fix(deps): make dependabot.yml enforce the three holds that only prose was holding by rbuergi · Pull Request #3537 · Systemorph/MeshWeaver

rbuergi · 2026-09-07T06:07:25Z

Enforces a decision this repository already made, in writing, and which nothing was holding.

Directory.Packages.props says — in capitals:

🚨 THE ASPIRE FAMILY IS HELD AT 13.4.6 ON PURPOSE — do not let a dependency sweep move it.

A dependency sweep moved it. #3519 proposes Aspire.Hosting 13.4.6 → 13.5.3, and what caught it was the licence gate, one job before the build:

LICENCE GATE FAILED - dependencies incompatible with Apache-2.0 / MIT:
  Json.More.Net 3.0.1    [transitive] -> OSMF-maintenance-fee
  JsonPatch.Net 5.0.2    [transitive] -> OSMF-maintenance-fee
  JsonPointer.Net 7.0.1  [transitive] -> OSMF-maintenance-fee

That is the right outcome by the wrong instrument. The gate is a backstop for a licence nobody vetted; it happened to also catch a bump the repo had already reasoned its way out of, and it would have caught it just as well on the tenth re-proposal. .github/dependabot.yml had no ignore: block at all, so the sweep would keep offering it every Monday.

The decision being enforced, in the words of the file that made it

13.5.0 is where Aspire's JsonPatch.Net dependency crosses MIT → OSMFEULA (Open Source Maintenance Fee).

🚨 The exposure is not our image. It is memex/aspire/Memex.Aspire.Hosting, which is IsPackable and published as MeshWeaver.Aspire.Hosting.Memex — its nuspec carries these three as dependencies, so taking 13.5.x hands the fee obligation to everyone who installs our integration and calls builder.AddMemex(), people who never chose it.

Measured on both pins, in that same comment:

pin	JsonPatch.Net	JsonPointer.Net	Json.More.Net	licence
13.4.6	3.3.0	5.2.0	2.1.0	MIT
13.5.3	5.0.2	7.0.1	3.0.1	OSMFEULA

Why it carries its own exit

The hold is temporary and upstream already fixed it: microsoft/aspire#19493 raised exactly this objection and #19498 replaced JsonPatch.Net with an internal RFC 6902 implementation over System.Text.Json.Nodes — merged 2026-08-25, not yet released (13.5.3 still pins 5.0.2).

So the block states the condition for its own deletion rather than becoming folklore:

curl -s https://api.nuget.org/v3-flatcontainer/aspire.hosting/<ver>/aspire.hosting.nuspec | grep JsonPatch.Net
# no match => the dependency is gone, safe to take

Scope

versions: [">=13.5.0"], not an update-type ignore. A minor-level ignore would also block 13.4.7; this blocks exactly the versions that cross the licence boundary and lets ordinary 13.4.x patches keep flowing.

What this does NOT do

Does not close Bump the nuget-minor-patch group with 21 updates #3519. That PR bumps 21 packages; 20 of them are fine. Once this lands, Dependabot re-proposes the group without the Aspire entries. Bump the nuget-minor-patch group with 21 updates #3519 also carries a genuine, unrelated defect — CS8602: Dereference of a possibly null reference in TwoSiloCacheUpdateFixture.cs:113 and SharedOrleansFixture.cs:234, from an Orleans bump tightening nullability under -warnaserror.
Does not touch ImageSharp. SixLabors.ImageSharp 4.x is a separate pay-to-use wall (#3526: "No Six Labors license found… obtain a license from sixlabors.com/pricing") and there is no recorded decision for it the way there is for Aspire. That one is a real question for the maintainer, not a rule to enforce, so it is deliberately left alone.

Verification

yaml.safe_load parses; the parsed config carries exactly one ignore entry, on the nuget ecosystem: [{'dependency-name': 'Aspire.*', 'versions': ['>=13.5.0']}].

Directory.Packages.props says, in capitals, THE ASPIRE FAMILY IS HELD AT 13.4.6 ON PURPOSE - do not let a dependency sweep move it. Nothing made that true. A sweep proposed 13.4.6 -> 13.5.3 (#3519) and the LICENCE GATE caught it, one job before the build - the right outcome by the wrong instrument, and only because that gate exists at all. 13.5.0 is where Aspire's JsonPatch.Net dependency crosses from MIT to OSMFEULA. The exposure is not our image: memex/aspire/Memex.Aspire.Hosting is PUBLISHED as MeshWeaver.Aspire.Hosting.Memex, so its nuspec would hand the maintenance-fee obligation to everyone who installs it and calls AddMemex(). Scoped to >= 13.5.0, not to minors, so 13.4.x patches still flow. The block carries its own exit condition - the nuspec check for the first release that drops JsonPatch.Net (microsoft/aspire#19498, merged, unreleased) - so it is deleted rather than inherited. A rule written only in prose is a rule the next sweep does not read.

Copilot

🟢 Approval recommended

The change is a narrowly scoped Dependabot configuration update that implements an already-documented version hold without affecting runtime behavior.

Pull request overview

This PR updates the repository’s Dependabot configuration to mechanically enforce the existing decision (documented in Directory.Packages.props) to hold the Aspire package family below 13.5.0 due to the transitive license change in JsonPatch.Net.

Changes:

Add a NuGet ignore rule for Aspire.* at versions >=13.5.0 so Dependabot won’t repeatedly propose the problematic bump.
Document the rationale and explicit “exit condition” for removing the ignore once Aspire releases without the JsonPatch.Net dependency.

File summaries

File	Description
`.github/dependabot.yml`	Adds a NuGet ignore rule to prevent Aspire updates to `>=13.5.0`, aligning Dependabot behavior with the existing pinned-version policy and license constraints.

Review details

Files reviewed: 1/1 changed files
Comments generated: 0
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-09-07T06:11:55Z