dependabot / dependabot/dependabot-core
NuGet: updates are offered despite ignore rules
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
NuGet
### Package manager version
NuGet Command Line 6.7.0.127
### Language version
C# 10, .NET 6
### Manifest location and content before the Dependabot update
Applicable snippet from `Directory.Build.props`, which defines the version properties:
```xml
net6.0
6.0.0
7.0.*
```
Usage in .csproj file that produces our NuGet package (uses frozen version to prevent breaking changes):
```xml
$(TargetFrameworkName)
true
true
```
Usage in .csproj files for tests (uses non-frozen version):
```xml
$(TargetFrameworkName)
```
### dependabot.yml content
```yml
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
pull-request-branch-name:
separator: "-"
- package-ecosystem: nuget
directory: "/"
schedule:
interval: daily
pull-request-branch-name:
separator: "-"
open-pull-requests-limit: 25
ignore:
# Block updates to all exposed dependencies of the NuGet packages we produce, as updating them would be a breaking change.
- dependency-name: 'Ben.Demystifier'
- dependency-name: 'Humanizer*'
- dependency-name: 'Microsoft.CodeAnalysis*'
- dependency-name: 'Microsoft.EntityFrameworkCore*'
# Block major updates of packages that require a matching .NET version.
- dependency-name: 'Microsoft.AspNetCore*'
update-types: ["version-update:semver-major"]
```
### Updated dependency
Bumps EntityFrameworkCoreVersion from 6.0.0 to 7.0.12.
Updates Microsoft.EntityFrameworkCore.Relational from 6.0.0 to 7.0.12
### What you expected to see, versus what you actually saw
We have two version properties in `Directory.Build.props`:
- `EntityFrameworkCoreFrozenVersion` = 6.0.0
- `EntityFrameworkCoreVersion` = 7.0.*
The first one must never be updated, because it would introduce a breaking change in the NuGet package we produce. The second one is used from our test projects, where we always want to use the latest version, so we'll know when something breaks. Because dependabot doesn't support ignore rules per project/directory, we decided to ignore the package completely using the below configuration:
```yaml
- package-ecosystem: nuget
directory: "/"
ignore:
# Block updates to all exposed dependencies of the NuGet packages we produce, as updating them would be a breaking change.
- dependency-name: 'Microsoft.EntityFrameworkCore*'
```
However, dependabot still offers to update the `Microsoft.EntityFrameworkCore.Relational` package by changing the value of `EntityFrameworkCoreFrozenVersion` to 7.0.12. This is unexpected.
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
https://github.com/json-api-dotnet/JsonApiDotNetCore/pull/1356
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Start by reproducing the update with the shown dependabot.yml, Directory.Build.props, and project-file snippets, using the linked pull request as the observed case. Trace how the NuGet update handles the two version properties and the Microsoft.EntityFrameworkCore* ignore rule. Done means the ignored dependency is no longer offered while the test-project version remains eligible for updates.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100