dependabot-docker 0.378.0 → 0.379.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17718cb0ff191b125f27342d3f6ac8ecc789aa7fbd1756b07f4169f72e7cdb1b
-  data.tar.gz: fe95510540508bb9aaab679699bed285909e3ca5252be80f6fe7d21bc77221d8
+  metadata.gz: d88012ff199df5eaf98766380b8615df8a81dfdc2730dd49f824fd47850f41b4
+  data.tar.gz: 985452621d56616c424a629f1c06a573a9254281fecbe4fb647cce173adf5cad
 SHA512:
-  metadata.gz: 72ec96db68fa95f61911fcaddb98601eb79f124357d17a4c0748c223bf1be60e4aa09089bcf4a5e0206201ec5fd1df2e7bcb2657fd3d362d9fd5001249402801
-  data.tar.gz: a04bc6ba3d922b2d5a28d62fbd06282d087db8b5c0e7dfe2acee5c057034a0c887ada15f5e04c7d64c34c49426b35b481b0fda843aefac7c5b96379ac3f8456f
+  metadata.gz: 29010cda214cb8e22a749ec33bed8ba0a1ceccd91db831f9ce864c518ffacbe7dd8b7f3e73f9b64337a213bd6d3bcae8308fb03b7fb7d4b1eafa70739a54bea3
+  data.tar.gz: b26bb3a77b99f9162ce152cd7b7e7390174c9b65c518c5c53cee8836e732b60448d81f38b410c33b0d7c189e3a0a32b0094bf8e2ad4cdfb1157019bfdf5378e8

data/lib/dependabot/docker/update_checker.rb

@@ -213,6 +213,18 @@ module Dependabot
           expected_digest =
             if source_tag
               latest_tag = latest_tag_from(source_tag)
+
+              # When digest-only updates are suppressed and the tag hasn't changed,
+              # treat the digest as up-to-date to avoid proposing a PR that only
+              # bumps the digest without a corresponding version change.
+              # Only apply to comparable (versioned) tags — non-comparable tags like
+              # "latest" or distro codenames should still get digest updates.
+              if Dependabot::Experiments.enabled?(:docker_digest_only_update_suppression) &&
+                 Tag.new(source_tag).comparable? &&
+                 latest_tag.name == source_tag
+                next true
+              end
+
               digest_of(latest_tag.name)
             else
               updated_digest

data/lib/dependabot/docker_compose/file_updater.rb

@@ -29,7 +29,18 @@ module Dependabot
 
       sig { override.params(escaped_declaration: String).returns(Regexp) }
       def build_old_declaration_regex(escaped_declaration)
-        %r{#{IMAGE_REGEX}\s+["']?(?:\$\{[^\}:]+:-)?(docker\.io/)?#{escaped_declaration}(?:\})?["']?(?=\s|$)}
+        %r{
+          #{IMAGE_REGEX}
+          (?:[>|][-+]?\s*)?              # optional YAML block scalar indicator (folded/literal)
+          \s+
+          ["']?
+          (?:\$\{[^\}:]+:-)?
+          (docker\.io/)?
+          #{escaped_declaration}
+          (?:\})?
+          ["']?
+          (?=\s|$)
+        }x
       end
 
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.378.0
+  version: 0.379.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.378.0
+        version: 0.379.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.378.0
+        version: 0.379.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.378.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.379.0
 rdoc_options: []
 require_paths:
 - lib