.NET project file not updated

[pascalberger]

While packages.config file was updated the csproj file was not updated in this PR: https://github.com/bbtsoftware/TfsUrlParser/pull/25/files

[feelepxyz]

@pascalberger hey sorry for the incredibly slow response on this! Is this still an issue for you? Looks like you've removed your packages file?

[pascalberger]

@feelepxyz The error still occurs from time to time on projects with packages.config

[justalemon]

I can also confirm this on justalemon/GGOV#16. Had to fix the csproj manually.

You can see how bad this is by taking a look at the respective AppVeyor build.

[feelepxyz]

Sorry, just realised this is a known issue and @greysteil already got back to you on it! To fix this issue is unfortunately a pretty major piece of work so won't get to any time soon :((

We're hopefully getting some resource to work on this in the next few months.

[justalemon]

Hi, there has been any progress on this?

cc @feelepxyz

[greysteil]

Sorry for the wait on this one - we're doing some infrastructure work that has taken up all of my time.

The change required here isn't trivial, as Phil says, so it's not something I can promise we'll get to immediately, but I'd really like to have it fixed. I'm hoping we'll have some .NET expertise on the team in the relatively near future, which will mean we can power through this and a couple of other issues 🤞.

[caiofbpa]

I'm having this issue too, and I don't understand why this isn't a trivial change.

In projects that have only the .csproj files, mostly .NET Standard projects, dependabot updates the version number accordingly.

In projects with package.config files, dependabot updates the version number too, it just needs to do the same on the .csproj too. I'm assuming the logic is already there, it just needs to be called appropriately.

[justalemon]

.csproj is just XML, so there is not a lot to do other than search for an ItemGroup that contains a Reference where Include starts with the package name(ish).

[greysteil]

Just digging into this now - looks like the issues described here are quite separate.

@justalemon - it looks like in justalemon/GGOV#16 Dependabot missed your ...csproj declaration because you use Reference, rather than PackageReference, as the tag name. I couldn't find any docs on that - could you point me to some? As you can see, that isn't included in Dependabot's selector.

@pascalberger - it looks like the issue on your repo is from a very old PR, and you've re-organised your project since. Do you have a more recent example of the issue on one of your repos?

@caiofbpa - can you link to a PR where you've seen this problem and I'll dig into that?

[caiofbpa]

@greysteil thanks for taking the time to look into this.

We only use dependabot in private projects, but assuming you can look into dependabot's logs for a specific PR, here it is: https://github.com/mercos/offline/pull/1965

Dependabot should have also edited the .csproj file replacing 1.3.4 to 2.1.0 in the line where Refractored.FloatingActionButton is present. Currently I have to do that manually, so I'm opening a different PR for that.

[pascalberger]

@greysteil Here's a newer one: cake-contrib/Cake.Issues.Reporting.Generic#148. For this project and package everytime only packages.config is updated and csproj not.

[justalemon]

@greysteil This is not documented for some reason. All of my .NET Framework projects have Reference instead of PackageReference. The same applies for @pascalberger Cake.Issues.Reporting.Generic.

[RohanNagar]

I believe Reference is used for assembly references. In your case @justalemon, your packages.confg is the "PackageReference" equivalent, and the binaries are downloaded from the Nuget feed into your local machine. Then, in the csproj since you already have the assemblies on the machine, it uses Reference to reference the assembly directly.

In other words, using PackageReference in a csproj is a direct reference to a nuget package. But if you have a packages.config, that takes the place of the nuget package reference, so you need to use Reference to reference the assembly that was downloaded from the packages.config declaration.

I'm not sure why I can't find great documentation on this, but it is standard. I have a project where I directly use Reference to a local dll assembly.

Edit: Take a look at this (https://docs.microsoft.com/en-us/aspnet/web-forms/overview/deployment/web-deployment-in-the-enterprise/understanding-the-project-file#items-and-item-groups):

... the Reference list includes assemblies that must be in place for a successful build, the Compile list includes code files that must be compiled, and the Content list includes resources that must be copied unaltered.

[greysteil]

Got you. @caiofbpa, in your case it looks like it's a HintPath that's part of a reference that hasn't been updated, so all of these are connected.

I think Dependabot should be able to successfully update these references whilst continuing to use its current regex-based approach for .NET. We'll need new logic for finding and updating them as they're structured differently, but I think this is still just a straight find and replace for the version in the relevant blocks. Make sense?

[caiofbpa]

@greysteil Makes total sense, it should simply be a find and replace indeed.

Sometimes one dependency triggers updates on others, but that is an exception that only happens on old projects (which is my case) and shouldn't be a concern because with .NET Core this has changed and is no longer an issue. I can treat those cases manually here, the find and replace is enough for most cases.