Dependabot not ignoring major semver changes #5758

lcooper01 · 2022-09-20T15:29:04Z

Is there an existing issue for this?

I have searched the existing issues

Package ecosystem

Docker

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

version: 2
updates:
  - package-ecosystem: "docker" # See documentation for possible values
    directory: "/" # Location of package manifests
    schedule:
      interval: "daily"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

Updated dependency

eclipse-temurin from 11.0.14.1_1-jre-alpine to 11.0.16.1_1-jre-alpine

What you expected to see, versus what you actually saw

Expected

eclipse-temurin from 11.0.14.1_1-jre-alpine to 11.0.16.1_1-jre-alpine

Actual

eclipse-temurin from 11.0.14.1_1-jre-alpine to 17.0.4_8-jre-alpine

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

  proxy | time="2022-09-20T15:23:11Z" level=info msg="proxy starting" commit=b031647dc5f52d8120800fc16337727989cb9be0
  proxy | 2022/09/20 15:23:11 Listening (:1080)
updater | 2022-09-20T15:23:11.959085124 [anonymous-instance:main:WARN:src/firecracker/src/main.rs:370] You are using a deprecated parameter: --seccomp-level 2, that will be removed in a future version.
updater | 2022-09-20T15:23:12.024873453 [465689105:main:WARN:src/devices/src/legacy/serial.rs:432] Detached the serial input due to peer close/error.
updater | time="2022-09-20T15:23:15Z" level=info msg="guest starting" commit=d97478b458e198f9b9a6cb546d902ee2e6651286
updater | time="2022-09-20T15:23:15Z" level=info msg="starting job..." fetcher_timeout=5m0s job_id=465689105 updater_timeout=45m0s updater_version=614fafdba436f058e32b92f1fc0a6ea940fe5c01
updater | I, [2022-09-20T15:23:18.755226 #7]  INFO -- sentry: ** [Raven] Raven 3.1.2 ready to catch errors
updater | To use retry middleware with Faraday v2.0+, install `faraday-retry` gem
updater | INFO <job_465689105> Starting job processing
  proxy | 2022/09/20 15:23:24 [002] GET https://api.github.com:443/repos/elcoops99/test-dependabot
  proxy | 2022/09/20 15:23:24 [002] * authenticating github api request
  proxy | 2022/09/20 15:23:24 [002] 200 https://api.github.com:443/repos/elcoops99/test-dependabot
  proxy | 2022/09/20 15:23:24 [004] GET https://api.github.com:443/repos/elcoops99/test-dependabot/git/refs/heads/main
  proxy | 2022/09/20 15:23:24 [004] * authenticating github api request
  proxy | 2022/09/20 15:23:24 [004] 200 https://api.github.com:443/repos/elcoops99/test-dependabot/git/refs/heads/main
  proxy | 2022/09/20 15:23:24 [006] GET https://api.github.com:443/repos/elcoops99/test-dependabot/contents/?ref=6c206aa384501da277a6f9fe6fa43b369cb9c503
  proxy | 2022/09/20 15:23:24 [006] * authenticating github api request
  proxy | 2022/09/20 15:23:24 [006] 200 https://api.github.com:443/repos/elcoops99/test-dependabot/contents/?ref=6c206aa384501da277a6f9fe6fa43b369cb9c503
  proxy | 2022/09/20 15:23:24 [008] GET https://api.github.com:443/repos/elcoops99/test-dependabot/contents/Dockerfile?ref=6c206aa384501da277a6f9fe6fa43b369cb9c503
  proxy | 2022/09/20 15:23:24 [008] * authenticating github api request
  proxy | 2022/09/20 15:23:25 [008] 200 https://api.github.com:443/repos/elcoops99/test-dependabot/contents/Dockerfile?ref=6c206aa384501da277a6f9fe6fa43b369cb9c503
updater | INFO <job_465689105> Finished job processing
updater | time="2022-09-20T15:23:25Z" level=info msg="task complete" container_id=job-465689105-file-fetcher exit_code=0 job_id=465689105 step=fetcher
updater | I, [2022-09-20T15:23:26.921430 #7]  INFO -- sentry: ** [Raven] Raven 3.1.2 ready to catch errors
updater | To use retry middleware with Faraday v2.0+, install `faraday-retry` gem
updater | INFO <job_465689105> Starting job processing
updater | INFO <job_465689105> Starting update job for elcoops99/test-dependabot
updater | INFO <job_465689105> Checking if eclipse-temurin 11.0.14.1_1-jre-alpine needs updating
updater | INFO <job_465689105> Ignored versions:
updater | INFO <job_465689105>   version-update:semver-major - from .github/dependabot.yml
