dependabot / dependabot/dependabot-core

Dependabot does not respect `ignore` version syntax for Nuget

Open
#4,075 8 comments 2 reactions 0 assignees View on GitHub
F: dependency-ignores L: dotnet:nuget T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
155

Description

**Package ecosystem**
nuget

**Package manager version**
N/A
**Language version**
N/A
**Manifest location and content prior to update**
https://github.com/amido/stacks-dotnet-packages-cosmosdb/pull/8/files#diff-0ee2cfdaf6f922b832e0d6b4ee312c515ff3df9f8bd22499d3222de34729b1bc

**dependabot.yml content**
https://github.com/amido/stacks-dotnet-packages-cosmosdb/blob/3711de53ac51eddd907fbfa75f6235f16c28500a/.github/dependabot.yml#L6-L7

Note we specify 5.0 which in Nuget terms means ignore 5.0 and above inclusive: https://docs.microsoft.com/en-us/nuget/concepts/package-versioning#version-ranges

**Updated dependency**
> Bump Microsoft.Extensions.Diagnostics.HealthChecks from 3.1.16 to 5.0.8 in /src

**What you expected to see, versus what you actually saw**
I expect the PR 8 here to be closed as we're telling it to ignore all >= 5.0 packages: https://github.com/amido/stacks-dotnet-packages-cosmosdb/pull/8

Instead PRs 9 and 7 closed as soon as I added the ignore, but 8 is ignoring the ignore file.

**Native package manager behavior**
N/A

**Images of the diff or a link to the PR, issue or logs**

Processed the ignore:
https://github.com/amido/stacks-dotnet-packages-cosmosdb/pull/9

Ignores the ignore
![image](https://user-images.githubusercontent.com/2286713/126787569-04282723-b51e-4756-820e-43b63ca7bc3b.png)
https://github.com/amido/stacks-dotnet-packages-cosmosdb/pull/8

Contributor guide

Open the contributing guide

Research direction

Start with the linked dependabot.yml configuration and the NuGet manifest and compare the behavior shown in pull requests 7, 8, and 9. Trace how the NuGet ignore value `5.0` is interpreted, then verify that updates at or above that version are excluded and the affected pull request behavior matches the expectation.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.