🔧 chore(release): v1.5.0-rc.24 (#375)

Cuts v1.5.0-rc.24: #356/#370 Version-column fix, #374 Trivy registry-URL normalization in controller mode, Crowdin translation sync (#373).

Author: scttbnsn

CHANGELOG.md

@@ -10,6 +10,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.0-rc.24] — 2026-05-17
+
+### Changed
+
+- **Translations refreshed from Crowdin (commit [`202f3d83`](https://github.com/CodesWhat/drydock/commit/202f3d83)).** Human translations were synced from Crowdin for the ~110-string rc.23 i18n extraction sweep, updating the 16 non-English locales across the `appShell`, `containerComponents`, `listViews`, `sharedComponents`, `configView`, `agentsView`, and `notificationOutboxView` namespaces. Strings that were previously falling back to English now render in each locale.
+
+### Fixed
+
+- **[#370](https://github.com/CodesWhat/drydock/issues/370) — Containers list "Version" column again shows the human-readable image tag for floating-tag + digest-watch containers, restoring the [#356](https://github.com/CodesWhat/drydock/issues/356) fix that rc.20 inadvertently reverted.** The rc.20 `#342` follow-up (commit `b40d3db8`) added a visible `sha256:… → sha256:…` digest pair to the Containers table "Version" cell and card body for all `updateKind === 'digest'` containers that are not digest-pinned. The intent was to surface the digest transition for hybrid containers where both the tag and the underlying image layer changed simultaneously; however, the change cast too wide a net: it also applied to floating-tag + digest-watch containers (e.g. `prom/prometheus:latest`, `linuxserver/plex` with a transform tag) — exactly the rows that [#356](https://github.com/CodesWhat/drydock/issues/356) fixed to show the human-readable tag instead of raw digest strings. The `updateKind === 'digest' && !isDigestPinned` branch of the table version cell and card body in `ui/src/components/containers/ContainersGroupedViews.vue` has been restored to the rc.19 behaviour: the version cell renders `c.currentTag` as a `CopyableTag` (with the full digest delta in the cell tooltip), and the card body shows only the update-state badge (with the digest delta in the badge tooltip). The digest transition remains visible through the adjacent "kind" column update-state indicator and the container detail panels. Digest-*pinned* containers (where `isDigestPinned` is true) are unaffected and continue to show the `sha256:… → sha256:…` pair directly in the cell.
+
+- **[#374](https://github.com/CodesWhat/drydock/issues/374) — Security scans no longer hand Trivy a raw registry v2 API URL, which had caused every scan in controller mode to fail.** `resolveContainerImageFullName` (`app/api/container/shared.ts`), used by both the security scan scheduler and the container API, falls back to composing the image reference directly from `container.image.registry.url` whenever the container's registry component is not present in the controller's registry state — the normal situation in controller mode (`DD_LOCAL_WATCHER=false`), where registries are configured on the agents rather than on the controller. `registry.url` is stored in the registry v2 API base form (e.g. `https://registry-1.docker.io/v2`), so the fallback produced references such as `https://registry-1.docker.io/v2/dgtlmoon/sockpuppetbrowser:0.0.3`; Trivy then interpreted the scheme as a hostname and every scan failed with `dial tcp: lookup https`. The fallback now mirrors `Registry.getImageFullName`: it strips the URL scheme and the `/v2` path segment and uses an `@` separator for digest references, yielding a plain `registry-1.docker.io/dgtlmoon/sockpuppetbrowser:0.0.3` reference. Containers whose registry component is available are unaffected — they already resolved through the correct `getImageFullName` path.
+
 ## [1.5.0-rc.23] — 2026-05-16
 
