Lock files and project references

[na1307]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

nuget

Package manager version

6.12

Language version

13

Manifest location and content before the Dependabot update

https://github.com/na1307/na1307.github.io/blob/80eed29b265bf2a6873492ea2a85da530306a949/Directory.Packages.props

dependabot.yml content

https://github.com/na1307/na1307.github.io/blob/f7188522766ef99889a81e43966f53d0bebb6e83/.github/dependabot.yml

Updated dependency

Bluehill.Blazor.GHPages from 1.0.0 to 1.0.1

What you expected to see, versus what you actually saw

This repo contains the following projects:

• BluehillHomePage: The Blazor WebAssembly project
• BluehillHomePage.Tests: Unit tests project for BluehillHomePage

Both projects use lock files. Unit test projects must of course reference the project they are testing. So in this case BluehillHomePage.Tests is referencing BluehillHomePage.

However, Dependabot only updates the lock file of the project to be tested, and not the lock file of the test project.

If the lock file of the referenced project is updated, the lock files of projects referencing that project must also be updated.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

na1307/na1307.github.io#5

Smallest manifest that reproduces the issue

No response