dependabot / dependabot/dependabot-core
dependabot ignores multiples versions of the same dependency
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
Docker
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
```shell
$ head ./containers/images/Dockerfile.user_api
# syntax = docker/dockerfile:1
FROM ghcr.io/astral-sh/uv:0.11.4@sha256:5164bf84e7b4e2e08ce0b4c66b4a8c996a286e6959f72ac5c6e0a3c80e8cb04a AS uv
FROM docker.io/library/python:3.14.3-slim-trixie@sha256:5e59aae31ff0e87511226be8e2b94d78c58f05216efda3b07dbbed938ec8583b AS base
$ head ./containers/images/Dockerfile.luggage
# syntax = docker/dockerfile:1
FROM ghcr.io/astral-sh/uv:0.11.4@sha256:5164bf84e7b4e2e08ce0b4c66b4a8c996a286e6959f72ac5c6e0a3c80e8cb04a AS uv
FROM docker.io/library/python:3.12.13-slim-trixie@sha256:5072b08ad74609c5329ab4085a96dfa873de565fb4751a4cfcd7dcc427661df0 AS python
```
### dependabot.yml content
```yaml
version: 2
updates:
- package-ecosystem: docker
directory: "/containers/images"
schedule:
interval: "monthly"
groups:
containerfiles:
patterns: ["*"]
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
- dependency-name: "library/python"
update-types: ["version-update:semver-major", "version-update:semver-minor"]
```
### Updated dependency
PR body:
| Package | From | To |
| --- | --- | --- |
| [astral-sh/uv](https://github.com/astral-sh/uv) | `0.10` | `0.11` |
| library/python | ``5e59aae`` | ``5e59aae`` |
Diff:
```diff
- FROM ghcr.io/astral-sh/uv:0.11.4@sha256:5164bf84e7b4e2e08ce0b4c66b4a8c996a286e6959f72ac5c6e0a3c80e8cb04a AS uv
+ FROM ghcr.io/astral-sh/uv:0.11.8@sha256:3b7b60a81d3c57ef471703e5c83fd4aaa33abcd403596fb22ab07db85ae91347 AS uv
...
- FROM docker.io/library/python:3.12.13-slim-trixie@sha256:5072b08ad74609c5329ab4085a96dfa873de565fb4751a4cfcd7dcc427661df0 AS python
+ FROM docker.io/library/python:3.12.13-slim-trixie@sha256:46cb7cc2877e60fbd5e21a9ae6115c30ace7a077b9f8772da879e4590c18c2e3 AS python
```
### What you expected to see, versus what you actually saw
**What I expect:** both py312 and py314 images are updated
**What I saw:** only the py312 image got updates, and the PR body lists the py314 image hash
This seems to be a recurring theme with dependabot:
* https://github.com/dependabot/dependabot-core/issues/14040#issuecomment-4236198337
* https://github.com/dependabot/dependabot-core/issues/2064
* https://github.com/dependabot/dependabot-core/issues/8050
* https://github.com/dependabot/dependabot-core/issues/14554
* ...
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.