Docker: Dependabot offers `golang:1.21rc4` as update instead of `golang:1.20.14`

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

Docker

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

Path:

/dependabot/docker/go/Dockerfile

Permalink:

• https://github.com/atc0005/bridge/blob/ad508312fcc67b1fe8a48e4fccd1cd7639d9ac61/dependabot/docker/go/Dockerfile

dependabot.yml content

Permalink to file:

• https://github.com/atc0005/bridge/blob/ad508312fcc67b1fe8a48e4fccd1cd7639d9ac61/.github/dependabot.yml

What I believe to be the relevant snippet:

  - package-ecosystem: docker
    directory: "/dependabot/docker/go"
    open-pull-requests-limit: 10
    target-branch: "master"
    schedule:
      interval: "daily"
      time: "02:00"
      timezone: "America/Chicago"
    assignees:
      - "atc0005"
    labels:
      - "dependencies"
      - "CI"
    allow:
      - dependency-type: "all"
    commit-message:
      prefix: "canary"
    ignore:
      - dependency-name: "golang"
        versions:
          - ">= 1.21"
          - "< 1.20"

This snippet attempts to constrain offered updates to the 1.20 series of Go releases.

Updated dependency

The dependency is the golang image currently at 1.20.13.

The proposed update is 1.21rc4 instead of the expected 1.20.14 update.

What you expected to see, versus what you actually saw

I expected Dependabot to offer 1.20.14 as the next update. Instead, it offered a release candidate version of the 1.21 series (1.21rc4) instead of the latest stable version of the 1.21 series.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

PR link:

• https://github.com/atc0005/bridge/pull/415

diff --git a/dependabot/docker/go/Dockerfile b/dependabot/docker/go/Dockerfile
index 657b269..eacab8c 100644
--- a/dependabot/docker/go/Dockerfile
+++ b/dependabot/docker/go/Dockerfile
@@ -15,4 +15,4 @@
 # binaries) to reflect that version of Go.
 
 # https://hub.docker.com/_/golang
-FROM golang:1.20.13
+FROM golang:1.21rc4

refs: https://patch-diff.githubusercontent.com/raw/atc0005/bridge/pull/415.diff

Smallest manifest that reproduces the issue

No response

Start with dependabot/docker/go/Dockerfile and the relevant Docker entry in .github/dependabot.yml, then compare the configured ignore ranges with the update shown in PR 415. Reproduce the golang 1.20.13 to 1.21rc4 proposal and verify that the expected result is the latest 1.20 release, 1.20.14.