dependabot / dependabot/dependabot-core

NuGet: updates are offered despite ignore rules

Open
#8,182 2 comments 1 reaction 0 assignees View on GitHub
F: dependency-ignores L: dotnet:nuget T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

NuGet

### Package manager version

NuGet Command Line 6.7.0.127

### Language version

C# 10, .NET 6

### Manifest location and content before the Dependabot update

Applicable snippet from `Directory.Build.props`, which defines the version properties:
```xml


net6.0
6.0.0
7.0.*

```

Usage in .csproj file that produces our NuGet package (uses frozen version to prevent breaking changes):
```xml


$(TargetFrameworkName)
true
true






```

Usage in .csproj files for tests (uses non-frozen version):
```xml


$(TargetFrameworkName)



```

### dependabot.yml content

```yml
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
pull-request-branch-name:
separator: "-"
- package-ecosystem: nuget
directory: "/"
schedule:
interval: daily
pull-request-branch-name:
separator: "-"
open-pull-requests-limit: 25
ignore:
# Block updates to all exposed dependencies of the NuGet packages we produce, as updating them would be a breaking change.
- dependency-name: 'Ben.Demystifier'
- dependency-name: 'Humanizer*'
- dependency-name: 'Microsoft.CodeAnalysis*'
- dependency-name: 'Microsoft.EntityFrameworkCore*'
# Block major updates of packages that require a matching .NET version.
- dependency-name: 'Microsoft.AspNetCore*'
update-types: ["version-update:semver-major"]
```

### Updated dependency

Bumps EntityFrameworkCoreVersion from 6.0.0 to 7.0.12.
Updates Microsoft.EntityFrameworkCore.Relational from 6.0.0 to 7.0.12

### What you expected to see, versus what you actually saw

We have two version properties in `Directory.Build.props`:
- `EntityFrameworkCoreFrozenVersion` = 6.0.0
- `EntityFrameworkCoreVersion` = 7.0.*

The first one must never be updated, because it would introduce a breaking change in the NuGet package we produce. The second one is used from our test projects, where we always want to use the latest version, so we'll know when something breaks. Because dependabot doesn't support ignore rules per project/directory, we decided to ignore the package completely using the below configuration:

```yaml
- package-ecosystem: nuget
directory: "/"
ignore:
# Block updates to all exposed dependencies of the NuGet packages we produce, as updating them would be a breaking change.
- dependency-name: 'Microsoft.EntityFrameworkCore*'
```

However, dependabot still offers to update the `Microsoft.EntityFrameworkCore.Relational` package by changing the value of `EntityFrameworkCoreFrozenVersion` to 7.0.12. This is unexpected.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

https://github.com/json-api-dotnet/JsonApiDotNetCore/pull/1356

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the update with the shown dependabot.yml, Directory.Build.props, and project-file snippets, using the linked pull request as the observed case. Trace how the NuGet update handles the two version properties and the Microsoft.EntityFrameworkCore* ignore rule. Done means the ignored dependency is no longer offered while the test-project version remains eligible for updates.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.