Dependabot options reference: Docker cooldown only applies to Docker Hub images

Aberta
  • Algo errado?
#46,208 1 comentário 1 reação 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

@HardMax71 já está trabalhando nisso.

Desde 6/10/2026.

  • #46209 de @HardMax71 — aberto

Avaliação

Dificuldade
1/5
Tempo estimado
Menos de uma hora
Facilidade para iniciantes
25/100
Tipo de issue
Documentação
Clareza
Claramente especificada
Status de atividade
Estagnada
Stack de tecnologia
docker, docker-compose
Domínio
documentation

Direção de pesquisa

Open the Dependabot options reference at the linked cooldown section and review the package-manager table and its note. The issue cites the Dependabot Docker README and update checker as background for the Docker Hub limitation. Done means the note clearly says Docker and Docker Compose cooldowns apply only to Docker Hub images; other registries skip cooldown.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

dependabot driver persona
Code of Conduct
What article on docs.github.com is affected?

https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#configuration-of-cooldown

What part(s) of the article would you like to see updated?

The table of package managers that support cooldown marks Docker and Docker Compose as supporting default-days, with no caveat. In practice the cooldown only applies to images on Docker Hub. For an image on ghcr.io (or any other registry), Dependabot has no publication date, skips the cooldown and proposes the newest tag. The job log says No verified registry publication date source for ghcr.io; skipping cooldown for <image>:<tag>, and the pull request body says "Cooldown could not be applied because no publication date was available from the registry."

This is intended in dependabot-core. The "Cooldown publication dates" section of the docker README says Docker Hub's tag_last_pushed is the only accepted date source and that GHCR dates are unavailable (docker/README.md#L51-L65, added in dependabot/dependabot-core#16143), and registry_tag_release_date returns a date only for Docker Hub (update_checker.rb#L492-L499). Docker Compose uses the same update checker. Only this page doesn't say it, so a cooldown set for a ghcr.io image looks like it works.

Suggested change: a bullet in the note under the table saying that for Docker and Docker Compose the cooldown only covers Docker Hub images, and that images in other registries skip it. I'll open a PR with that.

Additional information

We noticed it with ghcr.io/astral-sh/uv pinned as a build stage and cooldown: default-days: 7: each uv release was proposed 2 to 4 days after the image was built.

Linguagem predominante
TypeScript
Estrelas
21.1k
Forks
69.3k
Merge médio
17h 10min
PRs com merge (30d)
89

Preparar o ambiente

Abrir no Codespaces

Inicia o contêiner de desenvolvimento do projeto no navegador, com a sua própria conta do GitHub.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de github/docs

Todas as issues de github/docs

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.