From 18919ecfa6c8e349d1a8027656cbe79fbb09a4ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amaury=20Lev=C3=A9?= <amauryleve@microsoft.com>
Date: Tue, 23 Jun 2026 09:45:44 +0200
Subject: [PATCH 1/4] Make bundled Playwright version discoverable by
 Dependabot

Dependabot does not update a Central Package Management PackageVersion whose
Version is an MSBuild property interpolation ($(MicrosoftPlaywrightVersion)) when
the package has no direct PackageReference. That is exactly the case for the
Microsoft.Playwright.MSTest.v4 entry declared in the "not used directly" group, so
the bundled Playwright version silently stopped receiving updates.

Give the PackageVersion a literal version (which Dependabot can discover and bump)
and derive the MicrosoftPlaywrightVersion property from it via an item-metadata
transform, keeping a single source of truth that still flows into the MSTest.Sdk
template.

See dependabot-core #5812 / #7183. Related to #9362.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index add5417b22..9cbef9afa6 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -27,7 +27,9 @@
     <MicrosoftNETCoreUniversalWindowsPlatformVersion>6.2.14</MicrosoftNETCoreUniversalWindowsPlatformVersion>
     <!-- Test Platform, .NET Test SDK and Object Model  -->
     <MicrosoftNETTestSdkVersion>18.4.0</MicrosoftNETTestSdkVersion>
-    <MicrosoftPlaywrightVersion>1.58.0</MicrosoftPlaywrightVersion>
+    <!-- MicrosoftPlaywrightVersion is intentionally NOT defined here. It is derived from the
+         Microsoft.Playwright.MSTest.v4 PackageVersion (declared with a literal version near the
+         bottom of this file) so that Dependabot can keep it up to date. See the comment there. -->
     <MicrosoftTestingExtensionsFakesVersion>18.1.1</MicrosoftTestingExtensionsFakesVersion>
     <!-- Microsoft.Testing.Internal.Framework is an internal-only NuGet (consumed by tests that
          opt into UseInternalTestFramework via TestFramework.ForTestingMSTest); there is no public
@@ -122,10 +124,24 @@
     <PackageVersion Include="xunit.v3.mtp-v2" Version="3.2.2" />
   </ItemGroup>
   <!--
-    Declare below packages that we will be referenced through MSTest.Sdk but don't have direct reference.
-    This allows dependabot to suggest updates.
+    Declare below packages that are referenced through MSTest.Sdk but don't have a direct
+    PackageReference in this repo.
+
+    The version MUST be a literal here (not an MSBuild property such as
+    $(MicrosoftPlaywrightVersion)): Dependabot does not update a Central Package Management
+    PackageVersion whose Version is an MSBuild property interpolation when the package has no
+    direct PackageReference, so a property-based version silently stops receiving updates.
+    See dependabot-core #5812 / #7183.
+
+    The literal version is then surfaced as the MicrosoftPlaywrightVersion property below, which
+    is the single source of truth that flows into the MSTest.Sdk template (see MSTest.Sdk.csproj)
+    and is consumed by the shipped SDK. This keeps a single version to update (by Dependabot or by
+    hand) while remaining Dependabot-discoverable.
     -->
   <ItemGroup Label="Declared by MSTest.Sdk but not used directly">
-    <PackageVersion Include="Microsoft.Playwright.MSTest.v4" Version="$(MicrosoftPlaywrightVersion)" />
+    <PackageVersion Include="Microsoft.Playwright.MSTest.v4" Version="1.60.0" />
   </ItemGroup>
+  <PropertyGroup>
+    <MicrosoftPlaywrightVersion>@(PackageVersion->WithMetadataValue('Identity', 'Microsoft.Playwright.MSTest.v4')->'%(Version)')</MicrosoftPlaywrightVersion>
+  </PropertyGroup>
 </Project>

From 6a486b360d9771241df55a188bf60ea9bb6b82f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amaury=20Lev=C3=A9?= <amauryleve@microsoft.com>
Date: Tue, 23 Jun 2026 09:52:47 +0200
Subject: [PATCH 2/4] Repo-qualify dependabot-core issue references in comment

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 9cbef9afa6..12f346dba8 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -131,7 +131,7 @@
     $(MicrosoftPlaywrightVersion)): Dependabot does not update a Central Package Management
     PackageVersion whose Version is an MSBuild property interpolation when the package has no
     direct PackageReference, so a property-based version silently stops receiving updates.
-    See dependabot-core #5812 / #7183.
+    See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183.
 
     The literal version is then surfaced as the MicrosoftPlaywrightVersion property below, which
     is the single source of truth that flows into the MSTest.Sdk template (see MSTest.Sdk.csproj)

From 8400a07eeb30dfa39dedc19a0201408d2624a99a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amaury=20Lev=C3=A9?= <amauryleve@microsoft.com>
Date: Tue, 23 Jun 2026 10:07:56 +0200
Subject: [PATCH 3/4] Make bundled Aspire.Hosting.Testing version discoverable
 by Dependabot

Aspire.Hosting.Testing has the same problem as Playwright: AspireHostingTestingVersion
was a literal property flowing into the MSTest.Sdk template, but no literal PackageVersion
existed for the package, so Dependabot could not discover or bump it.

