Bump docker/setup-qemu-action from 4.1.0 to 4.2.0

[dependabot]

Bumps docker/setup-qemu-action from 4.1.0 to 4.2.0.

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.2.0

• Preserve names in esbuild bundle by @​crazy-max in docker/setup-qemu-action#311
• Bump @​actions/core from 3.0.0 to 3.0.1 in docker/setup-qemu-action#295
• Bump @​docker/actions-toolkit from 0.91.0 to 0.92.0 in docker/setup-qemu-action#315
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in docker/setup-qemu-action#312
• Bump js-yaml from 4.1.1 to 4.2.0 in docker/setup-qemu-action#310
• Bump tmp from 0.2.6 to 0.2.7 in docker/setup-qemu-action#304
• Bump undici from 6.26.0 to 6.27.0 in docker/setup-qemu-action#308
• Bump vite from 7.3.2 to 7.3.6 in docker/setup-qemu-action#307

Full Changelog: docker/setup-qemu-action@v4.1.0...v4.2.0

Commits

• 96fe6ef Merge pull request #315 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 31f08d3 [dependabot skip] chore: update generated content
• 4e7017a build(deps): bump @​docker/actions-toolkit from 0.91.0 to 0.92.0
• 0eca235 Merge pull request #314 from crazy-max/fix-yarn-preapprove-actions-toolkit
• ea66a41 chore: allow actions-toolkit to bypass yarn age gate
• 451542b Merge pull request #308 from docker/dependabot/npm_and_yarn/undici-6.27.0
• 532ae00 [dependabot skip] chore: update generated content
• b6f5af6 build(deps): bump undici from 6.26.0 to 6.27.0
• cf96b86 Merge pull request #304 from docker/dependabot/npm_and_yarn/tmp-0.2.7
• f0ba643 [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Single CI action version pin with no application or deployment logic changes.

Overview
Updates the Deploy Review App workflow’s package job to use docker/setup-qemu-action@v4.2.0 instead of v4.1.0 for the QEMU setup step before multi-platform (linux/amd64, linux/arm64) image builds.

No workflow logic or inputs change—only the action pin for routine dependency maintenance (upstream dependency bumps in the action itself).

^{Reviewed by Cursor Bugbot for commit 74e9370. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream diff and malware scan evidence for this docker/setup-qemu-action 4.1.0 → 4.2.0 bump.Verdict: benign

Minor bump of the official Docker GitHub Action; no malware indicators. Scanner warn is from noisy heuristics on the regenerated minified bundle, not real compromise (unicode/IOC/confusable = 0).

Evidence

• src/ and action.yml are unchanged; only deps, build flags (--keep-names), yarn hardening, CI pin bumps, and regenerated dist/ / lockfile.
• No install lifecycle scripts; no invisible Unicode / Trojan Source.
• Heuristics (codepoint_decoder, dynamic_require_import, obfuscation_indicator, credential_exfil, network_c2) hit normal bundled undici/Azure/HTTP code (e.g. charCodeAt, base64, storage.azure.com) — false positives.
• Upstream workflow edits are pin bumps in the action’s own CI, not payload injection into this repo.
• Authors are expected maintainers/bots (crazy-max, Dependabot, GitHub Actions, Docker sec bot); tags v4.1.0/v4.2.0 match the scanned range.

Safe to merge from a supply-chain malware perspective.

Compatibility Analysis

I'll analyze local usage of docker/setup-qemu-action and compare it against the upstream 4.1.0→4.2.0 changes.## Compatibility analysis: docker/setup-qemu-action 4.1.0 → 4.2.0

1) Local usage

Single call site: .github/workflows/deploy-review.yml (package job).

• Invoked with no with: inputs (all defaults).
• Does not read the platforms output.
• Purpose: enable QEMU before Buildx for linux/amd64,linux/arm64 image push.

2) API / behavior intersection

None. Upstream action.yml and src/ are unchanged between v4.1.0 and v4.2.0.

v4.2.0 is packaging/deps only:

• esbuild keep-names (Bump @docusaurus/plugin-google-gtag from 3.4.0 to 3.5.2 #311)
• transitive bumps (@actions/core, @docker/actions-toolkit, js-yaml, tmp, undici, etc.)
• regenerated dist/
• upstream CI/dev tooling (no consumer-facing contract change)

3) Risks / unknowns

• Low: residual risk only from rebuilt bundle / transitive deps (no intentional behavior change).
• No workflow config updates needed; defaults still apply.
• Unknown only if GH Actions runners fail the action for unrelated env reasons—not suggested by this diff.

