Repository navigation
chore(deps): update all packages (NuGet, npm, GitHub Actions) - #477
Merged
Merged
Conversation
44 PackageVersion entries refreshed via dotnet list package --outdated (no major bumps in the NuGet graph): AngleSharp 1.8.4->1.8.6, AWSSDK.Core 4.0.102.11->4.0.102.13, coverlet.collector 10.0.1->10.1.0, Dapper 2.1.86->2.1.89, FluentAssertions 8.10.0->8.11.0, Google.Protobuf 3.36.1->3.36.2, Grpc.AspNetCore(.Server.Reflection) 2.83.0->2.84.0 (now level with Grpc.Core.Api /Net.Client/Tools), linq2db 6.5.0->6.5.1, MailKit/MimeKit 4.18.0->4.18.2, Markdig 1.4.1->1.5.0, MessagePack 3.1.8->3.1.12, the Microsoft.* 10.0.12->10.0.13 wave (incl. EF Core, Data.Sqlite, AspNetCore.Authentication.*, Extensions.*), Microsoft.Extensions.Http.Resilience 10.10.0->10.11.0, Microsoft.Identity.Client(.Extensions.Msal) 4.90.1->4.91.1, Microsoft.NET.Test.Sdk 18.10.1->18.11.0, Microsoft.SourceLink.GitHub 10.0.401->10.0.402, BenchmarkDotNet diagnosers 18.7->18.12. The two Aspire projects run with ManagePackageVersionsCentrally=false and carry inline versions, so they are updated in place: Aspire.AppHost.Sdk and Aspire.Hosting(.AppHost) 13.5.3/13.6.1->13.6.4, MessagePack 2.5.303->3.1.12 (matches what AppHost already ships and what the 3.x line needs for the StreamJsonRpc transitive), SourceLink 10.0.401->10.0.402. Directory.Build.props pinned Microsoft.Data.Sqlite to 10.0.10 with a PackageVersion Update that ran before central package management declared the item; it is inert today, so it is bumped to 10.0.13 rather than left as a stale downgrade trap.
…ates npm update inside the declared semver ranges: @grpc/grpc-js 1.14.4->1.14.6, axios 1.18.1->1.20.0, ws 8.21.0->8.22.0, @types/ws 8.18.1->8.18.2, @typescript-eslint/* 8.68.0->8.72.0, ts-jest 29.4.11->29.4.15. The overrides for protobufjs (7.6.6) and esbuild (0.28.2) still hold. The majors are left alone on purpose: jest 30 (+ @types/jest 30), eslint 10, typescript 7 (the native port), tsup 9, google-protobuf 4 and @types/node 26 all need migration work, and the package has no CI job, so they should land one at a time with the client suite green.
actions/upload-artifact v4->v7 and actions/download-artifact v4->v8 (both migrate to the node24 runtime and keep the name/path semantics used here; they are bumped as a pair so the pack and publish jobs stay compatible). advanced-security/component-detection-dependency-submission-action v0.1.6->v0.2.0, docker/setup-qemu v4.3.0->v4.4.0, docker/setup-buildx v4.3.0->v4.4.1, docker/login v4.6.0->v4.7.0 and docker/build-push v7.3.0->v7.4.0, the docker ones kept SHA-pinned with their version comment. actions/checkout@v7, setup-dotnet@v6, setup-python@v7 and codecov-action v7.1.1 were already current.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refreshes every dependency ecosystem the repo carries: NuGet (44 direct packages), the JS client's npm lockfile, and the GitHub Actions pins.
Replaces the two dependabot PRs that were closed unfixed (#462 dotnet-microsoft group, #463 AngleSharp) and finishes the job they started, plus the packages they never covered.
