Go modules with version v0.0.0-xxx incorrectly marked by go_updater as not vulnerable in security updates

[ByAgenT]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

go_modules

Package manager version

go1.20.10

Language version

go1.11

Manifest location and content before the Dependabot update

go.mod

module issue_repro_example

require (
	golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e
)

go 1.11

dependabot.yml content

No response

Updated dependency

golang.org/x/net from v0.0.0-20190108225652-1e06a53dbb7e to v0.1.0

What you expected to see, versus what you actually saw

Expected: Dependabot should create Pull Request that upgrades dependency to version v0.1.0

Actual: Dependabot returns security_update_not_needed error claiming that dependency with version v0.0.0-20190108225652-1e06a53dbb7e is no longer vulnerable.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

module issue_repro_example

require (
	golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e
)

go 1.11

Dependabot Job yaml example for reproduction (security advisory based on GHSA-39qc-96h7-956f):

job:
    dependencies:
        - golang.org/x/net
    security-advisories:
        - dependency-name: golang.org/x/net
          affected-versions:
            - '>= 0, < 0.0.0-20190813141303-74dc4d7220e7'
    existing-pull-requests: []
    security-updates-only: true
    source:
      directory: /
      provider: github
      repo: ByAgenT/dependabot_go_modules
      branch: main
    package-manager: go_modules