chore(deps): batch the safe dependency bumps#56
Closed
Chineme123 wants to merge 3 commits into
Closed
Conversation
Clears the Dependabot backlog in one PR instead of nine serial merges (main requires branches be up to date, so nine PRs would mean nine rebase + CI cycles). This is what the new grouped dependabot.yml does going forward. Taken: - Microsoft.AspNetCore.Authentication.JwtBearer 10.0.0 -> 10.0.9 - actions/checkout v4 -> v7 - actions/setup-dotnet v4 -> v5 - actions/setup-node v4 -> v6 - actions/upload-artifact v4 -> v7 - github/codeql-action v3 -> v4 Held back (Dependabot proposed these, but they are NOT safe in isolation): - Microsoft.EntityFrameworkCore 10.0.0 -> 10.0.9 - Microsoft.EntityFrameworkCore.Design 10.0.0 -> 10.0.9 - dotnet-ef 10.0.2 -> 10.0.9 The latest STABLE Npgsql.EntityFrameworkCore.PostgreSQL is 10.0.0 (everything newer is an 11.0.0 preview) and it pins EF Relational to 10.0.0. Bumping EF Core alone skews the stack: it introduced 30 MSB3277 assembly conflict warnings against a clean baseline of 0. The EF stack moves in lockstep with Npgsql or not at all. Revisit when a stable Npgsql ships against EF 10.0.9+. Build: 0 warnings, 0 errors. Tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Chineme123
enabled auto-merge
July 14, 2026 21:25
This was referenced Jul 14, 2026
Owner
Author
|
Closing as superseded. Dependabot now covers this ground automatically — the safe NuGet bumps land in the grouped #58, and GitHub Actions updates are handled by the actions-safe group in .github/dependabot.yml. Consolidating on the Dependabot flow to avoid duplicate/conflicting csproj edits. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the Dependabot backlog in one PR instead of nine serial merges.
mainrequires branches be up to date (strict: true), so nine separate PRs would have meant nine rebase + full-CI cycles. This is exactly what the new groupeddependabot.yml(#54) does going forward.Taken
Microsoft.AspNetCore.Authentication.JwtBeareractions/checkoutactions/setup-dotnetactions/setup-nodeactions/upload-artifactgithub/codeql-actionSupersedes #37, #38, #39, #40, #41, #47.
Held back — these were NOT safe in isolation
Dependabot proposed bumping the EF stack (#46
dotnet-ef, #48Microsoft.EntityFrameworkCore, #49Microsoft.EntityFrameworkCore.Design→ 10.0.9), and their checks were green. They are still wrong to take right now.The latest stable
Npgsql.EntityFrameworkCore.PostgreSQLis10.0.0(everything newer is an11.0.0preview), and it pinsMicrosoft.EntityFrameworkCore.Relationalto10.0.0. Bumping EF Core on its own skews the stack:main: 0MSB3277assembly-conflict warningsMSB3277warningsDependabot proposed each package in isolation and could not see the Npgsql pin. The EF stack moves in lockstep with Npgsql or not at all. Revisit when a stable Npgsql ships against EF 10.0.9+.
How it was verified
dotnet build QuizApp.sln→ 0 warnings, 0 errorsdotnet test→ 42 passed (27 Auth, 9 User, 6 Quiz)dotnet restoreconfirms the bumped versions actually resolve.Definition of done (from CLAUDE.md)
context/progress-log.mdentry — left out so this cannot conflict with the other in-flight PRs that edit the log; added in a follow-up.