Apply the same pattern: declare a literal Aspire.Hosting.Testing PackageVersion in the
'not used directly' group and derive AspireHostingTestingVersion from it via an
item-metadata transform.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 12f346dba8..23f9849d21 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -12,7 +12,9 @@
     <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <PropertyGroup Label="Product dependencies">
-    <AspireHostingTestingVersion>13.2.1</AspireHostingTestingVersion>
+    <!-- AspireHostingTestingVersion is intentionally NOT defined here. It is derived from the
+         Aspire.Hosting.Testing PackageVersion (declared with a literal version near the bottom of
+         this file) so that Dependabot can keep it up to date. See the comment there. -->
     <MicrosoftBuildVersion>17.11.48</MicrosoftBuildVersion>
     <MicrosoftCodeAnalysisVersion>3.11.0</MicrosoftCodeAnalysisVersion>
     <MicrosoftCodeAnalysisVersionForTests>4.10.0</MicrosoftCodeAnalysisVersionForTests>
@@ -133,15 +135,17 @@
     direct PackageReference, so a property-based version silently stops receiving updates.
     See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183.
 
-    The literal version is then surfaced as the MicrosoftPlaywrightVersion property below, which
-    is the single source of truth that flows into the MSTest.Sdk template (see MSTest.Sdk.csproj)
-    and is consumed by the shipped SDK. This keeps a single version to update (by Dependabot or by
-    hand) while remaining Dependabot-discoverable.
+    Each literal version is then surfaced as the matching *Version property below, which is the
+    single source of truth that flows into the MSTest.Sdk template (see MSTest.Sdk.csproj) and is
+    consumed by the shipped SDK. This keeps a single version to update (by Dependabot or by hand)
+    while remaining Dependabot-discoverable.
     -->
   <ItemGroup Label="Declared by MSTest.Sdk but not used directly">
+    <PackageVersion Include="Aspire.Hosting.Testing" Version="13.2.1" />
     <PackageVersion Include="Microsoft.Playwright.MSTest.v4" Version="1.60.0" />
   </ItemGroup>
   <PropertyGroup>
+    <AspireHostingTestingVersion>@(PackageVersion->WithMetadataValue('Identity', 'Aspire.Hosting.Testing')->'%(Version)')</AspireHostingTestingVersion>
     <MicrosoftPlaywrightVersion>@(PackageVersion->WithMetadataValue('Identity', 'Microsoft.Playwright.MSTest.v4')->'%(Version)')</MicrosoftPlaywrightVersion>
   </PropertyGroup>
 </Project>

From 952aa644f464341094e8dc136c8e6a0eee4b06b9 Mon Sep 17 00:00:00 2001
From: Evangelink <amauryleve@users.noreply.github.com>
Date: Tue, 23 Jun 2026 10:41:17 +0200
Subject: [PATCH 4/4] Fix MSB4012: use literal version properties with a drift
 guard

Storing an @(PackageVersion->...) item transform in a <PropertyGroup>
leaves the property unexpanded; when concatenated with strings in a
task (e.g. the Copy in MSTest.Acceptance.IntegrationTests) it fails with
MSB4012. Keep the consumed *Version properties as plain scalar literals,
keep the literal PackageVersion items for Dependabot, and add the
_ValidateBundledSdkFeatureVersions target so the two cannot drift.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props | 46 +++++++++++++++++++++++++++-------------
 1 file changed, 31 insertions(+), 15 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 23f9849d21..40dd43cac5 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -12,9 +12,11 @@
     <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <PropertyGroup Label="Product dependencies">
-    <!-- AspireHostingTestingVersion is intentionally NOT defined here. It is derived from the
-         Aspire.Hosting.Testing PackageVersion (declared with a literal version near the bottom of
-         this file) so that Dependabot can keep it up to date. See the comment there. -->
+    <!-- AspireHostingTestingVersion is consumed by the build and baked into the shipped MSTest.Sdk
+         template. It MUST be kept in sync with the literal Aspire.Hosting.Testing PackageVersion
+         declared near the bottom of this file (the one Dependabot updates). The
+         _ValidateBundledSdkFeatureVersions target there fails the build if the two drift apart. -->
+    <AspireHostingTestingVersion>13.2.1</AspireHostingTestingVersion>
     <MicrosoftBuildVersion>17.11.48</MicrosoftBuildVersion>
     <MicrosoftCodeAnalysisVersion>3.11.0</MicrosoftCodeAnalysisVersion>
     <MicrosoftCodeAnalysisVersionForTests>4.10.0</MicrosoftCodeAnalysisVersionForTests>
@@ -29,9 +31,11 @@
     <MicrosoftNETCoreUniversalWindowsPlatformVersion>6.2.14</MicrosoftNETCoreUniversalWindowsPlatformVersion>
     <!-- Test Platform, .NET Test SDK and Object Model  -->
     <MicrosoftNETTestSdkVersion>18.4.0</MicrosoftNETTestSdkVersion>
-    <!-- MicrosoftPlaywrightVersion is intentionally NOT defined here. It is derived from the
-         Microsoft.Playwright.MSTest.v4 PackageVersion (declared with a literal version near the
-         bottom of this file) so that Dependabot can keep it up to date. See the comment there. -->
+    <!-- MicrosoftPlaywrightVersion is consumed by the build and baked into the shipped MSTest.Sdk
+         template. It MUST be kept in sync with the literal Microsoft.Playwright.MSTest.v4
+         PackageVersion declared near the bottom of this file (the one Dependabot updates). The
+         _ValidateBundledSdkFeatureVersions target there fails the build if the two drift apart. -->
+    <MicrosoftPlaywrightVersion>1.60.0</MicrosoftPlaywrightVersion>
     <MicrosoftTestingExtensionsFakesVersion>18.1.1</MicrosoftTestingExtensionsFakesVersion>
     <!-- Microsoft.Testing.Internal.Framework is an internal-only NuGet (consumed by tests that
          opt into UseInternalTestFramework via TestFramework.ForTestingMSTest); there is no public
@@ -127,7 +131,7 @@
   </ItemGroup>
   <!--
     Declare below packages that are referenced through MSTest.Sdk but don't have a direct
-    PackageReference in this repo.
+    PackageReference in this repo, so that Dependabot can discover and update them.
 
