dependabot / dependabot/dependabot-core

Investigate issue when NuGet updater pins a transitive dependency

Open
#11,292 0 comments 1 reaction 0 assignees View on GitHub
L: dotnet:nuget
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

Scenario seen in an internal conversation.

A transitive dependency needed to be pinned to a specific version in `project.csproj`, but the repo was using Central Package Management and the corresponding entry in `Directory.Packages.props` was missing.

E.g., the following change was made in `project.csproj`

``` diff
...
+
...
```

However the following change was expected, but not made in `Directory.Packages.props

``` diff
...
+
...
```

Contributor guide

Open the contributing guide

Research direction

Start by examining the NuGet updater behavior for a project using project.csproj and Central Package Management through Directory.Packages.props. Reproduce the transitive dependency pinning scenario and compare the generated changes; done means the package version entry is placed in Directory.Packages.props rather than only in project.csproj.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.