Hold three dependency lines where their pins require, until each constraint lifts - #757
Merged
Merged
Conversation
The next majors of xunit, Microsoft.NET.Test.Sdk and coverlet move the whole stack to Microsoft Testing Platform, and on the .NET 10 SDK that drops the VSTest bridge `dotnet test` relies on. Dependabot's grouped PR (#748) built fine and passed the logic suite, then failed the UI smoke tests with "Testing with VSTest target is no longer supported" -- so it is a migration, tracked in #756, not a version bump. All four are majors, so there is no partial upgrade to take either. Left ungated, that same unmergeable PR comes back every month and becomes noise people learn to scroll past -- which is how a genuinely important update gets missed later. Majors for this group are ignored until #756 lands; minor and patch updates still come through. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Grouping by coupling (#752) fixed the deadlock but only half the problem. Dependabot now proposes coupled packages together, which is what makes the constraint reviewable -- but it still picks the latest version of each, not the one the sibling requires. So the regenerated PRs were coherent and still wrong: the Avalonia group proposed SkiaSharp 4.152.1 against an Avalonia that ships 3.119.x, and the rpc group proposed MessagePack 3.1.9 against a pin deliberately held on 2.5.x. Both restore cleanly -- 4.152.1 satisfies Avalonia's ">= 3.119.4" -- so neither fails loudly; they would simply take the project off the versions those pins exist to hold it to. Both constraints are already written on the PackageReferences. This states them where Dependabot can act on them: majors ignored, minors and patches unaffected. With SkiaSharp held to 3.x the grouped Avalonia PR lands on 3.119.4, which is the version Avalonia asks for and the one the csproj comment describes. Neither is permanent. SkiaSharp's revisits when Avalonia moves to 4; MessagePack's when the 2.5.x compatibility constraint goes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
TheSevenPens
changed the title
This was referenced Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to triaging the first Dependabot batches. Three
ignorerules, each stating a constraint that is already written on thePackageReferenceit applies to.Grouping by coupling (#752) fixed the deadlock but only half the problem: Dependabot now proposes coupled packages together, which is what makes a constraint reviewable — but it still picks the latest version of each, not the one the sibling requires.
1. Test tooling — blocked on a migration (#756)
The grouped PR (#748) bumped four packages, all majors. It built fine and the logic suite passed; it failed at
UI smoke tests:That line has moved to Microsoft Testing Platform, and on the .NET 10 SDK the VSTest bridge
dotnet testrelies on is gone. It's a migration, tracked in #756, not a version bump — and all four being majors means there's nothing partial to take.2. SkiaSharp — must track Avalonia
Its pin exists to match what
Avalonia.Skiapulls; thePackageReferencecomment says so. Regrouped, Dependabot put it in the Avalonia PR as asked — and proposed 4.152.1 against an Avalonia that ships 3.119.x.That one restores cleanly (4.152.1 satisfies Avalonia's
>= 3.119.4), so it wouldn't fail loudly. It would just quietly take the project off the version the pin exists to hold it to. With majors ignored, the grouped PR lands on 3.119.4 — the version Avalonia actually asks for.3. MessagePack — security floor on the 2.5.x line
Pinned above what StreamJsonRpc pulls transitively (NU1903, GHSA-hv8m-jj95-wg3x) and deliberately held on 2.5.x for compatibility. The regenerated rpc PR proposed 3.1.9, a major, which breaks that.
Scope
Majors only. Minor and patch updates come through for all of these, so security and bug fixes on the current lines are unaffected — which for MessagePack is the whole reason its pin exists.
None is permanent, and each says what removes it: #756's acceptance criteria include deleting the test-tooling block; SkiaSharp's revisits when Avalonia moves to 4; MessagePack's when the 2.5.x constraint goes.
Why bother
Left ungated these return monthly and can't be merged. A recurring red PR is one people learn to scroll past — which is how a genuinely important update gets missed later.
🤖 Generated with Claude Code