Composer version constraints ignored

[lpoirothattermann]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

Composer

Package manager version

No response

Language version

PHP 8.2.9

Manifest location and content before the Dependabot update

{
"name": "laravel/laravel",
"type": "project",
"description": "The Laravel Framework.",
"keywords": ["framework", "laravel"],
"license": "MIT",
"require": {
"php": "^8.2.9",
"ext-openssl": "*",
"guzzlehttp/guzzle": "^7.2",
"intervention/image": "^2.7",
"laravel/framework": "^10.0",
"laravel/sanctum": "^3.0",
"laravel/telescope": "^4.9",
"laravel/tinker": "^2.7",
"league/flysystem-aws-s3-v3": "^3.0",
"livewire/livewire": "^2.10",
"simplesoftwareio/simple-qrcode": "~4",
"spatie/laravel-markdown": "^2.3",
"staudenmeir/laravel-cte": "^1.0",
"wire-elements/modal": "^1.0"
},
"require-dev": {
"barryvdh/laravel-debugbar": "^3.7",
"barryvdh/laravel-ide-helper": "^2.13",
"fakerphp/faker": "^1.9.1",
"laravel/breeze": "^1.14",
"laravel/pint": "^1.0",
"laravel/sail": "^1.0.1",
"mockery/mockery": "^1.4.4",
"nunomaduro/collision": "^7.0",
"nunomaduro/phpinsights": "^2.8",
"phpunit/phpunit": "^10.0",
"revolution/sail-db-backup": "^2.0",
"spatie/laravel-ignition": "^2.0"
},
"autoload": {
"psr-4": {
"App\": "app/",
"Database\Factories\": "database/factories/",
"Database\Seeders\": "database/seeders/"
}
},
"autoload-dev": {
"psr-4": {
"Tests\": "tests/"
}
},
"scripts": {
"post-autoload-dump": [
"Illuminate\Foundation\ComposerScripts::postAutoloadDump",
"@php artisan package:discover --ansi"
],
"post-update-cmd": [
"@php artisan vendor:publish --tag=laravel-assets --ansi --force"
],
"post-root-package-install": [
"@php -r "file_exists('.env') || copy('.env.example', '.env');""
],
"post-create-project-cmd": [
"@php artisan key:generate --ansi"
]
},
"extra": {
"laravel": {
"dont-discover": []
}
},
"config": {
"optimize-autoloader": true,
"preferred-install": "dist",
"sort-packages": true,
"allow-plugins": {
"pestphp/pest-plugin": true,
"dealerdirect/phpcodesniffer-composer-installer": true
}
},
"minimum-stability": "stable",
"prefer-stable": true
}

dependabot.yml content

version: 2
updates:

• package-ecosystem: "composer" # See documentation for possible values
  directory: "/" # Location of package manifests
  schedule:
  interval: "weekly"

Updated dependency

What you expected to see, versus what you actually saw

I expect to see no update, because I'm already at the highest version that satisfy my package constraint:
"license": "MIT",
"require": {
"php": "^8.2.9",
...
"intervention/image": "^2.7",
...
},

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response