dependabot / dependabot/dependabot-core

dependabot ignores multiples versions of the same dependency

Open
#14,974 0 comments 1 reaction 1 assignee Claimed by @markhallen View on GitHub
L: docker L: python L: python:uv T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

Docker

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

```shell
$ head ./containers/images/Dockerfile.user_api
# syntax = docker/dockerfile:1

FROM ghcr.io/astral-sh/uv:0.11.4@sha256:5164bf84e7b4e2e08ce0b4c66b4a8c996a286e6959f72ac5c6e0a3c80e8cb04a AS uv

FROM docker.io/library/python:3.14.3-slim-trixie@sha256:5e59aae31ff0e87511226be8e2b94d78c58f05216efda3b07dbbed938ec8583b AS base

$ head ./containers/images/Dockerfile.luggage
# syntax = docker/dockerfile:1

FROM ghcr.io/astral-sh/uv:0.11.4@sha256:5164bf84e7b4e2e08ce0b4c66b4a8c996a286e6959f72ac5c6e0a3c80e8cb04a AS uv

FROM docker.io/library/python:3.12.13-slim-trixie@sha256:5072b08ad74609c5329ab4085a96dfa873de565fb4751a4cfcd7dcc427661df0 AS python
```

### dependabot.yml content

```yaml
version: 2
updates:
- package-ecosystem: docker
directory: "/containers/images"
schedule:
interval: "monthly"
groups:
containerfiles:
patterns: ["*"]
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
- dependency-name: "library/python"
update-types: ["version-update:semver-major", "version-update:semver-minor"]
```

### Updated dependency

PR body:

| Package | From | To |
| --- | --- | --- |
| [astral-sh/uv](https://github.com/astral-sh/uv) | `0.10` | `0.11` |
| library/python | ``5e59aae`` | ``5e59aae`` |

Diff:

```diff
- FROM ghcr.io/astral-sh/uv:0.11.4@sha256:5164bf84e7b4e2e08ce0b4c66b4a8c996a286e6959f72ac5c6e0a3c80e8cb04a AS uv
+ FROM ghcr.io/astral-sh/uv:0.11.8@sha256:3b7b60a81d3c57ef471703e5c83fd4aaa33abcd403596fb22ab07db85ae91347 AS uv
...
- FROM docker.io/library/python:3.12.13-slim-trixie@sha256:5072b08ad74609c5329ab4085a96dfa873de565fb4751a4cfcd7dcc427661df0 AS python
+ FROM docker.io/library/python:3.12.13-slim-trixie@sha256:46cb7cc2877e60fbd5e21a9ae6115c30ace7a077b9f8772da879e4590c18c2e3 AS python
```

### What you expected to see, versus what you actually saw

**What I expect:** both py312 and py314 images are updated

**What I saw:** only the py312 image got updates, and the PR body lists the py314 image hash

This seems to be a recurring theme with dependabot:
* https://github.com/dependabot/dependabot-core/issues/14040#issuecomment-4236198337
* https://github.com/dependabot/dependabot-core/issues/2064
* https://github.com/dependabot/dependabot-core/issues/8050
* https://github.com/dependabot/dependabot-core/issues/14554
* ...

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.