Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for NuGet ManagePackageVersionsCentrally #4261

Closed
dorssel opened this issue Sep 28, 2021 · 2 comments
Closed

Support for NuGet ManagePackageVersionsCentrally #4261

dorssel opened this issue Sep 28, 2021 · 2 comments
Labels
L: dotnet:nuget NuGet packages via nuget or dotnet T: feature-request Requests for new features

Comments

@dorssel
Copy link

dorssel commented Sep 28, 2021

NuGet has a new way of centralized package versions:
https://github.com/NuGet/Home/wiki/Centrally-managing-NuGet-package-versions
Sure, this is still in preview, but the interface and functionality have been stable for more than a year and several projects already use it.

The function is quite similar to:
https://github.com/microsoft/MSBuildSdks/tree/main/src/CentralPackageVersions
This is already supported by dependabot since #1311

In fact, the two are so similar that the support could possibly be integrated. Instead of parsing Packages.props also parsing Directory.Packages.props could already be sufficient.

@dorssel dorssel added the T: feature-request Requests for new features label Sep 28, 2021
@brrygrdn brrygrdn added the L: dotnet:nuget NuGet packages via nuget or dotnet label Nov 26, 2021
@dorssel
Copy link
Author

dorssel commented Dec 8, 2021

Currently, GitHub's native Dependabot does check Directory.Packages.props (and global.json, etc.). This may have been implemented by now, in which case this issue can be closed. I don't know if dependabot-core and GitHub's version are in sync...

GitHub still does not display the right version in the Dependency Graph, but that issue has nothing to do with dependabot and has been reported to GitHub.

@jurre
Copy link
Member

jurre commented Dec 9, 2021

Yeah they're mostly in sync, sometimes the version deployed to GitHub lags behind a little, but all development on dependabot-core happens here 👍. I should note that dependabot-core only powers dependabot updates and not alerts or the dependency graph.

I believe this was implemented by #1880 and later fixed by #2309.

Those PRs seem to pre-date this issue, so not sure what happened tbh 😄 I think we should be ok to close this out though.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
L: dotnet:nuget NuGet packages via nuget or dotnet T: feature-request Requests for new features
Projects
None yet
Development

No branches or pull requests

3 participants