dependabot / dependabot/dependabot-core
`PackageReference` and `PackageVersion` element does not take `Condition` into consideration
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
nuget
### Package manager version
latest
### Language version
Multiple TargetFrameworks: net6.0;net7.0;net8.0
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
```yml
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "daily"
commit-message:
prefix: "build(ci)"
labels:
- "dependency-actions"
open-pull-requests-limit: 50
- package-ecosystem: "nuget"
directory: "/"
schedule:
interval: "daily"
commit-message:
prefix: "build(deps)"
labels:
- "dependency-nuget"
open-pull-requests-limit: 50
# groups:
# coverlet:
# patterns:
# - "coverlet*"
# testcontainers:
# patterns:
# - "testcontainers*"
# verify:
# patterns:
# - "verify*"
# xunit:
# patterns:
# - "xunit"
# - "xunit*"
- package-ecosystem: "gitsubmodule"
directory: "/"
schedule:
interval: "daily"
commit-message:
prefix: "build(mods)"
labels:
- "dependency-gitmodule"
open-pull-requests-limit: 50
groups:
submodules:
patterns:
- "*"
```
### Updated dependency
Microsoft.AspNetCore.TestHost
### What you expected to see, versus what you actually saw
I expect, that the line 23 (see screenshot) will be updated, and the lines 24 and 25 will be skipped because of the conditional update.
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs

### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
No source file, test, or minimal manifest is named. Start by reproducing the NuGet update with conditional PackageReference and PackageVersion elements, using the dependabot.yml configuration and the screenshot's expected line 23 versus skipped lines 24–25. Done means conditional elements are respected during the update.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100