Dependabot options reference: Docker cooldown only applies to Docker Hub images
維護者通常 1 天內回覆
評估
- 難度
- 1/5
- 預估耗時
- 1 小時以內
- 新手友好度
- 25/100
- Issue 類型
- 文件
- 描述清晰度
- 描述清楚
- 活躍度
- 停滯
- 技術堆疊
- docker, docker-compose
研究方向
Open the Dependabot options reference at the linked cooldown section and review the package-manager table and its note. The issue cites the Dependabot Docker README and update checker as background for the Docker Hub limitation. Done means the note clearly says Docker and Docker Compose cooldowns apply only to Docker Hub images; other registries skip cooldown.
由索引模型根據 Issue 內容生成。
描述
Code of Conduct
- I have read and agree to the GitHub Docs project's Code of Conduct
What article on docs.github.com is affected?
What part(s) of the article would you like to see updated?
The table of package managers that support cooldown marks Docker and Docker Compose as supporting default-days, with no caveat. In practice the cooldown only applies to images on Docker Hub. For an image on ghcr.io (or any other registry), Dependabot has no publication date, skips the cooldown and proposes the newest tag. The job log says No verified registry publication date source for ghcr.io; skipping cooldown for <image>:<tag>, and the pull request body says "Cooldown could not be applied because no publication date was available from the registry."
This is intended in dependabot-core. The "Cooldown publication dates" section of the docker README says Docker Hub's tag_last_pushed is the only accepted date source and that GHCR dates are unavailable (docker/README.md#L51-L65, added in dependabot/dependabot-core#16143), and registry_tag_release_date returns a date only for Docker Hub (update_checker.rb#L492-L499). Docker Compose uses the same update checker. Only this page doesn't say it, so a cooldown set for a ghcr.io image looks like it works.
Suggested change: a bullet in the note under the table saying that for Docker and Docker Compose the cooldown only covers Docker Hub images, and that images in other registries skip it. I'll open a PR with that.
Additional information
We noticed it with ghcr.io/astral-sh/uv pinned as a build stage and cooldown: default-days: 7: each uv release was proposed 2 to 4 days after the image was built.
- 主要語言
- TypeScript
- 星號
- 21.1k
- 分支
- 69.3k
- 平均合併
- 17 小時 10 分鐘
- 30 天內合併 PR
- 89
環境準備
在瀏覽器裡用你自己的 GitHub 帳號啟動這個專案的開發容器。
- 提供 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
github/docs 的其他 Issue
-
Incorrect tool permission option names in copilot app documentation可能已有人在做 @ashis-baral 於 2 天前認領。 未關閉content
難度 1/5 1 小時以內 新手友好度 88/100
維護者通常 1 天內回覆
-
actions builder persona content
難度 1/5 1 小時以內 新手友好度 86/100
維護者通常 1 天內回覆
-
Remove models already deprecated (GPT-4o, GPT-5.1 series, Gemini 3 Pro) from "Model multipliers for annual plans on request-based billing (legacy)"可能重新可做 關聯的 PR 已關閉且未合併。 未關閉builder persona content driver persona
難度 1/5 1-3 小時 新手友好度 82/100
維護者通常 1 天內回覆
-
builder persona
難度 1/5 1-3 小時 新手友好度 88/100
維護者通常 1 天內回覆
-
builder persona content copilot
難度 1/5 1-3 小時 新手友好度 72/100
維護者通常 1 天內回覆
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 75/100
維護者通常 1 天內回覆
-
難度 1/5 1 小時以內 新手友好度 83/100
維護者通常 1 天內回覆
-
🔊 a11y
難度 2/5 1-3 小時 新手友好度 82/100
betagouv/mon-entreprise#4726 ·
維護者通常 9 天內回覆
-
難度 2/5 1-3 小時 新手友好度 68/100
Deltares/fews-pi-requests#357 ·
維護者通常 1 天內回覆
-
bug confirmed js v6
難度 2/5 1-3 小時 新手友好度 85/100
維護者通常 1 天內回覆