Dependabot does not find latest commit - github

Question

I'm exploring how Dependabot works and it isn't working as I expect.
I've created 2 private Golang repos (one, two) with one depending on two:
one's go.mod:
module github.com/dazwilkin/one
go 1.17
require github.com/dazwilkin/two v0.0.0-20210927170438-e7aa41e4107b
NOTE e7aa41e4107b is a prior commit intentionally in order to check VS Code's and Dependabot's update checking.
And dependabot.yml:
version: 2
updates:
- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "daily"
two's 2 most recent commits are:
curl \
--silent \
--header "Authorization: Bearer ${TOKEN}" \
https://api.github.com/repos/${OWNER}/${REPO}/commits \
| jq -r '.[]|{"sha":.sha,"date":.commit.committer.date}'
And:
{
"sha": "b2f2074829aa61218d7e38f27bb6051ccd97ab7a",
"date": "2021-09-27T18:03:33Z"
}
{
"sha": "e7aa41e4107b8c28f99cadfe55b831380730e808",
"date": "2021-09-27T17:04:38Z"
}
NOTE b2f2074829aa is the commit I'm expecting to be told about and e7aa41e4107b is the prior commit on two that one continues to reference.
VS Code quickly determined that an update is available and:
go list -m -u all
github.com/dazwilkin/one
github.com/dazwilkin/two v0.0.0-20210927170438-e7aa41e4107b [v0.0.0-20210927180333-b2f2074829aa]
NOTE Correctly identifying the latest commit (b2f2074829aa) to replace the prior commit (e7aa41e4107b)
But, after 22 hours and repeated forced updates, dependabot continues to report that e7aa41e4107b is current:
updater | INFO <job_214390230> Starting job processing
updater | INFO <job_214390230> Starting update job for DazWilkin/one
updater | INFO <job_214390230> Checking if github.com/dazwilkin/two 0.0.0-20210927170438-e7aa41e4107b needs updating
updater | INFO <job_214390230> Latest version is 0.0.0-20210927170438-e7aa41e4107b
updater | INFO <job_214390230> No update needed for github.com/dazwilkin/two 0.0.0-20210927170438-e7aa41e4107b
updater | INFO <job_214390230> Finished job processing
NOTE Dependabot appears to have no issue accessing github.com/dazwilkin/two but it doesn't find the most recent commit.
Is this just an eventual consistency issue and I need wait longer?
Update I've waited another 24 hours and it continues to find the earlier commit as the latest version
Or am I misunderstanding or misconfiguring Dependabot?
One perhaps relevant issue that my GitHub account is mixed-case DazWilkin but, for simplicity, I'm publishing and referencing the Golang Modules using all-lowercase (github.com/dazwilkin). However Dependabot appears to have no issues finding the prior commit.

Answer 1

I believe this is because dependabot doesn't support pseudoversions - https://github.com/dependabot/dependabot-core/issues/3017