From 1209d7d4f40ff834e1147ea5546e6b1828ab9e54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amaury=20Lev=C3=A9?= <amauryleve@microsoft.com>
Date: Fri, 26 Jun 2026 11:01:15 +0200
Subject: [PATCH 1/4] Make bundled Playwright discoverable by Dependabot via
 PackageDownload

The orphan `PackageVersion` for `Microsoft.Playwright.MSTest.v4` in
Directory.Packages.props was never enough for Dependabot to discover and
bump it: Dependabot only proposes updates for packages that have a real
consuming reference (PackageReference / PackageDownload). Aspire.Hosting.Testing
sits in the same orphan-CPM ItemGroup but was kept up to date only because it
already had a PackageDownload in the acceptance-test project (see #9446, which
bumped Aspire but left Playwright stuck at 1.60.0).

Add a matching PackageDownload for Microsoft.Playwright.MSTest.v4 and update the
surrounding comments so future bundled SDK feature packages follow the same
pattern.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props                              | 11 ++++++++++-
 .../MSTest.Acceptance.IntegrationTests.csproj         |  7 ++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index edee48a01d..594536889e 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -134,7 +134,16 @@
   </ItemGroup>
   <!--
     Declare below packages that are referenced through MSTest.Sdk but don't have a direct
-    PackageReference in this repo, so that Dependabot can discover and update them.
+    PackageReference in this repo, so that the build can pin a single version for them.
+
+    IMPORTANT: a PackageVersion entry here is NOT enough on its own for Dependabot to discover the
+    package. Dependabot only proposes updates for packages that have a real consuming reference
+    (PackageReference / PackageDownload). Each of these packages therefore also has a matching
+    PackageDownload in test/IntegrationTests/MSTest.Acceptance.IntegrationTests/
+    MSTest.Acceptance.IntegrationTests.csproj which is what actually triggers the update; Dependabot
+    then bumps both the *Version property and the literal PackageVersion below. If you add another
+    bundled-but-unreferenced SDK feature package here, add a matching PackageDownload too, otherwise
+    it will silently never be updated.
 
     The version MUST be a literal here (not an MSBuild property such as
     $(MicrosoftPlaywrightVersion)): Dependabot does not update a Central Package Management
diff --git a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
index 4f4ac365d6..792d249f66 100644
--- a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
+++ b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
@@ -42,9 +42,14 @@
     <ProjectReference Include="$(RepoRoot)test\Utilities\Microsoft.Testing.TestInfrastructure\Microsoft.Testing.TestInfrastructure.csproj" />
   </ItemGroup>
 
-  <!-- Packages needed for the test assets but that we don't want to reference -->
+  <!-- Packages needed for the test assets but that we don't want to reference.
+       These PackageDownload items also give Dependabot a real consuming reference for the
+       bundled MSTest.Sdk feature packages (Aspire/Playwright), which is what makes it discover
+       and bump them. A lone orphan PackageVersion in Directory.Packages.props is NOT enough:
+       Dependabot only proposes updates for packages that have an actual reference. -->
   <ItemGroup>
     <PackageDownload Include="Aspire.Hosting.Testing" Version="[$(AspireHostingTestingVersion)]" />
+    <PackageDownload Include="Microsoft.Playwright.MSTest.v4" Version="[$(MicrosoftPlaywrightVersion)]" />
   </ItemGroup>
 
   <Target Name="CopyNuGetPackagesForTestAssets" BeforeTargets="BeforeBuild">

From 3964e2fdd113f6c14916a6f259efd6c47f2c1b68 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amaury=20Lev=C3=A9?= <amauryleve@microsoft.com>
Date: Fri, 26 Jun 2026 12:21:42 +0200
Subject: [PATCH 2/4] Revert redundant Playwright Dependabot fix superseded by
 main

