Skip to content

Bump the nuget group with 6 updates#3

Merged
AndrewP-GH merged 1 commit into
mainfrom
dependabot/nuget/nuget-6b5ff26ee5
Jul 14, 2026
Merged

Bump the nuget group with 6 updates#3
AndrewP-GH merged 1 commit into
mainfrom
dependabot/nuget/nuget-6b5ff26ee5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 14, 2026

Copy link
Copy Markdown
Contributor

Updated coverlet.msbuild from 10.0.0 to 10.0.1.

Release notes

Sourced from coverlet.msbuild's releases.

10.0.1

Improvements

Fixed

  • Fix inconsistent paths in cobertura reports #​1723
  • Fix when using "is" with "and" in pattern matching, branch coverage is lower than normal #​1313
  • Fix Coverlet flagging a branch for an async functions finally block where none exists #​1337
  • Fix Coverlet Tracker Missing CompilerGeneratedAttribute #​1828

Maintenance

  • Add architecture docs and diagrams for all integrations #​1927
  • Update NuGet packages and .NET SDK versions #​1933

Diff between 10.0.0 and 10.0.1

Commits viewable in compare view.

Updated FluentAssertions from 6.12.0 to 8.10.0.

Release notes

Sourced from FluentAssertions's releases.

8.10.0

What's Changed

Improvements

Documentation

Others

Full Changelog: fluentassertions/fluentassertions@8.9.0...8.10.0

8.9.0

[!WARNING]
For projects targeting .NET 9, you need at least .NET SDK 9.0.200 as earlier versions will trigger compile errors because of invalid overload resolution. See #​3225

