dependabot / dependabot/dependabot-core
Dependabot's Docker integration is incorrectly "upgrading" mcr's devcontainers/javascript-node artifacts to versions with less semver specificity
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
Docker
### Package manager version
docker-compose
### Language version
_No response_
### Manifest location and content before the Dependabot update
.devcontainer/docker-compose.yml:
```yaml
services:
devcontainer:
image: mcr.microsoft.com/devcontainers/javascript-node:4.0.13-24-trixie
command: sleep infinity
volumes:
- ..:/workspaces/example:cached
```
### dependabot.yml content
```yaml
version: 2
- package-ecosystem: "docker-compose"
directory: "/.devcontainer"
schedule:
interval: "daily"
commit-message:
prefix: "[devcontainers] "
labels:
- "dependencies"
- "devcontainers"
- "devcontainer-containers"
```
### Updated dependency
Bumps devcontainers/javascript-node from 4.0.13-24-trixie to 4-22-trixie
For https://mcr.microsoft.com/en-us/artifact/mar/devcontainers/javascript-node/tags
### What you expected to see, versus what you actually saw
Dependabot is trying to "update" `4.0.13-trixie` or `4.0.13-24-trixie` to `4-22-trixie`. Seemingly interpreting `4-22-trixie` as 4.22 when it's actually any v4 of devcontainers/javascript-node with Node.js v22 and Debian Trixie which is of a lower version specificity "4.0.13" downgraded to "4.x.x." and a downgrade of Node.js from v24 to v22. I think that it goes with `4-22-trixie` instead of `4-24-trixie` because `4-24-trixie` points to the same image as `4.0.13-trixie` and `4.0.13-24-trixie`.
Dependabot shouldn't consider this an upgrade. `4.0.13-trixie`/`4.0.13-24-trixie` is the latest upgrade so right now it should just not make a PR and in the future when a tag like like `4.0.14-trixie` or `4.1.0-24-trixie` shows up create a PR then.
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
```
2026/07/07 22:53:45 INFO Checking and updating versions pull requests...
updater | 2026/07/07 22:53:45 INFO Checking if devcontainers/javascript-node 4.0.13-24-trixie needs updating
proxy | 2026/07/07 22:53:45 [016] GET [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/tags/list](https://mcr.microsoft.com/v2/devcontainers/javascript-node/tags/list)
proxy | 2026/07/07 22:53:46 [016] 200 [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/tags/list](https://mcr.microsoft.com/v2/devcontainers/javascript-node/tags/list)
updater | 2026/07/07 22:53:46 INFO Original tag components: trixie
proxy | 2026/07/07 22:53:46 [018] HEAD [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/latest](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/latest)
proxy | 2026/07/07 22:53:46 [018] 200 [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/latest](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/latest)
proxy | 2026/07/07 22:53:46 [020] HEAD [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/24](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/24)
proxy | 2026/07/07 22:53:46 [020] 200 [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/24](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/24)
proxy | 2026/07/07 22:53:47 [022] HEAD [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie)
proxy | 2026/07/07 22:53:47 [022] 200 [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie)
proxy | 2026/07/07 22:53:47 [024] HEAD [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4-24-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4-24-trixie)
proxy | 2026/07/07 22:53:47 [024] 200 [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4-24-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4-24-trixie)
proxy | 2026/07/07 22:53:47 [026] HEAD [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie)
2026/07/07 22:53:47 [026] 200 [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie) (cached)
proxy | 2026/07/07 22:53:47 [028] GET [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie)
proxy | 2026/07/07 22:53:47 [028] 200 [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4.0.13-24-trixie)
proxy | 2026/07/07 22:53:47 [030] GET [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4-24-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4-24-trixie)
proxy | 2026/07/07 22:53:47 [030] 200 [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4-24-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4-24-trixie)
updater | 2026/07/07 22:53:47 INFO Digest check: 4-24-trixie has the same image contents as 4.0.13-24-trixie — no update needed, staying on 4.0.13-24-trixie
proxy | 2026/07/07 22:53:47 [032] HEAD [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4-22-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4-22-trixie)
proxy | 2026/07/07 22:53:47 [032] 200 [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4-22-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4-22-trixie)
proxy | 2026/07/07 22:53:47 [034] GET [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4-22-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4-22-trixie)
proxy | 2026/07/07 22:53:47 [034] 200 [https://mcr.microsoft.com:443/v2/devcontainers/javascript-node/manifests/4-22-trixie](https://mcr.microsoft.com/v2/devcontainers/javascript-node/manifests/4-22-trixie)
updater | 2026/07/07 22:53:47 INFO Latest version is 4-22-trixie
updater | 2026/07/07 22:53:47 INFO Requirements to unlock own
updater | 2026/07/07 22:53:47 INFO Requirements update strategy
updater | 2026/07/07 22:53:47 INFO Updating devcontainers/javascript-node from 4.0.13-24-trixie to 4-22-trixie
updater | 2026/07/07 22:53:47 INFO Submitting devcontainers/javascript-node pull request for update
```
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.