From 3f2b9df65b6b4dedeb7bbf5efb4bee0cf1cbaa37 Mon Sep 17 00:00:00 2001 From: Niklas Arbin Date: Thu, 27 Aug 2026 09:50:19 +0200 Subject: [PATCH] chore(deps): sweep all centrally managed NuGet packages Bring every dependency in Directory.Packages.props to its current release, and release the twelve packages whose published dependency floor moves. Three versions are held back deliberately: - StackExchange.Redis stays on 2.x (2.13.17). The 3.x API mirrors 2.13.17, but it defaults to RESP3 and would force every KnightBus.Redis consumer off 2.x, which belongs in its own major release. - Microsoft.Data.SqlClient stays on the 6.1 LTS line (6.1.6) rather than 7.0.2, which is short-term support. - FluentAssertions keeps its [7.2.0,8.0.0) range, the v8 licence guard. This clears twelve security advisories against transitive test dependencies: MessagePack 2.5.192 (two high, nine moderate) came in via Microsoft.NET.Test.Sdk, and SSH.NET 2024.2.0 (one high) via Testcontainers. Both were confined to the test suites and the Aspire sample, all IsPackable=false, so no published package carried them. Five call sites needed updating for new obsoletions: - PostgresAzureConfiguration.TokenCredential now defaults to ManagedIdentityCredential(ManagedIdentityId.SystemAssigned); Azure.Identity 1.21.0 obsoleted the constructor the old default resolved to. Same system-assigned identity, spelled explicitly. - The four Testcontainers setups pass their image to the builder constructor, since the parameterless overload is obsolete. Azurite and MsSql relied on the module defaults, which are unchanged between 4.3.0 and 4.14.0, so the tags are pinned to those exact values. KnightBus.PostgreSql goes to 4.3.0 rather than 4.2.0: #227 already published 4.2.0 with the previous Npgsql floor, and CI pushes with --skip-duplicate, so reusing that version would drop the new floor silently. Aspire.AppHost.Sdk is pinned in the AspireHost csproj rather than Directory.Packages.props, so it does not move on its own and is bumped here alongside Aspire.Hosting.Azure.ServiceBus. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_0176nyGkxqpWKrvJAEpwYtnx --- CHANGELOG.md | 38 +++++++- Directory.Packages.props | 87 ++++++++++--------- .../KnightBus.Samples.Azure.AspireHost.csproj | 7 +- src/KnightBus.Azure.ServiceBus/CHANGELOG.md | 6 ++ .../KnightBus.Azure.ServiceBus.csproj | 2 +- .../KnightBus.Azure.Storage.csproj | 2 +- src/KnightBus.Core/CHANGELOG.md | 5 ++ src/KnightBus.Core/KnightBus.Core.csproj | 2 +- src/KnightBus.Host/KnightBus.Host.csproj | 2 +- .../KnightBus.NewRelic.csproj | 2 +- .../KnightBus.OpenTelemetry.csproj | 2 +- ...ightBus.PostgreSql.Extensions.Azure.csproj | 2 +- .../PostgresAzureConfiguration.cs | 3 +- .../KnightBus.PostgreSql.Management.csproj | 2 +- src/KnightBus.PostgreSql/CHANGELOG.md | 4 + .../KnightBus.PostgreSql.csproj | 2 +- src/KnightBus.Redis/KnightBus.Redis.csproj | 2 +- .../KnightBus.Schedule.csproj | 2 +- .../KnightBus.SqlServer.csproj | 2 +- .../StorageSetup.cs | 5 +- .../PostgresSetup.cs | 3 +- .../RedisSetup.cs | 3 +- .../SqlServerSetup.cs | 5 +- 23 files changed, 129 insertions(+), 61 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 48a78656..5d76232a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,43 @@ * `PostgresMessageStateHandler` implements `IMessageLockHandler`, so `ExtendMessageLockDurationMiddleware` renews message locks on this transport and `IExtendMessageLockTimeout` settings are now supported here. A renewal pushes `visibility_timeout` forward and only applies while the consumer still holds the row; once another consumer has fetched it, the renewal is a no-op * The fetch lock is passed to the queue client as a `TimeSpan` instead of whole seconds, so a fractional `MessageLockTimeout` or `ExtensionDuration` no