dependabot rebase jumped the tracks

[dkfellows]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

Maven

Package manager version

No response

Language version

Java 11, 14, 17

Manifest location and content before the Dependabot update

Project: https://github.com/SpiNNakerManchester/JavaSpiNNaker
Manifest: /pom.xml

dependabot.yml content

https://github.com/SpiNNakerManchester/JavaSpiNNaker/blob/master/.github/dependabot.yml

Updated dependency

Spring Boot, 2.7.14 → 2.7.15 / 3.1.3

What you expected to see, versus what you actually saw

Dependabot submitted a PR to update Spring Boot from 2.7.14 to 2.7.15. Due to other things going on (permission issue), the PR failed to build automatically along with multiple others submitted at the same time. I fixed that problem and told Dependabot to @dependabot rebase to pick up the fix. So far so ordinary.

But the rebased version was no longer a change from 2.7.14 to 2.7.15 but rather to 3.1.3, a different major version with rather a lot of significant changes that made many aspects of the build fail. (I have a branch where this version is in use, but can't update my primary branch to it yet due to messy deployment restrictions.) This is not what I'd expect from a rebase. I would expect something more like a classic git rebase.

It was easy to work around once I saw what it'd unexpectedly done, but very much not as expected.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

• Bump spring.boot.version from 2.7.14 to 2.7.15 SpiNNakerManchester/JavaSpiNNaker#1014

Smallest manifest that reproduces the issue

No response

[yeikel]

Wow, that's quite the bug. Thanks for logging it

Everything about this is wrong, because even the commit is misleading

SpiNNakerManchester/JavaSpiNNaker@aca8a6b

The commit that started it all was SpiNNakerManchester/JavaSpiNNaker@01775a4

As it says Updates org.springframework.boot:spring-boot-starter from 2.7.14 to 2.7.15 when it is updating to 3.1.3

[huehnerlady]

We run into the same error, what is the update no this? It has been open for months and is quite a severe bug...