dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PR's.

Home Page:https://docs.github.com/en/code-security/dependabot

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Version mismatch while bumping a go dependancy in title and the code

kashifest opened this issue · comments

Is there an existing issue for this?

  • I have searched the existing issues

Package ecosystem

go

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

https://github.com/metal3-io/cluster-api-provider-metal3/blob/main/.github/dependabot.yml

Updated dependency

sigs.k8s.io/controller-runtime from 0.16.5 to 0.16.6

What you expected to see, versus what you actually saw

The title in the PR says its trying to bump sigs.k8s.io/controller-runtime from 0.16.5 to 0.16.6 but in the code it bumps to minor version which it shouldn't
metal3-io/cluster-api-provider-metal3#1799
Theres another PR for a different go module in the same branch where it does things correctly
metal3-io/cluster-api-provider-metal3#1796

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

metal3-io/cluster-api-provider-metal3#1799

Title and code mismatches the version

Smallest manifest that reproduces the issue

No response