NuGet dependency updates never arrive: Dependabot cannot evaluate the WinUI target framework #52

New Issue

2026-10-09T11:21:33Z

KofTwentyTwo commented

2026-10-09 11:21:33 +00:00

(Migrated from github.com)

Problem

No NuGet dependency update has landed since July. Dependabot's NuGet updater cannot evaluate the WinUI project's Windows-versioned target framework (net10.0-windows10.0.19041.0) and logs every newer package as not compatible. Incompatible project frameworks: net10.0-windows10.0.19041 (upstream: dependabot/dependabot-core#13923, open since 2026-01). Because it updates a package consistently across projects, the same packages were also blocked in the plain net10.0 test projects. The one PR it opened (#50) it closed itself; the weekly GitHub Actions job also failed every week on actions/setup-dotnet after v6 shipped.

Packages that were silently held back: Microsoft.WindowsAppSDK (2.2.0 → 2.5.1), Velopack (1.2.0 → 1.2.161), LibGit2Sharp (0.31.0 → 0.32.0, a security release), xunit.runner.visualstudio (3.1.5 → 4.0.0), Microsoft.NET.Test.Sdk, coverlet.collector, Microsoft.Windows.SDK.BuildTools, actions/setup-dotnet.

Resolution (in PR #51)

Catch-up bumps of all of the above, verified by build, both unit suites, the coverage gate and the FlaUI end-to-end suite.
.github/workflows/nuget-updates.yml + .github/scripts/Update-NuGetPackages.ps1 replace Dependabot's NuGet ecosystem: dotnet list package --outdated --format json (real MSBuild/NuGet evaluation) drives minor/patch bumps, holds majors and prereleases for review, runs the build/test/format gates on the bumped tree, and opens one PR on deps/nuget-weekly against dev (Mondays 06:00 ET, or on demand with include-major).
dependabot.yml keeps only the github-actions ecosystem and explains why.

Follow-ups

Optional DEPS_PAT secret so the generated PRs get their own CI checks (tracked in #7).
Revisit when dependabot-core#13923 is fixed; the script becomes redundant then.

## Problem No NuGet dependency update has landed since July. Dependabot's NuGet updater cannot evaluate the WinUI project's Windows-versioned target framework (`net10.0-windows10.0.19041.0`) and logs every newer package as `not compatible. Incompatible project frameworks: net10.0-windows10.0.19041` (upstream: dependabot/dependabot-core#13923, open since 2026-01). Because it updates a package consistently across projects, the same packages were also blocked in the plain `net10.0` test projects. The one PR it opened (#50) it closed itself; the weekly GitHub Actions job also failed every week on actions/setup-dotnet after v6 shipped. Packages that were silently held back: Microsoft.WindowsAppSDK (2.2.0 → 2.5.1), Velopack (1.2.0 → 1.2.161), LibGit2Sharp (0.31.0 → 0.32.0, a security release), xunit.runner.visualstudio (3.1.5 → 4.0.0), Microsoft.NET.Test.Sdk, coverlet.collector, Microsoft.Windows.SDK.BuildTools, actions/setup-dotnet. ## Resolution (in PR #51) - Catch-up bumps of all of the above, verified by build, both unit suites, the coverage gate and the FlaUI end-to-end suite. - `.github/workflows/nuget-updates.yml` + `.github/scripts/Update-NuGetPackages.ps1` replace Dependabot's NuGet ecosystem: `dotnet list package --outdated --format json` (real MSBuild/NuGet evaluation) drives minor/patch bumps, holds majors and prereleases for review, runs the build/test/format gates on the bumped tree, and opens one PR on `deps/nuget-weekly` against `dev` (Mondays 06:00 ET, or on demand with `include-major`). - `dependabot.yml` keeps only the `github-actions` ecosystem and explains why. ## Follow-ups - Optional `DEPS_PAT` secret so the generated PRs get their own CI checks (tracked in #7). - Revisit when dependabot-core#13923 is fixed; the script becomes redundant then.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#52