult:l,getError:b,updateState:f,setDelay:z,isDo...[truncated]
• dist/index.cjs:76 codepoint_decoder :: +this.showPosition(),{text:"",token:null,line:this.yylineno})},"next"),lex:i(function(){var s=this.next();return typeof s<"u"?s:this.lex()},"lex"),begin:i(function(s){this.conditionStack.push(s)},"begin"),popState:i(function(){return this.conditionStack.pop()},"popState"),_currentRules:i(function(){return this.conditions[this.conditionStack[this.conditionStack.length-1]].rules},"_currentRules"),topState:i(function(){return this.conditionStack[this.conditionStack.length-2]},"topState"),pushState...[truncated]
• dist/index.cjs:90 codepoint_decoder :: ,e};A1.prototype.Program=function(t){var e="",r=t.body,n=void 0,o=void 0;if(t.blockParams){var s="BLOCK PARAMS: [";for(n=0,o=t.blockParams.length;n<o;n++)s+=" "+t.blockParams[n];s+=" ]",e+=this.pad(s)}for(n=0,o=r.length;n<o;n++)e+=this.accept(r[n]);return this.padding--,e};A1.prototype.MustacheStatement=function(t){return this.pad("{{ "+this.SubExpression(t)+" }}")};A1.prototype.Decorator=function(t){return this.pad("{{ DIRECTIVE "+this.SubExpression(t)+" }}")};A1.prototype.BlockStatement=A1.pr...[truncated]
• dist/index.cjs:103 codepoint_decoder :: +new Error().stack),h=!1}return M.apply(this,arguments)},M)}i(ue,"deprecate");var qe={};function Qe(d,M){e.deprecationHandler!=null&&e.deprecationHandler(d,M),qe[d]||(Q(M),qe[d]=!0)}i(Qe,"deprecateSimple"),e.suppressDeprecationWarnings=!1,e.deprecationHandler=null;function Re(d){return typeof Function<"u"&&d instanceof Function||Object.prototype.toString.call(d)==="[object Function]"}i(Re,"isFunction");function ge(d){var M,h;for(h in d)s(d,h)&&(M=d[h],Re(M)?this[h]=M:this["_"+h]=M);this._config...[truncated]
• dist/index.cjs:107 codepoint_decoder :: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.)}var s=!0,a=!1,c;return{s:i(function(){r=(0,uy0.default)(t)},"s"),n:i(function(){var p=r.next();return s=p.done,p},"n"),e:i(function(p){a=!0,c=p},"e"),f:i(function(){try{!s&&r.return!=null&&r.return()}finally{if(a)throw c}},"f")}}i(my0,"_createForOfIteratorHelper");function hy0(t,e){var r;if(t){if(typeof t=="string")return Dye(t,e);var n=(0,by0.default)(r=Object.prototype.toString.call(t)).call(r,8,-1);if(n==="Ob...[truncated]
• dist/index.cjs:121 codepoint_decoder :: ||t==="\r"}i(vre,"isWhiteSpace");function Lre(t,e){let r=e;for(;e<t.length;e++)if(t[e]=="?"||t[e]==" "){let n=t.substr(r,e-r);if(e>5&&n==="xml")return O1("InvalidXml","XML declaration allowed only at the start of the document.",Pt(t,e));if(t[e]=="?"&&t[e+1]==">"){e++;break}else continue}return e}i(Lre,"readPI");function Qre(t,e){if(t.length>e+5&&t[e+1]==="-"&&t[e+2]==="-"){for(e+=3;e<t.length;e++)if(t[e]==="-"&&t[e+1]==="-"&&t[e+2]===">"){e+=2;break}}else if(t.length>e+8&&t[e+1]==="D"&&t[e+2]==...[truncated]
• dist/index.cjs:122 codepoint_decoder :: );let e=new ur("!xml"),r=e,n="";this.matcher.reset(),this.entityDecoder.reset(),this.entityExpansionCount=0,this.currentExpandedLength=0;let o=this.options,s=new YM(o.processEntities),a=t.length;for(let c=0;c<a;c++)if(t[c]==="<"){let p=t.charCodeAt(c+1);if(p===47){let A=Tl(t,">",c,"Closing Tag is not closed."),l=t.substring(c+2,A).trim();if(o.removeNSPrefix){let f=l.indexOf(":");f!==-1&&(l=l.substr(f+1))}l=mS(o.transformTagName,l,"",o).tagName,r&&(n=this.saveTextToParentTag(n,r,this.readonlyMat...[truncated]
• dist/index.cjs:125 codepoint_decoder :: ):(this.indentate=function(){return""},this.tagEndChar=">",this.newLine="")}i(Ar,"Builder");function qYe(t,e){let r=t["?xml"];if(r&&typeof r=="object"){if(e.attributesGroupName&&r[e.attributesGroupName]){let o=r[e.attributesGroupName][e.attributeNamePrefix+"version"];if(o)return o}let n=r[e.attributeNamePrefix+"version"];if(n)return n}return"1.0"}i(qYe,"detectXmlVersionFromObj");function qS(t,e,r,n,o){return!r.sanitizeName||ku(t,{xmlVersion:o})?t:r.sanitizeName(t,{isAttribute:e,matcher:n.readOn...[truncated]
• dist/index.cjs:145 codepoint_decoder :: ));let n=yield Qv(r,"create");yield _v(n,t)})}i(kv,"createTar");var M2=function(t,e,r,n){function o(s){return s instanceof r?s:new r(function(a){a(s)})}return i(o,"adopt"),new(r||(r=Promise))(function(s,a){function c(A){try{p(n.next(A))}catch(l){a(l)}}i(c,"fulfilled");function u(A){try{p(n.throw(A))}catch(l){a(l)}}i(u,"rejected");function p(A){A.done?s(A.value):o(A.value).then(c,u)}i(p,"step"),p((n=n.apply(t,e||[])).next())})},qo=class t extends Error{static{i(this,"ValidationError")}constructo...[truncated]
• dist/index.cjs:147 codepoint_decoder :: )}i(F00,"_buildMessageForResponseErrors");var W00=class extends Error{static{i(this,"GraphqlResponseError")}constructor(t,e,r){super(F00(r)),this.request=t,this.headers=e,this.response=r,this.errors=r.errors,this.data=r.data,Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor)}name="GraphqlResponseError";errors;data},x00=["method","baseUrl","url","headers","request","query","mediaType","operationName"],T00=["query","method","url"],Lae=/\/api\/v3\/?$/;function v00(t,e,r){if(r)...[truncated]
• dist/index.cjs:150 codepoint_decoder :: `,s),Buffer.from("\r",s)];e:for(let c=0;c<a.length;c++){let u=a[c].length;for(let p=0;p<u;p++)if(a[c][p]!==n[o+p])continue e;return this.options.record_delimiter.push(a[c]),this.state.recordDelimiterMaxLength=a[c].length,a[c].length}return 0},"__autoDiscoverRecordDelimiter"),__error:i(function(n){let{encoding:o,raw:s,skip_records_with_error:a}=this.options,c=typeof n=="string"?new Error(n):n;if(a){