Ubuntu numeric tag gets updated to named tag with timestamp

[sass1997]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitlab

Please tell us more about your question or problem

I currently struggle how to prevent tag updates to named tag of ubuntu image.

I currently have an image in my .gitlab-ci.yml

image: ubuntu:25.04@sha256:3fa335765c57a9ef67f62ef33b4411266c576f4dbdd9d5255f5da2ac306e021f

Renovate wants to update it now to

image: ubuntu:plucky-20250402@sha256:3fa335765c57a9ef67f62ef33b4411266c576f4dbdd9d5255f5da2ac306e021f

Is there another a setting to not allow this named releases?

Logs (if relevant)

Logs

DEBUG: packageFiles with updates (repository=xxx, baseBranch=main)
       "config": {
         "gitlabci": [
           {
             "packageFile": ".gitlab-ci.yml",
             "deps": [
               {
                 "depName": "ubuntu",
                 "currentValue": "25.04",
                 "currentDigest": "sha256:3fa335765c57a9ef67f62ef33b4411266c576f4dbdd9d5255f5da2ac306e021f",
                 "replaceString": "ubuntu:25.04@sha256:3fa335765c57a9ef67f62ef33b4411266c576f4dbdd9d5255f5da2ac306e021f",
                 "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
                 "datasource": "docker",
                 "versioning": "ubuntu",
                 "depType": "image",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "plucky-20250402",
                     "newValue": "plucky-20250402",
                     "newDigest": "sha256:3fa335765c57a9ef67f62ef33b4411266c576f4dbdd9d5255f5da2ac306e021f",
                     "releaseTimestamp": "2025-04-09T08:04:55.059Z",
                     "newVersionAgeInDays": 7,
                     "newMajor": 25,
                     "newMinor": 4,
                     "newPatch": null,
                     "updateType": "patch",
                     "branchName": "fix/renovate-ubuntu-25.x"
                   }
                 ],
                 "packageName": "ubuntu",
                 "warnings": [],
                 "registryUrl": "https://index.docker.io",
                 "lookupName": "library/ubuntu",
                 "currentVersion": "25.04",
                 "currentVersionTimestamp": "2025-04-09T08:04:35.305Z",
                 "currentVersionAgeInDays": 7,
                 "isSingleVersion": true,
                 "fixedVersion": "25.04"
               }
             ]
           }
         ]
       }

[github-actions[bot]]

Hi there,

Please locate the debug message packageFiles with updates in your logs and paste the contents here. Depending on your question, we may need the full list of packages or only one.

If you self-host Renovate: make sure you run Renovate with LOG_LEVEL=debug to get the debug log messages! Next, open the debug-level logs and search for packageFiles with updates. This text marks the start of a structured log message that shows every package file, dependency, and update that Renovate found.

Find the relevant dependency/dependencies in the log message, and copy/paste those parts into this discussion. If you do not know which bits we need, you can copy/paste the full log message.

Read the Renovate docs, Troubleshooting to learn more about getting the docs, and getting the correct type of logs.

Thanks, the Renovate team

[sass1997]

DEBUG: packageFiles with updates (repository=xxx, baseBranch=main)
       "config": {
         "gitlabci": [
           {
             "packageFile": ".gitlab-ci.yml",
             "deps": [
               {
                 "depName": "ubuntu",
                 "currentValue": "25.04",
                 "currentDigest": "sha256:3fa335765c57a9ef67f62ef33b4411266c576f4dbdd9d5255f5da2ac306e021f",
                 "replaceString": "ubuntu:25.04@sha256:3fa335765c57a9ef67f62ef33b4411266c576f4dbdd9d5255f5da2ac306e021f",
                 "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
                 "datasource": "docker",
                 "versioning": "ubuntu",
                 "depType": "image",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "plucky-20250402",
                     "newValue": "plucky-20250402",
                     "newDigest": "sha256:3fa335765c57a9ef67f62ef33b4411266c576f4dbdd9d5255f5da2ac306e021f",
                     "releaseTimestamp": "2025-04-09T08:04:55.059Z",
                     "newVersionAgeInDays": 7,
                     "newMajor": 25,
                     "newMinor": 4,
                     "newPatch": null,
                     "updateType": "patch",
                     "branchName": "fix/renovate-ubuntu-25.x"
                   }
                 ],
                 "packageName": "ubuntu",
                 "warnings": [],
                 "registryUrl": "https://index.docker.io",
                 "lookupName": "library/ubuntu",
                 "currentVersion": "25.04",
                 "currentVersionTimestamp": "2025-04-09T08:04:35.305Z",
                 "currentVersionAgeInDays": 7,
                 "isSingleVersion": true,
                 "fixedVersion": "25.04"
               }
             ]
           }
         ]
       }

[rarkins]

This shouldn't be happening, however until it's fixed you should be able to work around it by settings a regex pattern for allowedVersions for this dependency, e.g.

{
  "matchPackageNames": ["ubuntu"],
  "matchCurrentVersion": "/^\\d+/",
  "allowedVersions": "/^\\d+/"
}