[mvaneijken]

What broke

The release pipeline on main fails since #124 (run 38762281321):

[-] Dependency version literals.Should not copy any pinned dependency version outside the inventory
Build/DependabotValidation.ps1: Selenium.WebDriver 4.51.0

Why

• Start PR Validation for Dependabot updates that pass a reputation policy #122 added a sample Dependabot metadata block to the comment-based help of ConvertFrom-DependabotCommitMessage, naming Selenium.WebDriver 4.51.0. At that time the pin was 4.47.0, so the version was arbitrary.
• deps: Bump Selenium.WebDriver and 2 others #120 then pinned Selenium.WebDriver at exactly 4.51.0.
• Fail validation when a pinned dependency version is copied outside the inventory #124 added the guard that flags any file naming a pinned component together with its exact version. Its PR checks ran before deps: Bump Selenium.WebDriver and 2 others #120 merged, so the combination was first tested on main.

What changed

• The help example now uses Example.Package / 1.2.3. It only illustrates the message format, so a name and version that can never match the inventory is the right fix.
• Build/DependabotValidation.ps1 is deliberately not added to the allow list of DependencyVersionLiterals.Tests.ps1. That would also stop the scan from catching a real copied version in that file's code.

How it was verified

pwsh 7.4.6 / Pester 6.2.0 on Linux, Tests/Unit/DependencyVersionLiterals.Tests.ps1 and Tests/Unit/DependabotValidation.Tests.ps1:

• On main: 55 passed, 1 failed (the test above). This reproduces the release failure.
• With this change: 56 passed, 0 failed.
• I did not run the full suite or Windows PowerShell 5.1. The change only touches a comment block, so I expect no effect there; the PR Validation matrix covers both shells.

Follow-up to consider

This guard reacts to merge order: any Dependabot bump can make existing harmless text match. To catch this in the PR instead of in the release pipeline, require branches to be up to date before merging, or use a merge queue on main.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VaHXDCne5T9e998erwKnYW

---

Generated by Claude Code

[Copilot]

🟢 Approval recommended

The change is a verified, self-consistent documentation-only edit that uses a non-inventory package to resolve the guard failure without any functional impact.

0 open findings

What changed in this PR

This PR fixes a release-pipeline failure on main caused by the DependencyVersionLiterals guard. The comment-based help of ConvertFrom-DependabotCommitMessage in Build/DependabotValidation.ps1 contained a sample Dependabot metadata block naming Selenium.WebDriver at 4.51.0. Once Selenium.WebDriver was pinned to exactly 4.51.0, that harmless illustrative text matched the guard that flags any file naming a pinned component together with its exact pinned version. The fix swaps the example to a fictional Example.Package / 1.2.3, which can never match the real inventory, keeping the help's sole purpose (illustrating message format) intact.

I confirmed that Example.Package is not a pinned component in Build/Dependencies.psd1, so the example is now immune to future bumps, and that Tests/Unit/DependabotValidation.Tests.ps1 (which legitimately uses Selenium.WebDriver/4.51.0 as mock fixtures) remains covered by the test's allow list, so no further edits are required.

Changes:

• Replaced Selenium.WebDriver / 4.51.0 with Example.Package / 1.2.3 in the help example block.

File	Description
Build/​DependabotValidation.ps1	Updated the help example's sample dependency name/version to a fictional package that cannot collide with the pinned inventory.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.