main independently fixed #9362 via inert PackageReference ExcludeAssets=\"all\"
anchors for both Playwright and Aspire. Revert this branch's PackageDownload-based
approach and the contradictory comments to match main exactly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props                          | 15 ++++-----------
 .../MSTest.Acceptance.IntegrationTests.csproj     |  7 +------
 2 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index e7923b20ff..437bc74a84 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -133,17 +133,10 @@
     <PackageVersion Include="xunit.v3.mtp-v2" Version="3.2.2" />
   </ItemGroup>
   <!--
-    Declare below packages that are referenced through MSTest.Sdk but don't have a direct
-    PackageReference in this repo, so that the build can pin a single version for them.
-
-    IMPORTANT: a PackageVersion entry here is NOT enough on its own for Dependabot to discover the
-    package. Dependabot only proposes updates for packages that have a real consuming reference
-    (PackageReference / PackageDownload). Each of these packages therefore also has a matching
-    PackageDownload in test/IntegrationTests/MSTest.Acceptance.IntegrationTests/
-    MSTest.Acceptance.IntegrationTests.csproj which is what actually triggers the update; Dependabot
-    then bumps both the *Version property and the literal PackageVersion below. If you add another
-    bundled-but-unreferenced SDK feature package here, add a matching PackageDownload too, otherwise
-    it will silently never be updated.
+    Declare below packages that are bundled through MSTest.Sdk (baked into the shipped SDK
+    templates) and are not otherwise consumed by a built project, so that Dependabot can
+    discover and update them. Their only PackageReference in this repo is the inert anchor
+    described in condition 2 below.
 
     Two conditions must BOTH hold for Dependabot to bump one of these, and missing either one
     silently stops the updates:
diff --git a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
index 93ebef5efa..72c297422e 100644
--- a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
+++ b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
@@ -42,14 +42,9 @@
     <ProjectReference Include="$(RepoRoot)test\Utilities\Microsoft.Testing.TestInfrastructure\Microsoft.Testing.TestInfrastructure.csproj" />
   </ItemGroup>
 
-  <!-- Packages needed for the test assets but that we don't want to reference.
-       These PackageDownload items also give Dependabot a real consuming reference for the
-       bundled MSTest.Sdk feature packages (Aspire/Playwright), which is what makes it discover
-       and bump them. A lone orphan PackageVersion in Directory.Packages.props is NOT enough:
-       Dependabot only proposes updates for packages that have an actual reference. -->
+  <!-- Packages needed for the test assets but that we don't want to reference -->
   <ItemGroup>
     <PackageDownload Include="Aspire.Hosting.Testing" Version="[$(AspireHostingTestingVersion)]" />
-    <PackageDownload Include="Microsoft.Playwright.MSTest.v4" Version="[$(MicrosoftPlaywrightVersion)]" />
   </ItemGroup>
 
   <!--

From 05a1ef00b23f7c928332df1de5b88732eeeb7df5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amaury=20Lev=C3=A9?= <amauryleve@microsoft.com>
Date: Fri, 26 Jun 2026 12:56:41 +0200
Subject: [PATCH 3/4] Fix Dependabot discovery of bundled Playwright via
 PackageDownload

The anchor added in #9422 used a PackageReference with ExcludeAssets=\"all\",
which removes the reference from the dependency graph Dependabot reads, so the
package stays invisible and is never bumped. Aspire.Hosting.Testing kept updating
only because it ALSO has a PackageDownload; Microsoft.Playwright.MSTest.v4 had only
the ExcludeAssets anchor and stayed stuck at 1.60.0 (today's Dependabot run bumped
Aspire to 13.4.6 but skipped Playwright, with no PR-limit pressure).

Replace the inert ExcludeAssets anchors with PackageDownload (proven by Aspire),
which keeps the package in the restore graph without flowing any of its assets into
the test project, and correct the now-misleading guidance comments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props                      | 15 ++++----
 .../MSTest.Acceptance.IntegrationTests.csproj | 34 +++++++++----------
 2 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 437bc74a84..461c767122 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -135,8 +135,8 @@
   <!--
     Declare below packages that are bundled through MSTest.Sdk (baked into the shipped SDK
     templates) and are not otherwise consumed by a built project, so that Dependabot can
-    discover and update them. Their only PackageReference in this repo is the inert anchor
-    described in condition 2 below.
+    discover and update them. Their only reference in this repo is the inert anchor described
+    in condition 2 below.
 
     Two conditions must BOTH hold for Dependabot to bump one of these, and missing either one
     silently stops the updates:
@@ -146,14 +146,17 @@
          PackageVersion whose Version is an MSBuild property interpolation.
          See dependabot/dependabot-core#5812 and dependabot/dependabot-core#7183.
 
-      2. The package MUST have a real PackageReference somewhere in the repo's restore graph:
+      2. The package MUST appear in the repo's restore graph via a graph-visible reference:
          Dependabot only updates a CPM PackageVersion that is actually referenced by a project;
          an "orphan" PackageVersion (declared here but referenced nowhere) is ignored. Because
          these packages are only baked into the shipped SDK templates (Sdk/Features/*.targets)
-         and never referenced by a built project, we add inert anchor references
-         (PackageReference with ExcludeAssets="all") in
+         and never referenced by a built project, we add inert anchor references in
          test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj.
-         Without those anchors Dependabot never proposed bumps (see #9362).
+         The anchor MUST be a PackageDownload, NOT a PackageReference with ExcludeAssets="all":
+         ExcludeAssets="all" removes the reference from the dependency graph Dependabot reads, so
+         the package stays invisible and never gets bumped. PackageDownload keeps it in the restore
+         graph (so Dependabot proposes bumps) without flowing any of its assets into the project.
+         Without a graph-visible anchor Dependabot never proposed bumps (see #9362).
 
     Each literal version is duplicated as the matching *Version property (defined near the top of
     this file) which is the value actually consumed by the build and baked into the MSTest.Sdk
diff --git a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
index 72c297422e..ae05e107ae 100644
--- a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
+++ b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
@@ -42,26 +42,26 @@
     <ProjectReference Include="$(RepoRoot)test\Utilities\Microsoft.Testing.TestInfrastructure\Microsoft.Testing.TestInfrastructure.csproj" />
   </ItemGroup>
 
-  <!-- Packages needed for the test assets but that we don't want to reference -->
-  <ItemGroup>
-    <PackageDownload Include="Aspire.Hosting.Testing" Version="[$(AspireHostingTestingVersion)]" />
-  </ItemGroup>
-
   <!--
-    Dependabot anchor for the packages bundled by MSTest.Sdk (Microsoft.Playwright.MSTest.v4,
-    Aspire.Hosting.Testing). These are baked into the shipped SDK templates (Sdk/Features/*.targets)
-    and have no other PackageReference in the repo, so their Central Package Management PackageVersion
-    entries in Directory.Packages.props are "orphans" that Dependabot ignores (it only updates package
-    versions that are actually referenced by a project). Referencing them here (with ExcludeAssets="all"
-    so none of their assets such as compile/runtime/build targets, e.g. Playwright's browser install,
-    flow into this test project) puts them into a real restore graph so Dependabot proposes bumps. The
-    _ValidateBundledSdkFeatureVersions target in Directory.Packages.props then guards the matching
-    version properties (MicrosoftPlaywrightVersion, AspireHostingTestingVersion) against drift after
-    a bump. See https://github.com/microsoft/testfx/issues/9362.
+    Dependabot anchors (also used to stage nupkgs for test assets) for the packages bundled by
+    MSTest.Sdk (Microsoft.Playwright.MSTest.v4, Aspire.Hosting.Testing). These are baked into the
+    shipped SDK templates (Sdk/Features/*.targets) and have no other reference in the repo, so their
+    Central Package Management PackageVersion entries in Directory.Packages.props are "orphans" that
+    Dependabot ignores (it only updates package versions that are actually referenced by a project).
+
+    We use PackageDownload (NOT a PackageReference with ExcludeAssets="all") deliberately:
+    ExcludeAssets="all" removes the reference from the dependency graph Dependabot reads, so the
+    package stays invisible to it and never gets bumped (Aspire only kept updating because it ALSO
+    had this PackageDownload; the equivalent Playwright anchor with ExcludeAssets="all" silently did
+    nothing, see #9362). PackageDownload puts the package into the restore graph (so Dependabot
+    proposes bumps) without flowing any of its assets (compile/runtime/build, e.g. Playwright's
+    browser install) into this test project. The _ValidateBundledSdkFeatureVersions target in
+    Directory.Packages.props then guards the matching version properties (MicrosoftPlaywrightVersion,
+    AspireHostingTestingVersion) against drift after a bump.
   -->
   <ItemGroup>
-    <PackageReference Include="Microsoft.Playwright.MSTest.v4" ExcludeAssets="all" />
-    <PackageReference Include="Aspire.Hosting.Testing" ExcludeAssets="all" />
+    <PackageDownload Include="Aspire.Hosting.Testing" Version="[$(AspireHostingTestingVersion)]" />
+    <PackageDownload Include="Microsoft.Playwright.MSTest.v4" Version="[$(MicrosoftPlaywrightVersion)]" />
   </ItemGroup>
 
