Bump the aspnetcore group with 3 updates#35353
Conversation
Bumps Microsoft.AspNetCore.Authentication.Facebook from 10.0.0 to 10.0.7 Bumps Microsoft.AspNetCore.Authentication.Google from 10.0.0 to 10.0.7 Bumps Microsoft.AspNetCore.Authentication.MicrosoftAccount from 10.0.0 to 10.0.7 --- updated-dependencies: - dependency-name: Microsoft.AspNetCore.Authentication.Facebook dependency-version: 10.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspnetcore - dependency-name: Microsoft.AspNetCore.Authentication.Google dependency-version: 10.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspnetcore - dependency-name: Microsoft.AspNetCore.Authentication.MicrosoftAccount dependency-version: 10.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aspnetcore ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
area-infrastructure
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 35353Or
iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 35353" |
🤖 AI Summary
📊 Review Session —
|
| # | Source | Approach | Test Result | Files Changed | Notes |
|---|---|---|---|---|---|
| 1 | try-fix-1 (claude-opus-4.6 / regression patterns) | Bump only the 3 Auth packages 10.0.0→10.0.7; leave previous-TFM anchor alone | NU1202 introduced |
1 file, 3 lines | Strictly safer than pr but leaves stale 8.0.16 |
| 2 | try-fix-2 (claude-sonnet-4.6 / build-infra) | Bump 3 Auth → 10.0.7 AND fix anchor to 9.0.15 (correct net9 patch) |
9.0.15 exists on nuget.org |
1 file, 4 lines | Best functional outcome; same as pr-plus-reviewer minus comment |
| 3 | try-fix-3 (gpt-5.3-codex / api-design cohesion) | Bump ALL 13 AspNetCore-current to 10.0.7 + anchor to 9.0.15 |
1 file, 14 lines | Out of scope for this PR; should be separate PR | |
| 4 | try-fix-4 (gemini-3-pro-preview / supply-chain) | No-op: defer/decline the PR | 0 files | Safest but provides no value | |
| pr | PR #35353 (dependabot) | Bump 3 Auth → 10.0.7 AND anchor 8.0.16→10.0.7 | NU1202 for net9 builds |
1 file, 4 lines | Anchor change has wrong major version |
| pr-plus-reviewer | Branch A | PR diff + reviewer fix: anchor to 9.0.15 with explanatory comment |
1 file, 5 lines | Best overall; documents the coupling |
Cross-Pollination
| Model | Round | New Ideas? | Details |
|---|---|---|---|
| claude-opus-4.6 | 2 | No | try-fix-2 already covers the corrected anchor; try-fix-1 is the conservative fallback. NO NEW IDEAS. |
| claude-sonnet-4.6 | 2 | No | Considered also auto-deriving the anchor as $(_MauiPreviousDotNetVersion).x but that requires a Choose/When and is out of scope for a Dependabot PR. NO NEW IDEAS. |
| gpt-5.3-codex | 2 | No | try-fix-3 already represents the broadest reasonable bump. NO NEW IDEAS. |
| gemini-3-pro-preview | 2 | No | No-op already represents the most conservative path. NO NEW IDEAS. |
Exhausted: Yes (all four models report "NO NEW IDEAS").
Selected Fix: pr-plus-reviewer — preserves the 3 valid 10.0.7 bumps, corrects the previous-TFM anchor to 9.0.15, and adds a guarding comment documenting the coupling with _MauiPreviousDotNetTfm. Functionally identical to try-fix-2 with the added documentation guard.
📋 Report — Final Recommendation
PR #35353 — Comparative Report
Summary
Dependabot PR bumping 3 AspNetCore Authentication packages from 10.0.0 → 10.0.7. The diff also bumps a 4th line — MicrosoftAspNetCorePackageVersion from 8.0.16 → 10.0.7 — which is the previous-TFM anchor for net9.0-conditioned <PackageReference> items in eng/NuGetVersions.targets:209-252. That 4th change is incorrect: it points net9 builds at packages that only target net10, producing NU1202 restore errors. Correct value is a 9.0.x patch (latest is 9.0.15).
Candidate comparison
| Candidate | Auth bumps correct? | Previous-TFM anchor | Test/Gate | Risk-of-Regression | Verdict |
|---|---|---|---|---|---|
pr |
✅ 10.0.7 | ❌ 10.0.7 (wrong major) |
High — NU1202 for net9.0-* BlazorWebView/HybridWebView consumers |
❌ Reject as-is | |
pr-plus-reviewer |
✅ 10.0.7 | ✅ 9.0.15 + doc comment |
Low | ✅ Winner | |
try-fix-1 |
✅ 10.0.7 | 8.0.16 (stale) |
Low | Acceptable fallback | |
try-fix-2 |
✅ 10.0.7 | ✅ 9.0.15 |
Low | Tied with winner; no comment | |
try-fix-3 |
✅ 10.0.7 (also bumps 10 siblings) | ✅ 9.0.15 |
Medium — out of scope for this PR | Reject (open separate PR) | |
try-fix-4 |
❌ no bump | None — but no value delivered | Reject (no benefit) |
Per the ranking rule, "Candidates that failed regression tests MUST be ranked lower than candidates that passed them." No candidate has automated regression test coverage in this PR (Gate
⚠️ SKIPPED for all). Ranking therefore relies on mechanical correctness and risk analysis:
prdoes not "fail" tests but does mechanically introduce a known restore failure for net9 multi-targeted projects (NU1202). It is therefore ranked belowpr-plus-reviewer,try-fix-1, andtry-fix-2, which do not introduce that failure mode.