What's Changed

New features

Improvements

Fixes

Documentation

Others

8.8.0

What's Changed

New features

Improvements

Documentation

Others

Full Changelog: fluentassertions/fluentassertions@8.7.1...8.8.0

8.7.1

What's Changed

Others

Full Changelog: fluentassertions/fluentassertions@8.7.0...8.7.1

8.7.0

What's Changed

New features

Others

Full Changelog: fluentassertions/fluentassertions@8.6.0...8.7.0

8.6.0

What's Changed

Improvements

Others

New Contributors

Full Changelog: fluentassertions/fluentassertions@8.5.0...8.6.0

8.5.0

What's Changed

New features

Fixes

Others

Full Changelog: fluentassertions/fluentassertions@8.4.0...8.5.0

8.4.0

What's Changed

Improvements

Others

New Contributors

Full Changelog: fluentassertions/fluentassertions@8.3.0...8.4.0

8.3.0

What's Changed

Improvements

Others

Full Changelog: fluentassertions/fluentassertions@8.2.0...8.3.0

8.2.0

What's Changed

Improvements

Fixes

Others

Full Changelog: fluentassertions/fluentassertions@8.1.1...8.2.0

8.1.1

What's Changed

Fixes

Full Changelog: fluentassertions/fluentassertions@8.1.0...8.1.1

8.1.0

What's Changed

Improvements

Fixes

Documentation

Others

New Contributors

Full Changelog: fluentassertions/fluentassertions@8.0.1...8.1.0

8.0.1

What's Changed

Improvements

Others

Full Changelog: fluentassertions/fluentassertions@8.0.0...8.0.1

8.0.0

What's Changed

License change

Breaking Changes

New features

Improvements

8.0.0-rc.2

What's Changed

Fixes

Others

Full Changelog: fluentassertions/fluentassertions@8.0.0-rc.1...8.0.0-rc.2

8.0.0-rc.1

What's Changed

Breaking Changes

Fixes

Documentation

Others

8.0.0-alpha.1

What's Changed

Others

Full Changelog: fluentassertions/fluentassertions@7.0.0-alpha.6...8.0.0-alpha.1

7.2.2

What's Changed

Fixes

Building

Full Changelog: fluentassertions/fluentassertions@7.2.1...7.2.2

7.2.1

What's Changed

Fixes

Full Changelog: fluentassertions/fluentassertions@7.2.0...7.2.1

7.2.0

What's Changed

Improvements

Fixes

Others

Full Changelog: fluentassertions/fluentassertions@7.1.0...7.2.0

7.1.0

What's Changed

Improvements

Others

Full Changelog: fluentassertions/fluentassertions@7.0.0...7.1.0

7.0.0

What's Changed

Breaking Changes

Fixes

Documentation

Others

New Contributors

Full Changelog: fluentassertions/fluentassertions@6.12.2...7.0.0

6.12.2

What's Changed

Others

Full Changelog: fluentassertions/fluentassertions@6.12.1...6.12.2

6.12.1

What's Changed

Improvements

  • Improve BeEmpty() and BeNullOrEmpty() performance for IEnumerable<T>, by materializing only the first item - #​2530

Fixes

  • Fixed formatting error when checking nullable DateTimeOffset with BeWithin(...).Before(...) - #​2312
  • BeEquivalentTo will now find and can map subject properties that are implemented through an explicitly-implemented interface - #​2152
  • Fixed that the because and becauseArgs were not passed down the equivalency tree - #​2318
  • BeEquivalentTo can again compare a non-generic IDictionary with a generic one - #​2358
  • Fixed that the FormattingOptions were not respected in inner AssertionScope - #​2329
  • Capitalize true and false in failure messages and make them formattable to a custom BooleanFormatter - #​2390, #​2393
  • Improved the failure message for NotBeOfType when wrapped in an AssertionScope and the subject is null - #​2399
  • Improved the failure message for BeWritable/BeReadable when wrapped in an AssertionScope and the subject is read-only/write-only - #​2399
  • Improved the failure message for ThrowExactly[Async] when wrapped in an AssertionScope and no exception is thrown - #​2398
  • Improved the failure message for [Not]HaveExplicitProperty when wrapped in an AssertionScope and not implementing the interface - #​2403
  • Improved the failure message for [Not]HaveExplicitMethod when wrapped in an AssertionScope and not implementing the interface - #​2403
  • Changed BeEquivalentTo to exclude private protected members from the comparison - #​2417
  • Fixed using BeEquivalentTo on an empty ArraySegment - #​2445, #​2511
  • BeEquivalentTo with a custom comparer can now handle null values - #​2489
  • Ensured that nested calls to AssertionScope(context) create a chained context - #​2607
  • One overload of the AssertionScope constructor would not create an actual scope associated with the thread - #​2607
  • Fixed ThrowWithinAsync not respecting OperationCanceledException - #​2614
  • Fixed using BeEquivalentTo with an IEqualityComparer targeting nullable types - #​2648

Full Changelog: fluentassertions/fluentassertions@6.12.0...6.12.1

Commits viewable in compare view.

Updated Microsoft.Extensions.ObjectPool from 10.0.7 to 10.0.10.

Release notes

Sourced from Microsoft.Extensions.ObjectPool's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.5.1 to 18.8.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.8.1

What's Changed

Full Changelog: microsoft/vstest@v18.8.0...v18.8.1

18.8.0

What's Changed

Full Changelog: microsoft/vstest@v18.7.0...v18.8.0

18.7.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

18.6.0

What's Changed

Changes to tests and infra

Commits viewable in compare view.

Updated NUnit from 3.13.3 to 4.6.1.

Release notes

Sourced from NUnit's releases.

4.6.1

See release notes for details.

4.6.0

See release notes for details.

4.5.1

See release notes for details.

4.5.0

See release notes for details.

4.4.0

See release notes for details.

4.3.2

This is a hotfix release.
See release notes for details.

4.3.1

This is a hotfix release.
See release notes for details.

4.3.0

See release notes

4.2.2

Hotfix for fixing regression bug #​4802

What's Changed

Full Changelog: nunit/nunit@4.2.1...4.2.2

4.2.1

Hotfix release for Issue #​4794 and #​4795, affecting .Net Framework.

