Fix Dependabot discovery of bundled Playwright; bump to 1.61.0#9508
Conversation
#9452 switched the Dependabot anchor to PackageDownload, but Dependabot's NuGet ecosystem does not read PackageDownload items at all (dependabot/dependabot-core#2502), so the bundled Playwright version became invisible to Dependabot and stopped updating (1.61.0 was never proposed). Restore the PackageReference (ExcludeAssets="all") anchor for both Microsoft.Playwright.MSTest.v4 and Aspire.Hosting.Testing - ExcludeAssets only stops assets flowing into the build, it does not hide the reference from Dependabot. Keep the PackageDownload items for nupkg staging and property correlation. Bump bundled Playwright 1.60.0 -> 1.61.0. Fixes #9362 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR adjusts how MSTest SDK–bundled packages are surfaced to Dependabot (so updates get proposed) and bumps the bundled Playwright version to 1.61.0.
Changes:
- Restores
PackageReference+ExcludeAssets="all"anchors (and keepsPackageDownloadstaging) for Playwright and Aspire in the MSTest acceptance integration test project. - Bumps
MicrosoftPlaywrightVersionand the corresponding CPMPackageVersionforMicrosoft.Playwright.MSTest.v4from 1.60.0 to 1.61.0. - Updates in-file documentation to reflect Dependabot’s behavior and the intended anchor mechanism.
Show a summary per file
| File | Description |
|---|---|
| test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj | Reintroduces Dependabot-visible PackageReference anchors while retaining PackageDownload entries used for nupkg staging. |
| Directory.Packages.props | Updates Playwright version to 1.61.0 and revises the “Dependabot discovery” guidance/comments for bundled SDK packages. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Low
This comment has been minimized.
This comment has been minimized.
…isleading PackageDownload - Revert the manual 1.60.0 -> 1.61.0 bump: doing it here would leave the bundle at latest, so we couldn't tell whether the anchor fix actually let Dependabot propose the update. Leaving it at 1.60.0 means Dependabot's next run proposing 1.60.0 -> 1.61.0 is the proof the fix works. - Drop the Playwright PackageDownload anchor and its misleading comment (flagged in review): Dependabot ignores PackageDownload entirely, and nothing consumes Playwright's nupkg (only Aspire's is staged by CopyNuGetPackagesForTestAssets). The PackageReference (ExcludeAssets="all") is the sole Dependabot anchor; Aspire keeps its PackageDownload purely for nupkg staging. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
🧪 Test quality grade — PR #9508No new or modified test methods were identified in the changed regions Re-run with
|
|
Heads-up: this diff doesn't appear to include the version bump described in the Fix section. The description says it bumps bundled Playwright
The Could you double-check and push the version bump (so |
Fixes #9362
Problem
Despite several attempts (#9365, #9422, #9452), Dependabot still never bumps the bundled Playwright version. As reported in #9362, it's stuck at 1.60.0 even though
Microsoft.Playwright.MSTest.v41.61.0 has been published on nuget.org for days across multiple daily Dependabot runs.Root cause
#9452switched the Dependabot anchor for the bundled packages from aPackageReference(withExcludeAssets="all") to aPackageDownload, on the theory thatExcludeAssets="all"hid the reference from Dependabot.That theory is wrong on both counts:
PackageDownloaditems at all (dependabot/dependabot-core#2502). So after Fix Dependabot discovery of bundled Playwright via PackageDownload #9452 the Playwright anchor became invisible to Dependabot.ExcludeAssets="all"does NOT hide aPackageReferencefrom Dependabot — it only stops the package's assets from flowing into the build. Dependabot reads thePackageReferenceXML node, not the asset-flow rules. So the original#9422anchor was the correct mechanism.Aspire's bump in #9446 actually came from its
ExcludeAssetsPackageReference(present during the #9422–#9452 window), not from itsPackageDownload. Playwright simply had no newer release during that brief window (1.61 wasn't out yet); then #9452 removed the working anchor right before 1.61 shipped — and silently broke Aspire's discovery too (it only looks fine because it's already at latest).Fix
MSTest.Acceptance.IntegrationTests.csproj— restorePackageReference ... ExcludeAssets="all"anchors (the kind Dependabot reads) for bothMicrosoft.Playwright.MSTest.v4andAspire.Hosting.Testing, while keeping thePackageDownloaditems for nupkg staging +*Versionproperty correlation. Rewrote the comment to document the real Dependabot behavior. This dual-item layout is exactly what Aspire ran through green CI between Anchor SDK-bundled packages so Dependabot bumps them #9422 and Fix Dependabot discovery of bundled Playwright via PackageDownload #9452.Directory.Packages.props— bump bundled Playwright 1.60.0 → 1.61.0 (both theMicrosoftPlaywrightVersionproperty and the literalMicrosoft.Playwright.MSTest.v4PackageVersion, kept in sync so_ValidateBundledSdkFeatureVersionspasses). Corrected the "condition 2" comment.Verification
The change is config-only and structurally identical to the proven Aspire setup, so I'm confident in the MSBuild validity. The Dependabot behavior itself can only be confirmed on the next scheduled run against
main.