dependabot-docker 0.363.0 → 0.364.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9b2bbaa23379e0a0182097bd32b0e2e0d2628a18e61c34946068c70bb1ec526
-  data.tar.gz: a727fbf08f44bee5dce893eedb64dcf03f1c33e9cef368f2147e00dec608fc6a
+  metadata.gz: 62746febf2f7781d370bf9ae465d76c03ae5b8afb926d10eb0d27091ab0ac08c
+  data.tar.gz: a600410ab9c7b7d121c639898654f8a134033da58b6f98118c3da7bca9d75a4f
 SHA512:
-  metadata.gz: ae0183e506e3b21ea05a9fc8ebd01e7fe3c4d3c447f4ff7e7e3037eb4bff4614fe448bd81a5690d5d9d6d48248976db53554dad2d9da9aea3f39ccefcbba45bb
-  data.tar.gz: 0605ddcfc7e3957311ddd65ca6a76802ae61684e68915512952e412d49325238533b978fa145076aec743f5a722e24cd63b6c3a066339817e6bd39f6827cccba
+  metadata.gz: c26d57456c177d176c94a32e9dea887d302de313be6d5e530196c29da08de26664f2e9212e2179d99c5f5defeb41d40ca3bfd61ad9133662f52b6dd8aa3d45ba
+  data.tar.gz: 8f22ab97605010d3a7ea626cedcd838b1245c2e73a4412ff0829daa9c1c1a256275a49eb07020fc1b45e498ac62d3fbfd04e13d5ae4fb1f2df321080ee54dfde

data/lib/dependabot/docker/tag.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "dependabot/docker/file_parser"
+require "dependabot/experiments"
 require "sorbet-runtime"
 
 module Dependabot
@@ -99,6 +100,12 @@ module Dependabot
         comparable_format = comparable_formats(other.format, other.prefix, other.suffix)
         return equal_prefix && equal_format if other_format == :sha_suffixed
 
+        # When timestamp validation is enabled, dated and non-dated versions are
+        # not comparable — prevents updating from 4.8-windowsservercore-ltsc2022
+        # to 4.8-20250909-windowsservercore-ltsc2022 and vice versa
+        return false if Dependabot::Experiments.enabled?(:docker_created_timestamp_validation) &&
+                        dated_version? != other.dated_version?
+
         equal_suffix = suffix == other_suffix
         (equal_prefix && equal_format && equal_suffix) || comparable_format
       end
@@ -171,7 +178,29 @@ module Dependabot
       def numeric_version
         return unless comparable?
 
-        version&.gsub(/kb/i, "")&.gsub(/-[a-z]+/, "")&.downcase
+        result = version&.gsub(/kb/i, "")&.gsub(/-[a-z]+/, "")&.downcase
+        # When timestamp validation is enabled, strip date components from the
+        # version so they don't inflate semver comparison. "4.8-20250909" should
+        # compare as "4.8", not "4.8.20250909". The date is metadata — actual
+        # recency is determined by config blob timestamps.
+        if Dependabot::Experiments.enabled?(:docker_created_timestamp_validation)
+          result = result&.gsub(/-\d{8}(?:\b|$)/, "")
+        end
+        result
+      end
+
+      # Detects whether the version part contains a date-like component (YYYYMMDD).
+      # For example, "4.8-20250909" has a dated version, "4.8.1" does not.
+      # This is used to prevent cross-updates between dated and non-dated tags.
+      # NOTE: This method only checks for the presence of an 8-digit date-like segment in the version part.
+      # It does not attempt to validate the date itself. Nor does it check for other date formats
+      # (e.g., YYYY.MM.DD, YYYY-MM-DD, MM.DD.YYYY)
+      sig { returns(T::Boolean) }
+      def dated_version?
+        return false unless version
+
+        # Match 8-digit date-like segments (YYYYMMDD) within the version part
+        !!T.must(version).match?(/-\d{8}(?:\b|$)/)
       end
 
       sig { returns(Integer) }

data/lib/dependabot/docker/update_checker.rb

@@ -22,6 +22,67 @@ module Dependabot
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       extend T::Sig
 
+      MANIFEST_LIST_TYPES = T.let(
+        [
+          "application/vnd.docker.distribution.manifest.list.v2+json",
+          "application/vnd.oci.image.index.v1+json"
+        ].freeze,
+        T::Array[String]
+      )
+
+      # Tolerance window for platform timestamp comparison.
+      # Multi-arch CI builds may finish platforms at slightly different times.
+      PLATFORM_TIMESTAMP_TOLERANCE_SECONDS = T.let(3 * 60 * 60, Integer)
+
+      # Maximum number of candidates to run platform timestamp validation against.
+      # Each validation can require 1 + 1 + N*2 registry API calls for N platforms,
+      # so we cap the attempts to avoid rate limiting or excessive latency.
+      MAX_PLATFORM_VALIDATION_ATTEMPTS = T.let(5, Integer)
+
+      # Legacy patterns used when docker_created_timestamp_validation experiment is disabled.
+      # The broad alphanumeric regex matches tokens like "alpine3", "ltsc2022", "rc1"
+      # and classifies them as version-related, preserving pre-experiment behavior.
+      LEGACY_VERSION_RELATED_PATTERNS = T.let(
+        [
+          /^\d+$/,                          # pure numbers: "123", "8"
+          /^\d+\.\d+$/,                     # semver-like: "1.2"
+          /^v\d+/,                          # v-prefixed: "v2", "v10"
+          /^(?=.*\d)(?=.*[a-z])[a-z\d]+$/i, # broad mixed alphanumeric: "rc1", "beta2", "alpine3", "ltsc2022"
+          /^(rc|jre)$/,                     # common Docker tag components that are part of versioning
+          /^kb\d+$/i,                       # Microsoft KB numbers: "KB4505057"
+          /^g[0-9a-f]{5,}$/,                # git SHAs: "g1a2b3c4"
+          /^\d{8,14}$/,                     # timestamps: "20250909"
+          /\d+_\d+/                         # underscore-separated version parts: "12_8"
+        ].freeze,
+        T::Array[Regexp]
+      )
+
+      # Patterns that identify structurally obvious version components in tag
+      # names. Matching parts are excluded from the common-component system
+      # because they represent version data, not platform/variant identifiers.
+      #
+      # Everything that does NOT match these patterns is treated as a
+      # platform/variant component (e.g., "alpine3", "ltsc2022", "bookworm",
+      # "rc1", "jre"). This is intentionally broad — the primary tag filtering
+      # in comparable_to? already handles prerelease and suffix isolation via
+      # exact suffix matching, so component matching is a secondary safety net.
+      #
+      # To exclude a new structural pattern, add a regex here.
+      # Only used when docker_created_timestamp_validation experiment is enabled.
+      VERSION_RELATED_PATTERNS = T.let(
+        [
+          /^\d+$/,                          # pure numbers: "123", "8"
+          /^\d+\.\d+$/,                     # semver-like: "1.2"
+          /^v\d+/,                          # v-prefixed: "v2", "v10"
+          /^\d+[a-z]+\d+$/i,                # digit-letters-digit version parts: "0a1", "0b1", "0rc1"
+          /^kb\d+$/i,                       # Microsoft KB numbers: "KB4505057"
+          /^g[0-9a-f]{5,}$/,                # git SHAs: "g1a2b3c4"
+          /^\d{8,14}$/,                     # timestamps: "20250909"
+          /\d+_\d+/                         # underscore-separated version parts: "12_8"
+        ].freeze,
+        T::Array[Regexp]
+      )
+
       sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
         latest_version_from(T.must(dependency.version))
@@ -99,6 +160,16 @@ module Dependabot
 
         latest_tag = latest_tag_from(version)
 