4.2.0

See release notes

4.1.0

See release notes

4.0.1

Patch release to fix windows targets

See release notes
and
See migration guide

4.0.0

See release notes
and
See migration guide

4.0.0-beta.1

See release notes
and information

3.14.0

See release notes

Commits viewable in compare view.

Updated SonarAnalyzer.CSharp from 10.25.0.139117 to 10.29.0.143774.

Release notes

Sourced from SonarAnalyzer.CSharp's releases.

10.29.0.143774

Release notes - .NET Analyzers - 10.29

Feature

NET-3997 Move S6444 out of hotspot
NET-4060 Update RSPEC before 10.29 release

False Positive

NET-1626 Fix S6444 FP: REGEX_DEFAULT_MATCH_TIMEOUT

False Negative

NET-3920 Fix S2971 FN: Should raise on EntityFramework IQueryables
NET-3921 Fix S1155 FN: Should raise on EntityFramework IQueryables
NET-3922 Fix S3981 FN: Should raise on EntityFramework IQueryables
NET-3924 Fix S3169 FN: Should raise on EntityFramework IQueryables

10.28.0.143324

Release notes - .NET Analyzers - 10.28

Feature

NET-1990 S100/S101: Configuration for custom acronyms
NET-2280 New Rule T0048: Avoid is not { } value
NET-3802 Update RSPEC before 10.28 release
NET-3818 Change Protobuf Info message to Debug
NET-3820 Coverage warnings should surface as Analysis Warnings
NET-3827 Create RSPEC for S8717: Multiple "[Key]" attributes should not be used to define a composite key
NET-3843 Implement rule S8717: Multiple "[Key]" attributes should not be used to define a composite key
NET-3949 Modify rule S2696: add fix guidance, compliant example, and exceptions
NET-3950 Modify rule S1135: add compliant example and fix guidance
NET-3951 Modify rule S108: give the C# page its own code examples
NET-3952 Modify rule S1133: add rationale, fix guidance, code examples
NET-3953 Modify rule S3251: add compliant example, fix guidance, and exceptions
NET-3967 Move S1313 out of hotspot
NET-3969 Move S2077 out of hotspot
NET-3972 Move S2092 and S3330 out of hotspot
NET-3973 Move S2245 out of hotspot
NET-3975 Move S2257 out of hotspot
NET-3976 Move S4036 out of hotspot
NET-3978 Move S4502 out of hotspot
NET-3980 Move S4507 out of hotspot
NET-3982 Move S5122 out of hotspot
NET-3983 Move S5332 out of hotspot
NET-3993 Move S5443 out of hotspot
NET-3995 Move S5753 out of hotspot
NET-3996 Move S5766 out of hotspot
NET-3998 Move S6640 out of hotspot
NET-4000 Move S4790 out of hotspot
NET-4001 Move S5693 out of hotspot
NET-4008 Change S1313 message
NET-4009 Change S2257 message
NET-4010 Change S4036 message
NET-4011 Change S2077 message

False Positive

NET-3564 Fix FP S6966: Do not raise for methods for SqlDataReader.IsDBNull/GetFieldValue
NET-3808 Fix S4260 FP: Don't raise on extension properties
NET-3821 Fix S1244 FP: Should not raise on comparison to 0
NET-3825 Fix S2221 FP: Do not raise on async void
NET-3878 Fix S3358 FP: Suggesting to extract ternary from EF Core select
NET-3914 Fix T0044 FP: Should not raise on locator annotaitons
NET-3926 Fix S6608 FP: Should not raise inside expression tree
NET-3927 Fix S6603 FP: Should not raise inside expression tree
NET-3932 S2068: Do not raise on @​paramName and $paramName

False Negative

NET-1673 Fix S4790 FN: default parameters
NET-2846 Fix S1117 FN: Extensions, Partial Events
... (truncated)

10.27.0.140913

Release notes - .NET Analyzers - 10.27

Feat...

