Java AWS SDK patch versions aren't considered minor versions by dependabot

[eivindkopperud]

Hi 👋 First time poster here, sorry if this is not the right place for this.

Quick background

I've been using dependabot for a while now. I tend to set my config up to always ignore patch versions 👇

# .github/dependabot.yml

version: 2
updates:
  - package-ecosystem: "gradle" # .. or any other ecosystem for that matter
    directory: "/"
    schedule:
      interval: "daily"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-patch"]

Upon some recent work, I noticed that Java AWS SDK kept on spamming with patch updates PRs, even though the configuration above was applied. All other dependencies behaved well - i.e. only minor and major versions were suggested updated.

How I fixed it

After fiddling around, I just tried ignoring _minor_versions for these specific packages.

# .github/dependabot.yml

    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-patch"]
      - dependency-name: "software.amazon.awssdk:*"
        update-types: ["version-update:semver-minor"]

After I applied these, dependabot closed all PRs for patch updates of any software.amazon.awssdk dependency.
Great! But it would have been greater if I didn't have to investigate this myself.

Q: How can this be fixed?

Is this a dependabot bug, or is the Java AWS SDK not following semantic versioning in the expected way? I don't really see where this went wrong, so would love to have someone with a bit more knowledge help us out here ❤️

Links

Here's a link to my minimal repoducible example. I just created it, and hope that dependabot will kick in soon.

[eivindkopperud]

Scratch that. It works as expected in my MRE. Might have been using an old version with some poor versioning semantics or something in the other project.