feat: enhance version matching to skip Docker image tags with extended build identifiers

Author: CasperKristiansson

CHANGELOG.md

@@ -8,6 +8,12 @@ The project follows [Semantic Versioning](https://semver.org/) and adheres to th
 
 - Nothing yet.
 
+## [1.6.1] - 2025-10-14
+
+### Fixed
+
+- Stop treating Docker image tags with additional dotted build metadata (such as AWS Lambda runtimes) as CPython patch pins, preventing invalid tag rewrites (#8).
+
 ## [1.6.0] - 2025-10-10
 
 ### Added

src/scanning/patterns/python-version.ts

@@ -183,6 +183,14 @@ export function findPythonVersionMatches(filePath: string, content: string): Ver
 
         const relativeIndex = match[0].indexOf(version);
         const versionIndex = match.index + (relativeIndex >= 0 ? relativeIndex : 0);
+        const patchContinuationIndex = versionIndex + version.length;
+        const nextChar = content[patchContinuationIndex];
+        const nextNextChar = content[patchContinuationIndex + 1];
+
+        if (nextChar === '.' && nextNextChar && /\d/.test(nextNextChar)) {
+          continue;
+        }
+
         const position = indexToPosition(content, versionIndex);
 
         results.push({

tests/python-version-patterns.test.ts

@@ -29,6 +29,14 @@ describe('findPythonVersionMatches', () => {
     expect(matches.map((match) => match.matched)).toEqual(['3.13.2', '3.12.8', '3.12.8']);
   });
 
+  it('skips Docker image tags with extended build identifiers', () => {
+    const content = `FROM public.ecr.aws/lambda/python:3.13.2025.08.15.14\n`;
+
+    const matches = findPythonVersionMatches('Dockerfile', content);
+
+    expect(matches).toHaveLength(0);
+  });
+
   it('reads the version from .python-version files', () => {
     const matches = findPythonVersionMatches('.python-version', '3.10.14\n');