Skip to content

Bump the roslyn group with 1 update - #9

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/roslyn-c8fd945919
Closed

Bump the roslyn group with 1 update#9
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/roslyn-c8fd945919

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor

Updated Microsoft.Build.Framework from 17.11.48 to 18.8.2.

Release notes

Sourced from Microsoft.Build.Framework's releases.

18.8.2

What's Changed

18.7.1

What's Changed

18.6.3

What's Changed

18.5.4

What's Changed

18.4.0

What's Changed

18.3.3

What's Changed

18.0.2

What's Changed

17.14.28

What's Changed

17.14.8

What's Changed

Full Changelog: dotnet/msbuild@v17.14.5...v17.14.8

17.14.5

What's Changed

17.14.0-preview-25177-05

Release

What's Changed

17.14.0-preview-25155-01

Release

What's Changed

Description has been truncated

Bumps Microsoft.Build.Framework from 17.11.48 to 18.8.2

---
updated-dependencies:
- dependency-name: Microsoft.Build.Framework
  dependency-version: 18.8.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: roslyn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates label Aug 7, 2026
@SebHenn

SebHenn commented Aug 7, 2026

Copy link
Copy Markdown
Owner

Closing — verified broken locally, and red in CI.

Microsoft.Build.Framework 18.x pulls in Microsoft.NET.StringTools, which trips Build.Locator's own guard:

error MSBL001: A PackageReference to the package 'Microsoft.NET.StringTools' at version
'18.8.2' is present in this project without ExcludeAssets="runtime" and PrivateAssets="all"
set. This can cause errors at run-time due to MSBuild assembly-loading.

This one is fixable — give StringTools the same ExcludeAssets="runtime" treatment Microsoft.Build.Framework already has — but it is not worth fixing, which is the actual reason for closing rather than patching.

The package is referenced only so it can carry ExcludeAssets="runtime"; its assemblies are deliberately not loaded at run time, because MSBuildLocator resolves the real MSBuild from the installed SDK. So a newer version buys nothing here, while costing a load-bearing arrangement in the one subsystem where a mistake shows up as a workspace that fails to load rather than as a compile error.

#11 adds an ignore rule for major bumps. If a future MSBuild genuinely needs to be tracked, that is a deliberate change with the StringTools reference done properly alongside it — not a rubber-stamped bot PR.

@SebHenn SebHenn closed this Aug 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/nuget/roslyn-c8fd945919 branch August 7, 2026 13:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant