dependabot / dependabot/dependabot-core
Investigate issue when NuGet updater pins a transitive dependency
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
Scenario seen in an internal conversation.
A transitive dependency needed to be pinned to a specific version in `project.csproj`, but the repo was using Central Package Management and the corresponding entry in `Directory.Packages.props` was missing.
E.g., the following change was made in `project.csproj`
``` diff
...
+
...
```
However the following change was expected, but not made in `Directory.Packages.props
``` diff
...
+
...
```
Contributor guide
Research direction
Start by examining the NuGet updater behavior for a project using project.csproj and Central Package Management through Directory.Packages.props. Reproduce the transitive dependency pinning scenario and compare the generated changes; done means the package version entry is placed in Directory.Packages.props rather than only in project.csproj.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100