NuGet — 44 direct packages, all now latest
dotnet list SharpCoreDB.slnx package --outdatednow reports no outdated direct packages.Microsoft.*10.0.12 → 10.0.13 wave: EF Core (+ Relational/Sqlite), Data.Sqlite, AspNetCore.Authentication.{Certificate,JwtBearer,OpenIdConnect}, AspNetCore.{Mvc.Testing,TestHost}, Extensions.{Configuration*,DependencyInjection*,Diagnostics.HealthChecks,Hosting*,Http,Logging*,ObjectPool}, System.Diagnostics.PerformanceCounterMicrosoft.Extensions.Http.Resilience10.10.0 → 10.11.0Microsoft.Identity.Client(.Extensions.Msal)4.90.1 → 4.91.1Microsoft.NET.Test.Sdk18.10.1 → 18.11.0,Microsoft.SourceLink.GitHub10.0.401 → 10.0.402, BenchmarkDotNet diagnosers 18.7 → 18.12Grpc.AspNetCore(.Server.Reflection)2.83.0 → 2.84.0 (level again with the already-2.84.0Grpc.Core.Api/Grpc.Net.Client/Grpc.Tools)AngleSharp1.8.4 → 1.8.6,AWSSDK.Core4.0.102.11 → 4.0.102.13,Dapper2.1.86 → 2.1.89,FluentAssertions8.10.0 → 8.11.0,Google.Protobuf3.36.1 → 3.36.2,linq2db6.5.0 → 6.5.1,MailKit/MimeKit4.18.0 → 4.18.2,Markdig1.4.1 → 1.5.0,MessagePack3.1.8 → 3.1.12,coverlet.collector10.0.1 → 10.1.0Two things needed care:
ManagePackageVersionsCentrally=false) and carry inline versions, so the central props file never governed them — the props entries claimingAspire.Hosting 13.5.3were dead. Both are updated in place:Aspire.AppHost.SdkandAspire.Hosting(.AppHost)→ 13.6.4, SourceLink → 10.0.402, andMessagePackinSharpCoreDB.Aspire.Hosting2.5.303 → 3.1.12 (superseding Bump MessagePack from 2.5.302 to 2.5.303 #471; matches what AppHost has shipped since deps: Bump MessagePack from 3.1.11 to 3.1.12 #467).Directory.Build.propspinnedMicrosoft.Data.Sqliteto 10.0.10 through aPackageVersion Updatethat runs beforeDirectory.Packages.propsdeclares the item, so it never applied — a latent downgrade trap. Bumped to 10.0.13.npm (JS client)
In-range updates only:
@grpc/grpc-js1.14.4 → 1.14.6,axios1.18.1 → 1.20.0,ws8.21.0 → 8.22.0,@types/ws8.18.1 → 8.18.2,@typescript-eslint/*8.68.0 → 8.72.0,ts-jest29.4.11 → 29.4.15. Theprotobufjs7.6.6 /esbuild0.28.2 overrides still hold.Deliberately not bumped: jest 30 (with
@types/jest30), eslint 10, typescript 7, tsup 9, google-protobuf 4,@types/node26. Every one is a migration, the client has no CI job, andnpm run typecheckalready fails on master (see below) — those deserve their own PRs.GitHub Actions
actions/upload-artifactv4 → v7,actions/download-artifactv4 → v8 (node24 runtime; thename/pathform used inci.yml/ci-net10.yml/benchmarks.yml/compatibility-smoke.ymlis unchanged). Bumped as a pair so pack/publish stay compatible — which is why they are in the same commit.advanced-security/component-detection-dependency-submission-actionv0.1.6 → v0.2.0docker/setup-qemuv4.3.0 → v4.4.0,docker/setup-buildxv4.3.0 → v4.4.1,docker/loginv4.6.0 → v4.7.0,docker/build-pushv7.3.0 → v7.4.0 — new tag SHAs resolved via the API, comments updated, still SHA-pinned.actions/checkout@v7,setup-dotnet@v6,setup-python@v7,codecov-actionv7.1.1 were already current.Validation (local, same commands as CI)
dotnet restore SharpCoreDB.CI.slnf— clean, no downgrade/conflict warnings (only the pre-existing NU1510 pruning notices)dotnet build SharpCoreDB.CI.slnf -c Release --no-restore /p:ContinuousIntegrationBuild=true /p:UseLocalProjectReferences=true— succeededSharpCoreDB.Tests2137/2137,VectorSearch.Tests255/255,EntityFrameworkCore.Tests116/116,Functional.Linq2DB.Tests24/24SharpCoreDB.AppHostbuilt separately (it is not in CI.slnf, so this is the only check it gets for the Aspire SDK 13.5.3 → 13.6.4 bump) — succeededdotnet list package --vulnerable/--deprecatedon the CI slnf — nothing reported, so the two CI gates stay greennpm ci+npm test→ 16/16;npm run build→ tsup CJS/ESM/DTS ok;npm run typecheckstill fails with the TS2412/TS2375exactOptionalPropertyTypeserrors that are already present on master (verified by re-running against the master lockfile) — pre-existing, not touched hereMerge order
Merge after #476 (
chore/publish-skip-existing). These are dependency changes, not a version bump:$(SharpCoreDBVersion)stays 2.1.1, so with #476's skip-existing logic the master run after this merge publishes nothing. Without #476 merged first, that run would re-PUT all 27 packages and burn the NuGet quota again.