From 2b26342316bc42ffacd48d1c3250208463c0e1a2 Mon Sep 17 00:00:00 2001 From: Stuart Meeks Date: Mon, 21 Sep 2026 06:34:20 +0000 Subject: [PATCH] chore: sync dependabot ignore to STANDARD.md 4.10 (ignore floored packages entirely) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NextIteration.Standards PR #26 changed ยง4.10: per-TFM-floored packages MUST be ignored with no update-types filter, not just semver-major. A name-scoped major-only ignore cannot protect a per-TFM floor โ€” because the package name lives in both the net8 and net10 ItemGroups, a net10 minor/patch bump rewrites the net8 floor to a 10.x version (PR #89 did exactly that: 8.0.x -> 10.0.12). Sync this repo to the merged standard: - .github/dependabot.yml: drop update-types from the three floored-package ignore entries; rewrite the caveat comment. - Directory.Packages.props: update the cross-reference comment. Prevents Dependabot from regenerating the #89 net8-floor bump. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 34 ++++++++++++++++------------------ Directory.Packages.props | 7 +++++-- 2 files changed, 21 insertions(+), 20 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 417064a..00d7c87 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,30 +23,28 @@ updates: - dependencies - nuget # ------------------------------------------------------------------------- - # These three carry deliberate per-TFM floors (see the csproj comment): a - # net8.0 consumer must stay on its own 8.0.x servicing line, so an - # 8.x -> 10.x major PR is never mergeable and would just be weekly noise. + # These carry deliberate per-TFM floors (see the csproj comment): a net8.0 + # consumer must stay on its own 8.0.x servicing line. They are ignored + # ENTIRELY (no update-types filter = every version update), STANDARD.md 4.10. # - # Two caveats, both inherent to Dependabot rather than to this repo: - # 1. `ignore` matches by dependency NAME and cannot be scoped to a single - # target framework. These packages are referenced under BOTH the net8.0 - # and net10.0 ItemGroups, so this also suppresses a future net10 major - # (10.x -> 11.x). Bump those by hand when a new .NET major lands. - # 2. `ignore` conditions filter SECURITY updates as well as version - # updates, so a major-version security fix for these would also be - # suppressed. Low risk in practice (a CVE fix for 8.0.x ships as - # 8.0.y, a patch), but worth knowing. + # A major-only ignore is NOT enough. `ignore` matches by dependency NAME and + # cannot be scoped to one target framework, and each name appears under BOTH + # the net8.0 and net10.0 ItemGroups. Dependabot tracks a single version per + # name, so a net10 MINOR/PATCH bump โ€” which a semver-major filter does not + # catch โ€” is applied to every entry of that name, silently rewriting the + # net8.0 floor to a 10.x version. PR #89 did exactly that (8.0.x -> 10.0.12). + # Ignoring the package outright is the only name-scoped rule that protects a + # per-TFM floor; both floors are bumped by hand. + # + # Caveat, inherent to Dependabot: `ignore` also filters SECURITY updates, so + # a security fix for these is suppressed too. Low risk (a CVE fix for a + # floored line ships as a patch on that line, applied by hand), but worth + # knowing. # ------------------------------------------------------------------------- ignore: - dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions - update-types: - - version-update:semver-major - dependency-name: Microsoft.Extensions.Http - update-types: - - version-update:semver-major - dependency-name: System.Security.Cryptography.ProtectedData - update-types: - - version-update:semver-major groups: nuget-minor-patch: patterns: diff --git a/Directory.Packages.props b/Directory.Packages.props index 786f65e..cd2d351 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -22,8 +22,11 @@ groups per-TFM during the inner build. These three are also listed under `ignore` in .github/dependabot.yml with - update-types: [version-update:semver-major] (STANDARD.md 4.10), so - Dependabot never proposes the 8.x -> 10.x bump that can never be merged. + NO update-types filter (STANDARD.md 4.10), so Dependabot never touches them + on either TFM. A name-scoped major-only ignore is not enough: because the + same package name lives in both the net8 and net10 groups, a net10 + minor/patch bump would rewrite the net8 floor to a 10.x version (PR #89). + Both floors are bumped by hand. Versions here are unchanged from the per-project references they replaced. This migration is deliberately behaviour-preserving: raising a floor is a