From d06c03008049a6f2d114299c68bcf76e9817d384 Mon Sep 17 00:00:00 2001 From: HardMax71 Date: Tue, 6 Oct 2026 20:29:37 +0200 Subject: [PATCH 1/3] Note that Dependabot cooldown for Docker only covers Docker Hub images --- .../supply-chain-security/dependabot-options-reference.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md index 01d39a3ada2b..e1dcc20e5c2f 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md +++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md @@ -289,6 +289,7 @@ The table below shows the package managers that support `cooldown`. The `default > > * If `semver-major-days`, `semver-minor-days`, or `semver-patch-days` are not defined, the `default-days` settings will take precedence for cooldown-based updates. > * The `exclude` list always take precedence over the `include` list. If a dependency is specified in both lists, it is **excluded from cooldown** and will be updated immediately. +> * For Docker and Docker Compose, the cooldown only applies to images on Docker Hub, the only registry {% data variables.product.prodname_dependabot %} reads a publication date from. For images in other registries, such as the {% data variables.product.prodname_container_registry %}, {% data variables.product.prodname_dependabot %} skips the cooldown and proposes the newest tag right away, with a note in the pull request that the cooldown could not be applied. {% endif %} From e240e7ea6aca95a29f70e739d7fdc3c2d4a4cec1 Mon Sep 17 00:00:00 2001 From: mc <42146119+mchammer01@users.noreply.github.com> Date: Mon, 12 Oct 2026 11:08:55 +0100 Subject: [PATCH 2/3] Update content/code-security/reference/supply-chain-security/dependabot-options-reference.md --- .../supply-chain-security/dependabot-options-reference.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md index e1dcc20e5c2f..95ed95811f02 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md +++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md @@ -289,7 +289,7 @@ The table below shows the package managers that support `cooldown`. The `default > > * If `semver-major-days`, `semver-minor-days`, or `semver-patch-days` are not defined, the `default-days` settings will take precedence for cooldown-based updates. > * The `exclude` list always take precedence over the `include` list. If a dependency is specified in both lists, it is **excluded from cooldown** and will be updated immediately. -> * For Docker and Docker Compose, the cooldown only applies to images on Docker Hub, the only registry {% data variables.product.prodname_dependabot %} reads a publication date from. For images in other registries, such as the {% data variables.product.prodname_container_registry %}, {% data variables.product.prodname_dependabot %} skips the cooldown and proposes the newest tag right away, with a note in the pull request that the cooldown could not be applied. +> * For Docker and Docker Compose, the cooldown only applies to images on Docker Hub, the only registry {% data variables.product.prodname_dependabot %} reads a publication date from. For images in other registries, such as the {% data variables.product.prodname_container_registry %}, {% data variables.product.prodname_dependabot %} skips the cooldown and proposes the newest tag immediately, with a note in the pull request that the cooldown could not be applied. {% endif %} From 7a9d1ef58e2cafa009db4660b47cbded7f071edb Mon Sep 17 00:00:00 2001 From: HardMax71 Date: Tue, 20 Oct 2026 00:30:19 +0200 Subject: [PATCH 3/3] Show the Docker cooldown note on fpt and ghec only and mention replaces-base --- .../supply-chain-security/dependabot-options-reference.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md index 95ed95811f02..6bfd23f72254 100644 --- a/content/code-security/reference/supply-chain-security/dependabot-options-reference.md +++ b/content/code-security/reference/supply-chain-security/dependabot-options-reference.md @@ -289,7 +289,9 @@ The table below shows the package managers that support `cooldown`. The `default > > * If `semver-major-days`, `semver-minor-days`, or `semver-patch-days` are not defined, the `default-days` settings will take precedence for cooldown-based updates. > * The `exclude` list always take precedence over the `include` list. If a dependency is specified in both lists, it is **excluded from cooldown** and will be updated immediately. -> * For Docker and Docker Compose, the cooldown only applies to images on Docker Hub, the only registry {% data variables.product.prodname_dependabot %} reads a publication date from. For images in other registries, such as the {% data variables.product.prodname_container_registry %}, {% data variables.product.prodname_dependabot %} skips the cooldown and proposes the newest tag immediately, with a note in the pull request that the cooldown could not be applied. +{%- ifversion fpt or ghec %} +> * For Docker and Docker Compose, the cooldown only applies to images that {% data variables.product.prodname_dependabot %} looks up on Docker Hub, the only registry it reads a publication date from. For images in other registries, such as the {% data variables.product.prodname_container_registry %}, {% data variables.product.prodname_dependabot %} skips the cooldown and proposes the newest tag immediately, with a note in the pull request that the cooldown could not be applied. The same happens for Docker Hub images when a private Docker registry is configured with `replaces-base: true`. +{%- endif %} {% endif %}