+        # When timestamp validation is enabled, comparable_version_from strips
+        # date components (e.g. 4.8.1-20251014 -> 4.8.1), so two dated tags
+        # with different dates but the same base version compare as equal.
+        # Detect this case by checking the tag names directly.
+        if Dependabot::Experiments.enabled?(:docker_created_timestamp_validation) &&
+           version_tag.dated_version? && latest_tag.dated_version? &&
+           latest_tag.name != version_tag.name
+          return false
+        end
+
         comparable_version_from(latest_tag) <= comparable_version_from(version_tag)
       end
 
@@ -154,42 +225,108 @@ module Dependabot
         candidate_tags = sort_tags(candidate_tags, version_tag)
         candidate_tags = apply_cooldown(candidate_tags)
 
-        latest_tag = candidate_tags.last
-        return version_tag unless latest_tag
+        select_best_candidate(candidate_tags, version_tag)
+      end
+
+      sig do
+        params(
+          candidate_tags: T::Array[Dependabot::Docker::Tag],
+          version_tag: Dependabot::Docker::Tag
+        ).returns(Dependabot::Docker::Tag)
+      end
+      def select_best_candidate(candidate_tags, version_tag)
+        same_precision_tags = remove_precision_changes(candidate_tags, version_tag)
+        validation_attempts = 0
+
+        # Iterate from highest to lowest, trying each candidate until one passes validation
+        candidate_tags.reverse_each do |candidate|
+          selected = select_tag_with_precision(candidate, same_precision_tags, version_tag)
+
+          if Dependabot::Experiments.enabled?(:docker_created_timestamp_validation) &&
+             selected.name != version_tag.name
+            if validation_attempts >= MAX_PLATFORM_VALIDATION_ATTEMPTS
+              Dependabot.logger.info(
+                "Platform validation: reached max attempts (#{MAX_PLATFORM_VALIDATION_ATTEMPTS}), " \
+                "accepting #{selected.name} without timestamp check"
+              )
+              return selected
+            end
+            validation_attempts += 1
+          end
+
+          validated = validate_tag_with_timestamp(selected, version_tag)
+          return validated unless validated.name == version_tag.name && selected.name != version_tag.name
+        end
+
+        if validation_attempts.positive?
+          Dependabot.logger.info(
+            "Platform validation: exhausted all #{validation_attempts} candidate(s) " \
+            "for #{version_tag.name}, staying on current version"
+          )
+        end
+
+        version_tag
+      end
 
-        return latest_tag if latest_tag.same_precision?(version_tag)
+      sig do
+        params(
+          candidate: Dependabot::Docker::Tag,
+          same_precision_tags: T::Array[Dependabot::Docker::Tag],
+          version_tag: Dependabot::Docker::Tag
+        ).returns(Dependabot::Docker::Tag)
+      end
+      def select_tag_with_precision(candidate, same_precision_tags, version_tag)
+        return candidate if candidate.same_precision?(version_tag)
 
-        latest_same_precision_tag = remove_precision_changes(candidate_tags, version_tag).last
-        return latest_tag unless latest_same_precision_tag
+        # Find the highest same-precision tag that is <= this candidate
+        best_same_precision = same_precision_tags.reverse.find do |t|
+          comparable_version_from(t) <= comparable_version_from(candidate)
+        end
 
-        latest_same_precision_digest = digest_of(latest_same_precision_tag.name)
-        latest_digest = digest_of(latest_tag.name)
+        return candidate unless best_same_precision
 
-        # NOTE: Some registries don't provide digests (the API documents them as
-        # optional: https://docs.docker.com/registry/spec/api/#content-digests).
-        #
-        # In that case we can't know for sure whether the latest tag keeping
-        # existing precision is the same as the absolute latest tag.
-        #
-        # We can however, make a best-effort to avoid unwanted changes by
-        # directly looking at version numbers and checking whether the absolute
-        # latest tag is just a more precise version of the latest tag that keeps
-        # existing precision.
+        same_precision_digest = digest_of(best_same_precision.name)
+        candidate_digest = digest_of(candidate.name)
 