longer truncates — a value under one second used to become a zero-second lock. `PostgresBaseClient.GetMessagesAsync` gained a `TimeSpan` overload; the `int` one remains -# 2026-08-26 +### Dependency sweep +Every centrally managed dependency moved to its current release. No API changed; what changed for +consumers is the minimum version each package resolves against, so the twelve packages holding a +direct reference to something that moved get a minor bump: `KnightBus.Core` 18.4.0, `KnightBus.Host` +18.3.0, `KnightBus.Azure.ServiceBus` 24.2.0, `KnightBus.Azure.Storage` 18.3.0, `KnightBus.Redis` +17.2.0, `KnightBus.SqlServer` 17.2.0, `KnightBus.PostgreSql` 4.3.0, `KnightBus.PostgreSql.Management` +4.2.0, `KnightBus.PostgreSql.Extensions.Azure` 2.1.0, `KnightBus.Schedule` 15.3.0, +`KnightBus.NewRelic` 13.2.0 and `KnightBus.OpenTelemetry` 1.0.0-alpha4. + +`KnightBus.PostgreSql` goes to 4.3.0 rather than 4.2.0: the lock-extension release above already +published 4.2.0 with the previous Npgsql floor, and CI pushes with `--skip-duplicate`, so reusing +that version would drop the new floor silently. + +The remaining fourteen packages are unchanged and not republished. `KnightBus.ApplicationInsights`, +`KnightBus.Nats` and `KnightBus.Newtonsoft` were already on the current version of everything they +reference; the `.Messages` and `.Management` satellites have no package references of their own, and +the floors their published nuspecs already declare still resolve against the new versions. + +* Runtime packages, pinned per target framework: `Microsoft.Extensions.*` and `System.Text.Json` to + 9.0.19 on `net9.0` and 10.0.11 on `net10.0`; `Npgsql` and `Npgsql.DependencyInjection` to 9.0.5 and + 10.0.3 +* `Azure.Identity` 1.21.0, `Azure.Storage.Blobs` 12.29.2, `Azure.Storage.Queues` 12.27.1, + `Azure.Messaging.ServiceBus` 7.20.2, `Quartz` 3.19.1, `NewRelic.Agent.Api` 10.54.0 and the + OpenTelemetry family 1.18.0 +* **Held back deliberately.** `StackExchange.Redis` stays on 2.x (2.13.17): 3.x mirrors the 2.13.17 + API, but it defaults to RESP3 and would raise the floor in `KnightBus.Redis`, forcing every + consumer off 2.x — that belongs in its own major release. `Microsoft.Data.SqlClient` stays on the + 6.1 LTS line (6.1.6) rather than 7.0.2, which is short-term support. `FluentAssertions` keeps its + `[7.2.0,8.0.0)` range, the guard against the v8 licence change +* `PostgresAzureConfiguration.TokenCredential` now defaults to + `new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned)`; Azure.Identity 1.21.0 obsoleted + the constructor the old default resolved to. Same system-assigned identity, spelled explicitly +* Twelve security advisories against transitive test dependencies are gone — `MessagePack` 2.5.192 + (two high, nine moderate) reached the build through `Microsoft.NET.Test.Sdk`, now 18.9.0, and + `SSH.NET` 2024.2.0 (one high) through Testcontainers, now 4.14.0. Both were confined to the test + suites and the Aspire sample, all of which are `IsPackable=false`, so no published package ever + carried them ### Nullable reference types enabled across all packages All public APIs now carry nullability annotations; the signatures themselves are unchanged. Released diff --git a/Directory.Packages.props b/Directory.Packages.props index 02288fd0..667f14b0 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -14,19 +14,24 @@ - - - - + + + + - + + - + - - - + + + + - + - - - + + + - - - - - - + + + + + + - - - - - - - - - + + + + + + + + + + + diff --git a/samples/KnightBus.Samples.Azure.AspireHost/KnightBus.Samples.Azure.AspireHost.csproj b/samples/KnightBus.Samples.Azure.AspireHost/KnightBus.Samples.Azure.AspireHost.csproj index 9e63662a..92591cd9 100644 --- a/samples/KnightBus.Samples.Azure.AspireHost/KnightBus.Samples.Azure.AspireHost.csproj +++ b/samples/KnightBus.Samples.Azure.AspireHost/KnightBus.Samples.Azure.AspireHost.csproj @@ -1,9 +1,14 @@ - + Exe net10.0 enable b2ad9cab-ed30-4aba-b11f-df0144c0ee91 + + $(NoWarn);ASPIRE010 diff --git a/src/KnightBus.Azure.ServiceBus/CHANGELOG.md b/src/KnightBus.Azure.ServiceBus/CHANGELOG.md index 51d317a6..b7527cf8 100644 --- a/src/KnightBus.Azure.ServiceBus/CHANGELOG.md +++ b/src/KnightBus.Azure.ServiceBus/CHANGELOG.md @@ -1,5 +1,11 @@ # KnightBus.Azure.ServiceBus Changelog +## 24.2.0 +### Changed +- `Azure.Identity` moves to 1.21.0 and `Azure.Messaging.ServiceBus` to 7.20.2, raising the floor + consumers resolve against. No API change + + ## 24.1.0 ### Changed - Nullable reference types are enabled. `IServiceBusConfiguration.FullyQualifiedNamespace` and diff --git a/src/KnightBus.Azure.ServiceBus/KnightBus.Azure.ServiceBus.csproj b/src/KnightBus.Azure.ServiceBus/KnightBus.Azure.ServiceBus.csproj index fccbabed..f99c86eb 100644 --- a/src/KnightBus.Azure.ServiceBus/KnightBus.Azure.ServiceBus.csproj +++ b/src/KnightBus.Azure.ServiceBus/KnightBus.Azure.ServiceBus.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true Azure Service Bus Transport for KnightBus - 24.1.0$(VersionSuffix) + 24.2.0$(VersionSuffix) knightbus;azure servicebus;amqp;queues;messaging diff --git a/src/KnightBus.Azure.Storage/KnightBus.Azure.Storage.csproj b/src/KnightBus.Azure.Storage/KnightBus.Azure.Storage.csproj index 0cbe889e..6cff95f3 100644 --- a/src/KnightBus.Azure.Storage/KnightBus.Azure.Storage.csproj +++ b/src/KnightBus.Azure.Storage/KnightBus.Azure.Storage.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true Azure Storage Transport for KnightBus - 18.2.0$(VersionSuffix) + 18.3.0$(VersionSuffix) knightbus;azure storage;blob;queues;messaging diff --git a/src/KnightBus.Core/CHANGELOG.md b/src/KnightBus.Core/CHANGELOG.md index f2bf8ed8..19de0ee7 100644 --- a/src/KnightBus.Core/CHANGELOG.md +++ b/src/KnightBus.Core/CHANGELOG.md @@ -1,5 +1,10 @@ # KnightBus.Core Changelog +# 18.4.0 +* `Microsoft.Extensions.DependencyInjection.Abstractions`, `Microsoft.Extensions.Logging.Abstractions` + and `System.Text.Json` move to 9.0.19 on `net9.0` and 10.0.11 on `net10.0`, raising the floor + consumers resolve against. No API change + # 18.3.0 * Nullable reference types are enabled. Public APIs carry nullability annotations; no signature changed. Implementations of the annotated extension points get new warnings until they match: diff --git a/src/KnightBus.Core/KnightBus.Core.csproj b/src/KnightBus.Core/KnightBus.Core.csproj index f98d7873..36415c7e 100755 --- a/src/KnightBus.Core/KnightBus.Core.csproj +++ b/src/KnightBus.Core/KnightBus.Core.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true Shared core functionallity for the KnightBus framework - 18.3.0$(VersionSuffix) + 18.4.0$(VersionSuffix) knightbus;servicebus;esb;queues;messaging diff --git a/src/KnightBus.Host/KnightBus.Host.csproj b/src/KnightBus.Host/KnightBus.Host.csproj index f5df1944..545a6e9e 100644 --- a/src/KnightBus.Host/KnightBus.Host.csproj +++ b/src/KnightBus.Host/KnightBus.Host.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true KnightBus Host - 18.2.0$(VersionSuffix) + 18.3.0$(VersionSuffix) knightbus;servicebus;esb;queues;messaging diff --git a/src/KnightBus.NewRelic/KnightBus.NewRelic.csproj b/src/KnightBus.NewRelic/KnightBus.NewRelic.csproj index 404bbaa3..976c1364 100644 --- a/src/KnightBus.NewRelic/KnightBus.NewRelic.csproj +++ b/src/KnightBus.NewRelic/KnightBus.NewRelic.csproj @@ -4,7 +4,7 @@ KnightBus.NewRelicMiddleware true NewRelic.Agent.Api for KnightBus - 13.1.0$(VersionSuffix) + 13.2.0$(VersionSuffix) knightbus;apm;newrelic.agent.api diff --git a/src/KnightBus.OpenTelemetry/KnightBus.OpenTelemetry.csproj b/src/KnightBus.OpenTelemetry/KnightBus.OpenTelemetry.csproj index df0cd4b6..2297574c 100644 --- a/src/KnightBus.OpenTelemetry/KnightBus.OpenTelemetry.csproj +++ b/src/KnightBus.OpenTelemetry/KnightBus.OpenTelemetry.