Dependabot options reference: Docker cooldown only applies to Docker Hub images

Abierto
  • ¿Algo no está bien?
#46,208 1 comentario 1 reacción 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@HardMax71 ya está trabajando en esto.

Desde el 6/10/2026.

  • #46209 de @HardMax71 — abierto

Evaluación

Dificultad
1/5
Tiempo estimado
Menos de una hora
Aptitud para principiantes
25/100
Tipo de issue
Documentación
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
docker, docker-compose
Área
documentation

Línea de trabajo

Open the Dependabot options reference at the linked cooldown section and review the package-manager table and its note. The issue cites the Dependabot Docker README and update checker as background for the Docker Hub limitation. Done means the note clearly says Docker and Docker Compose cooldowns apply only to Docker Hub images; other registries skip cooldown.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

dependabot driver persona
Code of Conduct
What article on docs.github.com is affected?

https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#configuration-of-cooldown

What part(s) of the article would you like to see updated?

The table of package managers that support cooldown marks Docker and Docker Compose as supporting default-days, with no caveat. In practice the cooldown only applies to images on Docker Hub. For an image on ghcr.io (or any other registry), Dependabot has no publication date, skips the cooldown and proposes the newest tag. The job log says No verified registry publication date source for ghcr.io; skipping cooldown for <image>:<tag>, and the pull request body says "Cooldown could not be applied because no publication date was available from the registry."

This is intended in dependabot-core. The "Cooldown publication dates" section of the docker README says Docker Hub's tag_last_pushed is the only accepted date source and that GHCR dates are unavailable (docker/README.md#L51-L65, added in dependabot/dependabot-core#16143), and registry_tag_release_date returns a date only for Docker Hub (update_checker.rb#L492-L499). Docker Compose uses the same update checker. Only this page doesn't say it, so a cooldown set for a ghcr.io image looks like it works.

Suggested change: a bullet in the note under the table saying that for Docker and Docker Compose the cooldown only covers Docker Hub images, and that images in other registries skip it. I'll open a PR with that.

Additional information

We noticed it with ghcr.io/astral-sh/uv pinned as a build stage and cooldown: default-days: 7: each uv release was proposed 2 to 4 days after the image was built.

Lenguaje dominante
TypeScript
Estrellas
21.1k
Forks
69.3k
Merge medio
17 h 10 min
PR fusionados (30 d)
89

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de github/docs

Todos los issues de github/docs

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.