dependabot (gomod) upgrades "minor" versions when it says it is upgrading "patch" versions

[julio-lopez]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

gomod

Package manager version

Go 1.19

Language version

Go 1.19

Manifest location and content before the Dependabot update

https://github.com/kanisterio/kanister/blob/0ec651b1a6a5a10ad98c5fd1698aa673d72c4d70/go.mod

dependabot.yml content

https://github.com/kanisterio/kanister/blob/0ec651b1a6a5a10ad98c5fd1698aa673d72c4d70/.github/dependabot.yml

Updated dependency

Various in the k8s.io/* group, from 0.26.3 to supposedly 0.26.x (0.26.7).

See PR here kanisterio/kanister#2207

What you expected to see, versus what you actually saw

Expected

An update of the k8s.io/* packages with a patch upgrade. There is an ignore rule in the config for this. The PR message and description misleadingly appear to indicate that patch updates are being performed.

Bumps the k8s group with 6 updates:

Package	Update
k8s.io/api	0.26.3 to 0.26.7
k8s.io/apiextensions-apiserver	0.26.3 to 0.26.7
k8s.io/cli-runtime	0.26.3 to 0.26.7
k8s.io/kubectl	0.26.3 to 0.26.7
sigs.k8s.io/controller-runtime	0.14.6 to 0.15.0
sigs.k8s.io/kustomize/kyaml	0.13.9 to 0.14.3

See PR: kanisterio/kanister#2207 (comment)

Actual result

A minor (not patch) version upgrade of the k8s.io/* packages (from 0.26.x => 0.27.x), which is inconsistent with the PR message and the expected behavior according to the configuration.

See resulting go.mod file in the corresponding PR https://github.com/kanisterio/kanister/pull/2207/files

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

kanisterio/kanister#2207

Smallest manifest that reproduces the issue

No response

[julio-lopez]

Update: there was a little bit of user error here. (My bad)

It turns out our dependabot config had a typo. See kanisterio/kanister#2218

Nevertheless, the resulting behavior was confusing, misleading and probably undesirable.

After fixing that, dependabot opened a PR that matches the expected behavior. See kanisterio/kanister#2220

Thanks folks for dependabot, and for continuing improving it, it is extremely valuable to developers.