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true OpenTelemetry for KnightBus - 1.0.0-alpha3$(VersionSuffix) + 1.0.0-alpha4$(VersionSuffix) knightbus;opentelemetry;tracing;observability README.md true diff --git a/src/KnightBus.PostgreSql.Extensions.Azure/KnightBus.PostgreSql.Extensions.Azure.csproj b/src/KnightBus.PostgreSql.Extensions.Azure/KnightBus.PostgreSql.Extensions.Azure.csproj index 0f0ef45e..9de64c44 100644 --- a/src/KnightBus.PostgreSql.Extensions.Azure/KnightBus.PostgreSql.Extensions.Azure.csproj +++ b/src/KnightBus.PostgreSql.Extensions.Azure/KnightBus.PostgreSql.Extensions.Azure.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true Extension methods for setting up the KnightBus PostgreSql transport in Azure - 2.0.0$(VersionSuffix) + 2.1.0$(VersionSuffix) knightbus;postgresql;queues;messaging enable diff --git a/src/KnightBus.PostgreSql.Extensions.Azure/PostgresAzureConfiguration.cs b/src/KnightBus.PostgreSql.Extensions.Azure/PostgresAzureConfiguration.cs index 506b6a94..0801acd9 100644 --- a/src/KnightBus.PostgreSql.Extensions.Azure/PostgresAzureConfiguration.cs +++ b/src/KnightBus.PostgreSql.Extensions.Azure/PostgresAzureConfiguration.cs @@ -27,7 +27,8 @@ public class PostgresAzureConfiguration : PostgresConfiguration /// /// to use for acquiring Azure AD tokens. Defaults to /// - public TokenCredential TokenCredential { get; set; } = new ManagedIdentityCredential(); + public TokenCredential TokenCredential { get; set; } = + new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned); /// /// The set of scopes to request when acquiring an Azure AD token. diff --git a/src/KnightBus.PostgreSql.Management/KnightBus.PostgreSql.Management.csproj b/src/KnightBus.PostgreSql.Management/KnightBus.PostgreSql.Management.csproj index 70ab5bb1..307589c1 100644 --- a/src/KnightBus.PostgreSql.Management/KnightBus.PostgreSql.Management.csproj +++ b/src/KnightBus.PostgreSql.Management/KnightBus.PostgreSql.Management.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true PostgreSQL Transport Management for KnightBus - 4.1.0$(VersionSuffix) + 4.2.0$(VersionSuffix) knightbus;postgresql;queues;messaging enable diff --git a/src/KnightBus.PostgreSql/CHANGELOG.md b/src/KnightBus.PostgreSql/CHANGELOG.md index 0c19ab1d..921429bb 100644 --- a/src/KnightBus.PostgreSql/CHANGELOG.md +++ b/src/KnightBus.PostgreSql/CHANGELOG.md @@ -1,5 +1,9 @@ # KnightBus.PostgreSql Changelog +# 4.3.0 +(minor): `Npgsql` and `Npgsql.DependencyInjection` move to 9.0.5 on `net9.0` and 10.0.3 on `net10.0`, +raising the floor consumers resolve against. No API change. + # 4.2.0 (minor): Implement `IMessageLockHandler` on `PostgresMessageStateHandler` so `ExtendMessageLockDurationMiddleware` can renew message locks. The fetch lock is passed as a `TimeSpan`, so fractional durations no longer truncate to whole seconds. diff --git a/src/KnightBus.PostgreSql/KnightBus.PostgreSql.csproj b/src/KnightBus.PostgreSql/KnightBus.PostgreSql.csproj index 2b2ec3be..282b3352 100644 --- a/src/KnightBus.PostgreSql/KnightBus.PostgreSql.csproj +++ b/src/KnightBus.PostgreSql/KnightBus.PostgreSql.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true PostgreSQL Transport for KnightBus - 4.2.0$(VersionSuffix) + 4.3.0$(VersionSuffix) knightbus;postgresql;queues;messaging enable diff --git a/src/KnightBus.Redis/KnightBus.Redis.csproj b/src/KnightBus.Redis/KnightBus.Redis.csproj index 4ea7f5ab..18a1ce4a 100644 --- a/src/KnightBus.Redis/KnightBus.Redis.csproj +++ b/src/KnightBus.Redis/KnightBus.Redis.