Repository: dependabot/dependabot-core

Issue #4075: Dependabot does not respect `ignore` version syntax for Nuget
Created: 2021-07-23T13:24:14Z
Package ecosystem
nuget
Package manager version
N/A
Language version
N/A
Manifest location and content prior to update
https://github.com/amido/stacks-dotnet-packages-cosmosdb/pull/8/files#diff-0ee2cfdaf6f922b832e0d6b4ee312c515ff3df9f8bd22499d3222de34729b1bc
dependabot.yml content
https://github.com/amido/stacks-dotnet-packages-cosmosdb/blob/3711de53ac51eddd907fbfa75f6235f16c28500a/.github/dependabot.yml#L6-L7
Note we specify 5.0 which in Nuget terms means ignore 5.0 and above inclusive: https://docs.microsoft.com/en-us/nuget/concepts/package-versioning#version-ranges
Updated dependency

Bump Microsoft.Extensions.Diagnostics.HealthChecks from 3.1.16 to 5.0.8 in /src

What you expected to see, versus what you actually saw
I expect the PR 8 here to be closed as we're telling it to ignore all >= 5.0 packages: Ensono/stacks-dotnet-packages-cosmosdb#8
Instead PRs 9 and 7 closed as soon as I added the ignore, but 8 is ignoring the ignore file.
Native package manager behavior
N/A
Images of the diff or a link to the PR, issue or logs
Processed the ignore:
Ensono/stacks-dotnet-packages-cosmosdb#9
Ignores the ignore

Ensono/stacks-dotnet-packages-cosmosdb#8

Duplicate issue #11398: [NuGet] ignore semver-major doesn't appear to work
Created: 2025-01-24T04:22:23Z
Is there an existing issue for this?

 I have searched the existing issues

Package ecosystem
Nuget
Package manager version
No response
Language version
.NET 9
Manifest location and content before the Dependabot update
https://github.com/dotnet/aspire/blob/0ca981a95feccfc4cec15ebee6bd06bd7c792fe2/eng/Versions.props#L76-L104
dependabot.yml content
https://github.com/dotnet/aspire/blob/0ca981a95feccfc4cec15ebee6bd06bd7c792fe2/.github/dependabot.yml#L1-L87
version: 2
registries:
  public-nuget:
    type: nuget-feed
    url: https://api.nuget.org/v3/index.json
updates:
  - package-ecosystem: nuget
    directory: "/"
    registries:
      - public-nuget
    schedule:
      day: monday
      interval: weekly
      time: "07:00"
      timezone: "America/Los_Angeles"
    open-pull-requests-limit: 15
    ignore:
      # handled by Darc/Maestro flows
      - dependency-name: "Microsoft.DotNet.Arcade.Sdk"
      - dependency-name: "Microsoft.DotNet.Helix.Sdk"
      - dependency-name: "Microsoft.DotNet.SharedFramework.Sdk"
      - dependency-name: "Microsoft.Build.NoTargets"
      # Pinned versions that should not be updated
      - dependency-name: "Microsoft.CodeAnalysis.CSharp"
      # NetPlatform dependencies shouldn't update across major versions
      - dependency-name: "Microsoft.AspNetCore.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "Microsoft.EntityFrameworkCore.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "Microsoft.Extensions.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "System.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "Npgsql.*"
        update-types: ["version-update:semver-major"]
    groups:
      Azure:
        patterns:
          - "Azure.*"
          - "Microsoft.Azure.*"
          - "Microsoft.Extensions.Azure"
      AspNetCoreHealthChecks:
        patterns:
          - "AspNetCore.HealthChecks.*"
      FluentUi:
        patterns:
          - "Microsoft.FluentUI.*"
      OpenTelemetry:
        patterns:
          - "OpenTelemetry.*"
      Orleans:
        patterns:
          - "Microsoft.Orleans*"
      NetPlatform:
        patterns:
          - "Microsoft.AspNetCore.*"
          - "Microsoft.EntityFrameworkCore.*"
          - "Microsoft.Extensions.*"
          - "System.*"
        update-types:
          - 'minor'
          - 'patch'
      Npgsql:
        patterns:
          - "Npgsql.*"
        update-types:
          - 'minor'
          - 'patch'
      MicrosoftDotNet:
        patterns:
          - "Microsoft.DotNet.*"
      Grpc:
        patterns:
          - "Grpc.*"
      Polly:
        patterns:
          - "Polly.*"
    labels:
      - "area-codeflow"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: daily
    open-pull-requests-limit: 5
    labels:
      - area-engineering-systems

Updated dependency
dependabot made dotnet/aspire#7226 with the first commit dotnet/aspire@780a358
What you expected to see, versus what you actually saw
Since I'm saying to ignore semver-major on on Microsoft.Extensions.* and System.* dependencies, I expect that those dependencies won't get lifted from v8.0 to v9.0
However, dependabot is updating these dependencies across major versions in this PR.
Native package manager behavior
No response
Images of the diff or a link to the PR, issue, or logs

https://github.com/dotnet/aspire/actions/runs/12937683800/job/36086133337
Smallest manifest that reproduces the issue
No response

Closing comment (2025-01-29T20:58:16Z): Possibly related to #4075 (same issue but for ignored versions)