Dependabot for Composer ignores group sequence, listing updates in the wrong group

[drubb]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

Composer

Package manager version

2.8.4

Language version

PHP 8.3

Manifest location and content before the Dependabot update

No response

dependabot.yml content

Excerpt:

groups:
      drupal-core:
        patterns:
          - "drupal/core*"
      drupal-contrib:
        patterns:
          - "drupal/*"
          - "drush/*"
      assets:
        patterns:
          - "npm-asset/*"
      misc:
        patterns:
          - "*"

Updated dependency

drupal/core-composer-scaffold
drupal/core-recommended

What you expected to see, versus what you actually saw

Updates for the mentioned packages are listed in the "drupal-contrib" group, not in "drupal-core" as expected.
It used to work correctly. No changes to dependabot.yml.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response