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true Redis Transport for KnightBus - 17.1.0$(VersionSuffix) + 17.2.0$(VersionSuffix) knightbus;redis;queues;messaging diff --git a/src/KnightBus.Schedule/KnightBus.Schedule.csproj b/src/KnightBus.Schedule/KnightBus.Schedule.csproj index bbe5c053..06a45bb7 100644 --- a/src/KnightBus.Schedule/KnightBus.Schedule.csproj +++ b/src/KnightBus.Schedule/KnightBus.Schedule.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true KnightBus Chron Scheduler - 15.2.0$(VersionSuffix) + 15.3.0$(VersionSuffix) knightbus;quartz;schedule;trigger diff --git a/src/KnightBus.SqlServer/KnightBus.SqlServer.csproj b/src/KnightBus.SqlServer/KnightBus.SqlServer.csproj index 82bd2520..e36bef0a 100644 --- a/src/KnightBus.SqlServer/KnightBus.SqlServer.csproj +++ b/src/KnightBus.SqlServer/KnightBus.SqlServer.csproj @@ -3,7 +3,7 @@ net9.0;net10.0 true Sql Server for KnightBus - 17.1.0$(VersionSuffix) + 17.2.0$(VersionSuffix) knightbus;sql;sql server;saga; diff --git a/tests/KnightBus.Azure.Storage.Tests.Integration/StorageSetup.cs b/tests/KnightBus.Azure.Storage.Tests.Integration/StorageSetup.cs index 0c57def5..dc52502e 100644 --- a/tests/KnightBus.Azure.Storage.Tests.Integration/StorageSetup.cs +++ b/tests/KnightBus.Azure.Storage.Tests.Integration/StorageSetup.cs @@ -7,7 +7,10 @@ namespace KnightBus.Azure.Storage.Tests.Integration; [SetUpFixture] internal class StorageSetup { - private static readonly AzuriteContainer Azurite = new AzuriteBuilder() + // The image was the module default until Testcontainers made it explicit; keeping the same tag. + private static readonly AzuriteContainer Azurite = new AzuriteBuilder( + "mcr.microsoft.com/azure-storage/azurite:3.28.0" + ) .WithCommand("--skipApiVersionCheck") .Build(); public static string ConnectionString = null!; diff --git a/tests/KnightBus.PostgreSql.Tests.Integration/PostgresSetup.cs b/tests/KnightBus.PostgreSql.Tests.Integration/PostgresSetup.cs index fd6b902e..37cfaa32 100644 --- a/tests/KnightBus.PostgreSql.Tests.Integration/PostgresSetup.cs +++ b/tests/KnightBus.PostgreSql.Tests.Integration/PostgresSetup.cs @@ -7,8 +7,7 @@ namespace KnightBus.PostgreSql.Tests.Integration; [SetUpFixture] public class PostgresSetup { - private static readonly PostgreSqlContainer Postgres = new PostgreSqlBuilder() - .WithImage("postgres") + private static readonly PostgreSqlContainer Postgres = new PostgreSqlBuilder("postgres") .WithPortBinding(5433, 5432) .WithUsername("postgres") .WithPassword("passw") diff --git a/tests/KnightBus.Redis.Tests.Integration/RedisSetup.cs b/tests/KnightBus.Redis.Tests.Integration/RedisSetup.cs index c1e911a3..70994a58 100644 --- a/tests/KnightBus.Redis.Tests.Integration/RedisSetup.cs +++ b/tests/KnightBus.Redis.Tests.Integration/RedisSetup.cs @@ -7,8 +7,7 @@ namespace KnightBus.Redis.Tests.Integration; [SetUpFixture] public class RedisSetup { - private static readonly RedisContainer Redis = new RedisBuilder() - .WithImage("redis") + private static readonly RedisContainer Redis = new RedisBuilder("redis") .WithPortBinding(6380, 6379) .Build(); diff --git a/tests/KnightBus.SqlServer.Tests.Integration/SqlServerSetup.cs b/tests/KnightBus.SqlServer.Tests.Integration/SqlServerSetup.cs index 1d24e41a..74ce02a2 100644 --- a/tests/KnightBus.SqlServer.Tests.Integration/SqlServerSetup.cs +++ b/tests/KnightBus.SqlServer.Tests.Integration/SqlServerSetup.cs @@ -10,7 +10,10 @@ public class SqlServerSetup { private const string DatabaseName = "KnightBus"; - private static readonly IDatabaseContainer MsSql = new MsSqlBuilder() + // The image was the module default until Testcontainers made it explicit; keeping the same tag. + private static readonly IDatabaseContainer MsSql = new MsSqlBuilder( + "mcr.microsoft.com/mssql/server:2022-CU14-ubuntu-22.04" + ) .WithPortBinding(14333, 1433) .Build();