chore: ignore ImageSharp major updates in Dependabot#334
Merged
Conversation
SixLabors.ImageSharp 4.0.0 enforces a commercial licence at build time via an MSBuild target, failing the restore with "No Six Labors license found" unless a purchased key is supplied. This broke every backend RID job in the grouped NuGet bump (#333). Pin the grouped updates to the 3.x line by ignoring semver-major bumps for ImageSharp so the daily group PR stops reintroducing 4.0.0. Also normalise the Dependabot commit-message prefixes to lowercase "chore" to match the conventional prefixes used elsewhere.
|
plz12345
added a commit
that referenced
this pull request
Jul 20, 2026
#### Database Migration <!-- If you update database schema, the migration number must be noted here --> NO #### Description Rolling the 3.3.5 development cycle into a stable release. Replaces #330, which was headed by `eros-develop` and therefore kept absorbing post-3.3.5 commits as they landed. This one is headed by the frozen `release-3.3.5` branch, pinned to 39b1db6 — the exact commit carrying the `v3.3.5` marker tag — so the release contents can't drift. Commits after the tag (#331, #334, #335) are deliberately left on `eros-develop` for the next cycle. **Merge with "Create a merge commit" — not squash, not rebase.** The build derives its base version from the `v3.3.5` tag's commit SHA being reachable from `eros`; squashing collapses that SHA and rebasing rewrites it, either of which makes the release build as 3.3.4. #### Screenshot(s) (if UI related) <details> <!-- paste screenshots below here.--> <!-- paste screenshots above here. MAKE SURE THE ARE SFW --> </details> #### Todos - [ ] Tests - [ ] Translation Keys (./src/NzbDrone.Core/Localization/Core/en.json) #### Issues Fixed or Closed by this PR <!-- If multiple, put each on a separate line --> <!-- Release roll-up; individual fixes were linked on their own PRs. -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Database Migration
NO
Description
SixLabors.ImageSharp4.0.0 enforces a commercial licence at build time via an MSBuild target shipped in the package. Without a purchased key the build fails outright:This is not an API break that can be coded around — it fails during build, so it took out all ten
backendRID jobs in the grouped NuGet bump (#333), which in turn skippedunit_test,unit_test_postgresandintegration_test.This PR adds an
ignorerule for semver-major updates toSixLabors.ImageSharp, keeping the grouped NuGet PRs on the 3.x line. 3.1.12 (already in tree) is the latest 3.x release; 4.0.0 is the only version above it, so there is no intermediate to move to. Without this rule the daily group PR keeps reintroducing 4.0.0 and the build stays red.Also normalises the Dependabot
commit-message.prefixfor both ecosystems fromChoreto lowercasechore, matching the conventional prefixes CONTRIBUTING already tolerates.Follow-up, not in scope here: ImageSharp is used in exactly one place — a ~5-line JPEG thumbnail resize in
src/NzbDrone.Core/MediaCover/ImageResizer.cs. Staying on 3.1.x means eventually losing security fixes, so replacing it is worth its own issue.Screenshot(s) (if UI related)
N/A — CI configuration only.
Todos
Neither applies: this changes
.github/dependabot.ymlonly, with no application code and no user-facing strings.Issues Fixed or Closed by this PR
No tracked issue. Unblocks #333, which should be closed and left to regenerate once this merges.