Dependabot is based on releases from the various package repositories; running of main is pre-release - hence they’re probably using GitHub Actions to pin their Gemfile-defined Rails version to a commit hash.
Dependabot is for security issues, not this?
dependabot can also be used for regular version updates