.NET dependecy check PR missing project file contents

[josesimoes]

Hi,

I've just setup dependabot in one of our repos to give it a try. It's a .NET solution.
It seems that it updates the contents of the packages.config file, but it misses the references in the csproj files.

[greysteil]

Hey @josesimoes,

Hmmm, it should be picking those up. Can you give me the name of the repo (or email it to support@dependabot.com if it's private)?

[josesimoes]

Here's the PR

Actually I just realize that there was nothing to bump, because there was no new package... still dependabot has created this PR bumping to a non-existing package....

Looking at the PR comment I can see that it's picking up and linking to another unrelated repo: nf-class-libraries.... I don't know from here that comes from....

[josesimoes]

On the wrong bump and and repo link: I think I've found the reason.
There is a package in nuget for version 1.0.0 but it's unlisted so it's supposed to be hidden. Guess it's showing on the collection that dependabot receives from nuget API and it's wrongly considering it as a valid new version.

I would suggest that if a package is hidden then it should not be considered for evaluating if it's a valid new version.

[greysteil]

Awesome - I'll make that improvement tonight. It's a little late on a Friday evening here so I won't be responsive for the next couple of hours, but I'll get this fixed up when I'm back.

Thanks for giving Dependabot a try!

[greysteil]

OK, dependabot/dependabot-core@24f3458 and dependabot/dependabot-core@93ab669 are deploying now, which will fix the unlisted version problem. 🎉

Thanks for flagging this!

[josesimoes]

Thank YOU for the quick fix!

[josesimoes]

@greysteil it seems that it's not replacing the project file contents after all...

Please check this PR

It has replaced the packages content with the new version: PR files.

but it's missing the csproj file (which in this case has the extension nfproj because of our project system)
It should be replacing all the occurrences of this dependency: here and here.....

[greysteil]

Ah, OK, that's going to be because of the nfproj extension, which I wasn't aware of. Is that standard / is there any way Dependabot could have figured it out?

[josesimoes]

This is not a standard .NET extension (being standard something coming from Microsoft). It's part of a .NET project system that, despite being C#, it's derived from the regular CPS.

I guess this can happen with other folks using their own project systems/extensions...
Maybe if there was a new setting on the dependabot project on which one could enter the file extension(s) to the processed as the regular .csproj.....
Or maybe dependabot could "smartly" pick up those from the solution file that is next to the packages.config...

[greysteil]

I think Dependabot ought to be able to figure it out by parsing your .sln file better - at the moment it just looks for .(cs|fs|vb)proj files in there, but it should be taking the filename of anything that's declared as a project.

[josesimoes]

Makes sense!

[greysteil]

Deploying the fix now - should be live in about 10 mins.

[josesimoes]

That was fast! 👏

For some reason that is not working... You can use this PR for debugging if you want.

[greysteil]

Ah, it looks like this is a separate issues. Dependabot expects packages to be declared using PackageReference tags, but you're using a Dependency tag. Can you point me to any information about the difference?