  proxy | 2022/09/20 15:23:30 [012] GET https://registry.hub.docker.com:443/v2/library/eclipse-temurin/tags/list
  proxy | 2022/09/20 15:23:30 [012] 401 https://registry.hub.docker.com:443/v2/library/eclipse-temurin/tags/list
  proxy | 2022/09/20 15:23:31 [014] GET https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Alibrary%2Feclipse-temurin%3Apull
  proxy | 2022/09/20 15:23:31 [014] 200 https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Alibrary%2Feclipse-temurin%3Apull
  proxy | 2022/09/20 15:23:31 [016] GET https://registry.hub.docker.com:443/v2/library/eclipse-temurin/tags/list
  proxy | 2022/09/20 15:23:31 [016] 200 https://registry.hub.docker.com:443/v2/library/eclipse-temurin/tags/list
  proxy | 2022/09/20 15:23:31 [018] HEAD https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/latest
  proxy | 2022/09/20 15:23:31 [018] 401 https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/latest
  proxy | 2022/09/20 15:23:31 [020] GET https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Alibrary%2Feclipse-temurin%3Apull
  proxy | 2022/09/20 15:23:31 [020] 200 https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Alibrary%2Feclipse-temurin%3Apull
  proxy | 2022/09/20 15:23:31 [022] HEAD https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/latest
  proxy | 2022/09/20 15:23:31 [022] 200 https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/latest
  proxy | 2022/09/20 15:23:31 [024] HEAD https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/18
  proxy | 2022/09/20 15:23:31 [024] 401 https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/18
  proxy | 2022/09/20 15:23:32 [026] GET https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Alibrary%2Feclipse-temurin%3Apull
  proxy | 2022/09/20 15:23:32 [026] 200 https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Alibrary%2Feclipse-temurin%3Apull
  proxy | 2022/09/20 15:23:32 [028] HEAD https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/18
  proxy | 2022/09/20 15:23:32 [028] 200 https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/18
updater | INFO <job_465689105> Latest version is 17.0.4_8-jre-alpine
  proxy | 2022/09/20 15:23:32 [030] HEAD https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/11.0.14.1_1-jre-alpine
  proxy | 2022/09/20 15:23:32 [030] 401 https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/11.0.14.1_1-jre-alpine
  proxy | 2022/09/20 15:23:32 [032] GET https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Alibrary%2Feclipse-temurin%3Apull
  proxy | 2022/09/20 15:23:32 [032] 200 https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Alibrary%2Feclipse-temurin%3Apull
  proxy | 2022/09/20 15:23:32 [034] HEAD https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/11.0.14.1_1-jre-alpine
  proxy | 2022/09/20 15:23:32 [034] 200 https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/11.0.14.1_1-jre-alpine
  proxy | 2022/09/20 15:23:32 [036] HEAD https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/17.0.4_8-jre-alpine
  proxy | 2022/09/20 15:23:32 [036] 401 https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/17.0.4_8-jre-alpine
  proxy | 2022/09/20 15:23:32 [038] GET https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Alibrary%2Feclipse-temurin%3Apull
  proxy | 2022/09/20 15:23:32 [038] 200 https://auth.docker.io:443/token?service=registry.docker.io&scope=repository%3Alibrary%2Feclipse-temurin%3Apull
  proxy | 2022/09/20 15:23:32 [040] HEAD https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/17.0.4_8-jre-alpine
  proxy | 2022/09/20 15:23:32 [040] 200 https://registry.hub.docker.com:443/v2/library/eclipse-temurin/manifests/17.0.4_8-jre-alpine
updater | INFO <job_465689105> Pull request already exists for eclipse-temurin with latest version 17.0.4_8-jre-alpine
updater | INFO <job_465689105> Finished job processing
updater | time="2022-09-20T15:23:33Z" level=info msg="task complete" container_id=job-465689105-updater exit_code=0 job_id=465689105 step=updater

