Pin Hl7.Fhir.* and make Directory.Packages.props authoritative - #5863
Merged
Merged
Conversation
Dependabot rewrites the Hl7FhirVersion and Hl7FhirLegacyVersion properties directly, so nothing in Directory.Packages.props can hold these versions still. Add an ignore rule instead, and leave a note in the props file so the stale versions there are not mistaken for neglect. The rule covers all 17 Hl7.Fhir.* packages, which spans both properties. The hl7-fhir group is left configured, so deleting the ignore rule is enough to resume updates. AB#207007 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d055287-83a3-4073-979e-207b73aa028b
Mikael Weaver (mikaelweave)
changed the title
…authoritative Directory.Packages.props is meant to be the single source of every package version, but Central Package Management still lets an individual project opt out with VersionOverride on a PackageReference. Nothing in the repository uses that today, and nothing should: a version that only some projects honour is exactly the divergence central management exists to prevent. Dependabot has been observed introducing those overrides on its own. When it rebases a pull request whose version bump has already landed on main, it can rewrite the update as per-project VersionOverride entries in .csproj files instead of leaving the branch empty (dependabot/dependabot-core#13408). Setting CentralPackageVersionOverrideEnabled to false turns that into NU1013 at restore rather than a silent divergence that survives review. The property is set in Directory.Packages.props rather than Directory.Build.props because build/DependabotDiscovery deliberately stops the upward search for the latter, and it still has to be covered. AB#207007 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d055287-83a3-4073-979e-207b73aa028b
Mikael Weaver (mikaelweave)
force-pushed
the
mikaelweave-pin-hl7-fhir
branch
from
September 21, 2026 15:47
b87020e to
5ce18b9
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5863 +/- ##
==========================================
- Coverage 78.71% 78.66% -0.05%
==========================================
Files 1018 1018
Lines 37126 37120 -6
Branches 5680 5678 -2
==========================================
- Hits 29222 29199 -23
+ Misses 6498 6493 -5
- Partials 1406 1428 +22 🚀 New features to boost your workflow:
|
Paul Taladay (PTaladay)
approved these changes
Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Keeps
Directory.Packages.propsthe single source of every package version, and freezes the Firely SDK.AB#207007
1. Pin
Hl7.Fhir.*An
ignorerule in.github/dependabot.ymlblocks all three semver levels forHl7.Fhir.*, holding 5.11.4 / 5.11.0.2. Reject per-project
VersionOverrideCPM lets a project opt out of the central version with
VersionOverride.CentralPackageVersionOverrideEnabled=falsemakes that a restore error instead.#5859 is why: it added
VersionOverride="10.0.12"to five.csprojfiles rather than touching the props file, after a rebase of an already-landed bump (dependabot-core#13408).Set in
Directory.Packages.props, notDirectory.Build.props, becausebuild/DependabotDiscoverydeliberately stops the upward search for the latter.Verification
CosmosDb.Core→error NU1013. Removed → clean restore.falseinDependabotDiscovery,CosmosDb.CoreandR4.Client.VersionOverrideorVersion=on anyPackageReferencein the repo, so nothing breaks today.ValidateDependabotCoveragepasses.Follow-up
Close #5859 rather than fixing it —
$(DotNetSdkPackageVersion)is already10.0.12, so the catalog delivers what it pins. After this merges, rebasing it fails NU1013 instead of going green.