[NuGet] ignore semver-major doesn't appear to work

[eerhardt]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

Nuget

Package manager version

No response

Language version

.NET 9

Manifest location and content before the Dependabot update

https://github.com/dotnet/aspire/blob/0ca981a95feccfc4cec15ebee6bd06bd7c792fe2/eng/Versions.props#L76-L104

dependabot.yml content

https://github.com/dotnet/aspire/blob/0ca981a95feccfc4cec15ebee6bd06bd7c792fe2/.github/dependabot.yml#L1-L87

version: 2
registries:
  public-nuget:
    type: nuget-feed
    url: https://api.nuget.org/v3/index.json
updates:
  - package-ecosystem: nuget
    directory: "/"
    registries:
      - public-nuget
    schedule:
      day: monday
      interval: weekly
      time: "07:00"
      timezone: "America/Los_Angeles"
    open-pull-requests-limit: 15
    ignore:
      # handled by Darc/Maestro flows
      - dependency-name: "Microsoft.DotNet.Arcade.Sdk"
      - dependency-name: "Microsoft.DotNet.Helix.Sdk"
      - dependency-name: "Microsoft.DotNet.SharedFramework.Sdk"
      - dependency-name: "Microsoft.Build.NoTargets"
      # Pinned versions that should not be updated
      - dependency-name: "Microsoft.CodeAnalysis.CSharp"
      # NetPlatform dependencies shouldn't update across major versions
      - dependency-name: "Microsoft.AspNetCore.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "Microsoft.EntityFrameworkCore.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "Microsoft.Extensions.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "System.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "Npgsql.*"
        update-types: ["version-update:semver-major"]
    groups:
      Azure:
        patterns:
          - "Azure.*"
          - "Microsoft.Azure.*"
          - "Microsoft.Extensions.Azure"
      AspNetCoreHealthChecks:
        patterns:
          - "AspNetCore.HealthChecks.*"
      FluentUi:
        patterns:
          - "Microsoft.FluentUI.*"
      OpenTelemetry:
        patterns:
          - "OpenTelemetry.*"
      Orleans:
        patterns:
          - "Microsoft.Orleans*"
      NetPlatform:
        patterns:
          - "Microsoft.AspNetCore.*"
          - "Microsoft.EntityFrameworkCore.*"
          - "Microsoft.Extensions.*"
          - "System.*"
        update-types:
          - 'minor'
          - 'patch'
      Npgsql:
        patterns:
          - "Npgsql.*"
        update-types:
          - 'minor'
          - 'patch'
      MicrosoftDotNet:
        patterns:
          - "Microsoft.DotNet.*"
      Grpc:
        patterns:
          - "Grpc.*"
      Polly:
        patterns:
          - "Polly.*"
    labels:
      - "area-codeflow"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: daily
    open-pull-requests-limit: 5
    labels:
      - area-engineering-systems

Updated dependency

dependabot made dotnet/aspire#7226 with the first commit dotnet/aspire@780a358

What you expected to see, versus what you actually saw

Since I'm saying to ignore semver-major on on Microsoft.Extensions.* and System.* dependencies, I expect that those dependencies won't get lifted from v8.0 to v9.0

However, dependabot is updating these dependencies across major versions in this PR.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

https://github.com/dotnet/aspire/actions/runs/12937683800/job/36086133337

Smallest manifest that reproduces the issue

No response

[eerhardt]

@brettfo - am I doing something wrong in the dependabot yml config? Is this supposed to work:

    ignore:
      # NetPlatform dependencies shouldn't update across major versions
      - dependency-name: "Microsoft.AspNetCore.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "Microsoft.EntityFrameworkCore.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "Microsoft.Extensions.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "System.*"
        update-types: ["version-update:semver-major"]
      - dependency-name: "Npgsql.*"
        update-types: ["version-update:semver-major"]

[brettfo]

@eerhardt That scenario should work because the common code handles the ignore section; that's not NuGet specific, but something is obviously going wrong. I'll dig in a bit.

[brettfo]

@abdulapopoola and/or @jakecoffman Could I get some help routing this? The dependabot.yml file was updated in this PR and shortly after that this update job was run, but examining the job JSON file shows an empty ignore-conditions property where I would have expected it to have several values.

[bricelam]

Possibly related to #4075 (same issue but for ignored versions)