Skip to content

Fix Dependabot discovery of bundled Playwright via PackageDownload #9452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Evangelink merged 5 commits into from
Jun 26, 2026
Merged

Fix Dependabot discovery of bundled Playwright via PackageDownload #9452

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1209d7d
Make bundled Playwright discoverable by Dependabot via PackageDownload
Evangelink Jun 26, 2026
eed7903
Merge branch 'main' into evangelink-supreme-lamp
Evangelink Jun 26, 2026
3964e2f
Revert redundant Playwright Dependabot fix superseded by main
Evangelink Jun 26, 2026
05a1ef0
Fix Dependabot discovery of bundled Playwright via PackageDownload
Evangelink Jun 26, 2026
a150109
Address review: clarify Dependabot anchor comments
Evangelink Jun 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,9 +134,10 @@
</ItemGroup>
<!--
Declare below packages that are bundled through MSTest.Sdk (baked into the shipped SDK
templates) and are not otherwise consumed by a built project, so that Dependabot can
discover and update them. Their only PackageReference in this repo is the inert anchor
described in condition 2 below.
templates) and are not otherwise consumed by a restored project, so that Dependabot can
discover and update them. They are referenced only inside the SDK feature targets
(Sdk/Features/*.targets, which Dependabot doesn't restore); their only graph-visible reference
from a repo project restore is the inert anchor described in condition 2 below.

Two conditions must BOTH hold for Dependabot to bump one of these, and missing either one
silently stops the updates:
Expand All @@ -146,14 +147,17 @@
PackageVersion whose Version is an MSBuild property interpolation.
See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183.

2. The package MUST have a real PackageReference somewhere in the repo's restore graph:
2. The package MUST appear in the repo's restore graph via a graph-visible reference:
Dependabot only updates a CPM PackageVersion that is actually referenced by a project;
an "orphan" PackageVersion (declared here but referenced nowhere) is ignored. Because
these packages are only baked into the shipped SDK templates (Sdk/Features/*.targets)
and never referenced by a built project, we add inert anchor references
(PackageReference with ExcludeAssets="all") in
and never referenced by a built project, we add inert anchor references in
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj.
Without those anchors Dependabot never proposed bumps (see #9362).
The anchor MUST be a PackageDownload, NOT a PackageReference with ExcludeAssets="all":
ExcludeAssets="all" removes the reference from the dependency graph Dependabot reads, so
the package stays invisible and never gets bumped. PackageDownload keeps it in the restore
graph (so Dependabot proposes bumps) without flowing any of its assets into the project.
Without a graph-visible anchor Dependabot never proposed bumps (see #9362).

Each literal version is duplicated as the matching *Version property (defined near the top of
this file) which is the value actually consumed by the build and baked into the MSTest.Sdk
Expand Down
37 changes: 20 additions & 17 deletions ...grationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,26 +42,29 @@
<ProjectReference Include="$(RepoRoot)test\Utilities\Microsoft.Testing.TestInfrastructure\Microsoft.Testing.TestInfrastructure.csproj" />
</ItemGroup>

<!-- Packages needed for the test assets but that we don't want to reference -->
<ItemGroup>
<PackageDownload Include="Aspire.Hosting.Testing" Version="[$(AspireHostingTestingVersion)]" />
</ItemGroup>

<!--
Dependabot anchor for the packages bundled by MSTest.Sdk (Microsoft.Playwright.MSTest.v4,
Aspire.Hosting.Testing). These are baked into the shipped SDK templates (Sdk/Features/*.targets)
and have no other PackageReference in the repo, so their Central Package Management PackageVersion
entries in Directory.Packages.props are "orphans" that Dependabot ignores (it only updates package
versions that are actually referenced by a project). Referencing them here (with ExcludeAssets="all"
so none of their assets such as compile/runtime/build targets, e.g. Playwright's browser install,
flow into this test project) puts them into a real restore graph so Dependabot proposes bumps. The
_ValidateBundledSdkFeatureVersions target in Directory.Packages.props then guards the matching
version properties (MicrosoftPlaywrightVersion, AspireHostingTestingVersion) against drift after
a bump. See https://github.com/microsoft/testfx/issues/9362.
Dependabot anchors for the packages bundled by MSTest.Sdk (Microsoft.Playwright.MSTest.v4,
Aspire.Hosting.Testing). The Aspire entry doubles as the download that stages its nupkg for
test assets (see CopyNuGetPackagesForTestAssets below); the Playwright entry is the Dependabot
anchor only. These packages are baked into the shipped SDK templates (Sdk/Features/*.targets)
and are otherwise referenced only there (which Dependabot doesn't restore), so without a
graph-visible reference from a repo project their Central Package Management PackageVersion
entries in Directory.Packages.props are "orphans" that Dependabot ignores (it only updates
package versions that are actually referenced by a restored project).

We use PackageDownload (NOT a PackageReference with ExcludeAssets="all") deliberately:
ExcludeAssets="all" removes the reference from the dependency graph Dependabot reads, so the
package stays invisible to it and never gets bumped (Aspire only kept updating because it ALSO
had this PackageDownload; the equivalent Playwright anchor with ExcludeAssets="all" silently did
nothing, see #9362). PackageDownload puts the package into the restore (so Dependabot proposes
bumps) without flowing any of its assets (compile/runtime/build, e.g. Playwright's browser
install) into this test project. The _ValidateBundledSdkFeatureVersions target in
Directory.Packages.props then guards the matching version properties (MicrosoftPlaywrightVersion,
AspireHostingTestingVersion) against drift after a bump.
-->
<ItemGroup>
<PackageReference Include="Microsoft.Playwright.MSTest.v4" ExcludeAssets="all" />
<PackageReference Include="Aspire.Hosting.Testing" ExcludeAssets="all" />
<PackageDownload Include="Aspire.Hosting.Testing" Version="[$(AspireHostingTestingVersion)]" />
<PackageDownload Include="Microsoft.Playwright.MSTest.v4" Version="[$(MicrosoftPlaywrightVersion)]" />
</ItemGroup>

<Target Name="CopyNuGetPackagesForTestAssets" BeforeTargets="BeforeBuild">
Expand Down