4) Recommendation

merge — minor, no public API/input/output changes; usage is defaults-only and unaffected.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 15
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 1
• Resolved upstream range: 06116385d9baf250c9f4dcb4858b16962ea869c3..96fe6ef7f33517b61c61be40b68a1882f3264fb8
• Resolved refs: from=06116385d9baf250c9f4dcb4858b16962ea869c3 to=96fe6ef7f33517b61c61be40b68a1882f3264fb8
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 99

Top findings

• dist/index.cjs:2 codepoint_decoder :: ,d.message,d.stack);var m=new Error("tunneling socket could not be established, cause="+d.message);m.code="ECONNRESET",e.request.emit("error",m),n.removeSocket(s)}o(u,"onError")},"createSocket");ni.prototype.removeSocket=o(function(e){var r=this.sockets.indexOf(e);if(r!==-1){this.sockets.splice(r,1);var n=this.requests.shift();n&&this.createSocket(n,function(s){n.request.onSocket(s)})}},"removeSocket");function zD(t,e){var r=this;ni.prototype.createSocket.call(r,t,function(n){var s=t.request.ge...[truncated]
• dist/index.cjs:3 codepoint_decoder :: )||t.includes("\r")||t.includes("\0"))===!1}o(vT,"isValidHeaderValue");function W6(t,e){let{headersList:r}=e,n=(r.get("referrer-policy",!0)??"").split(","),s="";if(n.length>0)for(let i=n.length;i!==0;i--){let a=n[i-1].trim();if(D6.has(a)){s=a;break}}s!==""&&(t.referrerPolicy=s)}o(W6,"setRequestReferrerPolicyOnRedirect");function $6(){return"allowed"}o($6,"crossOriginResourcePolicyCheck");function j6(){return"success"}o(j6,"corsCheck");function K6(){return"success"}o(K6,"TAOCheck");function X6(t...[truncated]
• dist/index.cjs:4 codepoint_decoder :: );function Vj(t){for(let e=0;e<t.length;++e)if((t.charCodeAt(e)&-128)!==0)return!1;return!0}o(Vj,"isAsciiString");function Jj(t){let e=t.length;if(e<27||e>70)return!1;for(let r=0;r<e;++r){let n=t.charCodeAt(r);if(!(n>=48&&n<=57||n>=65&&n<=90||n>=97&&n<=122||n===39||n===45||n===95))return!1}return!0}o(Jj,"validateBoundary");function Wj(t,e){mp(e!=="failure"&&e.essence==="multipart/form-data");let r=e.parameters.get("boundary");if(r===void 0)return"failure";let n=Buffer.from(--${r},"utf8"),s=[]...[truncated]
• dist/index.cjs:45 codepoint_decoder :: .trim())}};A2.exports=BQ});var jp=g((dSe,h2)=>{"use strict";var d2=Symbol.for("undici.globalDispatcher.1"),{InvalidArgumentError:vee}=Ce(),Dee=Rc();p2()===void 0&&m2(new Dee);function m2(t){if(!t||typeof t.dispatch!="function")throw new vee("Argument agent must implement Agent");Object.defineProperty(globalThis,d2,{value:t,writable:!0,enumerable:!1,configurable:!1})}o(m2,"setGlobalDispatcher");function p2(){return globalThis[d2]}o(p2,"getGlobalDispatcher");h2.exports={setGlobalDispatcher:m2,get...[truncated]
• dist/index.cjs:46 codepoint_decoder :: ${i};break;case"retry":sU(i)&&(r[s]=i);break;case"id":iU(i)&&(r[s]=i);break;case"event":i.length>0&&(r[s]=i);break}}processEvent(e){e.retry&&sU(e.retry)&&(this.state.reconnectionTime=parseInt(e.retry,10)),e.id&&iU(e.id)&&(this.state.lastEventId=e.id),e.data!==void 0&&this.push({type:e.event||"message",options:{data:e.data,lastEventId:this.state.lastEventId,origin:this.state.origin}})}clearEvent(){this.event={data:void 0,event:void 0,id:void 0,retry:void 0}}};oU.exports={EventSourceStream:dx}});...[truncated]