-        if latest_same_precision_digest == latest_digest && latest_same_precision_tag.same_but_less_precise?(latest_tag)
-          latest_same_precision_tag
+        if same_precision_digest == candidate_digest &&
+           best_same_precision.same_but_less_precise?(candidate)
+          best_same_precision
         else
-          latest_tag
+          candidate
         end
       end
 
+      sig do
+        params(
+          selected_tag: Dependabot::Docker::Tag,
+          current_tag: Dependabot::Docker::Tag
+        ).returns(Dependabot::Docker::Tag)
+      end
+      def validate_tag_with_timestamp(selected_tag, current_tag)
+        return selected_tag unless Dependabot::Experiments.enabled?(:docker_created_timestamp_validation)
+        return selected_tag if selected_tag.name == current_tag.name
+
+        if validate_candidate_platforms(selected_tag, current_tag)
+          Dependabot.logger.info(
+            "Platform validation: #{selected_tag.name} confirmed valid update from #{current_tag.name}"
+          )
+          return selected_tag
+        end
+
+        Dependabot.logger.info(
+          "Platform validation: skipping #{selected_tag.name} — " \
+          "platform check failed against #{current_tag.name}"
+        )
+
+        current_tag
+      end
+
       sig { params(original_tag: Dependabot::Docker::Tag).returns(T::Array[Dependabot::Docker::Tag]) }
       def comparable_tags_from_registry(original_tag)
         common_components = identify_common_components(tags_from_registry)
         original_components = extract_tag_components(original_tag.name, common_components)
         Dependabot.logger.info("Original tag components: #{original_components.join(',')}")
 
-        tags_from_registry.select { |tag| tag.comparable_to?(original_tag) }
         tags_from_registry.select do |tag|
           tag.comparable_to?(original_tag) &&
             (original_components.empty? ||
@@ -333,18 +470,12 @@ module Dependabot
 
       sig { params(part: String).returns(T::Boolean) }
       def version_related_pattern?(part)
-        patterns = {
-          number: /^\d+$/,
-          semver: /^\d+\.\d+$/,
-          v_prefix: /^v\d+/,
-          version_marker: /^(rc|jre)$/,
-          prerelease: /^(?=.*\d)(?=.*[a-z])[a-z\d]+$/i,
-          sha: /^g[0-9a-f]{5,}$/,
-          timestamp: /^\d{8,14}$/,
-          underscore_parts: /\d+_\d+/
-        }
-
-        patterns.values.any? { |pattern| part.match?(pattern) }
+        patterns = if Dependabot::Experiments.enabled?(:docker_created_timestamp_validation)
+                     VERSION_RELATED_PATTERNS
+                   else
+                     LEGACY_VERSION_RELATED_PATTERNS
+                   end
+        patterns.any? { |pattern| part.match?(pattern) }
       end
 
       sig { params(tag_name: String, common_components: T::Array[String]).returns(T::Array[String]) }
@@ -601,19 +732,42 @@ module Dependabot
           .returns(T::Array[Dependabot::Docker::Tag])
       end
       def sort_tags(candidate_tags, version_tag)
-        candidate_tags.sort do |tag_a, tag_b|
-          if comparable_version_from(tag_a) > comparable_version_from(tag_b)
-            1
-          elsif comparable_version_from(tag_a) < comparable_version_from(tag_b)
-            -1
-          elsif tag_a.same_precision?(version_tag)
-            1
-          elsif tag_b.same_precision?(version_tag)
-            -1
-          else
-            0
-          end
-        end
+        candidate_tags.sort { |tag_a, tag_b| compare_tags(tag_a, tag_b, version_tag) }
+      end
+
+      sig do
+        params(
+          tag_a: Dependabot::Docker::Tag,
+          tag_b: Dependabot::Docker::Tag,
+          version_tag: Dependabot::Docker::Tag
+        ).returns(Integer)
+      end
+      def compare_tags(tag_a, tag_b, version_tag)
+        version_cmp = comparable_version_from(tag_a) <=> comparable_version_from(tag_b)
+        return version_cmp if version_cmp && version_cmp != 0
+
+        precision_cmp = compare_precision(tag_a, tag_b, version_tag)
+        return precision_cmp unless precision_cmp.zero?
+
+        # When versions and precision are equal (e.g., dated tags with same base version),
+        # use the raw version string as tiebreaker so newer dates sort higher
+        ((tag_a.version || "") <=> (tag_b.version || "")) || 0
+      end
+
+      sig do
+        params(
+          tag_a: Dependabot::Docker::Tag,
+          tag_b: Dependabot::Docker::Tag,
+          version_tag: Dependabot::Docker::Tag
+        ).returns(Integer)
+      end
+      def compare_precision(tag_a, tag_b, version_tag)
+        a_match = tag_a.same_precision?(version_tag)
+        b_match = tag_b.same_precision?(version_tag)
+        return 1 if a_match && !b_match
+        return -1 if b_match && !a_match
+
+        0
       end
 
