Repository navigation
build(deps): bump dunglas/frankenphp from static-builder-musl-1.12.4 to static-builder-musl-1.12.6 in the docker group across 1 directory - #337
Merged
Conversation
dependabot
Bot
added
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This was referenced Aug 15, 2026
Collaborator
|
@dependabot rebase |
dependabot
Bot
changed the title
f839cbe to 3cb1170 in the docker groupf839cbe to 3cb1170 in the docker group across 1 directory
dependabot
Bot
force-pushed
the
dependabot/docker/docker-31d6bfe641
branch
from
August 15, 2026 14:21
ab72578 to
b075564
Compare
lens0021
added a commit
that referenced
this pull request
Aug 15, 2026
All three base images were pinned on tags that carry no version (`composer:2`, `mediawiki:1.46-fpm-alpine`, `dunglas/frankenphp:static-builder-musl`). Dependabot's idea of the "version" is then the digest string, so a Docker PR is a digest-to-digest diff that says nothing: #337 reads `bump dunglas/frankenphp from f839cbe to 3cb1170` when it is really FrankenPHP 1.12.4 to 1.12.7. Dependabot's docker tag parser does understand prefix+version tags (`VERSION_WITH_PFX` in `dependabot-core`'s `docker/lib/dependabot/docker/tag.rb`), so `static-builder-musl-1.12.4` parses as prefix `static-builder-musl-` plus version `1.12.4`. This PR writes the version-bearing tag next to the digest that was already pinned. ## What changed | image | old pin | new pin | actual version of that digest | | --- | --- | --- | --- | | composer | `composer:2@sha256:4d71c3c2` | `composer:2.10.2@sha256:4d71c3c2` | 2.10.2 | | mediawiki | `mediawiki:1.46-fpm-alpine@sha256:b0e9413c` | `mediawiki:1.46.0-fpm-alpine@sha256:b0e9413c` | 1.46.0 | | dunglas/frankenphp | `...:static-builder-musl@sha256:f839cbec` | `...:static-builder-musl-1.12.4@sha256:f839cbec` | v1.12.4 | **No digest changed.** Every `FROM` still resolves to the exact same image bytes it did before, and the tag is only a label: Docker resolves `name:tag@digest` by digest. Verification, with `skopeo` against Docker Hub: - `composer:2.10.2` → `sha256:4d71c3c2…`, identical to the pinned digest and to what `composer:2` resolves to today. Its config carries `COMPOSER_VERSION=2.10.2`. - `mediawiki:1.46.0-fpm-alpine` → `sha256:b0e9413c…`, identical to the pinned digest and to what `mediawiki:1.46-fpm-alpine` resolves to today. Its config carries `MEDIAWIKI_VERSION=1.46.0`. - `dunglas/frankenphp@sha256:f839cbec…` carries the label `org.opencontainers.image.version=v1.12.4`, so the tag written here names the right version. One honest caveat: upstream rebuilt the `static-builder-musl-1.12.4` tag on 2026-07-19, so that tag now points at `sha256:4b4f493a…` (also labelled v1.12.4). This PR deliberately keeps the digest we already had rather than following the moved tag, so nothing pulled changes here either. ## dependabot.yml grouping `composer:2` and `mediawiki:1.46-fpm-alpine` encoded "stay on this stream" in the tag itself, and full version tags drop that guard. The answer is not to re-add the ceiling as `ignore` rules: a Composer 3 or MediaWiki 1.47 release is exactly the thing worth hearing about, and an ignored update is silently invisible. Dependabot should propose it and let a human decide. What the tags did carry, and what is worth keeping, is blast radius. So the docker entry groups by risk instead: - `mediawiki` gets its own group. A dependency joins the first group it matches, so a release-branch move always arrives as its own pull request, with the `REL*` CI matrix and extension bumps it needs, and never holds routine patches hostage. - the catch-all `docker` group takes `update-types: [minor, patch]`, so majors (Composer 3, FrankenPHP 2) leave the group and arrive as individual pull requests too. Everything still flows; nothing is suppressed. The difference is that a risky bump can no longer ride along inside an otherwise routine grouped PR. ## About #337 Untouched by this PR. Once this merges, #337 will conflict; the fix is to comment `@dependabot recreate` on it. The recreated PR will read as a version bump rather than a digest swap. Note that upstream has not published a `static-builder-musl-1.12.7` tag yet (the highest versioned tag today is `-1.12.6`, while the floating `static-builder-musl` tag currently carries a v1.12.7 build), so the recreated PR will most likely target 1.12.6. ## Lint `yamllint --strict .` with the repo's pinned 1.38.0 passes. No Dockerfile linter is configured in CI, and no local Docker build was run; CI builds the images. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps the docker group with 1 update in the / directory: dunglas/frankenphp. Updates `dunglas/frankenphp` from static-builder-musl-1.12.4 to static-builder-musl-1.12.6 --- updated-dependencies: - dependency-name: dunglas/frankenphp dependency-version: static-builder-musl dependency-type: direct:production dependency-group: docker ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
f839cbe to 3cb1170 in the docker group across 1 directory
dependabot
Bot
force-pushed
the
dependabot/docker/docker-31d6bfe641
branch
from
August 15, 2026 14:25
b075564 to
6f2ca40
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the docker group with 1 update in the / directory: dunglas/frankenphp.
Updates
dunglas/frankenphpfrom static-builder-musl-1.12.4 to static-builder-musl-1.12.6