Grouped package update being assigned to multiple Dependabot groups

[edmorley]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

Cargo

Package manager version

1.72

Language version

1.72

Manifest location and content before the Dependabot update

https://github.com/heroku/languages-github-actions/blob/e3c1fe2066215a6b20ace90150474351a885a716/Cargo.toml
https://github.com/heroku/languages-github-actions/blob/e3c1fe2066215a6b20ace90150474351a885a716/Cargo.lock

dependabot.yml content

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"
  - package-ecosystem: "cargo"
    directory: "/"
    schedule:
      interval: "monthly"
    groups:
      libcnb:
        patterns:
          - "libcnb*"
          - "libherokubuildpack"
      rust-dependencies:
        update-types:
          - "minor"
          - "patch"

Updated dependency

See: heroku/languages-github-actions#137

What you expected to see, versus what you actually saw

The Dependabot docs for the new grouped updates feature say:

Dependabot creates groups in the order they appear in your dependabot.yml file. If a dependency update could belong to more than one group, it is only assigned to the first group it matches with.

However, we're seeing the libcnb-data and libcnb-package packages being assigned to both the libcnb and rust-dependencies groups, even though they should be only seen in the libcnb group PR.

libcnb group (correct):
heroku/languages-github-actions#120

rust-dependencies group (not correct, the libcnb packages shouldn't be in here):
heroku/languages-github-actions#137

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response

[jurre]

@edmorley I think this is the same issue as what's described here? #7915

Let's keep track of things over there!

PS: Appreciate all your feedback 🙇