dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.66k stars 1.01k forks source link

Support updating NuGet packages for solutions targeting .NET vNext #10496

Open martincostello opened 1 month ago

martincostello commented 1 month ago

Is there an existing issue for this?

Feature description

I have two repositories where I'm already targeting .NET 9, and when .NET 9 release candidate 1 is released in September I'll have a bunch more.

I thought this was supported already by dependabot, but maybe I'm mistaken and/or it has stopped working since NuGet is being used to update the packages, but NuGet package updates are failing in these repositories because the .NET SDK in the dependabot image doesn't support net9.0: example

Ideally the dependabot job would be able to install the .NET SDK if the required version is missing (it could be conservative and only do this if the major version is missing, rather than the exact version in global.json) so that using a public pre-release version of .NET is supported.

/cc @danmoseley as I seem to remember you mentioning this in an issue at some point in the last year (maybe for Aspire?).

martincostello commented 1 month ago

.NET 9 release candidate 1 has now been released, and now my dependabot jobs fail to update packages 😞

Example

dotnet build in GetAllPackageDependenciesAsync failed. STDOUT:   Determining projects to restore...
/usr/local/dotnet/current/sdk/8.0.303/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.TargetFrameworkInference.targets(166,5): error NETSDK1045: The current .NET SDK does not support targeting .NET 9.0.  Either target .NET 8.0 or lower, or use a version of the .NET SDK that supports .NET 9.0. Download the .NET SDK from https://aka.ms/dotnet/download [/tmp/package-dependency-resolution_JGZoHl/Project.csproj]

Build FAILED.