WCF packages should be auto-updated

[ViktorHofer]

WCP packages should be auto-updated. Otherwise those package dependencies in the Microsoft.Windows.Compatibility package would be stale:

windowsdesktop/eng/Versions.props

Line 65 in bc8be62

<SystemServiceModelVersion>4.10.0</SystemServiceModelVersion>

Presumably that could be accomplished by using dependabot in the repository.

cc @dreddy-work @mmitche @carlossanlop

[dreddy-work]

@mmitche, anyways to auto-update this? Does dependabot need any configuration in the repo to identify this package and version?

[mmitche]

I think it needs to be configured in this repo for general version updates. I'm not sure how flexible it is, but you might take a look at the documentation https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates to see how to configure it for a subset of dependencies. We don't want it updating versions of dependencies within the stack (e.g, runtime).

I don't think it will automatically figure out that this property needs an update. For one thing, it doesn't know that this is a dependency, https://github.com/dotnet/windowsdesktop/network/dependencies, and secondly, System.ServiceModel isn't actually a package in the first place (it's a proxy name for a number of packages under System.ServiceModel.*).

[ViktorHofer]

Here's how dependabot works in the msbuild repo: https://github.com/dotnet/msbuild/tree/main/eng/dependabot

They specify a set of dependencies that should be auto-updated by dependabot. Everything else is either static or updated via dependency flow.