chore(ci): pin QuestPDF/SkiaSharp/Playwright against grouped dependabot bumps (#942) - #943
Merged
Merged
Conversation
…ot bumps (#942) The first grouped nuget PR under the #910 policy (#941) bundled 24 updates, three of which move packages CLAUDE.md pins for licence or runtime reasons: QuestPDF 2022.12.12 -> 2026.7.1 SkiaSharp.NativeAssets.Win32 2.88.6 -> 4.150.1 Microsoft.Playwright 1.43.0 -> 1.61.0 QuestPDF is the load-bearing one, and it is measured, not assumed. NuGet catalog, 2026-07-26: questpdf 2022.12.12 licenseExpression = "MIT" questpdf 2026.7.1 licenseExpression = (none), licenseUrl = aka.ms/deprecateLicenseUrl i.e. the embedded <license type="file"> form — the exact mechanism #905 identified as invisible to expression-only scanners (same shape as FluentAssertions 8.x). The #905 release gate reports "24/24 permissive" by reading those SPDX expressions, so merging #941 would remove the evidence that gate stands on, days after it passed as a #134 gate. Skia and Playwright are compatibility pins, majors only: Skia is QuestPDF's native backend and must move with it; Playwright 1.43.0 is what the CI Test step has been launching real Chromium with since #911, mirror-fallback included. Deliberately NOT a blanket major filter on .NET. Grouping is all-or-nothing, so the list names only pins that are already-recorded decisions (#588, #905, CLAUDE.md "Stable Dependency Versions"); everything else keeps flowing and is triaged on merit. Newtonsoft 13.0.3->13.0.4, PdfPig, dotNetRdf, CsvHelper and the rest of #941 remain available for a deliberate tested pass after the tag. Validated: 29 update blocks preserved, schemastore dependabot-2.0 PASS. Refs #942, #905, #910, #941 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Jul 26, 2026
This was referenced Jul 26, 2026
jsboige
added a commit
that referenced
this pull request
Jul 26, 2026
… no-op, OWLSharp major breaks the build (#947) The first grouped nuget PR under the #910 policy (#941) was superseded by dependabot itself with #945, and #945 is the measurement that shows two defects in the pin list merged as #943. 1. The Microsoft.Playwright entry was `update-types: ["version-update:semver-major"]`, which is a NO-OP for that package: it has never left the 1.x line (1.0 -> 1.61), so a semver-major update cannot fire. #945 proposed 1.43.0 -> 1.61.0 as a MINOR and the filter let it through. Found by po-2024's review on #945, confirmed firsthand against the PR's package delta. Now pinned on ALL update types, like QuestPDF. An ignore entry is only as strong as the package's versioning scheme. 2. OWLSharp / OWLSharp.Extensions 4.x -> 5.x breaks the build: 10 compile errors, all in Ontology/OwlAdapter.cs, all `RDFResource` -> `OWLNamedIndividual` (SKOSHelper changed its signatures). The try/catch fallbacks around those five call sites guard runtime, not compile, so the build never reaches the 638 tests. OWLSharp was deliberately left unpinned as "a major to test on its merits after the tag"; #945 ran that test and the answer is "needs an API migration", now issue #946 with its DoD. The pin is the corollary of that scheduled work, not a way to silence a red build. Also recorded, both deliberately NOT changed: - dotNetRdf stays unpinned. The #945 review first attributed the OwlAdapter break to dotNetRdf 3.3.2 -> 3.5.2; re-measured, that is wrong (VDS.RDF is used elsewhere in the file, the bump is a minor, and RDFSharp.RDFResource is the type our code passes, not the one that moved). Pinning it would have been an over-pin bought on a mis-attribution. - SkiaSharp keeps major-only. #945 delivered 2.88.6 -> 2.88.9, a patch inside the 2.88.x line QuestPDF 2022.12.12 links against — the pin working as intended, not a leak. Labels nuget / npm / vendored created in the repo: they were referenced by this file but did not exist, so dependabot posted a "labels could not be found" comment on all 27 open PRs. Noted in the header so they are not deleted without editing the config. Refs #942, #945, #946 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why now
The #910 policy took effect and dependabot regenerated grouped. The very first grouped nuget PR — #941, 24 updates in one — moves three packages that CLAUDE.md pins for licence or runtime reasons:
The QuestPDF finding — measured, not assumed
NuGet catalog, 2026-07-26:
The SPDX expression disappears. That is the embedded
<license type="file">form — the exact mechanism #905 identified as invisible to expression-only scanners (same shape as FluentAssertions 8.x, the one remaining flag in that inventory).This matters beyond tidiness: the #905 gate reports the shipped binary as 24/24 permissive by reading those expressions, and that gate passed days ago as a #134 release gate. Merging #941 would remove the evidence the gate stands on, without turning anything red.
Skia and Playwright are compatibility pins, majors only: Skia is QuestPDF's native backend and shouldn't move while QuestPDF is frozen; Playwright 1.43.0 is what the CI Test step has been launching real Chromium with since #911 — including the mirror-fallback chain that survives the
playwright.azureedge.net400s observed in both matrix legs.What this is not
Not a blanket major filter on .NET. Grouping is all-or-nothing, so one unmergeable package holds 24 hostage. The
ignorelist names only packages whose pin is an already-recorded decision — licence (#588, #905) or a documented runtime coupling (CLAUDE.md Stable Dependency Versions). Everything else keeps flowing and is triaged on its merits. A comment in the file states the bar for adding an entry: cite the decision; do not add one to silence a red build.Left deliberately unpinned, to be triaged on merit after the tag: OWLSharp 4→5 (Apache-2.0, no licence risk, but a major under a known-fail round-trip test #133) and the safe remainder of #941 — Newtonsoft 13.0.3→13.0.4, PdfPig, dotNetRdf, CsvHelper, Spectre.
Verification
dependabot-2.0(jsonschema,$refresolved) — same bar as chore(ci): add .github/dependabot.yml — group + ignore-major policy (vendored npm + AutoMapper) [DRAFT for jsboige scope arbitration] #910Follow-up
#941 stays unmerged and is superseded by the regenerated group this config produces. Also note it would have introduced version skew inside the solution: it bumps Playwright/coverlet/Test.Sdk in
VisualTests.csprojbut not inTests.csproj, which carries the same packages.Refs #942, #905, #910, #941
🤖 Coordinator ai-01