deps: stop Dependabot reopening the ImageSharp major it cannot build - #55
Merged
Merged
Conversation
ImageSharp 4.0 moved to the Six Labors Split License and its build targets fail
outright without a registered key:
error : No Six Labors license found. Set $(SixLaborsLicenseKey), set
$(SixLaborsLicenseFile), or add a 'sixlabors.lic' file
error : Please obtain a license from https://sixlabors.com/pricing/
Directory.Packages.props already pins the 3.1.x line for that reason, but
nothing told Dependabot, so every ImageSharp release opens a PR that cannot
build and has to be closed by hand. Ignore the major for ImageSharp and for
Drawing, whose next major depends on ImageSharp 4.x and so inherits the same
constraint. Minor and patch updates still flow.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion to closing #49.
What & why
Directory.Packages.propsalready pins ImageSharp to the 3.1.x line on purpose, with a comment explaining why. Nothing communicated that to Dependabot, so every ImageSharp release opens a PR that cannot build and has to be closed by hand — #49 being the current one.I verified the pin is still correct rather than trusting the comment. Building against 4.1.1:
Still a hard failure at build time, not a warning. For a zero-config OSS binary that ships to users, the 3.1.x Apache-2.0 line remains the right place to be.
The change
Ignore major updates for
SixLabors.ImageSharpandSixLabors.ImageSharp.Drawing. Drawing is included because its next major depends on ImageSharp 4.x and so inherits the same licensing constraint — otherwise it becomes the same recurring PR under a different name.Minor and patch updates are unaffected and still flow through the existing group, so security and bug fixes on 3.1.x keep arriving.
Type of change
Checklist
dotnet build Netdocs.slnx -c Releasesucceeds.github/dependabot.ymlparses as valid YAMLdocs-site/docs/**— no user-facing behaviour changeNotes for reviewers
This is worth revisiting only if Six Labors changes its licensing, or if you ever decide to buy a key — at which point deleting these four lines is the whole migration.
🤖 Generated with Claude Code