Docker datasource reuses an expired registry token for the rest of a repository run

[ashtonian]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

44.166.0. The code below is unchanged on main.

Please tell us more about your question or problem

getAuthHeaders in lib/modules/datasource/docker/common.ts requests the registry's bearer token with cacheProvider: memCacheProvider. MemoryHttpCacheProvider.bypassServer returns a stored response without checking its age, so the first token issued for a registry and repository scope is reused until the repository run ends. The expires_in in the token response is ignored.

Docker Hub issues tokens with expires_in: 300. The registry then rejects the token with 401 and www-authenticate: Bearer ... error="invalid_token". In a repository run that looks up the same Docker Hub repository again more than five minutes after its first token request, that lookup:

1. gets 401 on the manifest request,
2. logs Unauthorized docker lookup and returns null, and
3. skips the update with Could not determine new digest for update.

Nothing requests a new token. Lookups within the first five minutes succeed, so the failure looks intermittent. It shows up in long repository runs: many image references, or hostRules that throttle registry requests.

Reproduction: the failure needs one repository run that lasts longer than the registry's token lifetime, so I don't have a small reproduction repository. The unit tests in the fix (below) reproduce it by moving the clock past the token's lifetime. They fail on main and pass with the fix.

Expected behavior: Renovate requests a new token once the cached one has expired.

Proposed fix: cache the token together with its expires_in and replace it shortly before it expires. When expires_in is omitted, use 60 seconds, the default in the distribution token specification. Concurrent lookups keep sharing one token request, and a failed token request is not cached. I have this ready with unit tests and can open a PR.

Logs (if relevant)

No response

[ashtonian]

Fix with tests: #47316