Description has been truncated

@dependabot
Bump the nuget group with 6 updates
8f5c3ad 
Bumps coverlet.msbuild from 10.0.0 to 10.0.1
Bumps FluentAssertions from 6.12.0 to 8.10.0
Bumps Microsoft.Extensions.ObjectPool from 10.0.7 to 10.0.10
Bumps Microsoft.NET.Test.Sdk from 18.5.1 to 18.8.1
Bumps NUnit from 3.13.3 to 4.6.1
Bumps SonarAnalyzer.CSharp from 10.25.0.139117 to 10.29.0.143774

---
updated-dependencies:
- dependency-name: coverlet.msbuild
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: FluentAssertions
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.ObjectPool
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: NUnit
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.29.0.143774
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Jul 14, 2026
@AndrewP-GH
AndrewP-GH merged commit 4db9be8 into main Jul 14, 2026
2 checks passed
@AndrewP-GH
AndrewP-GH deleted the dependabot/nuget/nuget-6b5ff26ee5 branch July 14, 2026 20:59
@AndrewP-GH AndrewP-GH mentioned this pull request Jul 14, 2026
Merged
4 tasks
AndrewP-GH added a commit that referenced this pull request Jul 14, 2026
@AndrewP-GH
Drop the inherited NoWarn list, enable the analyzers MS recommends, h…
fcdfe18 
…arden packaging (#4)

## Why

Three questions, answered empirically by clearing `NoWarn` and
rebuilding. A packaging review pass (below) followed.

## 1. The `NoWarn` list is gone

It arrived with the import from mapi/menu. **Twelve of the seventeen
codes never fire here** (CA1861, CA1848, CA1707, CA1014, CA1716, CA1034,
CA1725, CA1032, CA5398, CA1816, CA1063, CA1822) — deleted. The other
five were muting real work:

| Code | Where it fired | Fix |
|---|---|---|
| CA2007 | 16 awaits in src, 130 in tests | `ConfigureAwait(false)` in
src — a consumer with a SynchronizationContext would otherwise resume on
their thread. Scoped off for `tests/**` (no context under the runner). |
| CA1062 | 6 sites, all public `SerializeWithPointers` entries |
`ArgumentNullException.ThrowIfNull` |
| CA1852 | 8 test fixtures | sealed |
| CA1812 | 4 test fixtures | Scoped off for `tests/**` — NUnit
instantiates by reflection. |
| NU1507 | not code — multi-source `~/.nuget/NuGet.Config` under CPM |
repo `NuGet.config` with a single source. All six dependencies are
public, so the build is now hermetic: no authenticated feed to build the
repo. |

## 2. Analyzers: was CA-only, now the full MS set

- **`IsAotCompatible`** → trim/AOT/single-file analyzers. Surfaced
exactly two sites: the `JsonSerializerOptions` overloads resolve
metadata by reflection, so they now carry
`[RequiresUnreferencedCode]`/`[RequiresDynamicCode]` like
`System.Text.Json`'s own. The `JsonTypeInfo<T>` path — which is what
`PooledReferenceSerializer` uses — stays clean, so a Native AOT consumer
is warned only where it would actually break.
- **`EnforceCodeStyleInBuild`** + the org `.editorconfig` (taken from
Dodo.Unique). Immediately found 7 redundant `using
Dodo.Json.References;` in tests.
- **`GenerateDocumentationFile`** — all 17 undocumented public members
now have XML docs, and the XML ships in the package. It must also be on
for IDE0005 to run on build
([dotnet/roslyn#41640](dotnet/roslyn#41640)).

## 3. Target framework stays net10.0

net9 compiles unchanged (verified, src and tests), but it buys nothing:
both consumers are net10 and **.NET 9 left support in May 2026**. net8
does not compile at all — `System.IO.Pipelines` only entered the base
targeting pack in .NET 9, so it would need a conditional
`PackageReference`. No CI change needed.

