dependabot / dependabot/dependabot-core
Dependabot only raises one PR where 2 FROM statements exist in Dockerfile
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
Docker
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
```
version: 2
updates:
- package-ecosystem: "docker" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "daily"
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
```
### Updated dependency
```
eclipse-temurin from 11.0.14.1_1-jre-alpine to 11.0.18_10-jre-alpine
```
and
```
eclipse-temurin from 17.0.5_8-jre-alpine to 17.0.6_10-jre-alpine
```
### What you expected to see, versus what you actually saw
Following on from the original issue of the complex version not being picked up.
https://github.com/dependabot/dependabot-core/issues/5758
Expected two PR's created. One for java11 and one for java17 minor updates.
Only one PR created which bumps both java11 and java17 to the java17 updated version
https://github.com/lcooper01/test-dependabot/pull/6
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
This PR shows both images being bumped to the same java17 increment as java17 from is top of file
https://github.com/lcooper01/test-dependabot/pull/6
After moving java 11 to the top of the file and running dependabot again:
It tells us the PR already exists to bump java11
```
updater | INFO Pull request already exists for eclipse-temurin with latest version 11.0.18_10-jre-alpine
```
Tried closing the PR and rerunning dependabot but still says pr exists.
Therefore opened a new repo to put java11 at the top of the file which then no pr would raise
https://github.com/lcooper01/test-dependabot-java11/
Removed java17 and then the pr raised successfully for java11
https://github.com/lcooper01/test-dependabot-java11/pull/1/files
Added java17 back in and reran dependabot which then says there is an existing pr for java11 again.
```
updater | INFO Pull request already exists for eclipse-temurin with latest version 11.0.18_10-jre-alpine
```
### Smallest manifest that reproduces the issue
In the order below both images are bumped
```
FROM eclipse-temurin:17.0.5_8-jre-alpine as java-17
FROM eclipse-temurin:11.0.14.1_1-jre-alpine as java11
```
In the order below no pr is created
```
FROM eclipse-temurin:11.0.14.1_1-jre-alpine as java11
FROM eclipse-temurin:17.0.5_8-jre-alpine as java-17
```
Contributor guide
Research direction
Start with the smallest Dockerfile in the issue and reproduce the result with the two FROM statements in each order. Trace the Docker dependency updater using the reported Dependabot logs and linked example PRs, then verify that separate updates are created for the Java 11 and Java 17 images without incorrectly reusing an existing PR.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100