Bump the minor-and-patch group with 10 updates by dependabot[bot] · Pull Request #767 · KSAModding/Borea

dependabot · 2026-10-14T18:37:36Z

Updated Avalonia from 12.1.2 to 12.1.4.

Release notes

Sourced from Avalonia's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Avalonia.Desktop from 12.1.2 to 12.1.4.

Release notes

Sourced from Avalonia.Desktop's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Avalonia.Headless from 12.1.2 to 12.1.4.

Release notes

Sourced from Avalonia.Headless's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Avalonia.Themes.Fluent from 12.1.2 to 12.1.4.

Release notes

Sourced from Avalonia.Themes.Fluent's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated coverlet.collector from 10.0.1 to 10.1.0.

Release notes

Sourced from coverlet.collector's releases.

10.1.0

Improvements

Publish Microsoft.Testing.Platform coverage messages from coverlet.MTP #2019
Implement dynamic exclusion filters for assemblies (Coverlet.MTP) #1946
Replace legacy .sln files with modern .slnx format #1966
coverlet.console: add trace diagnostics and actionable warnings for instrumentation/hit/empty-result failures #2005
Relax auto-property skip logic and improve coverage for records #1941

Fixed

Fix coverlet.MTP does not collect coverage on the .NET Framework portion of a large project #1980 #1967
Fix Regression in branch coverage for lambda expressions #1938
Fix When using "is" with "or" in pattern matching, branch coverage is lower than normal #1979
Fix silent zero coverage on .NET Framework since 8.0.0 #1985 by @tobiwae
Fix Race condition between ProcessExit hit-file write and out-of-proc coverage read causes EndOfStreamException #1987 #1988 by @bkoelman
Fix Regression TypeInitializationException when targeting .NET Framework - Could not load type 'System.Collections.Concurrent.ConcurrentBag #2010
Fix use --config-file CLI arg in coverlet.MTP #2030 by alexthornton1
Fix silently empty coverage for shared-framework assemblies missing from compileLibraries #2032 by @Eljees

Diff between 10.0.1 and 10.1.0

Commits viewable in compare view.

Updated cyclonedx from 6.2.0 to 6.3.1.

Release notes

Sourced from cyclonedx's releases.

6.3.1 Fixed

Fixes a regression in 6.3.0 where Microsoft.ML.OnnxRuntime.Gpu and its managed/native dependencies were classified as development-only and removed by --exclude-dev (#1139, #1140).

Build-only runtime aggregation wrappers are now retained as Required when their restored dependency closure provides positive evidence in an allowed runtime-capable category. The refinement is target-local and preserves explicit development-only asset selections, standalone build-only/analyzer/tool filtering, test-only exclusion, and production runtime sharing.

Intentional limitation

Restored dependency graphs cannot distinguish every runtime wrapper from a build-tool wrapper with the same observable assets. Conservative retention may therefore also retain ambiguous build-tool closures. PrivateAssets controls propagation, not development intent, and alone does not guarantee exclusion. This is not an exact publish-output scanner.

Validation

Cross-platform .NET CI and Docker E2E tests pass. A real consumer referencing only Microsoft.ML.OnnxRuntime.Gpu 1.25.1 was also restored and published for linux-x64; native runtime loading and XML/JSON SBOM closure retention with --exclude-dev were verified. GPU inference was not tested.

Thanks

Thank you @wahyuen (Wah Yuen) for reporting the regression and providing the reproduction details!

Update

dotnet tool update --global CycloneDX --version 6.3.1

Docker image: cyclonedx/cyclonedx-dotnet:6.3.1 (also published as latest).

6.3.0 Added

NuGet purls for project references (#1137, fixes #1136): combining --set-nuget-purl with --include-project-references generates missing project purls. Existing purls and custom BOM references are preserved, and dependency edges use the final references.

Changed

Development dependency scopes (#1138): development dependencies and their development-only transitive dependencies are included by default with scope="excluded". Packages shared with production runtime use remain required.
--exclude-dev is deprecated but continues to filter: it omits development-only and test-project-only packages while retaining packages shared with production runtime use.

Fixed

Assembly-name resolution (#1128, fixes #917): resolve $(RootNamespace) in assembly names, including nested $(MSBuildProjectName) tokens. Missing, empty, or circular $(AssemblyName)-referencing namespaces fall back to the project filename. This is best-effort substitution, not full MSBuild evaluation.
Exclusion filtering (#1135, fixes #1133): --exclude-filter removes only packages it newly orphans; pre-existing orphans are retained.
Target-framework regression coverage (#1131, fixes #1126): verifies exclusion filtering for non-normalized target frameworks, including net48, netstandard2.0, Net8.0, and Windows-qualified TFMs. The underlying NuGet.ProjectModel 7.6.0 fix was already included in 6.2.1.

Contributors

Thanks to everyone who contributed code, tests, and issue reports to this release:

@MichaelKopfMkf — NuGet purls for project references (#1137, #1136).
@mtsfoni — development dependency scopes and compatible exclusion behavior (#1138).
@uo-uhbc — exclusion-filter orphan handling fix and reproduction (#1135, #1133).
@mgnslndh — regression coverage for exclusion filtering on non-normalized target frameworks (#1131).
@Eljees — root-namespace assembly-name resolution fix (#1128).
@TobiDimmel — reported the assembly-name property resolution issue (#917).
@jasonlhills — reported the exclusion-filter failure (#1126).

🎉 New Contributors

A warm welcome and a big thank you to our first-time contributors:

@MichaelKopfMkf made their first contribution in #1137.
@mgnslndh made their first contribution in #1131.
@Eljees made their first contribution in #1128.

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.1...v6.3.0

6.2.1 CycloneDX for .NET 6.2.1

This patch release fixes dependency resolution in multi-project solutions and hash computation for uncached NuGet packages.

Fixed

Resolve dependency ranges with multiple matching package versions (#1113, fixes #1110) — solution scans no longer fail with Sequence contains more than one matching element when multiple merged package versions satisfy an unresolved NuGet dependency range. The BOM now retains a dependency edge to every matching component.
Fix hash computation for uncached NuGet packages (#1099) — reset the package stream before computing hashes when falling back to downloading an uncached .nupkg.

Changed

Update .NET dependencies and CI tooling.
Upgrade Testcontainers to 4.16.0 to resolve SSH.NET security advisories in the E2E test infrastructure. This is a test-infrastructure update, not a runtime dependency change to the CLI.

Documentation

Add a best-practices guide covering root project targeting, restore-first workflows, and BOM metadata setup.

Contributors

Thanks to everyone who contributed to this release:

@LukasChristel — fix hash computation for uncached NuGet packages (#1099).
@michael-eberhard-skidata — report and reproduction for the multi-version dependency range failure (#1110).
@mtsfoni — dependency range resolution fix and regression coverage (#1113).

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.0...v6.2.1

Commits viewable in compare view.

Updated JsonSchema.Net from 9.4.0 to 9.4.1.

Release notes

Sourced from JsonSchema.Net's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.9.0 to 18.11.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.11.0 What's Changed

Fix TRX logger mangling astral-plane (non-BMP) characters by @azat-msft in Fix TRX logger mangling astral-plane (non-BMP) characters microsoft/vstest#16318
Disable the MTP testhost by default by @nohwnd in Disable the MTP testhost by default microsoft/vstest#16337
Fix OS-blind apphost probe in MTP bridge on Unix (regression from #16201) by @azat-msft in Fix OS-blind apphost probe in MTP bridge on Unix (regression from #16201) microsoft/vstest#16336
Retarget the MTP client onto Microsoft.Testing.Platform.ServerMode.Client.Sources by @nohwnd in Retarget the MTP client onto Microsoft.Testing.Platform.ServerMode.Client.Sources microsoft/vstest#16300
Pass arguments to PowerShell with -File instead of -command by @nohwnd in Pass arguments to PowerShell with -File instead of -command microsoft/vstest#16363
Respect console logger verbosity from a settings file by @nohwnd in Respect console logger verbosity from a settings file microsoft/vstest#16044
Fix backslash normalization in VSTestCLIRunSettings on Unix by @nohwnd in [fix] Fix backslash normalization in VSTestCLIRunSettings on Unix microsoft/vstest#15795
Docs: fix typo explicitely -> explicitly by @vaibhav8a in docs: fix typo explicitely -> explicitly microsoft/vstest#16397
Copy acceptance test diagnostic logs into the test results directory by @nohwnd in Copy acceptance test diagnostic logs into the test results directory microsoft/vstest#16403

New Contributors

@vaibhav8a made their first contribution in docs: fix typo explicitely -> explicitly microsoft/vstest#16397

Full Changelog: microsoft/vstest@v18.10.1...v18.11.0

18.10.1 What's Changed

Isolate code coverage files in published output by @azat-msft in [rel/18.10] Isolate code coverage files in published output microsoft/vstest#16476

Full Changelog: microsoft/vstest@v18.10.0...v18.10.1

18.10.0 What's Changed

Drop Mono fallback, run .NET Framework tests on Windows only by @nohwnd in Drop Mono fallback, run .NET Framework tests on Windows only microsoft/vstest#16158
Run Microsoft.Testing.Platform test apps under vstest.console and datacollector by @nohwnd in Run Microsoft.Testing.Platform test apps under vstest.console and datacollector microsoft/vstest#16201
Fix test output eaten by MSBuild terminal logger by @nohwnd in [fix] Fix test output eaten by MSBuild terminal logger microsoft/vstest#16223
Remove the experimental test session feature by @nohwnd in Remove the experimental test session feature microsoft/vstest#16231
Skip a single bad executor instead of failing all executor loading by @nohwnd in Skip a single bad executor instead of failing all executor loading microsoft/vstest#16239
Assert apartment state instead of using Clipboard in UI tests by @nohwnd in Assert apartment state instead of using Clipboard in UI tests microsoft/vstest#16270
Surface test host crashes during protocol negotiation by @nohwnd in Surface test host crashes during protocol negotiation microsoft/vstest#16285
Pass the inferred target platform to the host in run settings by @nohwnd in Pass the inferred target platform to the host in run settings microsoft/vstest#16271
Report raw invalid IsTargetPlatformInferred value, cover host x64 forcing by @nohwnd in Report raw invalid IsTargetPlatformInferred value, cover host x64 forcing microsoft/vstest#16295
Disable the MTP testhost by default (#16337) by @nohwnd in [rel/18.10] Disable the MTP testhost by default (#16337) microsoft/vstest#16341

Full Changelog: microsoft/vstest@v18.9.0...v18.10.0

Commits viewable in compare view.

Updated System.CommandLine from 2.0.11 to 2.0.13.

Release notes

Sourced from System.CommandLine's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 4.0.0 to 4.0.1.

Release notes

Sourced from xunit.runner.visualstudio's releases.

4.0.1

Release notes: https://xunit.net/releases/visualstudio/4.0.1

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

coveralls · 2026-10-16T12:17:01Z

Coverage Report for CI Build 38900790663

Coverage increased (+0.09%) to 88.836%

Details

Coverage increased (+0.09%) from the base build.
Patch coverage: No coverable lines changed in this PR.
2 coverage regressions across 1 file.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

2 previously-covered lines in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
src/Borea.Storage/Instances/FileInstanceSizeReader.cs	2	92.11%

Coverage Stats


Relevant Lines:	43666
Covered Lines:	40307
Line Coverage:	92.31%
Relevant Branches:	23486
Covered Branches:	19348
Branch Coverage:	82.38%
Branches in Coverage %:	Yes
Coverage Strength:	5819.63 hits per line

💛 - Coveralls

Bumps Avalonia from 12.1.2 to 12.1.4 Bumps Avalonia.Desktop from 12.1.2 to 12.1.4 Bumps Avalonia.Headless from 12.1.2 to 12.1.4 Bumps Avalonia.Themes.Fluent from 12.1.2 to 12.1.4 Bumps coverlet.collector from 10.0.1 to 10.1.0 Bumps cyclonedx from 6.2.0 to 6.3.1 Bumps JsonSchema.Net from 9.4.0 to 9.4.1 Bumps Microsoft.NET.Test.Sdk from 18.9.0 to 18.11.0 Bumps System.CommandLine from 2.0.11 to 2.0.13 Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1 --- updated-dependencies: - dependency-name: Avalonia dependency-version: 12.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Avalonia.Desktop dependency-version: 12.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Avalonia.Headless dependency-version: 12.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Avalonia.Themes.Fluent dependency-version: 12.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: coverlet.collector dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: coverlet.collector dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: coverlet.collector dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: coverlet.collector dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: coverlet.collector dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: coverlet.collector dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: cyclonedx dependency-version: 6.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: JsonSchema.Net dependency-version: 9.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: System.CommandLine dependency-version: 2.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Oct 14, 2026

github-project-automation Bot added this to Borea Oct 14, 2026

github-project-automation Bot moved this to Backlog in Borea Oct 14, 2026

dependabot Bot and others added 2 commits October 16, 2026 14:28

Pin the hash of the CycloneDX 6.3.1 tool package

9bb7883

Maximilian-Nesslauer force-pushed the dependabot/nuget/dot-config/minor-and-patch-b9a99951a9 branch from 8df4935 to 9bb7883 Compare October 16, 2026 12:28

Maximilian-Nesslauer approved these changes Oct 16, 2026

View reviewed changes

github-project-automation Bot moved this from Backlog to In review in Borea Oct 16, 2026

Maximilian-Nesslauer merged commit 5f97dee into main Oct 16, 2026
12 checks passed

Maximilian-Nesslauer deleted the dependabot/nuget/dot-config/minor-and-patch-b9a99951a9 branch October 16, 2026 12:37

github-project-automation Bot moved this from In review to Done in Borea Oct 16, 2026

Navigation Menu

Repository navigation

Bump the minor-and-patch group with 10 updates - #767

Bump the minor-and-patch group with 10 updates#767
Maximilian-Nesslauer merged 2 commits into
mainfrom
dependabot/nuget/dot-config/minor-and-patch-b9a99951a9

dependabot Bot commented on behalf of github Oct 14, 2026

Uh oh!

coveralls commented Oct 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026

10.1.0

Improvements

Fixed

6.3.1

Fixed

Intentional limitation

Validation

Thanks

Update

6.3.0

Added

Changed

Fixed

Contributors

🎉 New Contributors

6.2.1

CycloneDX for .NET 6.2.1

Fixed

Changed

Documentation

Contributors

18.11.0

What's Changed

New Contributors

18.10.1

What's Changed

18.10.0

What's Changed

4.0.1

Uh oh!

coveralls commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 38900790663

Coverage increased (+0.09%) to 88.836%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coveralls commented Oct 16, 2026 •

edited

Loading