chore(deps): update docker/metadata-action action to v6.2.0 - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/metadata-action	action	minor	v6.0.0 → v6.2.0

---

Release Notes

docker/metadata-action (docker/metadata-action)

v6.2.0

Compare Source

v6.1.0

Compare Source

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in #​613
• Bump brace-expansion from 1.1.12 to 5.0.6 in #​658 #​630
• Bump csv-parse from 6.1.0 to 6.2.1 in #​617
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in #​620
• Bump flatted from 3.3.3 to 3.4.2 in #​623
• Bump glob from 10.3.15 to 10.5.0 in #​621
• Bump handlebars from 4.7.8 to 4.7.9 in #​629
• Bump lodash from 4.17.23 to 4.18.1 in #​639
• Bump moment-timezone from 0.6.0 to 0.6.1 in #​619
• Bump picomatch from 4.0.3 to 4.0.4 in #​626
• Bump postcss from 8.5.6 to 8.5.10 in #​649
• Bump tar from 6.2.1 to 7.5.15 in #​657
• Bump undici from 6.23.0 to 6.25.0 in #​614
• Bump vite from 7.3.1 to 7.3.2 in #​637

Full Changelog: docker/metadata-action@v6.0.0...v6.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Version Update Path: v6.0.0 → v6.1.0 → v6.2.0

v6.1.0 Changes (May 22, 2024):

• Pure dependency maintenance release with 13 package updates
• Notable updates: @docker/actions-toolkit (0.79.0→0.90.0), handlebars (4.7.8→4.7.9), lodash (4.17.23→4.18.1), tar (6.2.1→7.5.15)
• No functional changes, breaking changes, or new features
• Security patches included in dependency updates (handlebars, postcss, tar)

v6.2.0 Changes (July 2, 2024):

• Build improvement: Preserved names in esbuild bundle
• Additional dependency updates across 15+ packages
• Core Actions libraries: @actions/core (3.0.0→3.0.1), @actions/github (9.0.0→9.1.1)
• Security-focused updates: @sigstore packages, undici (6.25.0→6.27.0)
• No API changes, deprecations, or breaking changes

Breaking Changes: None across both minor versions

Security Fixes: Multiple security patches delivered through dependency updates (handlebars, postcss, tar, undici, vite)

API Stability: All inputs (images, tags) and outputs (tags, labels, annotations) remain fully compatible

🎯 Impact Scope Investigation

Usage Location: Single occurrence in .github/workflows/release-please.yml:64

Current Usage:

- uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
  id: meta
  with:
    images: ghcr.io/codize-dev/sandbox
    tags: |
      type=semver,pattern={{version}},value=${{ needs.release-please.outputs.tag }}
      type=semver,pattern={{major}}.{{minor}},value=${{ needs.release-please.outputs.tag }}
      type=semver,pattern={{major}},value=${{ needs.release-please.outputs.tag }}
      type=sha,format=long,prefix=
      type=raw,value=latest,enable={{is_default_branch}}

Compatibility Analysis:

• images input: No changes required
• tags input with semver/sha/raw types: Fully supported, syntax unchanged
• Output consumption (steps.meta.outputs.tags, steps.meta.outputs.labels): No changes

Dependency Impact: No other GitHub Actions or workflow configurations affected

Configuration Impact: No changes to Docker build process, tag generation logic, or label creation

💡 Recommended Actions

Immediate Action: ✅ Safe to merge immediately

No Migration Required:

• Zero code changes needed
• Existing workflow configuration remains fully compatible
• All tag types (semver, sha, raw) function identically

Post-Merge Validation:

• Verify release workflow succeeds on next release trigger
• Confirm Docker image tags are generated correctly at ghcr.io/codize-dev/sandbox
• Review steps.meta.outputs.tags matches expected pattern

Benefits of Update:

• Security patches via transitive dependency updates
• Improved build tooling (esbuild name preservation)
• Maintained compatibility with Actions Runner requirements

🔗 Reference Links

• v6.1.0 Release Notes
• v6.2.0 Release Notes
• Full Comparison v6.0.0...v6.2.0 (162 commits)
• Security Advisories (No advisories published)
• Action Documentation

Generated by koki-develop/claude-renovate-review