 ### Added

app/api/container/shared.test.ts

@@ -6,6 +6,7 @@ import {
   isSensitiveKey,
   redactContainerRuntimeEnv,
   redactContainersRuntimeEnv,
+  resolveContainerImageFullName,
 } from './shared.js';
 
 describe('api/container/shared', () => {
@@ -231,4 +232,74 @@ describe('api/container/shared', () => {
       expect(descriptor?.enumerable).toBe(false);
     });
   });
+
+  describe('resolveContainerImageFullName', () => {
+    function makeContainer(
+      registryName: string,
+      registryUrl: string,
+      imageName: string,
+      tagValue: string,
+    ) {
+      return {
+        image: {
+          registry: { name: registryName, url: registryUrl },
+          name: imageName,
+          tag: { value: tagValue },
+        },
+      } as never;
+    }
+
+    test('normalizes a Docker Hub v2 API base URL in the fallback branch (issue #374 regression guard)', () => {
+      const container = makeContainer(
+        'hub',
+        'https://registry-1.docker.io/v2',
+        'dgtlmoon/sockpuppetbrowser',
+        '0.0.3',
+      );
+      const result = resolveContainerImageFullName(container, {});
+      expect(result).toBe('registry-1.docker.io/dgtlmoon/sockpuppetbrowser:0.0.3');
+      expect(result.startsWith('https://')).toBe(false);
+      expect(result).not.toContain('/v2/');
+    });
+
+    test('normalizes a ghcr.io v2 API base URL in the fallback branch', () => {
+      const container = makeContainer(
+        'ghcr',
+        'https://ghcr.io/v2',
+        'codeswhat/drydock',
+        '1.5.0-rc.22',
+      );
+      const result = resolveContainerImageFullName(container, {});
+      expect(result).toBe('ghcr.io/codeswhat/drydock:1.5.0-rc.22');
+    });
+
+    test('leaves a plain registry host unchanged in the fallback branch', () => {
+      const container = makeContainer('hub', 'fallback-registry', 'test/app', '1.2.3');
+      const result = resolveContainerImageFullName(container, {});
+      expect(result).toBe('fallback-registry/test/app:1.2.3');
+    });
+
+    test('uses an @ separator when the tag override is a digest', () => {
+      const container = makeContainer('ghcr', 'https://ghcr.io/v2', 'codeswhat/drydock', '1.0.0');
+      const result = resolveContainerImageFullName(container, {}, 'sha256:abc123');
+      expect(result).toBe('ghcr.io/codeswhat/drydock@sha256:abc123');
+    });
+
+    test("delegates to the registry component's getImageFullName when available", () => {
+      const container = makeContainer(
+        'hub',
+        'https://registry-1.docker.io/v2',
+        'library/nginx',
+        '1.25',
+      );
+      const registryState = {
+        hub: {
+          getImageFullName: (image: { name: string }, tag: string) =>
+            `resolved:${image.name}:${tag}`,
+        },
+      };
+      const result = resolveContainerImageFullName(container, registryState as never);
+      expect(result).toBe('resolved:library/nginx:1.25');
+    });
+  });
 });

app/api/container/shared.ts

@@ -132,7 +132,16 @@ export function resolveContainerImageFullName(
   if (containerRegistry && typeof containerRegistry.getImageFullName === 'function') {
     return containerRegistry.getImageFullName(container.image, tag);
   }
-  return `${container.image.registry.url}/${container.image.name}:${tag}`;
+  // No registry component is available — controller mode runs registries on
+  // the agents, not the controller. Mirror Registry.getImageFullName so
+  // scanners receive a plain image reference: registry.url is the v2 API base
+  // (e.g. "https://registry-1.docker.io/v2"), which Trivy would otherwise
+  // treat as a literal host, producing "https://https/v2/" DNS failures.
+  // See issue #374.
+  const separator = tag.includes(':') ? '@' : ':';
+  return `${container.image.registry.url}/${container.image.name}${separator}${tag}`
+    .replace(/https?:\/\//, '')
+    .replace(/\/v2/, '');
 }
 