Final ranking
pr-plus-reviewer— correct + documentedtry-fix-2— correct, no doc commenttry-fix-1— safe subset (3 packages only); leaves stale8.0.16try-fix-3— correct but out-of-scopepr— introduces net9 restore failuretry-fix-4— no-op
Winner: pr-plus-reviewer
Rationale: Preserves the legitimate Dependabot-driven patch bumps for the 3 Authentication packages, simultaneously corrects the latent bug in the previous-TFM anchor (which the PR worsened), and adds a guarding XML comment so the next Dependabot/manual bump cannot re-introduce the same drift. This is the only candidate that addresses both the surface change and the latent infrastructure bug while staying within the spirit of a Dependabot bump PR.
Recommended PR-author actions
- Replace
<MicrosoftAspNetCorePackageVersion>10.0.7</MicrosoftAspNetCorePackageVersion>with<MicrosoftAspNetCorePackageVersion>9.0.15</MicrosoftAspNetCorePackageVersion>. - (Optional but recommended) Add an XML comment near that line documenting that the value must track the major.minor of
_MauiPreviousDotNetTfm(Directory.Build.props:67-71). - Update PR title to reflect that this also corrects the previous-TFM anchor (e.g., "Bump aspnetcore group with 3 updates and correct previous-TFM anchor to 9.0.15").
MauiBot
left a comment
MauiBot
left a comment
There was a problem hiding this comment.
Expert Review — 2 findings
See inline comments for details.
| <MicrosoftJSInteropPackageVersion>10.0.0</MicrosoftJSInteropPackageVersion> | ||
| <!-- Everything else (previous edition) --> | ||
| <MicrosoftAspNetCorePackageVersion>8.0.16</MicrosoftAspNetCorePackageVersion> | ||
| <MicrosoftAspNetCorePackageVersion>10.0.7</MicrosoftAspNetCorePackageVersion> |
There was a problem hiding this comment.
MicrosoftAspNetCorePackageVersion is the anchor inherited by every *PreviousPackageVersion property (lines 102–114) and is consumed by eng/NuGetVersions.targets:209-252 only when TargetFramework.StartsWith('$(_MauiPreviousDotNetTfm)'). _MauiPreviousDotNetTfm resolves to net9.0 (Directory.Build.props:67-71, _MauiPreviousDotNetVersionMajor=9).
Setting it to 10.0.7 will cause dotnet restore for net9.0-* BlazorWebView/HybridWebView projects to request packages that only target net10.0, producing NU1202. The previous value 8.0.16 was already stale (it was a net8.0 value), but bumping further to 10.0.7 is strictly worse — 10 > 9 has no graceful fallback, whereas 8.0.x packages still install into a 9.0 project.
Suggested fix: use the latest 9.0 patch — <MicrosoftAspNetCorePackageVersion>9.0.15</MicrosoftAspNetCorePackageVersion>.
| <MicrosoftJSInteropPackageVersion>10.0.0</MicrosoftJSInteropPackageVersion> | ||
| <!-- Everything else (previous edition) --> | ||
| <MicrosoftAspNetCorePackageVersion>8.0.16</MicrosoftAspNetCorePackageVersion> | ||
| <MicrosoftAspNetCorePackageVersion>10.0.7</MicrosoftAspNetCorePackageVersion> |
There was a problem hiding this comment.
Consider adding an XML comment above this line to remind future maintainers (and Dependabot's grouped-update logic) that this value must track the major.minor of _MauiPreviousDotNetTfm (currently net9.0). This will help avoid the same drift on the next grouped bump.
MauiBot
added
s/agent-review-incomplete
s/agent-reviewed
|
Looks like these dependencies are no longer updatable, so this is no longer needed. |
2 participants
Updated Microsoft.AspNetCore.Authentication.Facebook from 10.0.0 to 10.0.7.
Release notes
Sourced from Microsoft.AspNetCore.Authentication.Facebook's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated Microsoft.AspNetCore.Authentication.Google from 10.0.0 to 10.0.7.
Release notes
Sourced from Microsoft.AspNetCore.Authentication.Google's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated Microsoft.AspNetCore.Authentication.MicrosoftAccount from 10.0.0 to 10.0.7.
Release notes
Sourced from Microsoft.AspNetCore.Authentication.MicrosoftAccount's releases.
No release notes found for this version range.
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions