dependabot-docker_compose 0.301.1 → 0.302.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4dbd908c78578757cd9bf427ecd648acfb8ab65a454badb5ef9e18da488ea4f4
-  data.tar.gz: 14308a1e922c8c33f0a99e381fbcaf909866e9bdb34c763ce4bb8316b0a1559e
+  metadata.gz: f013b83f2aee3471ad04a37a2cb705587f6d9ef3feb11eaca5b3c9ca1d917ea4
+  data.tar.gz: a767ede3de68f8019646c18ada1bd62effce4e4f3207dc8fbd8daf3c57ead95b
 SHA512:
-  metadata.gz: bd2d19149604651c17250cbe02ac34f7b4eac085580fdf119a14e99b7c02496bed5bc8eda403f4873ff39c05dacc96235e772e4501eca0bc81651836c9c84739
-  data.tar.gz: cf2f528634ae1667f6978f93e36562d54d5cf8e052c91254789fe6134e50a5cf43449e8464583772d193e289228d497722870ead97d4a4fe95f539248cef6246
+  metadata.gz: a7024c1c406fe761d7cb42ac91eeb1d91cbf75711a2fdf58745ed70e4e299d89cae4b1e0e0f92c4b21d5911ae3f0bdc1b61d9dec49ae0a5ff063d1a020dcbd29
+  data.tar.gz: 359be8b9184d88c14615e32c6c8724463b6dd83369b70584478ee6eb71053104018fcd63a9c93c98789129663727b000fa9ca6b4e3191272e8aea4727c646859

data/lib/dependabot/docker_compose/file_parser.rb

@@ -10,7 +10,7 @@ module Dependabot
     class FileParser < Dependabot::Shared::SharedFileParser
       extend T::Sig
 
-      ENV_VAR = /\${[^}]+}/
+      ENV_VAR = /\${(?<variable_name>[^}:]+)(?:\:-(?<default_value>[^}]+))?}/
       DIGEST = /(?<digest>[0-9a-f]{64})/
       IMAGE_REGEX = %r{^(#{REGISTRY}/)?#{IMAGE}#{TAG}?(?:@sha256:#{DIGEST})?#{NAME}?}x
 
@@ -65,10 +65,7 @@ module Dependabot
         return nil unless service
 
         if service["image"]
-          return nil if service["image"].match?(/^\${[^}]+}$/)
-
-          match = IMAGE_REGEX.match(service["image"])
-          return match&.named_captures
+          return service_image(service["image"])
         elsif service["build"].is_a?(Hash) && service["build"]["dockerfile_inline"]
           return nil if service["build"]["dockerfile_inline"].match?(/^FROM\s+\${[^}]+}$/)
 
@@ -79,6 +76,20 @@ module Dependabot
         nil
       end
 
+      sig { params(image: String).returns(T.nilable(T::Hash[String, T.nilable(String)])) }
+      def service_image(image)
+        docker_image = image
+
+        if image.match?(/^#{ENV_VAR}/o)
+          default_value = ENV_VAR.match(image)&.named_captures&.fetch("default_value")
+          return unless default_value
+
+          docker_image = default_value
+        end
+
+        IMAGE_REGEX.match(docker_image)&.named_captures
+      end
+
       sig { params(parsed_image: T::Hash[String, T.nilable(String)]).returns(T.nilable(String)) }
       def version_from(parsed_image)
         return nil if parsed_image["tag"]&.match?(ENV_VAR)

data/lib/dependabot/docker_compose/file_updater.rb

@@ -34,7 +34,7 @@ module Dependabot
 
       sig { override.params(escaped_declaration: String).returns(Regexp) }
       def build_old_declaration_regex(escaped_declaration)
-        %r{#{IMAGE_REGEX}\s+["']?(docker\.io/)?#{escaped_declaration}["']?(?=\s|$)}
+        %r{#{IMAGE_REGEX}\s+["']?(?:\$\{[^\}:]+:-)?(docker\.io/)?#{escaped_declaration}(?:\})?["']?(?=\s|$)}
       end
 
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-docker_compose
 version: !ruby/object:Gem::Version
-  version: 0.301.1
+  version: 0.302.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-14 00:00:00.000000000 Z
+date: 2025-03-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.301.1
+        version: 0.302.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.301.1
+        version: 0.302.0
 - !ruby/object:Gem::Dependency
   name: dependabot-docker
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.301.1
+        version: 0.302.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.301.1
+        version: 0.302.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -266,7 +266,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.301.1
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.302.0
 post_install_message:
 rdoc_options: []
 require_paths: