From 8d5da3dc7b5661cf768502fbb1490abf3269184e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Amaury=20Lev=C3=A9?= Date: Thu, 25 Jun 2026 08:05:25 +0200 Subject: [PATCH 1/2] Anchor SDK-bundled packages so Dependabot bumps them Microsoft.Playwright.MSTest.v4 and Aspire.Hosting.Testing are declared as CPM PackageVersion entries in Directory.Packages.props but are only baked into the shipped MSTest.Sdk templates, with no real PackageReference anywhere in the repo. Dependabot only updates a CPM PackageVersion that is actually referenced by a project, so these 'orphan' versions were silently never bumped (Playwright stuck at 1.60.0 even though 1.61.0 shipped, #9362). PR #9365 only fixed the property-interpolation half of the problem. Add inert anchor references (PackageReference with ExcludeAssets=all) for both packages in the CI-built MSTest.Acceptance.IntegrationTests project so they enter a real restore graph and Dependabot discovers them, without pulling any of their assets (e.g. Playwright's browser-install targets) into the test project. Correct the now-misleading comment in Directory.Packages.props to document both required conditions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Directory.Packages.props | 21 ++++++++++++++----- .../MSTest.Acceptance.IntegrationTests.csproj | 16 ++++++++++++++ 2 files changed, 32 insertions(+), 5 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index edee48a01d..a9083905a5 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -136,11 +136,22 @@ Declare below packages that are referenced through MSTest.Sdk but don't have a direct PackageReference in this repo, so that Dependabot can discover and update them. - The version MUST be a literal here (not an MSBuild property such as - $(MicrosoftPlaywrightVersion)): Dependabot does not update a Central Package Management - PackageVersion whose Version is an MSBuild property interpolation when the package has no - direct PackageReference, so a property-based version silently stops receiving updates. - See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183. + Two conditions must BOTH hold for Dependabot to bump one of these, and missing either one + silently stops the updates: + + 1. The version MUST be a literal here (not an MSBuild property such as + $(MicrosoftPlaywrightVersion)): Dependabot does not update a Central Package Management + PackageVersion whose Version is an MSBuild property interpolation. + See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183. + + 2. The package MUST have a real PackageReference somewhere in the repo's restore graph: + Dependabot only updates a CPM PackageVersion that is actually referenced by a project; + an "orphan" PackageVersion (declared here but referenced nowhere) is ignored. Because + these packages are only baked into the shipped SDK templates (Sdk/Features/*.targets) + and never referenced by a built project, we add inert anchor references + (PackageReference with ExcludeAssets="all") in + test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj. + Without those anchors Dependabot never proposed bumps (see #9362). Each literal version is duplicated as the matching *Version property (defined near the top of this file) which is the value actually consumed by the build and baked into the MSTest.Sdk diff --git a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj index 4f4ac365d6..dd5fe30249 100644 --- a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj +++ b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj @@ -47,6 +47,22 @@ + + + + + + From 2a06e5a9dd9c786b0206477603fd60e16f58b0b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Amaury=20Lev=C3=A9?= Date: Thu, 25 Jun 2026 09:04:05 +0200 Subject: [PATCH 2/2] Address review: clarify Dependabot anchor comments Update the opening sentence in Directory.Packages.props (the bundled packages now do have an inert anchor PackageReference) and broaden the drift-guard wording in the .csproj to name both guarded version properties (MicrosoftPlaywrightVersion and AspireHostingTestingVersion). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Directory.Packages.props | 6 ++++-- .../MSTest.Acceptance.IntegrationTests.csproj | 3 ++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index a9083905a5..7b2308b23b 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -133,8 +133,10 @@