## 4. Packaging hardened ahead of the first nuget.org push

Two independent reviews of `Directory.Build.props` + the csproj (mine
and Codex's). Everything below is verified against a real `dotnet pack`
and, for each removal, `dotnet msbuild -getProperty` to confirm the SDK
default matches what was there.

**Correctness**

- **NU1903 now fails the build.** It was exempt from
`TreatWarningsAsErrors` along with NU1901/NU1902 — but NU1903 means a
*high-severity* known vulnerability, which should never be publishable.
Low/moderate (NU1901/NU1902) still warn: a newly published low-severity
advisory should not break a build that changed nothing, and Dependabot
raises the bump.
- **`allowPrerelease: false`.** `rollForward: latestMajor` was silently
selecting an installed **.NET 11 preview** SDK for local packs. Stays
`latestMajor` (deliberate, per the earlier .NET 11 decision); the
preview hole is what's closed.
- **`Version` falls back to `0.0.0-local`.** Without it an unversioned
local `dotnet pack` produces `1.0.0` — an artifact that looks official.
CI always sets `Version` from the tag, so the real publish is
unaffected.
- **`CentralPackageTransitivePinningEnabled` dropped.** It can promote a
pinned transitive version into the generated nuspec, silently enlarging
the package's dependency contract. Fine for apps; wrong for a library.
- **`--skip-duplicate` on `dotnet nuget push`** so a re-run after a
partial publish failure doesn't die on the already-pushed package.

**Metadata / hygiene**

- `Copyright` added (matches LICENSE).
- Description reworded — it now says what the package does
(serialization *and* deserialization) instead of naming internals
("options + reference resolver leases").
- `EnablePackageValidation` on. `PackageValidationBaselineVersion`
follows once 1.0.0 exists.
- `InternalsVisibleTo` via the SDK item instead of hand-writing the
`AssemblyAttribute`.
- Dropped four properties that are already the net10 SDK default:
`IsPackable`, `LangVersion`, `EmbedUntrackedSources`, and the analyzer
`IncludeAssets` boilerplate.

Not done, deliberately: `PackageReleaseNotes` pointing at a GitHub
Release URL (no Releases exist yet — it would ship a dead link), and
pinning the SDK to an exact patch (contradicts `latestMajor`).

## 5. ConfigureAwait: reviewed, kept

The 16 `ConfigureAwait(false)` calls from §1 were re-reviewed on the
question of whether .NET 10 has made them unnecessary. Two independent
passes, both **keep all 16**:

- No global opt-out exists. `ConfigureAwaitOptions.None` is *equivalent
to* per-await `false`; there is no assembly- or project-wide switch, and
`ValueTask` still only has the boolean overload. CA2007 being off by
default in .NET 10 means "don't impose this on app code", not "the
mechanism is obsolete" — its docs still call for `false` in
app-model-independent libraries.
- Consumers with a live SynchronizationContext in 2026: WPF, WinForms,
MAUI, and **Blazor Server** (circuit-scoped). Sync-over-async there
deadlocks; even a correct async caller pays a UI/circuit dispatch on
every resume.
- "Only the first await needs it" does not hold, and this code is the
counterexample: a synchronously-completed await never clears
`SynchronizationContext.Current`. `Utf8JsonWriter.DisposeAsync` over an
`IBufferWriter` only calls `Advance()`, and `TransformCore` always
returns `ValueTask.CompletedTask` — so the early awaits complete inline
and the context flows straight through to the awaits that can actually
suspend.

