build(deps): bump OfficeIMO to 3.2.6, AngleSharp to 1.7.2 and PdfPig to 0.1.16 - #366
Merged
github-actions[bot] merged 3 commits intoAug 24, 2026
Conversation
Bumps AngleSharp from 1.7.1 to 1.7.2 Bumps OfficeIMO.Excel from 3.2.2 to 3.2.6 Bumps OfficeIMO.Excel.Pdf from 3.2.2 to 3.2.6 Bumps OfficeIMO.PowerPoint from 3.2.2 to 3.2.6 Bumps OfficeIMO.PowerPoint.Pdf from 3.2.2 to 3.2.6 Bumps OfficeIMO.Word from 3.2.2 to 3.2.6 Bumps OfficeIMO.Word.Html from 3.2.2 to 3.2.6 Bumps OfficeIMO.Word.Markdown from 3.2.2 to 3.2.6 Bumps OfficeIMO.Word.Pdf from 3.2.2 to 3.2.6 Bumps PdfPig from 0.1.15 to 0.1.16 --- updated-dependencies: - dependency-name: AngleSharp dependency-version: 1.7.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-dependencies - dependency-name: OfficeIMO.Excel dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-dependencies - dependency-name: OfficeIMO.Excel.Pdf dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-dependencies - dependency-name: OfficeIMO.PowerPoint dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-dependencies - dependency-name: OfficeIMO.PowerPoint.Pdf dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-dependencies - dependency-name: OfficeIMO.Word dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-dependencies - dependency-name: OfficeIMO.Word.Html dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-dependencies - dependency-name: OfficeIMO.Word.Markdown dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-dependencies - dependency-name: OfficeIMO.Word.Pdf dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-dependencies - dependency-name: PdfPig dependency-version: 0.1.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
This was referenced Aug 24, 2026
Ank-KhoaHo
changed the title
Owner
|
Retitled from
The mislabelling was not Dependabot misbehaving: the tests block reaches Repaired and verified here:
Pushing to the branch means Dependabot no longer manages it, so it will not rebase itself. That is |
Ank-KhoaHo
added a commit
that referenced
this pull request
Aug 24, 2026
Both `/src/` blocks ignore `dependency-name: "*"` and propose nothing, and their comment says bumps there "stay a deliberate manual act". **They did not.** The tests block reaches `src/` through `ProjectReference`, Dependabot edits the src csproj on its way past, and that block carries `prefix: chore` — hidden and non-bumping. So the only automated path that touched a shipped dependency was the one whose own header says *"these do not ship, so they stay out of the public changelog."* ## What it cost #366, titled *"Bump the test-dependencies group with 10 updates"*, bumped **seven shipped runtime dependencies**: OfficeIMO 3.2.2 → 3.2.6 across eight packages, AngleSharp 1.7.1 → 1.7.2, PdfPig 0.1.15 → 0.1.16. OfficeIMO is the engine behind every DOCX, XLSX, PPTX and PDF path here. Under `chore:` a consumer restores four patch versions of different rendering code with no changelog entry and no version proposed. It also truncated all eight lockfiles, exactly as the `/src/` blocks predict — so the brokenness those blocks were disabled to avoid arrived anyway, under a different label. ## Why the existing guard passed `check-dependabot-scoping.py` was right about what it checked, and **its own comment named the hole**: > The NAMED rules still have to be repeated. A wildcard in src/ stops Dependabot proposing bumps > rooted there; it does nothing about a bump proposed from the tests or root block that edits a src > csproj on its way past. It required the **4 named** rules. `src/Directory.Build.props` declares **15** packages, and only `SixLabors.Fonts` was in both sets — leaving **14 reachable and bumpable**. Discarding `"*"` stays, and is right: requiring the tests block to repeat it would stop test dependencies updating at all, for a reason that has nothing to do with them. ## The fix All fifteen are ignored in both blocks that reach `src/`, and the requirement is **derived** from the props file rather than listed — the same principle as `gen-third-party-notices.py` reading the lockfile. Verified by sabotage in both directions, because a derived check has two ways to go quiet: | sabotage | result | |---|---| | delete one shipped ignore | 1 error, naming it | | add a sixteenth package to the props | required set grows to 19; tests block reported `MISSING` it | The second is the one that matters — a hand-written list passes that case, which is how four rules came to cover one of fifteen packages. The script also refuses to run if the props file is missing or parses to zero references, rather than quietly requiring less. ## Not in scope Whether shipped bumps should be automated under `build:` instead. That is a separate decision and the `/src/` blocks' lockfile reasoning argues against it. `dependency-report.yml` already delivers the information weekly, read-only, which is what those blocks say was actually wanted. Closes C37.
