Repository navigation
ci: adds additional dependabot groups in dotnet to reduce noise - #8059
Conversation
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
There was a problem hiding this comment.
🟢 Approval recommended
The group patterns are valid, non-overlapping, and align with the package families currently used.
Pull request overview
Adds coherent NuGet dependency groups to reduce Dependabot PR noise for related .NET SDK families.
Changes:
- Groups Aspire, AgentServer, AGUI, VectorData, and Anthropic packages.
- Leaves dependency versions and runtime behavior unchanged.
File summaries
| File | Description |
|---|---|
.github/dependabot.yml |
Adds five NuGet dependency groups for dotnet/. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
GitHub Actions
Inactive
GitHub Actions
Inactive
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): 533b1a34f21b
Model: gpt-5.6-sol-fast
Overview
The PR adds five family-based groups to the .NET NuGet Dependabot configuration without changing package versions or runtime behavior. The patterns match the currently declared package families, remain scoped to dotnet/, and generated dependency changes retain code-owner review and .NET build/test coverage. No Critical, High, or Medium defect is supported by the reviewed configuration and repository evidence.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
Motivation & Context
Dependabot has recently opened and merged several separate .NET NuGet update PRs for package families that share package namespacing and release cadence. Grouping those related packages should reduce Dependabot PR noise while keeping updates scoped to coherent SDK families.
Description & Review Guide
Adds NuGet Dependabot groups for the
dotnet/update configuration:aspire: groupsAspire.*andCommunityToolkit.Aspire.*packages. This is based on recentAspire.HostingDependabot updates and the related Aspire package family already tracked together in central package management.azure-ai-agentserver: groupsAzure.AI.AgentServer.*packages. This keeps AgentServer core, invocations, and responses packages on the same update path.agui: groupsAGUI.*packages. These packages currently share the same version and are maintained as one SDK family.communitytoolkit-vectordata: groupsCommunityToolkit.VectorData.*packages. These vector data packages share the same namespace and compatible release cadence.anthropic: groupsAnthropic*packages. Recent Dependabot activity covered bothAnthropicandAnthropic.Foundry, so grouping keeps related Anthropic SDK updates together.Dependabot should create fewer, more coherent .NET dependency update PRs for related NuGet package families. The change only affects Dependabot PR grouping and does not alter package versions or runtime code.
Please review whether the selected groups are scoped narrowly enough to avoid combining unrelated package updates while still reducing noise for packages that typically move together.
Related Issue
No tracked issue. There is no other open PR for this branch.
Contribution Checklist
breaking changelabel (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.