Repository navigation
Conversation
github-actions
Bot
added
the
triage
subatoi
added
content
|
Thanks @HardMax71, I'll get this triaged for review and consideration by the appropriate team |
There was a problem hiding this comment.
@HardMax71 👋🏻 - thanks for catching this and for the clear write-up ✨
I'm approving from an editorial point of view; the wording is clear and fits the existing note format (I'll apply a tiny suggestion I made).
I'll loop in a GitHub SME to confirm the technical accuracy of the Docker Hub/registry behavior described here before this merges.
…ot-options-reference.md
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
carlincherry
left a comment
carlincherry
left a comment
There was a problem hiding this comment.
Approving with 2 requested changes: 1) fpt and ghec only (no ghes), 2) replaces-base (Dependabot reads the date only when it looks up an image on Docker Hub directly. If a private Docker registry is configured with replaces-base: true, Dependabot looks up Docker Hub images in that registry instead, so they skip the cooldown too)
| > | ||
| > * If `semver-major-days`, `semver-minor-days`, or `semver-patch-days` are not defined, the `default-days` settings will take precedence for cooldown-based updates. | ||
| > * The `exclude` list always take precedence over the `include` list. If a dependency is specified in both lists, it is **excluded from cooldown** and will be updated immediately. | ||
| > * For Docker and Docker Compose, the cooldown only applies to images on Docker Hub, the only registry {% data variables.product.prodname_dependabot %} reads a publication date from. For images in other registries, such as the {% data variables.product.prodname_container_registry %}, {% data variables.product.prodname_dependabot %} skips the cooldown and proposes the newest tag immediately, with a note in the pull request that the cooldown could not be applied. |
There was a problem hiding this comment.
Resolved in 7a9d1ef: fpt and ghec only, plus the replaces-base sentence.
Why:
Closes: #46208
What's being changed (if available, include any code snippets, screenshots, or gifs):
One bullet added to the note under the
cooldownsupport table in the Dependabot options reference: for Docker and Docker Compose the cooldown only applies to images on Docker Hub. For images in other registries, such as the Container registry, Dependabot skips the cooldown, proposes the newest tag and says so in the pull request. The source is the "Cooldown publication dates" section of the dependabot-core docker README andregistry_tag_release_datein the docker update checker (links in the issue).Check off the following: