Skip to content

Bump the dotnet-dependencies group with 14 updates - #623

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/dotnet-dependencies-edf1e7fbf5
Closed

Bump the dotnet-dependencies group with 14 updates#623
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/dotnet-dependencies-edf1e7fbf5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Updated coverlet.collector from 10.0.1 to 10.1.0.

Release notes

Sourced from coverlet.collector's releases.

10.1.0

Improvements

  • Publish Microsoft.Testing.Platform coverage messages from coverlet.MTP #​2019
  • Implement dynamic exclusion filters for assemblies (Coverlet.MTP) #​1946
  • Replace legacy .sln files with modern .slnx format #​1966
  • coverlet.console: add trace diagnostics and actionable warnings for instrumentation/hit/empty-result failures #​2005
  • Relax auto-property skip logic and improve coverage for records #​1941

Fixed

  • Fix coverlet.MTP does not collect coverage on the .NET Framework portion of a large project #​1980 #​1967
  • Fix Regression in branch coverage for lambda expressions #​1938
  • Fix When using "is" with "or" in pattern matching, branch coverage is lower than normal #​1979
  • Fix silent zero coverage on .NET Framework since 8.0.0 #​1985 by @​tobiwae
  • Fix Race condition between ProcessExit hit-file write and out-of-proc coverage read causes EndOfStreamException #​1987 #​1988 by @​bkoelman
  • Fix Regression TypeInitializationException when targeting .NET Framework - Could not load type 'System.Collections.Concurrent.ConcurrentBag #​2010
  • Fix use --config-file CLI arg in coverlet.MTP #​2030 by alexthornton1
  • Fix silently empty coverage for shared-framework assemblies missing from compileLibraries #​2032 by @​Eljees

Diff between 10.0.1 and 10.1.0

Commits viewable in compare view.

Updated CsCheck from 4.9.1 to 5.0.0.

Release notes

Sourced from CsCheck's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated cyclonedx from 6.2.0 to 6.3.1.

Release notes

Sourced from cyclonedx's releases.

6.3.1

Fixed

Fixes a regression in 6.3.0 where Microsoft.ML.OnnxRuntime.Gpu and its managed/native dependencies were classified as development-only and removed by --exclude-dev (#​1139, #​1140).

Build-only runtime aggregation wrappers are now retained as Required when their restored dependency closure provides positive evidence in an allowed runtime-capable category. The refinement is target-local and preserves explicit development-only asset selections, standalone build-only/analyzer/tool filtering, test-only exclusion, and production runtime sharing.

Intentional limitation

Restored dependency graphs cannot distinguish every runtime wrapper from a build-tool wrapper with the same observable assets. Conservative retention may therefore also retain ambiguous build-tool closures. PrivateAssets controls propagation, not development intent, and alone does not guarantee exclusion. This is not an exact publish-output scanner.

Validation

Cross-platform .NET CI and Docker E2E tests pass. A real consumer referencing only Microsoft.ML.OnnxRuntime.Gpu 1.25.1 was also restored and published for linux-x64; native runtime loading and XML/JSON SBOM closure retention with --exclude-dev were verified. GPU inference was not tested.

Thanks

Thank you @​wahyuen (Wah Yuen) for reporting the regression and providing the reproduction details!

Update

dotnet tool update --global CycloneDX --version 6.3.1

Docker image: cyclonedx/cyclonedx-dotnet:6.3.1 (also published as latest).

6.3.0

Added

  • NuGet purls for project references (#​1137, fixes #​1136): combining --set-nuget-purl with --include-project-references generates missing project purls. Existing purls and custom BOM references are preserved, and dependency edges use the final references.

Changed

  • Development dependency scopes (#​1138): development dependencies and their development-only transitive dependencies are included by default with scope="excluded". Packages shared with production runtime use remain required.
  • --exclude-dev is deprecated but continues to filter: it omits development-only and test-project-only packages while retaining packages shared with production runtime use.

Fixed

  • Assembly-name resolution (#​1128, fixes #​917): resolve $(RootNamespace) in assembly names, including nested $(MSBuildProjectName) tokens. Missing, empty, or circular $(AssemblyName)-referencing namespaces fall back to the project filename. This is best-effort substitution, not full MSBuild evaluation.
  • Exclusion filtering (#​1135, fixes #​1133): --exclude-filter removes only packages it newly orphans; pre-existing orphans are retained.
  • Target-framework regression coverage (#​1131, fixes #​1126): verifies exclusion filtering for non-normalized target frameworks, including net48, netstandard2.0, Net8.0, and Windows-qualified TFMs. The underlying NuGet.ProjectModel 7.6.0 fix was already included in 6.2.1.

Contributors

Thanks to everyone who contributed code, tests, and issue reports to this release:

  • @​MichaelKopfMkf — NuGet purls for project references (#​1137, #​1136).
  • @​mtsfoni — development dependency scopes and compatible exclusion behavior (#​1138).
  • @​uo-uhbc — exclusion-filter orphan handling fix and reproduction (#​1135, #​1133).
  • @​mgnslndh — regression coverage for exclusion filtering on non-normalized target frameworks (#​1131).
  • @​Eljees — root-namespace assembly-name resolution fix (#​1128).
  • @​TobiDimmel — reported the assembly-name property resolution issue (#​917).
  • @​jasonlhills — reported the exclusion-filter failure (#​1126).

🎉 New Contributors

A warm welcome and a big thank you to our first-time contributors:

  • @​MichaelKopfMkf made their first contribution in #​1137.
  • @​mgnslndh made their first contribution in #​1131.
  • @​Eljees made their first contribution in #​1128.

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.1...v6.3.0

6.2.1

CycloneDX for .NET 6.2.1

This patch release fixes dependency resolution in multi-project solutions and hash computation for uncached NuGet packages.

Fixed

  • Resolve dependency ranges with multiple matching package versions (#​1113, fixes #​1110) — solution scans no longer fail with Sequence contains more than one matching element when multiple merged package versions satisfy an unresolved NuGet dependency range. The BOM now retains a dependency edge to every matching component.
  • Fix hash computation for uncached NuGet packages (#​1099) — reset the package stream before computing hashes when falling back to downloading an uncached .nupkg.

Changed

  • Update .NET dependencies and CI tooling.
  • Upgrade Testcontainers to 4.16.0 to resolve SSH.NET security advisories in the E2E test infrastructure. This is a test-infrastructure update, not a runtime dependency change to the CLI.

Documentation

  • Add a best-practices guide covering root project targeting, restore-first workflows, and BOM metadata setup.

Contributors

Thanks to everyone who contributed to this release:

  • @​LukasChristel — fix hash computation for uncached NuGet packages (#​1099).
  • @​michael-eberhard-skidata — report and reproduction for the multi-version dependency range failure (#​1110).
  • @​mtsfoni — dependency range resolution fix and regression coverage (#​1113).

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.0...v6.2.1

Commits viewable in compare view.

Updated dotnet-reportgenerator-globaltool from 5.5.11 to 5.5.12.

Release notes

Sourced from dotnet-reportgenerator-globaltool's releases.

5.5.12

Changes:

  • #​790 Allow a custom file reader for the source files when generating a report (contributed by @​jeremy-morren)

This release requires .NET Framework 4.7 or .NET 8.0/9.0/10.0

Commits viewable in compare view.

Updated jetbrains.resharper.globaltools from 2026.2.3.1 to 2026.2.4.

Updated Meziantou.Analyzer from 3.0.296 to 3.0.318.

Release notes

Sourced from Meziantou.Analyzer's releases.

3.0.318

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.318

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.317...3.0.318

3.0.317

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.317

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.316...3.0.317

3.0.316

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.316

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.315...3.0.316

3.0.315

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.315

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.314...3.0.315

3.0.314

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.314

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.313...3.0.314

3.0.313

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.313

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.312...3.0.313

3.0.312

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.312

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.311...3.0.312

3.0.311

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.311

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.310...3.0.311

3.0.310

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.310

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.309...3.0.310

3.0.309

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.309

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.308...3.0.309

3.0.308

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.308

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.307...3.0.308

3.0.307

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.307

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.306...3.0.307

3.0.306

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.306

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.305...3.0.306

3.0.305

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.305

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.304...3.0.305

3.0.304

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.304

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.303...3.0.304

3.0.303

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.303

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.302...3.0.303

3.0.302

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.302

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.301...3.0.302

3.0.301

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.301

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.300...3.0.301

3.0.300

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.300

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.299...3.0.300

3.0.299

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.299

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.298...3.0.299

3.0.298

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.298

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.297...3.0.298

3.0.297

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.297

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.296...3.0.297

Commits viewable in compare view.

Updated Microsoft.Bcl.AsyncInterfaces from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Bcl.AsyncInterfaces's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.SourceLink.GitHub from 10.0.401 to 10.0.403.

Release notes

Sourced from Microsoft.SourceLink.GitHub's releases.

10.0.403

You can build .NET 10.0 from the repository by cloning the release tag v10.0.403 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

10.0.402

You can build .NET 10.0 from the repository by cloning the release tag v10.0.402 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Commits viewable in compare view.

Updated Microsoft.VisualStudio.Threading.Analyzers from 18.7.23 to 18.12.1.

Release notes

Sourced from Microsoft.VisualStudio.Threading.Analyzers's releases.

18.12.1

Analyzer Fixes

Library Enhancements

Doc fixes

New Contributors

Full Changelog: microsoft/vs-threading@v18.7.23...v18.12.1

Commits viewable in compare view.

Updated System.Diagnostics.DiagnosticSource from 10.0.12 to 10.0.14.

Release notes

Sourced from System.Diagnostics.DiagnosticSource's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Wolfgang.Etl.Abstractions from 0.26.0 to 0.26.1.

Release notes

Sourced from Wolfgang.Etl.Abstractions's releases.

0.26.1

What's Changed

Full Changelog: Chris-Wolfgang/ETL-Abstractions@v0.26.0...v0.26.1

Commits viewable in compare view.

Updated Wolfgang.Etl.TestKit from 0.26.0 to 0.26.1.

Release notes

Sourced from Wolfgang.Etl.TestKit's releases.

0.26.1

What's Changed

Full Changelog: Chris-Wolfgang/ETL-Abstractions@v0.26.0...v0.26.1

Commits viewable in compare view.

Updated Wolfgang.Etl.TestKit.Xunit from 0.26.0 to 0.26.1.

Release notes

Sourced from Wolfgang.Etl.TestKit.Xunit's releases.

0.26.1

What's Changed

Full Changelog: Chris-Wolfgang/ETL-Abstractions@v0.26.0...v0.26.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dotnet-dependencies group with 14 updates
a0ff70c 
Bumps coverlet.collector from 10.0.1 to 10.1.0
Bumps CsCheck from 4.9.1 to 5.0.0
Bumps cyclonedx from 6.2.0 to 6.3.1
Bumps dotnet-reportgenerator-globaltool from 5.5.11 to 5.5.12
Bumps jetbrains.resharper.globaltools from 2026.2.3.1 to 2026.2.4
Bumps Meziantou.Analyzer from 3.0.296 to 3.0.318
Bumps Microsoft.Bcl.AsyncInterfaces from 10.0.12 to 10.0.14
Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.12 to 10.0.14
Bumps Microsoft.SourceLink.GitHub from 10.0.401 to 10.0.403
Bumps Microsoft.VisualStudio.Threading.Analyzers from 18.7.23 to 18.12.1
Bumps System.Diagnostics.DiagnosticSource from 10.0.12 to 10.0.14
Bumps Wolfgang.Etl.Abstractions from 0.26.0 to 0.26.1
Bumps Wolfgang.Etl.TestKit from 0.26.0 to 0.26.1
Bumps Wolfgang.Etl.TestKit.Xunit from 0.26.0 to 0.26.1

---
updated-dependencies:
- dependency-name: coverlet.collector
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-dependencies
- dependency-name: coverlet.collector
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-dependencies
- dependency-name: coverlet.collector
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-dependencies
- dependency-name: CsCheck
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet-dependencies
- dependency-name: cyclonedx
  dependency-version: 6.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-dependencies
- dependency-name: dotnet-reportgenerator-globaltool
  dependency-version: 5.5.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: jetbrains.resharper.globaltools
  dependency-version: 2026.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Meziantou.Analyzer
  dependency-version: 3.0.318
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.Bcl.AsyncInterfaces
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.Bcl.AsyncInterfaces
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.SourceLink.GitHub
  dependency-version: 10.0.403
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Microsoft.VisualStudio.Threading.Analyzers
  dependency-version: 18.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-dependencies
- dependency-name: System.Diagnostics.DiagnosticSource
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Wolfgang.Etl.Abstractions
  dependency-version: 0.26.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Wolfgang.Etl.TestKit
  dependency-version: 0.26.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Wolfgang.Etl.TestKit
  dependency-version: 0.26.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Wolfgang.Etl.TestKit
  dependency-version: 0.26.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
- dependency-name: Wolfgang.Etl.TestKit.Xunit
  dependency-version: 0.26.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 30, 2026
@dependabot
dependabot Bot requested a review from Chris-Wolfgang as a code owner October 30, 2026 21:22
This was referenced Oct 31, 2026
Merged
Merged
@Chris-Wolfgang

Chris-Wolfgang commented Oct 31, 2026

Copy link
Copy Markdown
Owner

Superseded by #625 (csproj + .config/dotnet-tools.json bumps) and #626 (Directory.Build.props analyzer/SourceLink bumps, a protected file, so split into its own PR), stacked on #624. Together they carry all 14 updates at the same versions as this PR.

Evidence (local, Windows, heads dccab54 / 531cadf): scripts/build-pr.ps1 -TestCoverageThreshold 93 on #625 passed (786/786 tests including Tests.Fuzz on CsCheck 5.0.0, line 99.2%, gate passed, DevSkim + gitleaks clean); dotnet build -c Release --no-incremental on #626 with the new analyzers: 0 errors, only the pre-existing CS0618 in examples/Metrics.

Left open (the burn-down run never closes PRs): close this by hand once #625 and #626 merge.

🤖 Generated with Claude Code

@Chris-Wolfgang Chris-Wolfgang mentioned this pull request Nov 2, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

Chris-Wolfgang added a commit that referenced this pull request Nov 2, 2026
@Chris-Wolfgang @claude
build(deps): NuGet package bumps in the csproj files (supersedes #623,…
612c442 
… part 1 of 3) (#625)

* build(deps): NuGet package and local-tool bumps from #623 (non-protected files)

Every csproj / dotnet-tools.json bump from Dependabot #623:
- Microsoft.Extensions.Logging.Abstractions, System.Diagnostics.DiagnosticSource,
  Microsoft.Bcl.AsyncInterfaces 10.0.12 -> 10.0.14 (src, Tests.Unit)
- Wolfgang.Etl.Abstractions 0.26.0 -> 0.26.1 (src)
- Wolfgang.Etl.TestKit / TestKit.Xunit 0.26.0 -> 0.26.1 (Tests.Unit, examples)
- coverlet.collector 10.0.1 -> 10.1.0 (Concurrency, Fuzz, Snapshot)
- CsCheck 4.9.1 -> 5.0.0 (Fuzz)
- cyclonedx 6.2.0 -> 6.3.1, jetbrains.resharper.globaltools 2026.2.3.1 -> 2026.2.4,
  dotnet-reportgenerator-globaltool 5.5.11 -> 5.5.12 (local tools)

The Directory.Build.props analyzer bumps go in their own protected-file PR.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* build(deps): move the local-tool bumps out of this PR

.config/dotnet-tools.json is on the Protected Files Guard list, so a PR that
changes it alongside the csproj bumps fails the guard as a mixed PR. The tool
bumps (CycloneDX 6.3.1, ReSharper GlobalTools 2026.2.4, ReportGenerator 5.5.12)
move to their own PR stacked directly above this one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Chris-Wolfgang added a commit that referenced this pull request Nov 2, 2026
@Chris-Wolfgang @claude
build(deps): local-tool bumps (supersedes #623, protected half) (#631)
dca6b36 
From Dependabot #623, the .config/dotnet-tools.json part:
- CycloneDX 6.2.0 -> 6.3.1
- JetBrains.ReSharper.GlobalTools 2026.2.3.1 -> 2026.2.4
- dotnet-reportgenerator-globaltool 5.5.11 -> 5.5.12

Split out of the NuGet package PR because the Protected Files Guard fails a
PR that mixes this file with non-protected files.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Chris-Wolfgang added a commit that referenced this pull request Nov 2, 2026
@Chris-Wolfgang @claude
build(deps): analyzer and SourceLink bumps from #623 (Directory.Build…
0cfca51 
….props) (#626)

- Microsoft.VisualStudio.Threading.Analyzers 18.7.23 -> 18.12.1
- Meziantou.Analyzer 3.0.296 -> 3.0.318
- Microsoft.SourceLink.GitHub 10.0.401 -> 10.0.403

Protected file, so its own PR (completes the supersede of #623).

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
@dependabot
dependabot Bot deleted the dependabot/nuget/dot-config/dotnet-dependencies-edf1e7fbf5 branch November 2, 2026 18:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Chris-Wolfgang Chris-Wolfgang Awaiting requested review from Chris-Wolfgang Chris-Wolfgang is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Chris-Wolfgang