## Test plan

- [x] `dotnet build -c Release` — 0 warnings, 0 errors, with
`TreatWarningsAsErrors` and no `NoWarn`
- [x] `dotnet test` — 55/55 pass
- [x] `dotnet pack` — package contents verified: `lib/net10.0/{dll,xml}`
+ README + MIT expression + `.snupkg` + SourceLink repository commit
- [x] CI green (build-and-test, CodeQL)

## Follow-ups (not in this PR)

- **Package icon** — the only remaining gap on the nuget.org page; needs
a logo asset.
- **FluentAssertions 8** — Dependabot merged 6.12 → 8.10 in #2/#3. v8 is
the Xceed Community License (non-commercial); 7.x was the last
Apache-2.0. CI is green, so nothing flags it. Options: pin 7.x, swap to
AwesomeAssertions (MIT fork), or TUnit (as Dodo.Unique does) — plus a
`dependabot.yml` `ignore` for major test-framework bumps.
@AndrewP-GH AndrewP-GH mentioned this pull request Jul 15, 2026
Merged
AndrewP-GH added a commit that referenced this pull request Jul 15, 2026
@AndrewP-GH
fix: lower Microsoft.Extensions.ObjectPool floor to the 10.0 band min…
07983ed 
…imum (#9)

## Problem

The package's only runtime dependency,
`Microsoft.Extensions.ObjectPool`, is pinned at **10.0.10** — set by a
dependabot grouped bump (#3), not by any API need. A NuGet dependency
version is a **floor**: rc.1 forces `>= 10.0.10` on every consumer, and
both downstream repos (menu pinned 10.0.7, dodo-mobile-api pinned
10.0.8, both with `CentralPackageTransitivePinningEnabled`) failed
restore with NU1109 downgrade errors, each needing a coordinated
central-pin bump. This recurs on every future dependabot patch bump.

## Fix

- `Directory.Packages.props`: ObjectPool **10.0.10 → 10.0.0** (the .NET
10 band minimum). Packed nuspec now declares
`Microsoft.Extensions.ObjectPool >= 10.0.0`; consumer pins at
10.0.7/10.0.8/10.0.10 all satisfy it unchanged.
- `.github/dependabot.yml`: `ignore` patch/minor `update-types` for this
dependency so the floor stays at the band minimum. A major (11.x band
move) still opens a PR, and update-type ignores do **not** suppress
Dependabot security updates.

## Why 10.0.0 is safe

- Used surface is only `ObjectPool<T>`, `DefaultObjectPool<T>(policy,
maxRetained)`, `IPooledObjectPolicy<T>`. Decompiled the shipped net10.0
assemblies from 10.0.0, 10.0.7, 10.0.8 and 10.0.10: these types are
implementation-identical across all four, and every assembly carries
`AssemblyVersion 10.0.0.0` — there is no servicing behavior this library
relies on.
- Matches .NET library guidance: a dependency version is an inclusive
minimum; avoid exact versions and upper bounds; floor at the lowest
version the library requires (the pattern third-party libraries like
Serilog.Extensions.Logging follow, e.g. `MEL >= 9.0.0`).
- A 9.x floor would also restore on net10 but was rejected: no consumer
gain for a net10.0-only library, unpinned consumers would resolve to a
maintenance-band 9.0.0 (EOL 2026-11-10), and it misaligns with the 10.x
shared-framework copy Web SDK consumers actually run.

## Verification

- `dotnet build` clean, 57/57 tests green on the 10.0.0-restored graph.
- `dotnet pack` nuspec check: `<dependency
id="Microsoft.Extensions.ObjectPool" version="10.0.0" />`.
- Independent adversarial review of the proposal (decompile evidence
above) agreed on both changes and refuted the two considered
alternatives (group exclusion still raises the floor on merge; bare
dependency ignore would affect security updates while update-type ignore
does not).

Unblocks the stable `v1.0.0` tag: once published, menu repins
`1.0.0-rc.1 → 1.0.0` and its next stable `MenuContracts/x.y.z` pack no
longer trips NU5104, and the downstream ObjectPool pin bumps become
unnecessary.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AndrewP-GH