 export async function resolveContainerRegistryAuth(

ui/src/components/containers/ContainersGroupedViews.vue

@@ -645,14 +645,15 @@ onScopeDispose(() => {
               <CopyableTag :tag="c.newDigest" class="container-version-tag container-version-tag-target text-2xs-plus font-semibold" style="color: var(--dd-primary);" @click.stop>{{ formatShortDigest(c.newDigest) }}</CopyableTag>
             </div>
           </div>
+          <!-- #356 / #370 regression guard: non-digest-pinned containers (floating or
+               specific tag with digest watch, e.g. `:latest`, `v8.13.2`) show the
+               human-readable TAG ONLY here — the digest delta belongs in the tooltip.
+               Do NOT render a visible `sha256:… → sha256:…` pair in this branch; that
+               display is for the digest-PINNED branch directly above. This bug has
+               regressed twice (#356 fixed it, b40d3db8 re-broke it → #370). -->
           <div v-else-if="c.updateKind === 'digest' && c.newDigest && c.currentDigest" class="container-version-query">
-            <div class="container-version-flow flex-col items-start gap-0.5">
-              <span class="text-2xs dd-text-muted truncate max-w-[140px]" v-tooltip.top="c.currentTag">{{ c.currentTag }}</span>
-              <div class="container-version-flow">
-                <span class="container-version-tag text-2xs-plus dd-text-secondary" v-tooltip.top="c.currentDigest">{{ formatShortDigest(c.currentDigest) }}</span>
-                <AppIcon name="arrow-right" :size="8" class="container-version-arrow dd-text-muted shrink-0" />
-                <CopyableTag :tag="c.newDigest" class="container-version-tag container-version-tag-target text-2xs-plus font-semibold" style="color: var(--dd-primary);" @click.stop>{{ formatShortDigest(c.newDigest) }}</CopyableTag>
-              </div>
+            <div class="container-version-flow">
+              <CopyableTag :tag="c.currentTag" class="container-version-tag container-version-tag-target text-2xs-plus font-semibold" style="color: var(--dd-primary);" v-tooltip.top="tt(`${c.currentTag} — ${formatShortDigest(c.currentDigest)} → ${formatShortDigest(c.newDigest)}`)" @click.stop>{{ c.currentTag }}</CopyableTag>
             </div>
           </div>
           <div v-else-if="c.newTag" class="container-version-query">
@@ -1059,18 +1060,18 @@ onScopeDispose(() => {
                 </span>
                 <span v-if="c.updateMaturity" class="text-2xs dd-text-muted">{{ getUpdateMaturityLabel(c.updateMaturity) }}</span>
               </template>
+              <!-- #356 / #370 regression guard: non-digest-pinned containers (floating or
+                   specific tag with digest watch, e.g. `:latest`, `v8.13.2`) show the
+                   human-readable TAG ONLY here — the digest delta belongs in the tooltip.
+                   Do NOT render a visible `sha256:… → sha256:…` pair in this branch; that
+                   display is for the digest-PINNED branch directly above. This bug has
+                   regressed twice (#356 fixed it, b40d3db8 re-broke it → #370). -->
               <template v-else-if="c.updateKind === 'digest' && c.newDigest && c.currentDigest">
-                <span class="text-2xs-plus ml-1 dd-text-muted shrink-0">{{ t('containerComponents.groupedViews.latestLabel') }}</span>
-                <CopyableTag :tag="c.currentDigest" class="text-xs dd-text-muted truncate max-w-[80px]" @click.stop>{{ formatShortDigest(c.currentDigest) }}</CopyableTag>
-                <AppIcon name="arrow-right" :size="8" class="dd-text-muted shrink-0" />
-                <CopyableTag :tag="c.newDigest" class="text-xs font-bold truncate max-w-[80px]"
-                      :style="{ color: updateKindColor(c.updateKind).text }" @click.stop>
-                  {{ formatShortDigest(c.newDigest) }}
-                </CopyableTag>
                 <span
                   data-test="container-card-update-state"
-                  class="inline-flex items-center gap-1.5 text-2xs-plus font-semibold"
+                  class="inline-flex items-center gap-1.5 ml-1 text-2xs-plus font-semibold"
                   :style="{ color: getContainerUpdateStateColor(c) }"
+                  v-tooltip.top="tt(`${formatShortDigest(c.currentDigest)} → ${formatShortDigest(c.newDigest)}`)"
                 >
                   <span class="h-2 w-2 shrink-0 rounded-full" :style="{ backgroundColor: getContainerUpdateStateColor(c) }"></span>
                   {{ getContainerUpdateStateLabel(c) }}