Dependabot options reference: Docker cooldown only applies to Docker Hub images

Offen
  • Stimmt etwas nicht?
#46,208 1 Kommentar 1 Reaktion 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@HardMax71 arbeitet bereits daran.

Seit 06.10.2026.

  • #46209 von @HardMax71 — offen

Bewertung

Schwierigkeit
1/5
Geschätzter Aufwand
Unter einer Stunde
Anfängerfreundlichkeit
25/100
Issue-Typ
Dokumentation
Klarheit
Klar beschrieben
Aktivitätsstatus
Veraltet
Tech-Stack
docker, docker-compose
Bereich
documentation

Rechercherichtung

Open the Dependabot options reference at the linked cooldown section and review the package-manager table and its note. The issue cites the Dependabot Docker README and update checker as background for the Docker Hub limitation. Done means the note clearly says Docker and Docker Compose cooldowns apply only to Docker Hub images; other registries skip cooldown.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

dependabot driver persona
Code of Conduct
What article on docs.github.com is affected?

https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#configuration-of-cooldown

What part(s) of the article would you like to see updated?

The table of package managers that support cooldown marks Docker and Docker Compose as supporting default-days, with no caveat. In practice the cooldown only applies to images on Docker Hub. For an image on ghcr.io (or any other registry), Dependabot has no publication date, skips the cooldown and proposes the newest tag. The job log says No verified registry publication date source for ghcr.io; skipping cooldown for <image>:<tag>, and the pull request body says "Cooldown could not be applied because no publication date was available from the registry."

This is intended in dependabot-core. The "Cooldown publication dates" section of the docker README says Docker Hub's tag_last_pushed is the only accepted date source and that GHCR dates are unavailable (docker/README.md#L51-L65, added in dependabot/dependabot-core#16143), and registry_tag_release_date returns a date only for Docker Hub (update_checker.rb#L492-L499). Docker Compose uses the same update checker. Only this page doesn't say it, so a cooldown set for a ghcr.io image looks like it works.

Suggested change: a bullet in the note under the table saying that for Docker and Docker Compose the cooldown only covers Docker Hub images, and that images in other registries skip it. I'll open a PR with that.

Additional information

We noticed it with ghcr.io/astral-sh/uv pinned as a build stage and cooldown: default-days: 7: each uv release was proposed 2 to 4 days after the image was built.

Vorherrschende Sprache
TypeScript
Sterne
21.1k
Forks
69.3k
Ø Merge
8 Std. 3 Min.
Gemergte PRs (30 T.)
90

Entwicklungsumgebung

In Codespaces öffnen

Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus github/docs

Alle Issues in github/docs

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.