• dist/index.cjs:49 codepoint_decoder :: >>> no match, partial?,t,u,e,d),u===a))}var p;if(typeof l=="string"?(p=A===l,this.debug("string match",l,A,p)):(p=A.match(l),this.debug("pattern match",l,A,p)),!p)return!1}if(s===a&&i===c)return!0;if(s===a)return r;if(i===c)return s===a-1&&t[s]==="";throw new Error("wtf?")};function kle(t){return t.replace(/\\(.)/g,"$1")}o(kle,"globUnescape");function Tle(t){return t.replace(/[-[\]{}()*+?.,\\^$|#\s]/g,"\\$&")}o(Tle,"regExpEscape")});var Ju=g((uTe,BH)=>{"use strict";var Hle="2.0.0",zle=Number.MA...[truncated]
• dist/index.cjs:66 codepoint_decoder :: Polling status: ${s4.includes(u)?"Stopped":"Running"}),u==="succeeded"){let d=a(A,r);if(d!==void 0)return{response:await e(d).catch(r4({state:r,stateProxy:n,isOperationError:c})),status:u}}return{response:A,status:u}}o(PCe,"pollOperationHelper");async function c4(t){let{poll:e,state:r,stateProxy:n,options:s,getOperationStatus:i,getResourceLocation:a,getOperationLocation:c,isOperationError:l,withOperationLocation:A,getPollingInterval:u,processResult:d,getError:m,updateState:p,setDelay:h,isDone:...[truncated]
• dist/index.cjs:76 codepoint_decoder :: +this.showPosition(),{text:"",token:null,line:this.yylineno})},"next"),lex:o(function(){var i=this.next();return typeof i<"u"?i:this.lex()},"lex"),begin:o(function(i){this.conditionStack.push(i)},"begin"),popState:o(function(){return this.conditionStack.pop()},"popState"),_currentRules:o(function(){return this.conditions[this.conditionStack[this.conditionStack.length-1]].rules},"_currentRules"),topState:o(function(){return this.conditionStack[this.conditionStack.length-2]},"topState"),pushState...[truncated]
• dist/index.cjs:104 codepoint_decoder :: ||t==="\r"}o(DV,"isWhiteSpace");function kV(t,e){let r=e;for(;e<t.length;e++)if(t[e]=="?"||t[e]==" "){let n=t.substr(r,e-r);if(e>5&&n==="xml")return ct("InvalidXml","XML declaration allowed only at the start of the document.",nr(t,e));if(t[e]=="?"&&t[e+1]==">"){e++;break}else continue}return e}o(kV,"readPI");function TV(t,e){if(t.length>e+5&&t[e+1]==="-"&&t[e+2]==="-"){for(e+=3;e<t.length;e++)if(t[e]==="-"&&t[e+1]==="-"&&t[e+2]===">"){e+=2;break}}else if(t.length>e+8&&t[e+1]==="D"&&t[e+2]==="O"...[truncated]
• dist/index.cjs:105 codepoint_decoder :: );let e=new Cr("!xml"),r=e,n="";this.matcher.reset(),this.entityDecoder.reset(),this.entityExpansionCount=0,this.currentExpandedLength=0;let s=this.options,i=new Nd(s.processEntities),a=t.length;for(let c=0;c<a;c++)if(t[c]==="<"){let A=t.charCodeAt(c+1);if(A===47){let u=Pl(t,">",c,"Closing Tag is not closed."),d=t.substring(c+2,u).trim();if(s.removeNSPrefix){let p=d.indexOf(":");p!==-1&&(d=d.substr(p+1))}d=sN(s.transformTagName,d,"",s).tagName,r&&(n=this.saveTextToParentTag(n,r,this.readonlyMat...[truncated]
• dist/index.cjs:108 codepoint_decoder :: ):(this.indentate=function(){return""},this.tagEndChar=">",this.newLine="")}o(Br,"Builder");function yge(t,e){let r=t["?xml"];if(r&&typeof r=="object"){if(e.attributesGroupName&&r[e.attributesGroupName]){let s=r[e.attributesGroupName][e.attributeNamePrefix+"version"];if(s)return s}let n=r[e.attributeNamePrefix+"version"];if(n)return n}return"1.0"}o(yge,"detectXmlVersionFromObj");function mN(t,e,r,n,s){return!r.sanitizeName||Sa(t,{xmlVersion:s})?t:r.sanitizeName(t,{isAttribute:e,matcher:n.readOn...[truncated]
