Skip to content

Docker version parser can treat suffixes as part of the version umber #13864

@brettfo

Description

@brettfo

Dependabot can create an improper docker update with the following contents:

-FROM mcr.microsoft.com/dotnet/framework/runtime:4.8.1-windowsservercore-ltsc2022
+FROM mcr.microsoft.com/dotnet/framework/runtime:4.8-20250909-windowsservercore-ltsc2022

This is because the string 20250909 is treated as part of the version number.

Expanding this test case to include the following scenario shows the behavior:

expect(described_class.new("4.8.1-windowsservercore-ltsc2022")).to be > described_class.new("4.8-20250909-windowsservercore-ltsc2022")

Test output:

expected: > #<Dependabot::Docker::Version "4.8.20250909">
     got:   #<Dependabot::Docker::Version "4.8.1">

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions