Dependabot options reference: Docker cooldown only applies to Docker Hub images #46208

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#configuration-of-cooldown

What part(s) of the article would you like to see updated?

The table of package managers that support cooldown marks Docker and Docker Compose as supporting default-days, with no caveat. In practice the cooldown only applies to images on Docker Hub. For an image on ghcr.io (or any other registry), Dependabot has no publication date, skips the cooldown and proposes the newest tag. The job log says No verified registry publication date source for ghcr.io; skipping cooldown for <image>:<tag>, and the pull request body says "Cooldown could not be applied because no publication date was available from the registry."

This is intended in dependabot-core. The "Cooldown publication dates" section of the docker README says Docker Hub's tag_last_pushed is the only accepted date source and that GHCR dates are unavailable (docker/README.md#L51-L65, added in dependabot/dependabot-core#16143), and registry_tag_release_date returns a date only for Docker Hub (update_checker.rb#L492-L499). Docker Compose uses the same update checker. Only this page doesn't say it, so a cooldown set for a ghcr.io image looks like it works.

Suggested change: a bullet in the note under the table saying that for Docker and Docker Compose the cooldown only covers Docker Hub images, and that images in other registries skip it. I'll open a PR with that.

Additional information

We noticed it with ghcr.io/astral-sh/uv pinned as a build stage and cooldown: default-days: 7: each uv release was proposed 2 to 4 days after the image was built.