dependabot / dependabot/dependabot-core

`PackageReference` and `PackageVersion` element does not take `Condition` into consideration

Open
#9,299 10 comments 0 reactions 0 assignees View on GitHub
L: dotnet:nuget T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

nuget

### Package manager version

latest

### Language version

Multiple TargetFrameworks: net6.0;net7.0;net8.0

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

```yml
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates

version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "daily"
commit-message:
prefix: "build(ci)"
labels:
- "dependency-actions"
open-pull-requests-limit: 50

- package-ecosystem: "nuget"
directory: "/"
schedule:
interval: "daily"
commit-message:
prefix: "build(deps)"
labels:
- "dependency-nuget"
open-pull-requests-limit: 50
# groups:
# coverlet:
# patterns:
# - "coverlet*"
# testcontainers:
# patterns:
# - "testcontainers*"
# verify:
# patterns:
# - "verify*"
# xunit:
# patterns:
# - "xunit"
# - "xunit*"

- package-ecosystem: "gitsubmodule"
directory: "/"
schedule:
interval: "daily"
commit-message:
prefix: "build(mods)"
labels:
- "dependency-gitmodule"
open-pull-requests-limit: 50
groups:
submodules:
patterns:
- "*"
```

### Updated dependency

Microsoft.AspNetCore.TestHost

### What you expected to see, versus what you actually saw

I expect, that the line 23 (see screenshot) will be updated, and the lines 24 and 25 will be skipped because of the conditional update.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

![image](https://github.com/dependabot/dependabot-core/assets/3283596/fb66830a-774b-4237-8ad6-ee77327a203c)

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

No source file, test, or minimal manifest is named. Start by reproducing the NuGet update with conditional PackageReference and PackageVersion elements, using the dependabot.yml configuration and the screenshot's expected line 23 versus skipped lines 24–25. Done means conditional elements are respected during the update.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.