Note that Dependabot cooldown for Docker only covers Docker Hub images

[HardMax71]

Why:

Closes: #46208

What's being changed (if available, include any code snippets, screenshots, or gifs):

One bullet added to the note under the cooldown support table in the Dependabot options reference: for Docker and Docker Compose the cooldown only applies to images on Docker Hub. For images in other registries, such as the Container registry, Dependabot skips the cooldown, proposes the newest tag and says so in the pull request. The source is the "Cooldown publication dates" section of the dependabot-core docker README and registry_tag_release_date in the docker update checker (links in the issue).

Check off the following:

• A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
• The changes in this PR meet the docs fundamentals that are required for all content.
• All CI checks are passing and the changes look good in the review environment.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
code-security/reference/supply-chain-security/dependabot-options-reference.md	fpt ghec ghes@ 3.22 3.21 3.20 3.19 3.18	fpt ghec ghes@ 3.22 3.21 3.20 3.19 3.18

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[subatoi]

Thanks @HardMax71, I'll get this triaged for review and consideration by the appropriate team

[mchammer01]

@HardMax71 👋🏻 - thanks for catching this and for the clear write-up ✨
I'm approving from an editorial point of view; the wording is clear and fits the existing note format (I'll apply a tiny suggestion I made).
I'll loop in a GitHub SME to confirm the technical accuracy of the Docker Hub/registry behavior described here before this merges.

[carlincherry]

Approving with 2 requested changes: 1) fpt and ghec only (no ghes), 2) replaces-base (Dependabot reads the date only when it looks up an image on Docker Hub directly. If a private Docker registry is configured with replaces-base: true, Dependabot looks up Docker Hub images in that registry instead, so they skip the cooldown too)

[carlincherry]

Suggested change

	> * For Docker and Docker Compose, the cooldown only applies to images on Docker Hub, the only registry {% data variables.product.prodname_dependabot %} reads a publication date from. For images in other registries, such as the {% data variables.product.prodname_container_registry %}, {% data variables.product.prodname_dependabot %} skips the cooldown and proposes the newest tag immediately, with a note in the pull request that the cooldown could not be applied.
	{%- ifversion fpt or ghec %}
	> * For Docker and Docker Compose, the cooldown only applies to images that {% data variables.product.prodname_dependabot %} looks up on Docker Hub, the only registry it reads a publication date from. For images in other registries, such as the {% data variables.product.prodname_container_registry %}, {% data variables.product.prodname_dependabot %} skips the cooldown and proposes the newest tag immediately, with a note in the pull request that the cooldown could not be applied. The same happens for Docker Hub images when a private Docker registry is configured with `replaces-base: true`.
	{%- endif %}

[HardMax71]

Resolved in 7a9d1ef: fpt and ghec only, plus the replaces-base sentence.