       sig { params(candidate_tags: T::Array[Dependabot::Docker::Tag]).returns(T::Array[Dependabot::Docker::Tag]) }
@@ -685,6 +839,333 @@ module Dependabot
         days = cooldown_days_for
         (Time.now.to_i - release_date.to_i) < (days * 24 * 60 * 60)
       end
+
+      # Fetches the "created" timestamp from the image config blob for a given tag.
+      # This represents the actual build time, which is more reliable than semver
+      # for determining which image is truly newer.
+      sig { params(tag_name: String).returns(T.nilable(Time)) }
+      def fetch_image_config_created(tag_name)
+        return config_created_timestamps[tag_name] if config_created_timestamps.key?(tag_name)
+
+        created = fetch_image_config_created_from_registry(tag_name)
+        config_created_timestamps[tag_name] = created
+        created
+      rescue *transient_docker_errors, DockerRegistry2::RegistryAuthenticationException,
+             RestClient::Forbidden, JSON::ParserError => e
+        Dependabot.logger.info(
+          "Failed to fetch config created timestamp for #{docker_repo_name}:#{tag_name}: #{e.message}"
+        )
+        config_created_timestamps[tag_name] = nil
+        nil
+      end
+
+      sig { params(tag_name: String).returns(T.nilable(Time)) }
+      def fetch_image_config_created_from_registry(tag_name)
+        manifest = with_retries(max_attempts: 3, errors: transient_docker_errors) do
+          docker_registry_client.manifest(docker_repo_name, tag_name)
+        end
+
+        resolved = resolve_platform_manifest(manifest)
+        return nil unless resolved
+
+        config_digest = resolved.dig("config", "digest")
+        return nil unless config_digest
+
+        parse_created_from_config_blob(config_digest)
+      end
+
+      # Fetches and parses the "created" timestamp from a config blob identified by its digest.
+      sig { params(config_digest: String).returns(T.nilable(Time)) }
+      def parse_created_from_config_blob(config_digest)
+        config_blob = with_retries(max_attempts: 3, errors: transient_docker_errors) do
+          docker_registry_client.doget("v2/#{docker_repo_name}/blobs/#{config_digest}")
+        end
+
+        config_data = JSON.parse(config_blob.body)
+        created_str = config_data["created"]
+        return nil unless created_str
+
+        Time.parse(created_str)
+      rescue ArgumentError => e
+        Dependabot.logger.info(
+          "Failed to parse config created timestamp for #{docker_repo_name} blob #{config_digest}: #{e.message}"
+        )
+        nil
+      end
+
+      # Resolves a manifest to a single platform-specific manifest.
+      # If the manifest is a manifest list (multi-arch), selects the most
+      # appropriate platform (preferring linux/amd64).
+      sig { params(manifest: T.untyped).returns(T.nilable(T::Hash[String, T.untyped])) }
+      def resolve_platform_manifest(manifest)
+        media_type = manifest["mediaType"] || manifest[:mediaType]
+
+        unless MANIFEST_LIST_TYPES.include?(media_type)
+          return manifest.is_a?(Hash) ? manifest : manifest.to_h
+        end
+
+        platform_digest = select_platform_digest(manifest)
+        return nil unless platform_digest
+
+        platform_manifest = with_retries(max_attempts: 3, errors: transient_docker_errors) do
+          docker_registry_client.doget("v2/#{docker_repo_name}/manifests/#{platform_digest}")
+        end
+
+        JSON.parse(platform_manifest.body)
+      end
+
+      # Selects the digest of the best platform-specific manifest from a manifest list,
+      # preferring linux/amd64.
+      sig { params(manifest: T.untyped).returns(T.nilable(String)) }
+      def select_platform_digest(manifest)
+        manifests = manifest["manifests"] || manifest[:manifests] || []
+        return nil if manifests.empty?
+
+        selected = find_amd64_manifest(manifests) || manifests.first
+        selected&.dig("digest") || selected&.dig(:digest)
+      end
+
+      sig { params(manifests: T.untyped).returns(T.untyped) }
+      def find_amd64_manifest(manifests)
+        manifests.find do |m|
+          platform = m["platform"] || m[:platform] || {}
+          (platform["architecture"] || platform[:architecture]) == "amd64"
+        end
+      end
+
+      # Validates that all platforms from the current tag are present in the
+      # candidate tag and that each platform's image was built at the same time
+      # (within tolerance) or newer. For single-platform current tags, falls
+      # back to simple timestamp comparison.
+      sig do
+        params(
+          candidate_tag: Dependabot::Docker::Tag,
+          current_tag: Dependabot::Docker::Tag
+        ).returns(T::Boolean)
+      end
+      def validate_candidate_platforms(candidate_tag, current_tag)
+        current_platforms = fetch_manifest_platforms(current_tag.name)
+
+        # Single-platform current tag — fall back to simple timestamp comparison
+        return candidate_newer_by_created_date?(candidate_tag, current_tag) if current_platforms.nil?
+
+        candidate_platforms = fetch_manifest_platforms(candidate_tag.name)
+
+        # Candidate is single-platform but current is multi-platform
+        if candidate_platforms.nil?
+          Dependabot.logger.info(
+            "Platform validation: #{candidate_tag.name} is single-platform " \
+            "but #{current_tag.name} is multi-platform"
+          )
+          return false
+        end
+
+        # Check all current platforms exist in candidate
+        current_keys = current_platforms.to_set { |p| platform_key(p) }
+        candidate_keys = candidate_platforms.to_set { |p| platform_key(p) }
+        missing = current_keys - candidate_keys
+
+        unless missing.empty?
+          Dependabot.logger.info(
+            "Platform validation: #{candidate_tag.name} missing platforms: #{missing.to_a.join(', ')}"
+          )
+          return false
+        end
+
+        # Validate timestamps for each platform
+        validate_platform_timestamps(candidate_tag, current_tag, current_keys)
+      end
+
+      sig do
+        params(
+          candidate_tag: Dependabot::Docker::Tag,
+          current_tag: Dependabot::Docker::Tag,
+          platform_keys: T::Set[String]
+        ).returns(T::Boolean)
+      end
+      def validate_platform_timestamps(candidate_tag, current_tag, platform_keys)
+        candidate_timestamps = fetch_all_platform_timestamps(candidate_tag.name)
+        current_timestamps = fetch_all_platform_timestamps(current_tag.name)
+
+        platform_keys.all? do |key|
+          candidate_time = candidate_timestamps[key]
+          current_time = current_timestamps[key]
+
+          # Both nil → trust semver
+          next true if candidate_time.nil? && current_time.nil?
+          # Only candidate nil → can't confirm, conservative fail
+          next false if candidate_time.nil?
+          # Only current nil → trust semver
+          next true if current_time.nil?
+
+          candidate_time >= (current_time - PLATFORM_TIMESTAMP_TOLERANCE_SECONDS)
+        end
+      end
+
+      sig do
+        params(
+          candidate_tag: Dependabot::Docker::Tag,
+          current_tag: Dependabot::Docker::Tag
+        ).returns(T::Boolean)
+      end
+      def candidate_newer_by_created_date?(candidate_tag, current_tag)
+        candidate_created = fetch_image_config_created(candidate_tag.name)
+        current_created = fetch_image_config_created(current_tag.name)
+
+        # If both timestamps are unavailable, trust semver ordering
+        return true if candidate_created.nil? && current_created.nil?
+
+        # If only the candidate's timestamp is unavailable, we can't confirm it's newer
+        return false if candidate_created.nil?
+
+        # If only the current tag's timestamp is unavailable, trust semver ordering
+        return true if current_created.nil?
+
+        candidate_created > current_created
+      end
+
+      # Fetches the platform entries from a manifest list for a given tag.
+      # Returns nil if the tag is a single-platform image (not a manifest list).
+      sig { params(tag_name: String).returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+      def fetch_manifest_platforms(tag_name)
+        return manifest_platforms_cache[tag_name] if manifest_platforms_cache.key?(tag_name)
+
+        platforms = fetch_manifest_platforms_from_registry(tag_name)
+        manifest_platforms_cache[tag_name] = platforms
+        platforms
+      rescue *transient_docker_errors, DockerRegistry2::RegistryAuthenticationException,
+             RestClient::Forbidden, JSON::ParserError => e
+        Dependabot.logger.info(
+          "Failed to fetch manifest platforms for #{docker_repo_name}:#{tag_name}: #{e.message}"
+        )
+        manifest_platforms_cache[tag_name] = nil
+        nil
+      end
+
+      sig { params(tag_name: String).returns(T.nilable(T::Array[T::Hash[String, T.untyped]])) }
+      def fetch_manifest_platforms_from_registry(tag_name)
+        manifest = with_retries(max_attempts: 3, errors: transient_docker_errors) do
+          docker_registry_client.manifest(docker_repo_name, tag_name)
+        end
+
+        media_type = manifest["mediaType"] || manifest[:mediaType]
+        return nil unless MANIFEST_LIST_TYPES.include?(media_type)
+
+        manifests = manifest["manifests"] || manifest[:manifests] || []
+
+        # Filter to actual image manifests (exclude attestations/signatures)
+        manifests.filter_map { |m| extract_platform(m) }
+      end
+
+      sig { params(manifest_entry: T.untyped).returns(T.nilable(T::Hash[String, T.untyped])) }
