Repository navigation
chore(deps): bump NuGet packages to latest (#683) - #685
Merged
Merged
Conversation
Nineteen packages move, and the lock files are regenerated in the same commit so CI's --locked-mode restore stays green. Floating already, so only the locks changed: StackExchange.Redis 3.1.13 to 3.1.31, seven OpenTelemetry packages 1.17.0 to 1.18.0, Google.Protobuf 3.36.0 to 3.36.1. Pinned, so the csproj changed too: the four Aspire.Hosting packages 13.5.1 to 13.5.3, and Microsoft.CodeAnalysis.CSharp 5.0.0 to 5.9.0. That last one is why the weekly Dependabot nuget job has failed since around 2026-08-28. CodeAnalysis.CSharp 5.9.0 requires CodeAnalysis.Common at exactly 5.9.0, while Cluckwork.Api gets Common only transitively through EntityFrameworkCore.Design, whose Roslyn chain exact-pins it at 5.0.0. Taking the update ourselves removes the pending bump; whether that is enough for Dependabot only its next run can show, and issue 683 tracks the answer. Two packages are deliberately left alone. Microsoft.OpenApi 2.12.2 to 3.10.2 is a major that was previously spiked and found non-trivial, so it needs its own decision. OpenTelemetry.Instrumentation.EntityFrameworkCore 1.16.0-beta.1 reports "Not found at the sources" and wants understanding before it is moved. Two consequences a reviewer should see. CodeAnalysis.Common now resolves to 5.9.0 in Application.Tests and stays at 5.0.0 in Api and Infrastructure, which is correct because per-project graphs are independent. And a prerelease enters a committed lock file, CodeAnalysis.Analyzers 5.9.0-1.26328.17, forced by CodeAnalysis.CSharp 5.9.0's own nuspec; it is confined to a test project. Verified: dotnet build 0 warnings 0 errors with warnings-as-errors, and dotnet test 2278 passed, identical to the baseline captured on main at 94b188f before any change. The 1669 integration tests ran against real Postgres via Testcontainers.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (9)
Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review. 📝 WalkthroughWalkthroughUpdated NuGet package references and lockfiles across production and test projects. The changes upgrade OpenTelemetry, Redis, Aspire.Hosting, Google.Protobuf, and Microsoft.CodeAnalysis packages, including related transitive dependencies and content hashes. ChangesNuGet dependency refresh
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This updates NuGet dependency resolutions and committed lock files while preserving consistent package graphs. The reported clean build and passing baseline tests indicate no current merge-blocking risk. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Linked Issues checkExplanation The package updates, lock-file regeneration, build results, and test results satisfy the coding objectives in issue [ ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
4 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #683.
Nineteen packages move. Lock files regenerated in the same commit, so CI's
--locked-moderestore stays green (a stale lock isNU1004).What moved
Floating already (
*ranges) — only the locks changed, no.csprojedit:StackExchange.Redis3.1.13→3.1.31 (+RESPite) ·OpenTelemetry×7 1.17.0→1.18.0 ·Google.Protobuf3.36.0→3.36.1Pinned —
.csprojedits:Aspire.Hosting.{JavaScript,PostgreSQL,Redis,Testing}13.5.1→13.5.3 ·Microsoft.CodeAnalysis.CSharp5.0.0→5.9.0Why the Roslyn bump is the point
The weekly Dependabot
nugetjob has failed since ~2026-08-28 (dependency_not_found,Microsoft.CodeAnalysis.Common/= 5.9.0). Cause, with evidence:CodeAnalysis.CSharp 5.9.0's nuspec requiresCodeAnalysis.Commonat exactly[5.9.0, 5.9.0]— that exact pin is the= 5.9.0in the error.Cluckwork.ApigetsCommononly transitively, viaEntityFrameworkCore.Design 10.*, whose Roslyn chain exact-pins it at= 5.0.0(three packages do).http=200), so it was never a missing package. Reproduced in a scratch project: threeNU1608constraint violations.Taking the update ourselves removes the pending bump. Whether that fully fixes the job, only its next weekly run can show — the exact-pin split still exists. #683 tracks that answer, and names the fallback (a narrowly scoped
ignore, with the trade-off stated:ignoresuppresses security updates too).Deliberately not bumped
Microsoft.OpenApi2.12.2 → 3.10.2 — not ours to take: it is range-blocked upstream.Microsoft.AspNetCore.OpenApi 10.0.11(ASP.NET Core's own OpenAPI integration, tracking .NET 10 via10.*) declaresMicrosoft.OpenApi [2.7.5, 3.0.0)— a hard ceiling below 3.x. Verified, not recalled:Forcing it would (a) fail the build, since
TreatWarningsAsErrorsis on in all seven projects, so that NU1608 is an error here even though a bare scratch project merely warns; (b) risk silent runtime breakage if the warning were muted, because ASP.NET Core's document generation is compiled against the 2.x object model and 3.x is a rewritten API surface — the class of failure that passes restore and breaks at request time; and (c) fight a security pin rather than a preference. That explicitMicrosoft.OpenApi 2.12.2line is a floor raised above a vulnerable transitive (GHSA-v5pm-xwqc-g5wc, NU1903, per the comment beside it); 2.12.2 is the version satisfying both that floor and the framework's ceiling.It unblocks when ASP.NET Core ships a range admitting 3.x, at which point
Microsoft.AspNetCore.OpenApipulls it in and our explicit pin may become removable. Re-checkable in one command — read theMicrosoft.OpenApirange underMicrosoft.AspNetCore.OpenApiinsrc/Cluckwork.Api/packages.lock.json— so nobody needs to re-spike this.OpenTelemetry.Instrumentation.EntityFrameworkCore 1.16.0-beta.1—--outdatedreports "Not found at the sources". Understand before moving.Two things for a reviewer to look at
CodeAnalysis.Commonnow resolves differently per project — 5.9.0 inApplication.Tests, 5.0.0 inApi/Infrastructure. Correct: per-project graphs are independent.CodeAnalysis.Analyzers 3.11.0 → 5.9.0-1.26328.17, forced byCodeAnalysis.CSharp 5.9.0's own nuspec. Test-project only, nothing shipped. Flagged because it should be a decision, not a discovery.Verification
main@94b188f7, before any changedotnet testexit 0, 2278 passeddotnet build Cluckwork.slnafterdotnet test Cluckwork.slnafterBreakdown both runs: Domain 365 · AppHost 10 · Application 234 · Api.Integration 1669. The integration tests ran against real Postgres via Testcontainers (2m5s), so the Redis and OpenTelemetry moves were genuinely exercised, not merely compiled.
Follow-up: #684 adopts Central Package Management so the next bump is one file instead of eight — deliberately after this, because its acceptance criterion is byte-identical lock files, and a version bump would destroy that proof.
Summary by CodeRabbit