Docker: Dependabot offers golang:1.21rc4 as update instead of golang:1.20.14 #9007
Description
Is there an existing issue for this?
- I have searched the existing issues
Package ecosystem
Docker
Package manager version
No response
Language version
No response
Manifest location and content before the Dependabot update
Path:
/dependabot/docker/go/Dockerfile
Permalink:
dependabot.yml content
Permalink to file:
What I believe to be the relevant snippet:
- package-ecosystem: docker
directory: "/dependabot/docker/go"
open-pull-requests-limit: 10
target-branch: "master"
schedule:
interval: "daily"
time: "02:00"
timezone: "America/Chicago"
assignees:
- "atc0005"
labels:
- "dependencies"
- "CI"
allow:
- dependency-type: "all"
commit-message:
prefix: "canary"
ignore:
- dependency-name: "golang"
versions:
- ">= 1.21"
- "< 1.20"This snippet attempts to constrain offered updates to the 1.20 series of Go releases.
Updated dependency
The dependency is the golang image currently at 1.20.13.
The proposed update is 1.21rc4 instead of the expected 1.20.14 update.
What you expected to see, versus what you actually saw
I expected Dependabot to offer 1.20.14 as the next update. Instead, it offered a release candidate version of the 1.21 series (1.21rc4) instead of the latest stable version of the 1.21 series.
Native package manager behavior
No response
Images of the diff or a link to the PR, issue, or logs
PR link:
diff --git a/dependabot/docker/go/Dockerfile b/dependabot/docker/go/Dockerfile
index 657b269..eacab8c 100644
--- a/dependabot/docker/go/Dockerfile
+++ b/dependabot/docker/go/Dockerfile
@@ -15,4 +15,4 @@
# binaries) to reflect that version of Go.
# https://hub.docker.com/_/golang
-FROM golang:1.20.13
+FROM golang:1.21rc4refs: https://patch-diff.githubusercontent.com/raw/atc0005/bridge/pull/415.diff
Smallest manifest that reproduces the issue
No response