• dist/index.cjs:128 codepoint_decoder :: ));let n=yield wv(r,"create");yield Nv(n,t)})}o(Rv,"createTar");var lA=function(t,e,r,n){function s(i){return i instanceof r?i:new r(function(a){a(i)})}return o(s,"adopt"),new(r||(r=Promise))(function(i,a){function c(u){try{A(n.next(u))}catch(d){a(d)}}o(c,"fulfilled");function l(u){try{A(n.throw(u))}catch(d){a(d)}}o(l,"rejected");function A(u){u.done?i(u.value):s(u.value).then(c,l)}o(A,"step"),A((n=n.apply(t,e||[])).next())})},Xn=class t extends Error{static{o(this,"ValidationError")}constructo...[truncated]
• dist/index.cjs:131 codepoint_decoder :: ,i),Buffer.from("\r",i)];e:for(let c=0;c<a.length;c++){let l=a[c].length;for(let A=0;A<l;A++)if(a[c][A]!==n[s+A])continue e;return this.options.record_delimiter.push(a[c]),this.state.recordDelimiterMaxLength=a[c].length,a[c].length}return 0},"__autoDiscoverRecordDelimiter"),__error:o(function(n){let{encoding:s,raw:i,skip_records_with_error:a}=this.options,c=typeof n=="string"?new Error(n):n;if(a){if(this.state.recordHasError=!0,this.options.on_skip!==void 0)try{this.options.on_skip(c,i?this.sta...[truncated]
• dist/index.cjs.map:4 codepoint_decoder :: "sourcesContent": ["'use strict';\n\nvar net = require('net');\nvar tls = require('tls');\nvar http = require('http');\nvar https = require('https');\nvar events = require('events');\nvar assert = require('assert');\nvar util = require('util');\n\n\nexports.httpOverHttp = httpOverHttp;\nexports.httpsOverHttp = httpsOverHttp;\nexports.httpOverHttps = httpOverHttps;\nexports.httpsOverHttps = httpsOverHttps;\n\n\nfunction httpOverHttp(options) {\n var agent = new TunnelingAgent(options);\n agen...[truncated]
• dist/index.cjs:2 dynamic_require_import :: ,d.message,d.stack);var m=new Error("tunneling socket could not be established, cause="+d.message);m.code="ECONNRESET",e.request.emit("error",m),n.removeSocket(s)}o(u,"onError")},"createSocket");ni.prototype.removeSocket=o(function(e){var r=this.sockets.indexOf(e);if(r!==-1){this.sockets.splice(r,1);var n=this.requests.shift();n&&this.createSocket(n,function(s){n.request.onSocket(s)})}},"removeSocket");function zD(t,e){var r=this;ni.prototype.createSocket.call(r,t,function(n){var s=t.request.ge...[truncated]
• dist/index.cjs:41 dynamic_require_import :: ,this[vX]=l??3e5,this[PX]=s??3e5,this[DX]=E??!0,this[kX]=B,this[dB]=S,this[ji]=null,this[FX]=me>-1?me:-1,this[OX]=xe??100,this[it]=null,this[Mn]=[],this[di]=0,this[Ln]=0,this[YA]=ee=>pB(this,ee),this[UX]=ee=>zM(this,ee)}get pipelining(){return this[vp]}set pipelining(e){this[vp]=e,this[YA](!0)}get[WA](){return this[Mn].length-this[Ln]}get[JA](){return this[Ln]-this[di]}get[VA](){return this[Mn].length-this[di]}get[QX](){return!!this[it]&&!this[wc]&&!this[it].destroyed}get[uB](){return!!(this[it...[truncated]
• dist/index.cjs:95 dynamic_require_import :: `),{implicitDescendants:!1});try{for(var A=!0,u=_de(l.globGenerator()),d;d=yield u.next(),e=d.done,!e;A=!0){s=d.value,A=!1;let p=ya.relative(c,s).replace(new RegExp(\${ya.sep},"g"),"/");w(Matched: ${p}),p===""?a.push("."):a.push(${p})}}catch(m){r={error:m}}finally{try{!A&&!e&&(n=u.return)&&(yield n.call(u))}finally{if(r)throw r.error}}return a})}o(_b,"resolvePaths");function nd(t){re