   <Target Name="CopyNuGetPackagesForTestAssets" BeforeTargets="BeforeBuild">

From a150109c5c1f34eb7e70a0a67d979cbc0383fcb1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Amaury=20Lev=C3=A9?= <amauryleve@microsoft.com>
Date: Fri, 26 Jun 2026 13:55:08 +0200
Subject: [PATCH 4/4] Address review: clarify Dependabot anchor comments

- Note that the bundled packages ARE referenced inside the SDK feature targets
  (Sdk/Features/*.targets); what's missing is a graph-visible reference from a
  restored repo project, which is what Dependabot relies on.
- Clarify that only the Aspire PackageDownload stages a nupkg for test assets;
  the Playwright PackageDownload is the Dependabot anchor only.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props                      |  7 ++++---
 .../MSTest.Acceptance.IntegrationTests.csproj | 19 +++++++++++--------
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 461c767122..e211c40dc3 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -134,9 +134,10 @@
   </ItemGroup>
   <!--
     Declare below packages that are bundled through MSTest.Sdk (baked into the shipped SDK
-    templates) and are not otherwise consumed by a built project, so that Dependabot can
-    discover and update them. Their only reference in this repo is the inert anchor described
-    in condition 2 below.
+    templates) and are not otherwise consumed by a restored project, so that Dependabot can
+    discover and update them. They are referenced only inside the SDK feature targets
+    (Sdk/Features/*.targets, which Dependabot doesn't restore); their only graph-visible reference
+    from a repo project restore is the inert anchor described in condition 2 below.
 
     Two conditions must BOTH hold for Dependabot to bump one of these, and missing either one
     silently stops the updates:
diff --git a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
index ae05e107ae..e3348314e3 100644
--- a/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
+++ b/test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj
@@ -43,19 +43,22 @@
   </ItemGroup>
 
   <!--
-    Dependabot anchors (also used to stage nupkgs for test assets) for the packages bundled by
-    MSTest.Sdk (Microsoft.Playwright.MSTest.v4, Aspire.Hosting.Testing). These are baked into the
-    shipped SDK templates (Sdk/Features/*.targets) and have no other reference in the repo, so their
-    Central Package Management PackageVersion entries in Directory.Packages.props are "orphans" that
-    Dependabot ignores (it only updates package versions that are actually referenced by a project).
+    Dependabot anchors for the packages bundled by MSTest.Sdk (Microsoft.Playwright.MSTest.v4,
+    Aspire.Hosting.Testing). The Aspire entry doubles as the download that stages its nupkg for
+    test assets (see CopyNuGetPackagesForTestAssets below); the Playwright entry is the Dependabot
+    anchor only. These packages are baked into the shipped SDK templates (Sdk/Features/*.targets)
+    and are otherwise referenced only there (which Dependabot doesn't restore), so without a
+    graph-visible reference from a repo project their Central Package Management PackageVersion
+    entries in Directory.Packages.props are "orphans" that Dependabot ignores (it only updates
+    package versions that are actually referenced by a restored project).
 
     We use PackageDownload (NOT a PackageReference with ExcludeAssets="all") deliberately:
     ExcludeAssets="all" removes the reference from the dependency graph Dependabot reads, so the
     package stays invisible to it and never gets bumped (Aspire only kept updating because it ALSO
     had this PackageDownload; the equivalent Playwright anchor with ExcludeAssets="all" silently did
-    nothing, see #9362). PackageDownload puts the package into the restore graph (so Dependabot
-    proposes bumps) without flowing any of its assets (compile/runtime/build, e.g. Playwright's
-    browser install) into this test project. The _ValidateBundledSdkFeatureVersions target in
+    nothing, see #9362). PackageDownload puts the package into the restore (so Dependabot proposes
+    bumps) without flowing any of its assets (compile/runtime/build, e.g. Playwright's browser
+    install) into this test project. The _ValidateBundledSdkFeatureVersions target in
     Directory.Packages.props then guards the matching version properties (MicrosoftPlaywrightVersion,
     AspireHostingTestingVersion) against drift after a bump.
   -->