From 9cafd69277b08e156736703d7011df109df7dc2d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Amaury=20Lev=C3=A9?= Date: Mon, 29 Jun 2026 19:49:01 +0200 Subject: [PATCH 1/2] Fix Dependabot discovery of bundled Playwright; bump to 1.61.0 #9452 switched the Dependabot anchor to PackageDownload, but Dependabot's NuGet ecosystem does not read PackageDownload items at all (dependabot/dependabot-core#2502), so the bundled Playwright version became invisible to Dependabot and stopped updating (1.61.0 was never proposed). Restore the PackageReference (ExcludeAssets="all") anchor for both Microsoft.Playwright.MSTest.v4 and Aspire.Hosting.Testing - ExcludeAssets only stops assets flowing into the build, it does not hide the reference from Dependabot. Keep the PackageDownload items for nupkg staging and property correlation. Bump bundled Playwright 1.60.0 -> 1.61.0. Fixes #9362 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Directory.Packages.props | 22 ++++++----- .../MSTest.Acceptance.IntegrationTests.csproj | 39 +++++++++++-------- 2 files changed, 35 insertions(+), 26 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 6751813eb5..730df7976a 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -37,7 +37,7 @@ PackageVersion declared near the bottom of this file (the one Dependabot updates). The _ValidateBundledSdkFeatureVersions target (in Directory.Build.targets) fails the build if the two drift apart. --> - 1.60.0 + 1.61.0 18.1.1 - + diff --git a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj index e3348314e3..a2e3627709 100644 --- a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj +++ b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj @@ -44,25 +44,32 @@ + + From 7065e1768ce1e3c7cf8cac3e026fe0b891d847bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Amaury=20Lev=C3=A9?= Date: Mon, 29 Jun 2026 19:57:47 +0200 Subject: [PATCH 2/2] Address review: keep Playwright at 1.60.0 to validate the fix, drop misleading PackageDownload - Revert the manual 1.60.0 -> 1.61.0 bump: doing it here would leave the bundle at latest, so we couldn't tell whether the anchor fix actually let Dependabot propose the update. Leaving it at 1.60.0 means Dependabot's next run proposing 1.60.0 -> 1.61.0 is the proof the fix works. - Drop the Playwright PackageDownload anchor and its misleading comment (flagged in review): Dependabot ignores PackageDownload entirely, and nothing consumes Playwright's nupkg (only Aspire's is staged by CopyNuGetPackagesForTestAssets). The PackageReference (ExcludeAssets="all") is the sole Dependabot anchor; Aspire keeps its PackageDownload purely for nupkg staging. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Directory.Packages.props | 4 +-- .../MSTest.Acceptance.IntegrationTests.csproj | 33 +++++++++---------- 2 files changed, 18 insertions(+), 19 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 730df7976a..099b474b3e 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -37,7 +37,7 @@ PackageVersion declared near the bottom of this file (the one Dependabot updates). The _ValidateBundledSdkFeatureVersions target (in Directory.Build.targets) fails the build if the two drift apart. --> - 1.61.0 + 1.60.0 18.1.1 - + diff --git a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj index a2e3627709..29f33d2ca4 100644 --- a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj +++ b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj @@ -49,29 +49,28 @@ Package Management PackageVersion entries in Directory.Packages.props are "orphans" that Dependabot ignores unless a project references them. - Two item kinds work together here: + The PackageReference (with ExcludeAssets="all") is the Dependabot ANCHOR: Dependabot reads the + PackageReference XML node to discover the dependency and bump its CPM PackageVersion. + ExcludeAssets="all" only stops the package's assets (compile/runtime/build, e.g. Playwright's + browser install) from flowing into this test project - it does NOT hide the reference from + Dependabot. A PackageDownload does NOT work as the anchor: Dependabot does not read + PackageDownload items at all (dependabot/dependabot-core#2502). Using PackageDownload as the + anchor is exactly why Playwright silently stopped updating - see #9362 / #9452. - * The PackageReference (with ExcludeAssets="all") is the Dependabot ANCHOR. Dependabot reads - the PackageReference XML node to discover the dependency and bump its CPM PackageVersion. - ExcludeAssets="all" only stops the package's assets (compile/runtime/build, e.g. Playwright's - browser install) from flowing into this test project - it does NOT hide the reference from - Dependabot. A PackageDownload does NOT work as the anchor: Dependabot does not read - PackageDownload items at all (dependabot/dependabot-core#2502). Using PackageDownload as the - anchor is exactly why Playwright silently stopped updating - see #9362 / #9452. - - * The PackageDownload (Version="[$(...)]") stages the package nupkg into the global packages - folder (Aspire's is consumed by CopyNuGetPackagesForTestAssets below) and ties the *Version - property to the package so Dependabot rewrites the property alongside the PackageVersion. - - The _ValidateBundledSdkFeatureVersions target in Directory.Build.targets then guards the matching - version properties (MicrosoftPlaywrightVersion, AspireHostingTestingVersion) against drift after - a bump. + Dependabot only bumps the literal PackageVersion in Directory.Packages.props, not the matching + *Version property the build consumes; the _ValidateBundledSdkFeatureVersions target in + Directory.Build.targets fails the build if the two drift apart, so a maintainer reconciles the + property in the Dependabot PR. --> + + + + -