Stop Dependabot's restore rewriting multi-targeted lock files - #73
Merged
Merged
Conversation
Dependabot's NuGet discovery invokes Restore through ProjectReferenceBuildTargets, so each referenced multi-targeted project was restored with one TargetFramework and its packages.lock.json rewritten with net10.0 only. That broke both Dependabot NuGet PRs (#42, #45). Reproduced locally with the same msbuild invocation (from dependabot-core's SdkProjectDiscovery.cs): three lock files lost net8.0. Directory.Build.targets sends the lock file to obj/ when a multi-targeted project is restored under a single TargetFramework, which ordinary restore never does. With it, the reproduction changes nothing; a fresh locked restore still fails on a lock file missing a framework. tools/lockfile-probe/check.sh runs the reproduction in validate.sh full and fails without the fix. Closes #63 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #63.
Root cause, from dependabot-core's source (
NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs): discovery runsdotnet msbuild <project> /t:Restore,ResolveProjectReferences,GenerateBuildDependencyFile /p:ProjectReferenceBuildTargets="Restore;...". MSBuild calls each referenced multi-targeted project with a singleTargetFramework, so NuGet rewrote itspackages.lock.jsonfor that framework alone.Reproduced locally: running that exact invocation from a test project on a clean tree strips net8.0 from the lock files of
RulesKernel,RulesKernel.RandomnessandRulesKernel.Testing. That matches #42 and #45.Fix:
Directory.Build.targetssends the lock file toobj/when a multi-targeted project is restored under a singleTargetFramework. Ordinarydotnet restorenever evaluates that combination.dotnet restore --locked-modestill fails with NU1004 on a lock file missing net8.0, so the gate isn't blinded.validate.sh fullpasses.Kept fixed:
tools/lockfile-probe/check.shruns the reproduction from every test project in a copy of the tree, and fails if any lock file changes. It runs invalidate.sh full(~8 s). It fails without the fix, as shown above.We'll only see it end to end when Dependabot next opens a NuGet PR.
🤖 Generated with Claude Code