dependabot / dependabot/dependabot-core
Dependabot does not consider ignore rule
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
nuget
### Package manager version
_No response_
### Language version
netstandard2.0
### Manifest location and content before the Dependabot update
https://github.com/jscarle/AttributeSourceGenerator/blob/main/src/AttributeSourceGenerator/AttributeSourceGenerator.csproj
```xml
```
### dependabot.yml content
https://github.com/jscarle/AttributeSourceGenerator/blob/main/.github/dependabot.yml
```yml
version: 2
updates:
- package-ecosystem: "nuget"
directory: "/"
schedule:
interval: "weekly"
ignore:
- dependency-name: "Microsoft.CodeAnalysis.CSharp"
```
### Updated dependency
Microsoft.CodeAnalysis.CSharp 4.3.1 => 4.9.2
### What you expected to see, versus what you actually saw
Ignore should be respected and PR should not be opened.
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
https://github.com/jscarle/AttributeSourceGenerator/pull/4
### Smallest manifest that reproduces the issue
```yml
version: 2
updates:
- package-ecosystem: "nuget"
ignore:
- dependency-name: "Microsoft.CodeAnalysis.CSharp"
```
Contributor guide
Research direction
Start by comparing the ignore rule in .github/dependabot.yml with the Microsoft.CodeAnalysis.CSharp reference in AttributeSourceGenerator.csproj and the update shown in pull request #4. Reproduce the smallest manifest case, then trace the NuGet update handling; done means the ignore rule prevents a pull request from being opened.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100