Make bundled SDK feature package versions discoverable by Dependabot#9365
Merged
Conversation
Dependabot does not update a Central Package Management PackageVersion whose Version is an MSBuild property interpolation ($(MicrosoftPlaywrightVersion)) when the package has no direct PackageReference. That is exactly the case for the Microsoft.Playwright.MSTest.v4 entry declared in the "not used directly" group, so the bundled Playwright version silently stopped receiving updates. Give the PackageVersion a literal version (which Dependabot can discover and bump) and derive the MicrosoftPlaywrightVersion property from it via an item-metadata transform, keeping a single source of truth that still flows into the MSTest.Sdk template. See dependabot-core microsoft#5812 / microsoft#7183. Related to microsoft#9362. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates how the MSTest SDK’s bundled Playwright-for-.NET version is declared so Dependabot can detect and propose updates for it, while still keeping MicrosoftPlaywrightVersion as the single source of truth used by the SDK templates.
Changes:
- Replace the
MicrosoftPlaywrightVersionproperty constant with a literalPackageVersionforMicrosoft.Playwright.MSTest.v4(Dependabot-discoverable). - Derive
MicrosoftPlaywrightVersionfrom thePackageVersionitem via an item-metadata transform so the SDK template continues to consume the resolved version.
Show a summary per file
| File | Description |
|---|---|
| Directory.Packages.props | Makes the Playwright bundle version Dependabot-discoverable via a literal PackageVersion, and derives MicrosoftPlaywrightVersion from it for template consumption. |
Copilot's findings
- Files reviewed: 1/1 changed files
- Comments generated: 1
…ndabot-playwright
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ndabot-playwright
Aspire.Hosting.Testing has the same problem as Playwright: AspireHostingTestingVersion was a literal property flowing into the MSTest.Sdk template, but no literal PackageVersion existed for the package, so Dependabot could not discover or bump it. Apply the same pattern: declare a literal Aspire.Hosting.Testing PackageVersion in the 'not used directly' group and derive AspireHostingTestingVersion from it via an item-metadata transform. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Evangelink
changed the title
0101
approved these changes
Jun 23, 2026
Storing an @(PackageVersion->...) item transform in a <PropertyGroup> leaves the property unexpanded; when concatenated with strings in a task (e.g. the Copy in MSTest.Acceptance.IntegrationTests) it fails with MSB4012. Keep the consumed *Version properties as plain scalar literals, keep the literal PackageVersion items for Dependabot, and add the _ValidateBundledSdkFeatureVersions target so the two cannot drift. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
# Conflicts: # Directory.Packages.props
This was referenced Jun 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Some packages bundled by the MSTest SDK fell behind because Dependabot wasn't proposing updates for them (the cause behind #9362 leaving Playwright stuck at 1.58.0). The same applies to
Aspire.Hosting.Testing.Both
Microsoft.Playwright.MSTest.v4andAspire.Hosting.Testingare bundled viaSdk/Features/*.targetsand versioned through MSBuild properties (MicrosoftPlaywrightVersion,AspireHostingTestingVersion) that flow into the SDK template. Dependabot does not update a Central Package ManagementPackageVersionthat is both:PackageReferenceanywhere in the repo.So:
not used directlygroup withVersion="$(MicrosoftPlaywrightVersion)"— property-interpolated, so invisible to Dependabot.PackageVersionexisted for it at all (only theAspireHostingTestingVersionproperty and property-interpolated usages), so Dependabot had nothing to discover.See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183.
Fix
For each bundled package:
PackageVersionin thenot used directlygroup so Dependabot can discover and bump it.*VersionMSBuild property (MicrosoftPlaywrightVersion,AspireHostingTestingVersion) as a literal that flows into the MSTest.Sdk template (MSTest.Sdk.csproj->Sdk.props)._ValidateBundledSdkFeatureVersionstarget that fails theMSTest.Sdkbuild if the property and the literalPackageVersionever drift apart (e.g. after Dependabot bumps only thePackageVersion), so the two values can never ship out of sync.Versions are unchanged by this PR (Playwright
1.60.0, Aspire13.2.1); Dependabot can take it from here.Verification
PackageVersionin sync (Playwright1.60.0, Aspire13.2.1), theMSTest.Sdkbuild passes and the same versions flow into the SDK template (MSTest.Sdk.csproj's_TemplateProperties).PackageVersion(simulating a Dependabot PR) trips the_ValidateBundledSdkFeatureVersions<Error>, which names the property to update — so drift fails fast in CI instead of silently shipping.Related to #9362.