dependabot / dependabot/dependabot-core

partial nuget package update failure

Open
#15,069 3 comments 0 reactions 0 assignees View on GitHub
L: dotnet:dotnet-sdk L: dotnet:nuget L: github:actions L: javascript T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

nuget

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

I have a mono repo with a bunch of projects, some referenced by others. My dependabot setup successfully finds and updates all but 1 specific dependency each time for the last 3 monthly .NET updates:
- I bump all `Microsoft.*` patch versions which microsoft updates 2nd tuesday most months.
- Here is the latest dependabot PR this happened: https://github.com/Finbuckle/Finbuckle.MultiTenant/pull/1123
- You can see that it updated all package versions except only `Microsoft.Extensions.Identity.Stores` in the `test/Finbuckle.MultiTenant.Identity.EntityFrameworkCore.Test`
- Other dependencies in that specific project updated succesfully
- Additionally some lockfiles failed to update, both transitive and project referenced. Here is the commit showing where I had to manually update them: https://github.com/Finbuckle/Finbuckle.MultiTenant/commit/2192ada1d75b64a85cc2fe3bf2c5802c10a859e4

### dependabot.yml content

version: 2
updates:
- package-ecosystem: "nuget"
directories:
- "/src/Finbuckle.MultiTenant"
- "/src/Finbuckle.MultiTenant.Abstractions"
- "/src/Finbuckle.MultiTenant.AspNetCore"
- "/src/Finbuckle.MultiTenant.EntityFrameworkCore"
- "/src/Finbuckle.MultiTenant.Identity.EntityFrameworkCore"
- "/test/Finbuckle.MultiTenant.Test"
- "/test/Finbuckle.MultiTenant.AspNetCore.Test"
- "/test/Finbuckle.MultiTenant.EntityFrameworkCore.Test"
- "/test/Finbuckle.MultiTenant.Identity.EntityFrameworkCore.Test"
schedule:
interval: "daily"
ignore:
- dependency-name: "Microsoft.*"
update-types: [ "version-update:semver-major" ]
commit-message:
prefix: "fix"
include: "scope"
groups:
"microsoft-packages":
patterns:
- "Microsoft.*"

- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "daily"

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

I expect all packages across all projects to update and lockfiles to update.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the dependabot.yml configuration and compare the linked PR #1123 with commit 2192ada1d75b64a85cc2fe3bf2c5802c10a859e4, focusing on Microsoft.Extensions.Identity.Stores and the failed transitive and project-referenced lockfile updates. Done means identifying and reproducing the partial NuGet update, then ensuring all listed projects and lockfiles update consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, ruby
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.