dependabot / dependabot/dependabot-core

Version update PRs understate what's being updated in title and description

Open
#11,366 1 comment 0 reactions 0 assignees View on GitHub
L: dotnet:nuget L: github:actions T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 14h
Merged PRs (30d)
156

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

nuget

### Package manager version

_No response_

### Language version

MSBuild

### Manifest location and content before the Dependabot update

/Directory.Packages.props

```xml



true
true
2.0.171
61.0.15-preview
0.12.8-experimental

0.1.42-alpha
4.12.0
3.11.0
















































```

### dependabot.yml content

```yml
# Please see the documentation for all configuration options:
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file

version: 2
updates:
- package-ecosystem: nuget
directory: /
schedule:
interval: weekly
groups:
nerdbank-gitversioning:
patterns:
- nbgv
- nerdbank.gitversioning
xunit:
patterns:
- 'xunit*'
- package-ecosystem: dotnet-sdk
directory: /
schedule:
interval: monthly
ignore:
- dependency-name: MessagePack # We have to use the MessagePack version used by win32metadata (https://github.com/microsoft/CsWin32/issues/371)
```

### Updated dependency

```diff
- 3.11.0
+ 4.12.0

-
+

-
-
-
+
+
+
```

### What you expected to see, versus what you actually saw

The PR title was: "Bump MessagePackAnalyzer from 2.5.108 to 2.5.192" but it updated much more than that.

The PR description carried on this understatement, claiming to only "Bumps [MessagePackAnalyzer](https://github.com/MessagePack-CSharp/MessagePack-CSharp) from 2.5.108 to 2.5.192."

Yet I've seen other Dependabot PRs with descriptions that call out that more had to be updated because of interactions between dependencies. But this one didn't.

**Most importantly**, the alleged package update [has no dependencies of its own](https://www.nuget.org/packages/messagepackanalyzer#dependencies-body-tab) and therefore totally should not have required updating any other packages.

### Native package manager behavior

I would have expected any other tool to just update MessagePackAnalyzer itself if I asked it to update that one.

### Images of the diff or a link to the PR, issue, or logs

https://github.com/microsoft/CsWin32/pull/1327

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.