v1 not a tag - dependabot suddenly bumping from 1 to 1.300.0

[liskin]

A couple days ago dependabot started opening PRs changing uses: ruby/setup-ruby@v1 to …@v1.300.0:
https://github.com/search?q=%22bump+ruby%2Fsetup-ruby+from+1+to+1.300.0%22&type=pullrequests

That doesn't look right. I can see that v1 is now a branch, which would explain this. I'm just not sure if this is a change in dependabot, or if setup-ruby switched from using a tag to a branch.

[ntkme]

v1 in this repo has always been a branch, not a tag.

The dependabot PRs you linked are very strange. I have a few repositories using setup-ruby@v1, that dependabot checks daily but is not creating any PRs like the linked ones.

I spot checked a few repositories who are getting those weird PRs and it seems they all have a commonality in the dependabot config:

  cooldown:
    default-days: 7

My repositories do not have cooldown config, and I’m not getting update from v1 to v1.300.0. I suspect this is a bug (or feature?) in dependabot when handling cooldown config.

[liskin]

That's an excellent observation with the cooldown. I may have just added that a few days ago. Thanks!

[eregon]

I went through the list and commented on all open & merged PRs which changed
from uses: ruby/setup-ruby@v1 to uses: ruby/setup-ruby@v1.300.0 for awareness.

The usual recommendation is either use @v1 and automatically get updates, or pin to a sha (and update it regularly) if you want full security.
The middle ground of updating to a tag seems not very useful, as an attacker might be able to write to tags too if they can already write to a branch.
I added a new ruleset to make all tags non-updatable and non-deletable though, seems good anyway.

[eregon]

I suppose updating to an older tag achieves the purpose of lagging N days behind the last release, but updating to a tag and not a sha seems quite odd.