     The version MUST be a literal here (not an MSBuild property such as
     $(MicrosoftPlaywrightVersion)): Dependabot does not update a Central Package Management
@@ -135,17 +139,29 @@
     direct PackageReference, so a property-based version silently stops receiving updates.
     See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183.
 
-    Each literal version is then surfaced as the matching *Version property below, which is the
-    single source of truth that flows into the MSTest.Sdk template (see MSTest.Sdk.csproj) and is
-    consumed by the shipped SDK. This keeps a single version to update (by Dependabot or by hand)
-    while remaining Dependabot-discoverable.
+    Each literal version is duplicated as the matching *Version property (defined near the top of
+    this file) which is the value actually consumed by the build and baked into the MSTest.Sdk
+    template (see MSTest.Sdk.csproj). The two cannot be unified because the consuming property must
+    be a plain scalar (an item transform such as @(PackageVersion->...) stored in a property is not
+    expanded and breaks string concatenation, e.g. MSB4012), while Dependabot needs the literal on
+    the PackageVersion. The _ValidateBundledSdkFeatureVersions target below fails the build if the
+    property and the PackageVersion ever drift apart (e.g. after Dependabot bumps only the
+    PackageVersion), so the duplication can never ship out of sync.
     -->
   <ItemGroup Label="Declared by MSTest.Sdk but not used directly">
     <PackageVersion Include="Aspire.Hosting.Testing" Version="13.2.1" />
     <PackageVersion Include="Microsoft.Playwright.MSTest.v4" Version="1.60.0" />
   </ItemGroup>
-  <PropertyGroup>
-    <AspireHostingTestingVersion>@(PackageVersion->WithMetadataValue('Identity', 'Aspire.Hosting.Testing')->'%(Version)')</AspireHostingTestingVersion>
-    <MicrosoftPlaywrightVersion>@(PackageVersion->WithMetadataValue('Identity', 'Microsoft.Playwright.MSTest.v4')->'%(Version)')</MicrosoftPlaywrightVersion>
-  </PropertyGroup>
+  <Target Name="_ValidateBundledSdkFeatureVersions"
+          BeforeTargets="CollectPackageReferences;GenerateNuspec;Build;Pack"
+          Condition=" '$(MSBuildProjectName)' == 'MSTest.Sdk' ">
+    <PropertyGroup>
+      <_AspireHostingTestingPackageVersion>@(PackageVersion->WithMetadataValue('Identity', 'Aspire.Hosting.Testing')->'%(Version)')</_AspireHostingTestingPackageVersion>
+      <_MicrosoftPlaywrightPackageVersion>@(PackageVersion->WithMetadataValue('Identity', 'Microsoft.Playwright.MSTest.v4')->'%(Version)')</_MicrosoftPlaywrightPackageVersion>
+    </PropertyGroup>
+    <Error Condition=" '$(AspireHostingTestingVersion)' != '$(_AspireHostingTestingPackageVersion)' "
+           Text="AspireHostingTestingVersion ('$(AspireHostingTestingVersion)') is out of sync with the 'Aspire.Hosting.Testing' PackageVersion ('$(_AspireHostingTestingPackageVersion)') in Directory.Packages.props. Update the AspireHostingTestingVersion property to match (Dependabot only updates the PackageVersion)." />
+    <Error Condition=" '$(MicrosoftPlaywrightVersion)' != '$(_MicrosoftPlaywrightPackageVersion)' "
+           Text="MicrosoftPlaywrightVersion ('$(MicrosoftPlaywrightVersion)') is out of sync with the 'Microsoft.Playwright.MSTest.v4' PackageVersion ('$(_MicrosoftPlaywrightPackageVersion)') in Directory.Packages.props. Update the MicrosoftPlaywrightVersion property to match (Dependabot only updates the PackageVersion)." />
+  </Target>
 </Project>