dependabot
Bot
deleted the
dependabot/nuget/src/test-dependencies-933011c772
branch
August 24, 2026 13:23
Ank-KhoaHo
added a commit
that referenced
this pull request
Aug 24, 2026
…t config (#374) **#373 shipped a `.github/dependabot.yml` that Dependabot refuses to parse.** It appended the fifteen shipped packages to two ignore lists that already named `SixLabors.Fonts`, so both gained a duplicate: ``` The property '#/updates/2/ignore/18/dependency-name' is a duplicate. ``` Dependabot stops parsing the **whole file** on that, so every update it would raise is disabled — **security updates included**. `main` has been in that state since #373 merged. Caught by Dependabot's own API check appearing on #366, not by anything in this repo. ## Why nothing here saw it Three separate blind spots, all pointing the same way: - `check-dependabot-scoping.py` reduces each block's ignore list to a **set**, so a duplicate is gone before it is examined - `yaml.safe_load` accepts duplicate list items happily — they are list entries, not map keys - the config check that objects is Dependabot's, and it runs on a PR touching the file, which #373's own checks did not show before I merged it ## Fixed `SixLabors.Fonts` is no longer a standalone entry in either block; the derived list carries it. In the root block that entry had an `update-types: ["version-update:semver-major"]` line under it — removing only the name left the line orphaned and broke the YAML outright, which is worth recording because it is the second way to get this wrong in one edit. That is a deliberate widening: the root block ignored only SixLabors majors, the derived entry ignores it entirely. Ignoring more is always safe, and `src/` pins it to an exact version anyway. ## Guarded `check-dependabot-scoping.py` now counts each ignore list as a **list** rather than a set, using this file's own line patterns. **Deliberately not via PyYAML.** The first version of this check imported it inside a `try/except ImportError` — and no workflow here installs PyYAML, so in CI it would have skipped itself and reported success. A check that silently does nothing is worse than no check. Sabotage-verified three ways, each duplicating a name that already exists in its own block: | duplicated | caught | |---|---| | `Ank.DocToolkit` | yes | | `OfficeIMO.Word` | yes | | `Microsoft.Extensions.Hosting` | yes | My first two sabotage attempts were ineffective — I added a name to a block that did not already have it, so no duplicate existed and the check passed correctly. Worth stating: an ineffective sabotage looks exactly like a guard that does not work.
Ank-KhoaHo
added a commit
that referenced
this pull request
Aug 24, 2026
🤖 I have created a release *beep* *boop* --- ## [0.37.0](v0.36.1...v0.37.0) (2026-08-24) ### Added * **extensions:** mirror DocxReview as IDocxReview ([#375](#375)) ([8bcfacf](8bcfacf)) ### Fixed * **ci:** remove the duplicate ignore entries that broke the Dependabot config ([#374](#374)) ([cab06a2](cab06a2)) * **core:** restore the samples to the floating version ([#371](#371)) ([51a66eb](51a66eb)) ### Changed * **deps:** bump OfficeIMO to 3.2.6, AngleSharp to 1.7.2 and PdfPig to 0.1.16 ([#366](#366)) ([df1dc03](df1dc03)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated AngleSharp from 1.7.1 to 1.7.2.
Release notes
Sourced from AngleSharp's releases.
1.7.2
Released on Sunday, August 23 2026
What's Changed
annotation-xmlencoding to be case-insensitive (#1284) @arpitjain099<xmp>usage in<select>elementsNew Contributors
Full Changelog: AngleSharp/AngleSharp@1.7.1...v1.7.2
Commits viewable in compare view.
Updated OfficeIMO.Excel from 3.2.2 to 3.2.6.
Release notes
Sourced from OfficeIMO.Excel's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated OfficeIMO.Excel.Pdf from 3.2.2 to 3.2.6.
Release notes
Sourced from OfficeIMO.Excel.Pdf's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated OfficeIMO.PowerPoint from 3.2.2 to 3.2.6.
Release notes
Sourced from OfficeIMO.PowerPoint's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated OfficeIMO.PowerPoint.Pdf from 3.2.2 to 3.2.6.
Release notes
Sourced from OfficeIMO.PowerPoint.Pdf's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated OfficeIMO.Word from 3.2.2 to 3.2.6.
Release notes
Sourced from OfficeIMO.Word's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated OfficeIMO.Word.Html from 3.2.2 to 3.2.6.
Release notes
Sourced from OfficeIMO.Word.Html's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated OfficeIMO.Word.Markdown from 3.2.2 to 3.2.6.
Release notes
Sourced from OfficeIMO.Word.Markdown's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated OfficeIMO.Word.Pdf from 3.2.2 to 3.2.6.
Release notes
Sourced from OfficeIMO.Word.Pdf's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated PdfPig from 0.1.15 to 0.1.16.
Release notes
Sourced from PdfPig's releases.
0.1.16
What's Changed
New Contributors
Full Changelog: UglyToad/PdfPig@v0.1.15...v0.1.16
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions