Fix revision updates not being grouped#14653
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
This PR fixes Dependabot NuGet dependency grouping when version changes don’t cleanly map to SemVer patch updates (e.g., revision-only 1.1.1.2 -> 1.1.1.3 and prerelease label changes), ensuring such updates can still be grouped.
Changes:
- Treat “same major/minor” NuGet updates as patch-equivalent for grouping rules.
- Add end-to-end test coverage proving revision-only updates are grouped when
update-typesaren’t specified. - Add unit-style test data validating
IsAllowedByVersionbehavior for revision and prerelease-only changes.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/DependencyGroup.cs | Adjusts patch classification logic to include revision/prerelease-only updates as patch-equivalent. |
| nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/UpdateHandlers/GroupUpdateAllVersionsHandlerTests.cs | Adds an end-to-end scenario asserting revision-only updates are grouped by default group rules. |
| nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/MiscellaneousTests.cs | Adds focused tests for IsAllowedByVersion covering revision-only and prerelease-only cases. |
…into fix/group-dependencies-revision-updates
dfc3910 to
81dc537
Compare
|
@brettfo @JamieMagee would you be so kind to review the PR? It is related to #14475 (comment) , I thought you might have some context to review. |
|
Building updater images internally. In case the test |
What are you trying to accomplish?
Dependabot creates PRs with for individual dependencies and ignores grouping settings for certain version numbers which do not conform to SemVer format.
Dependabot supports strict SemVer version numbers in
major.minor.patchformat. When a version number changes without affecting the SemVer part:1.1.1.2 -> 1.1.1.31.1.0-alpha -> 1.1.0-betasuch change cannot be categorised as a patch update due to a bug introduced on March 17th. Dependabot fails to group it despite having no
update-typespecified in the groups configuration, and creates PRs for each individual dependency.This change addresses #14286 and #14607 and ensures that dependencies are grouped correctly, and revision updates to multiple dependencies do not result in multiple PRs being created.
Anything you want to highlight for special attention from reviewers?
How will you know you've accomplished your goal?
I added automated tests for the updated logic. I also ran a manual test against a copy of this repo https://github.com/LouisMT/dependabot-test-2 (courtesy of @LouisMT in #14607) with some dependencies added. I observed that the dependencies with revision updates are now grouped.
Dependabot output without fix - 6 PRs, no grouping for revision updates
Dependabot output with fix - 2 PRs, revision updates for AWSSDK are bundled together with patch updates
Checklist