+      def extract_platform(manifest_entry)
+        platform = manifest_entry["platform"] || manifest_entry[:platform]
+        return unless platform
+
+        os = platform["os"] || platform[:os]
+        arch = platform["architecture"] || platform[:architecture]
+        return unless os && arch
+
+        platform
+      end
+
+      # Builds a normalized string key from a platform hash, e.g. "linux/amd64" or "linux/arm64/v8"
+      sig { params(platform: T::Hash[T.any(String, Symbol), T.untyped]).returns(String) }
+      def platform_key(platform)
+        os = platform["os"] || platform[:os]
+        arch = platform["architecture"] || platform[:architecture]
+        variant = platform["variant"] || platform[:variant]
+
+        key = "#{os}/#{arch}"
+        key = "#{key}/#{variant}" if variant
+        key
+      end
+
+      # Fetches the created timestamp for every platform in a tag's manifest list.
+      # Returns a Hash mapping platform key (e.g. "linux/amd64") to Time.
+      sig { params(tag_name: String).returns(T::Hash[String, T.nilable(Time)]) }
+      def fetch_all_platform_timestamps(tag_name)
+        return T.must(platform_timestamps_cache[tag_name]) if platform_timestamps_cache.key?(tag_name)
+
+        timestamps = fetch_all_platform_timestamps_from_registry(tag_name)
+        platform_timestamps_cache[tag_name] = timestamps
+        timestamps
+      rescue *transient_docker_errors, DockerRegistry2::RegistryAuthenticationException,
+             RestClient::Forbidden, JSON::ParserError => e
+        Dependabot.logger.info(
+          "Failed to fetch platform timestamps for #{docker_repo_name}:#{tag_name}: #{e.message}"
+        )
+        platform_timestamps_cache[tag_name] = {}
+        {}
+      end
+
+      sig { params(tag_name: String).returns(T::Hash[String, T.nilable(Time)]) }
+      def fetch_all_platform_timestamps_from_registry(tag_name)
+        manifest = with_retries(max_attempts: 3, errors: transient_docker_errors) do
+          docker_registry_client.manifest(docker_repo_name, tag_name)
+        end
+
+        media_type = manifest["mediaType"] || manifest[:mediaType]
+        return {} unless MANIFEST_LIST_TYPES.include?(media_type)
+
+        manifests = manifest["manifests"] || manifest[:manifests] || []
+        collect_platform_timestamps(manifests)
+      end
+
+      sig { params(manifests: T.untyped).returns(T::Hash[String, T.nilable(Time)]) }
+      def collect_platform_timestamps(manifests)
+        timestamps = {}
+
+        manifests.each do |m|
+          platform = extract_platform(m)
+          next unless platform
+
+          digest = m["digest"] || m[:digest]
+          next unless digest
+
+          key = platform_key(platform)
+          timestamps[key] = fetch_platform_created_timestamp(digest)
+        end
+
+        timestamps
+      end
+
+      sig { params(platform_digest: String).returns(T.nilable(Time)) }
+      def fetch_platform_created_timestamp(platform_digest)
+        platform_manifest = with_retries(max_attempts: 3, errors: transient_docker_errors) do
+          docker_registry_client.doget("v2/#{docker_repo_name}/manifests/#{platform_digest}")
+        end
+
+        parsed = JSON.parse(platform_manifest.body)
+        config_digest = parsed.dig("config", "digest")
+        return nil unless config_digest
+
+        parse_created_from_config_blob(config_digest)
+      end
+
+      sig { returns(T::Hash[String, T.nilable(T::Array[T::Hash[String, T.untyped]])]) }
+      def manifest_platforms_cache
+        @manifest_platforms_cache ||= T.let(
+          {},
+          T.nilable(T::Hash[String, T.nilable(T::Array[T::Hash[String, T.untyped]])])
+        )
+      end
+
+      sig { returns(T::Hash[String, T::Hash[String, T.nilable(Time)]]) }
+      def platform_timestamps_cache
+        @platform_timestamps_cache ||= T.let(
+          {},
+          T.nilable(T::Hash[String, T::Hash[String, T.nilable(Time)]])
+        )
+      end
+
+      sig { returns(T::Hash[String, T.nilable(Time)]) }
+      def config_created_timestamps
+        @config_created_timestamps ||= T.let(
+          {},
+          T.nilable(T::Hash[String, T.nilable(Time)])
+        )
+      end
     end
     # rubocop:enable Metrics/ClassLength
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker
 version: !ruby/object:Gem::Version
-  version: 0.363.0
+  version: 0.364.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.363.0
+        version: 0.364.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.363.0
+        version: 0.364.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -261,7 +261,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.363.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.364.0
 rdoc_options: []
 require_paths:
 - lib