From 1209d7d4f40ff834e1147ea5546e6b1828ab9e54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amaury=20Lev=C3=A9?= <amauryleve@microsoft.com>
Date: Fri, 26 Jun 2026 11:01:15 +0200
Subject: [PATCH 1/2] Make bundled Playwright discoverable by Dependabot via
 PackageDownload

The orphan `PackageVersion` for `Microsoft.Playwright.MSTest.v4` in
Directory.Packages.props was never enough for Dependabot to discover and
bump it: Dependabot only proposes updates for packages that have a real
consuming reference (PackageReference / PackageDownload). Aspire.Hosting.Testing
sits in the same orphan-CPM ItemGroup but was kept up to date only because it
already had a PackageDownload in the acceptance-test project (see #9446, which
bumped Aspire but left Playwright stuck at 1.60.0).

Add a matching PackageDownload for Microsoft.Playwright.MSTest.v4 and update the
surrounding comments so future bundled SDK feature packages follow the same
pattern.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props                              | 11 ++++++++++-
 .../MSTest.Acceptance.IntegrationTests.csproj         |  7 ++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index edee48a01d..594536889e 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -134,7 +134,16 @@
   </ItemGroup>
   <!--
     Declare below packages that are referenced through MSTest.Sdk but don't have a direct
-    PackageReference in this repo, so that Dependabot can discover and update them.
+    PackageReference in this repo, so that the build can pin a single version for them.
+
+    IMPORTANT: a PackageVersion entry here is NOT enough on its own for Dependabot to discover the
+    package. Dependabot only proposes updates for packages that have a real consuming reference
+    (PackageReference / PackageDownload). Each of these packages therefore also has a matching
+    PackageDownload in test/IntegrationTests/MSTest.Acceptance.IntegrationTests/
+    MSTest.Acceptance.IntegrationTests.csproj which is what actually triggers the update; Dependabot
+    then bumps both the *Version property and the literal PackageVersion below. If you add another
+    bundled-but-unreferenced SDK feature package here, add a matching PackageDownload too, otherwise
+    it will silently never be updated.
 
     The version MUST be a literal here (not an MSBuild property such as
     $(MicrosoftPlaywrightVersion)): Dependabot does not update a Central Package Management
diff --git a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
index 4f4ac365d6..792d249f66 100644
--- a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
+++ b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
@@ -42,9 +42,14 @@
     <ProjectReference Include="$(RepoRoot)test\Utilities\Microsoft.Testing.TestInfrastructure\Microsoft.Testing.TestInfrastructure.csproj" />
   </ItemGroup>
 
-  <!-- Packages needed for the test assets but that we don't want to reference -->
+  <!-- Packages needed for the test assets but that we don't want to reference.
+       These PackageDownload items also give Dependabot a real consuming reference for the
+       bundled MSTest.Sdk feature packages (Aspire/Playwright), which is what makes it discover
+       and bump them. A lone orphan PackageVersion in Directory.Packages.props is NOT enough:
+       Dependabot only proposes updates for packages that have an actual reference. -->
   <ItemGroup>
     <PackageDownload Include="Aspire.Hosting.Testing" Version="[$(AspireHostingTestingVersion)]" />
+    <PackageDownload Include="Microsoft.Playwright.MSTest.v4" Version="[$(MicrosoftPlaywrightVersion)]" />
   </ItemGroup>
 
   <Target Name="CopyNuGetPackagesForTestAssets" BeforeTargets="BeforeBuild">

From 3964e2fdd113f6c14916a6f259efd6c47f2c1b68 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amaury=20Lev=C3=A9?= <amauryleve@microsoft.com>
Date: Fri, 26 Jun 2026 12:21:42 +0200
Subject: [PATCH 2/2] Revert redundant Playwright Dependabot fix superseded by
 main

main independently fixed #9362 via inert PackageReference ExcludeAssets=\"all\"
anchors for both Playwright and Aspire. Revert this branch's PackageDownload-based
approach and the contradictory comments to match main exactly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props                          | 15 ++++-----------
 .../MSTest.Acceptance.IntegrationTests.csproj     |  7 +------
 2 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index e7923b20ff..437bc74a84 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -133,17 +133,10 @@
     <PackageVersion Include="xunit.v3.mtp-v2" Version="3.2.2" />
   </ItemGroup>
   <!--
-    Declare below packages that are referenced through MSTest.Sdk but don't have a direct
-    PackageReference in this repo, so that the build can pin a single version for them.
-
-    IMPORTANT: a PackageVersion entry here is NOT enough on its own for Dependabot to discover the
-    package. Dependabot only proposes updates for packages that have a real consuming reference
-    (PackageReference / PackageDownload). Each of these packages therefore also has a matching
-    PackageDownload in test/IntegrationTests/MSTest.Acceptance.IntegrationTests/
-    MSTest.Acceptance.IntegrationTests.csproj which is what actually triggers the update; Dependabot
-    then bumps both the *Version property and the literal PackageVersion below. If you add another
-    bundled-but-unreferenced SDK feature package here, add a matching PackageDownload too, otherwise
-    it will silently never be updated.
+    Declare below packages that are bundled through MSTest.Sdk (baked into the shipped SDK
+    templates) and are not otherwise consumed by a built project, so that Dependabot can
+    discover and update them. Their only PackageReference in this repo is the inert anchor
+    described in condition 2 below.
 
     Two conditions must BOTH hold for Dependabot to bump one of these, and missing either one
     silently stops the updates:
diff --git a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
index 93ebef5efa..72c297422e 100644
--- a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
+++ b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
@@ -42,14 +42,9 @@
     <ProjectReference Include="$(RepoRoot)test\Utilities\Microsoft.Testing.TestInfrastructure\Microsoft.Testing.TestInfrastructure.csproj" />
   </ItemGroup>
 
-  <!-- Packages needed for the test assets but that we don't want to reference.
-       These PackageDownload items also give Dependabot a real consuming reference for the
-       bundled MSTest.Sdk feature packages (Aspire/Playwright), which is what makes it discover
-       and bump them. A lone orphan PackageVersion in Directory.Packages.props is NOT enough:
-       Dependabot only proposes updates for packages that have an actual reference. -->
+  <!-- Packages needed for the test assets but that we don't want to reference -->
   <ItemGroup>
     <PackageDownload Include="Aspire.Hosting.Testing" Version="[$(AspireHostingTestingVersion)]" />
-    <PackageDownload Include="Microsoft.Playwright.MSTest.v4" Version="[$(MicrosoftPlaywrightVersion)]" />
   </ItemGroup>
 
   <!--