Skip to content

Anchor SDK-bundled packages so Dependabot bumps them #9422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Evangelink merged 2 commits into from
Jun 25, 2026
+37 −7
Merged

Anchor SDK-bundled packages so Dependabot bumps them #9422

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8d5da3d
Anchor SDK-bundled packages so Dependabot bumps them
Evangelink Jun 25, 2026
2a06e5a
Address review: clarify Dependabot anchor comments
Evangelink Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 20 additions & 7 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,14 +133,27 @@
<PackageVersion Include="xunit.v3.mtp-v2" Version="3.2.2" />
</ItemGroup>
<!--
Declare below packages that are referenced through MSTest.Sdk but don't have a direct
PackageReference in this repo, so that Dependabot can discover and update them.
Declare below packages that are bundled through MSTest.Sdk (baked into the shipped SDK
templates) and are not otherwise consumed by a built project, so that Dependabot can
discover and update them. Their only PackageReference in this repo is the inert anchor
described in condition 2 below.

The version MUST be a literal here (not an MSBuild property such as
$(MicrosoftPlaywrightVersion)): Dependabot does not update a Central Package Management
PackageVersion whose Version is an MSBuild property interpolation when the package has no
direct PackageReference, so a property-based version silently stops receiving updates.
See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183.
Two conditions must BOTH hold for Dependabot to bump one of these, and missing either one
silently stops the updates:

1. The version MUST be a literal here (not an MSBuild property such as
$(MicrosoftPlaywrightVersion)): Dependabot does not update a Central Package Management
PackageVersion whose Version is an MSBuild property interpolation.
See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183.

2. The package MUST have a real PackageReference somewhere in the repo's restore graph:
Dependabot only updates a CPM PackageVersion that is actually referenced by a project;
an "orphan" PackageVersion (declared here but referenced nowhere) is ignored. Because
these packages are only baked into the shipped SDK templates (Sdk/Features/*.targets)
and never referenced by a built project, we add inert anchor references
(PackageReference with ExcludeAssets="all") in
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj.
Without those anchors Dependabot never proposed bumps (see #9362).

Each literal version is duplicated as the matching *Version property (defined near the top of
this file) which is the value actually consumed by the build and baked into the MSTest.Sdk
Expand Down
17 changes: 17 additions & 0 deletions ...grationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,23 @@
<PackageDownload Include="Aspire.Hosting.Testing" Version="[$(AspireHostingTestingVersion)]" />
</ItemGroup>

<!--
Dependabot anchor for the packages bundled by MSTest.Sdk (Microsoft.Playwright.MSTest.v4,
Aspire.Hosting.Testing). These are baked into the shipped SDK templates (Sdk/Features/*.targets)
and have no other PackageReference in the repo, so their Central Package Management PackageVersion
entries in Directory.Packages.props are "orphans" that Dependabot ignores (it only updates package
versions that are actually referenced by a project). Referencing them here (with ExcludeAssets="all"
so none of their assets such as compile/runtime/build targets, e.g. Playwright's browser install,
flow into this test project) puts them into a real restore graph so Dependabot proposes bumps. The
_ValidateBundledSdkFeatureVersions target in Directory.Packages.props then guards the matching
version properties (MicrosoftPlaywrightVersion, AspireHostingTestingVersion) against drift after
a bump. See https://github.com/microsoft/testfx/issues/9362.
-->
<ItemGroup>
<PackageReference Include="Microsoft.Playwright.MSTest.v4" ExcludeAssets="all" />
<PackageReference Include="Aspire.Hosting.Testing" ExcludeAssets="all" />
</ItemGroup>

<Target Name="CopyNuGetPackagesForTestAssets" BeforeTargets="BeforeBuild">
<ItemGroup>
<MicrosoftTestingExtensionsCodeCoveragePackage Include="$(PkgMicrosoft_Testing_Extensions_CodeCoverage)\microsoft.testing.extensions.codecoverage.*.nupkg" />
Expand Down