Smallest manifest that reproduces the issue

FROM eclipse-temurin:11.0.14.1_1-jre-alpine as java11

The text was updated successfully, but these errors were encountered:

jeffwidman · 2022-09-20T21:50:36Z

Background context here: #5728 (comment)

Your config looks correct to me to ignore major semver changes, so this looks like a bug, but unrelated to #5734.

Unfortunately this one doesn't have a lot of impacted users, so probably will take a bit to get to it.

If you want to help, try running the dry-run script locally (I highly suggest running within the docker container as explained in the readme section just above that). And then add some puts statements or even a breakpoint to step through and see whether the problem is that the code doesn't think it's a major version bump or if the code simply never guards against major version bumps...

Anything you can do to make it quicker for us to fix increases the chance we'll get to it. Also, feel free to put together a PR with a failing test case--you can see an example of how to create one for the docker ecosystem in #5734.

lcooper01 · 2022-09-21T15:09:30Z

Hi @jeffwidman

I would love to help as much as I can but forgive me I have no prior experience in Ruby. However I have tried to add in a couple of puts statement where I think it's running an if statement to determine if any ignore conditions are set (in this block)

This resulted in the message outputting saying there are no ignore conditions present (log at the bottom).

def ignored_versions_for(dep)
  if $options[:ignore_conditions].any?
    puts "Ignore Conditions are present"
    ignore_conditions = $options[:ignore_conditions].map do |ic|
      Dependabot::Config::IgnoreCondition.new(
        dependency_name: ic["dependency-name"],
        versions: [ic["version-requirement"]].compact,
        update_types: ic["update-types"]
      )
    end
    Dependabot::Config::UpdateConfig.new(ignore_conditions: ignore_conditions).
      ignored_versions_for(dep, security_updates_only: $options[:security_updates_only])
  else
    puts "No ignore conditions present"
    $update_config.ignored_versions_for(dep)
  end
end

[dependabot-core-dev] ~/dependabot-core $ bin/dry-run.rb docker lcooper01/test-dependabot
To use retry middleware with Faraday v2.0+, install `faraday-retry` gem
=> fetching dependency files
=> dumping fetched dependency files: ./dry-run/lcooper01/test-dependabot/
=> parsing dependency files
=> updating 1 dependencies: eclipse-temurin
No ignore conditions present

=== eclipse-temurin (11.0.14.1_1-jre-alpine)
 => checking for updates 1/1
 => latest available version is 17.0.4_8-jre-alpine
 => latest allowed version is 17.0.4_8-jre-alpine
 => requirements to unlock: own
 => requirements update strategy: 
 => updating eclipse-temurin from 11.0.14.1_1-jre-alpine to 17.0.4_8-jre-alpine

    ± Dockerfile
    ~~~
    1c1
    < FROM eclipse-temurin:11.0.14.1_1-jre-alpine as java11
    ---
    > FROM eclipse-temurin:17.0.4_8-jre-alpine as java11
    ~~~
🌍 Total requests made: '0'

deivid-rodriguez · 2022-10-13T21:44:04Z

Hei @lcooper01!

Nice start of the investigation. Your conclusion is correct, dry-run.rb does not use ignore conditions by default, although you can pass them in a very cumbersome way, like this

IGNORE_CONDITIONS='[{"dependency-name":"*","update-types": ["version-update:semver-major"]}]' bin/dry-run.rb docker lcooper01/test-dependabot`

Happily using your sample repository I was able to identify the problem and I will open a PR shortly 🎉.

lcooper01 · 2022-10-17T10:17:16Z

Great news, thanks @deivid-rodriguez

deivid-rodriguez · 2022-11-13T22:02:07Z

I completely forgot about this 🙏! Opened a PR to fix this now at #6115.

lcooper01 · 2022-11-16T16:27:26Z

@deivid-rodriguez
thanks so much for putting together the PR, do you know when its scheduled to be merged ?

deivid-rodriguez · 2022-11-16T16:29:45Z

I still want to try tweak it a bit to make it less invasive, will make it as ready after that and once it gets approved I'll merge it.

guilhemferr · 2022-12-20T21:14:50Z

just facing this same issue, any update you can give us @deivid-rodriguez?

deivid-rodriguez · 2022-12-28T14:56:25Z

Hei @guilhemferr. The PR was rebased and I decided that the original approach was good enough. It also got a review from @Nishnha, so I hope to ship it very soon!

Bert-R · 2023-01-25T09:44:43Z

@deivid-rodriguez Is this still on the radar? We really appreciate the work you did in #6115, but it is quiet for about a month now.

deivid-rodriguez · 2023-01-25T12:45:51Z

Yes @Bert-R, sorry for the delay there, it was a busy month for me. Trying to catch up now and shipping improvements like that one.

deivid-rodriguez · 2023-02-08T16:12:47Z

Finally got around shipping this. Please let me know if something unexpected comes up!

Bert-R · 2023-02-08T20:03:31Z

@deivid-rodriguez Thanks a lot! When can we expect to see this in production?

deivid-rodriguez · 2023-02-08T20:04:14Z

It already is!

Bert-R · 2023-02-08T20:23:25Z

Tested it and it works

Now that dependabot/dependabot-core#5758 is closed, it's possible to instruct Dependabot to ignore major version updates for Java

lcooper01 · 2023-02-15T17:11:24Z

I tested it and it works if you have one FROM statement in the dockerfile.

If you have the config for two images in the Dockerfile it will only pickup the first FROM and creates only one pr for the repo rather than 2.

deivid-rodriguez · 2023-02-15T17:13:41Z

@lcooper01 So Dependabot was creating two PRs to an incorrect version, while now it is creating just one PR to a correct version, is that it? Could you open a separate issue about this? If you can also create a sample repository, that'd be even more awesome!

lcooper01 · 2023-02-16T09:57:07Z

I'll do that and link it here so anyone can track it whos interested

lcooper01 · 2023-02-20T11:50:13Z

@deivid-rodriguez I've put together another issue and tried a few different scenarios that I've tried to document. If any of them aren't clear or need reproducing to show any additional logs etc then please let me know.

#6700

lcooper01 added the T: bug 🐞 Something isn't working label Sep 20, 2022

jeffwidman added the L: docker Docker containers label Sep 20, 2022

deivid-rodriguez mentioned this issue Nov 13, 2022

Support version-update:ignore-{patch,minor,major} in docker ecosystem #6115

Merged

Bert-R mentioned this issue Jan 25, 2023

Update Dockerfile to use current JDK version obsidiandynamics/kafdrop#463

Merged

jeffwidman added the F: dependency-ignores Allow excluding certain versions label Feb 3, 2023

deivid-rodriguez closed this as completed in #6115 Feb 8, 2023

Bert-R added a commit to Bert-R/kafdrop that referenced this issue Feb 9, 2023

Dependabot: ignore major Java version updates

7836939

Now that dependabot/dependabot-core#5758 is closed, it's possible to instruct Dependabot to ignore major version updates for Java

Bert-R mentioned this issue Feb 9, 2023

Dependabot: ignore major Java version updates obsidiandynamics/kafdrop#466

Merged

davideicardi pushed a commit to obsidiandynamics/kafdrop that referenced this issue Feb 14, 2023

Dependabot: ignore major Java version updates

851f5b5

Now that dependabot/dependabot-core#5758 is closed, it's possible to instruct Dependabot to ignore major version updates for Java

lcooper01 mentioned this issue Feb 20, 2023

Dependabot only raises one PR where 2 FROM statements exist in Dockerfile #6700

Open

1 task

jeffwidman mentioned this issue Apr 7, 2023

Document some other useful options for the dry-run script #7020

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Dependabot not ignoring major semver changes #5758

Dependabot not ignoring major semver changes #5758

lcooper01 commented Sep 20, 2022 •

edited

jeffwidman commented Sep 20, 2022

lcooper01 commented Sep 21, 2022 •

edited

deivid-rodriguez commented Oct 13, 2022

lcooper01 commented Oct 17, 2022

deivid-rodriguez commented Nov 13, 2022

lcooper01 commented Nov 16, 2022

deivid-rodriguez commented Nov 16, 2022

guilhemferr commented Dec 20, 2022

deivid-rodriguez commented Dec 28, 2022

Bert-R commented Jan 25, 2023

deivid-rodriguez commented Jan 25, 2023

deivid-rodriguez commented Feb 8, 2023

Bert-R commented Feb 8, 2023

deivid-rodriguez commented Feb 8, 2023

Bert-R commented Feb 8, 2023

lcooper01 commented Feb 15, 2023

deivid-rodriguez commented Feb 15, 2023

lcooper01 commented Feb 16, 2023

lcooper01 commented Feb 20, 2023

Dependabot not ignoring major semver changes #5758

Dependabot not ignoring major semver changes #5758

Comments

lcooper01 commented Sep 20, 2022 • edited

Is there an existing issue for this?

Package ecosystem

Package manager version

Language version

Manifest location and content before the Dependabot update

dependabot.yml content

Updated dependency

What you expected to see, versus what you actually saw

Native package manager behavior

Images of the diff or a link to the PR, issue, or logs

Smallest manifest that reproduces the issue

jeffwidman commented Sep 20, 2022

lcooper01 commented Sep 21, 2022 • edited

deivid-rodriguez commented Oct 13, 2022

lcooper01 commented Oct 17, 2022

deivid-rodriguez commented Nov 13, 2022

lcooper01 commented Nov 16, 2022

deivid-rodriguez commented Nov 16, 2022

guilhemferr commented Dec 20, 2022

deivid-rodriguez commented Dec 28, 2022

Bert-R commented Jan 25, 2023

deivid-rodriguez commented Jan 25, 2023

deivid-rodriguez commented Feb 8, 2023

Bert-R commented Feb 8, 2023

deivid-rodriguez commented Feb 8, 2023

Bert-R commented Feb 8, 2023

lcooper01 commented Feb 15, 2023

deivid-rodriguez commented Feb 15, 2023

lcooper01 commented Feb 16, 2023

lcooper01 commented Feb 20, 2023

lcooper01 commented Sep 20, 2022 •

edited

lcooper01 commented Sep 21, 2022 •

edited