dependabot-docker 0.377.0 → 0.379.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ef1dc5166936b5d6aada4bf0f859a424d1a60f5b22a4050acc6ca09bc968ad7
-  data.tar.gz: 9c0961430097c367900629b3e67c5bbfa633a3f49a1ff69500b77c2530f53322
+  metadata.gz: d88012ff199df5eaf98766380b8615df8a81dfdc2730dd49f824fd47850f41b4
+  data.tar.gz: 985452621d56616c424a629f1c06a573a9254281fecbe4fb647cce173adf5cad
 SHA512:
-  metadata.gz: 4c1844c652bddc83266a3045535d364f7469cbb5245d327f1ff70debe9d648f11bdde27f607d7de70bdfc938dc5544417b4794fd871dba357c3de03c2066c272
-  data.tar.gz: e6c9ec06ac35771d9408cce9b544729cd59ac0d122995db9fbf6463c4724a48025a825ce148614908758a361c4e737131162b01f2c1e8d6cdda35f5efadd5ba2
+  metadata.gz: 29010cda214cb8e22a749ec33bed8ba0a1ceccd91db831f9ce864c518ffacbe7dd8b7f3e73f9b64337a213bd6d3bcae8308fb03b7fb7d4b1eafa70739a54bea3
+  data.tar.gz: b26bb3a77b99f9162ce152cd7b7e7390174c9b65c518c5c53cee8836e732b60448d81f38b410c33b0d7c189e3a0a32b0094bf8e2ad4cdfb1157019bfdf5378e8

data/lib/dependabot/docker/update_checker.rb

@@ -213,6 +213,18 @@ module Dependabot
           expected_digest =
             if source_tag
               latest_tag = latest_tag_from(source_tag)
+
+              # When digest-only updates are suppressed and the tag hasn't changed,
+              # treat the digest as up-to-date to avoid proposing a PR that only
+              # bumps the digest without a corresponding version change.
+              # Only apply to comparable (versioned) tags — non-comparable tags like
+              # "latest" or distro codenames should still get digest updates.
+              if Dependabot::Experiments.enabled?(:docker_digest_only_update_suppression) &&
+                 Tag.new(source_tag).comparable? &&
+                 latest_tag.name == source_tag
+                next true
+              end
+
               digest_of(latest_tag.name)
             else
               updated_digest
@@ -374,7 +386,9 @@ module Dependabot
         candidate_tags.reverse_each do |tag|
           details = publication_detail(tag)
 
-          next if !details || !details.released_at
+          # If we can't determine publication details, skip cooldown for this tag and use it
+          # rather than blocking the update when the registry doesn't support the required API calls
+          return [tag] if !details || !details.released_at
 
           return [tag] unless cooldown_period?(T.must(details.released_at), tag)
 
@@ -389,7 +403,7 @@ module Dependabot
         return publication_details[candidate_tag.name] if publication_details.key?(candidate_tag.name)
 
         details = get_tag_publication_details(candidate_tag)
-        publication_details[candidate_tag.name] = T.cast(details, Dependabot::Package::PackageRelease)
+        publication_details[candidate_tag.name] = details
 
         details
       end
@@ -404,12 +418,17 @@ module Dependabot
         first_digest = extract_digest_from_response(digest_info, tag)
         return nil unless first_digest
 
-        blob_info = with_retries(max_attempts: 3, errors: transient_docker_errors) do
+        # When digest_info is an Array the registry returned a manifest list
+        # (OCI image index) and the extracted digest points at a platform-
+        # specific *manifest*, not a blob.  Use the correct endpoint so the
+        # HEAD request succeeds on registries like ghcr.io.
+        endpoint = digest_info.is_a?(Array) ? "manifests" : "blobs"
+        head_response = with_retries(max_attempts: 3, errors: transient_docker_errors) do
           client = docker_registry_client
-          client.dohead "v2/#{docker_repo_name}/blobs/#{first_digest}"
+          client.dohead "v2/#{docker_repo_name}/#{endpoint}/#{first_digest}"
         end
 
-        last_modified = blob_info.headers[:last_modified]
+        last_modified = head_response.headers[:last_modified]
         published_date = last_modified ? Time.parse(last_modified) : nil
 
         Dependabot::Package::PackageRelease.new(
@@ -420,6 +439,15 @@ module Dependabot
           url: nil,
           package_type: "docker"
         )
+      rescue *transient_docker_errors,
+             DockerRegistry2::RegistryAuthenticationException,
+             RestClient::Forbidden,
+             RestClient::TooManyRequests => e
+        Dependabot.logger.warn(
+          "Failed to fetch publication details for #{docker_repo_name}:#{tag.name}, " \
+          "skipping cooldown: #{e.class} - #{e.message}"
+        )
+        nil
       end
 
       sig do

data/lib/dependabot/docker_compose/file_updater.rb

@@ -29,7 +29,18 @@ module Dependabot
 
       sig { override.params(escaped_declaration: String).returns(Regexp) }
       def build_old_declaration_regex(escaped_declaration)
-        %r{#{IMAGE_REGEX}\s+["']?(?:\$\{[^\}:]+:-)?(docker\.io/)?#{escaped_declaration}(?:\})?["']?(?=\s|$)}
+        %r{
+          #{IMAGE_REGEX}
+          (?:[>|][-+]?\s*)?              # optional YAML block scalar indicator (folded/literal)
+          \s+
+          ["']?
+          (?:\$\{[^\}:]+:-)?
+          (docker\.io/)?
+          #{escaped_declaration}
+          (?:\})?
+          ["']?
+          (?=\s|$)
+        }x
       end
 
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.377.0
+  version: 0.379.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.377.0
+        version: 0.379.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.377.0
+        version: 0.379.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.377.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.379.0
 rdoc_options: []
 require_paths:
 - lib