[dependabot]

Updated cyclonedx from 6.2.0 to 6.3.0.

Release notes

Sourced from cyclonedx's releases.

6.3.0

Added

• NuGet purls for project references (#​1137, fixes #​1136): combining --set-nuget-purl with --include-project-references generates missing project purls. Existing purls and custom BOM references are preserved, and dependency edges use the final references.

Changed

• Development dependency scopes (#​1138): development dependencies and their development-only transitive dependencies are included by default with scope="excluded". Packages shared with production runtime use remain required.
• --exclude-dev is deprecated but continues to filter: it omits development-only and test-project-only packages while retaining packages shared with production runtime use.

Fixed

• Assembly-name resolution (#​1128, fixes #​917): resolve $(RootNamespace) in assembly names, including nested $(MSBuildProjectName) tokens. Missing, empty, or circular $(AssemblyName)-referencing namespaces fall back to the project filename. This is best-effort substitution, not full MSBuild evaluation.
• Exclusion filtering (#​1135, fixes #​1133): --exclude-filter removes only packages it newly orphans; pre-existing orphans are retained.
• Target-framework regression coverage (#​1131, fixes #​1126): verifies exclusion filtering for non-normalized target frameworks, including net48, netstandard2.0, Net8.0, and Windows-qualified TFMs. The underlying NuGet.ProjectModel 7.6.0 fix was already included in 6.2.1.

Contributors

Thanks to everyone who contributed code, tests, and issue reports to this release:

• @​MichaelKopfMkf — NuGet purls for project references (#​1137, #​1136).
• @​mtsfoni — development dependency scopes and compatible exclusion behavior (#​1138).
• @​uo-uhbc — exclusion-filter orphan handling fix and reproduction (#​1135, #​1133).
• @​mgnslndh — regression coverage for exclusion filtering on non-normalized target frameworks (#​1131).
• @​Eljees — root-namespace assembly-name resolution fix (#​1128).
• @​TobiDimmel — reported the assembly-name property resolution issue (#​917).
• @​jasonlhills — reported the exclusion-filter failure (#​1126).

🎉 New Contributors

A warm welcome and a big thank you to our first-time contributors:

• @​MichaelKopfMkf made their first contribution in #​1137.
• @​mgnslndh made their first contribution in #​1131.
• @​Eljees made their first contribution in #​1128.

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.1...v6.3.0

6.2.1

CycloneDX for .NET 6.2.1

This patch release fixes dependency resolution in multi-project solutions and hash computation for uncached NuGet packages.

Fixed

• Resolve dependency ranges with multiple matching package versions (#​1113, fixes #​1110) — solution scans no longer fail with Sequence contains more than one matching element when multiple merged package versions satisfy an unresolved NuGet dependency range. The BOM now retains a dependency edge to every matching component.
• Fix hash computation for uncached NuGet packages (#​1099) — reset the package stream before computing hashes when falling back to downloading an uncached .nupkg.

Changed

• Update .NET dependencies and CI tooling.
• Upgrade Testcontainers to 4.16.0 to resolve SSH.NET security advisories in the E2E test infrastructure. This is a test-infrastructure update, not a runtime dependency change to the CLI.

Documentation

• Add a best-practices guide covering root project targeting, restore-first workflows, and BOM metadata setup.

Contributors

Thanks to everyone who contributed to this release:

• @​LukasChristel — fix hash computation for uncached NuGet packages (#​1099).
• @​michael-eberhard-skidata — report and reproduction for the multi-version dependency range failure (#​1110).
• @​mtsfoni — dependency range resolution fix and regression coverage (#​1113).

Full changelog: CycloneDX/cyclonedx-dotnet@v6.2.0...v6.2.1

Commits viewable in compare view.

Updated FluentValidation from 12.1.1 to 12.2.0.

Release notes

Sourced from FluentValidation's releases.

12.2.0

Release notes

Please read the upgrade guide if you are moving from 11.x to 12.x

Changes in 12.2.0

• Add Lithuanian language (#​2350)
• Add Belarusian language (#​2356)
• Add GetParentChain() to PropertyChain (#​2358)
• Fix ArgumentNullException in TestValidationResult when a failure has a null PropertyName (#​2362)
• Reject an inverted range when the comparer returns a negative other than -1 in RangeValidator (#​2370)
• Change EnumValidator to work under native AOT (#​2371)
• Fix PropertyChain.IsChildChainOf for sibling chains that share a name prefix (#​2372)
• Fix PropertyPath is incorrect in .When() on RuleForEach (#​2363)

Changes in 12.1.0

• Add Tamil language (#​2334)
• Add Telugu language (#​2333)
• Fixes to Japanese translations (#​2340)

Changes in 12.0.0

• Drops support for netstandard2.0, netstandard2.1, .net 5, .net 6 and .net 7. Minimum supported platform is now .net 8.
• Add support for dependent rules for custom rules (#​2170)
• Removes deprecated DI extensions
• Removes deprecated transform methods (#​2027)
• Remove the ability to disable the root-model null check (#​2069)
• Use Zomp.SyncMethodGenerator to clean up internal sync/async code paths and increase performance (#​2136)
• Add Serbian (Cyrillic) language; rename existing Serbian to Serbian (Latin) (#​2283)

Downloads

Binaries can be downloaded from nuget:

• FluentValidation - Main package

Commits viewable in compare view.

Updated FluentValidation.DependencyInjectionExtensions from 12.1.1 to 12.2.0.

Release notes

Sourced from FluentValidation.DependencyInjectionExtensions's releases.

12.2.0

Release notes

Please read the upgrade guide if you are moving from 11.x to 12.x

Changes in 12.2.0

• Add Lithuanian language (#​2350)
• Add Belarusian language (#​2356)
• Add GetParentChain() to PropertyChain (#​2358)
• Fix ArgumentNullException in TestValidationResult when a failure has a null PropertyName (#​2362)
• Reject an inverted range when the comparer returns a negative other than -1 in RangeValidator (#​2370)
• Change EnumValidator to work under native AOT (#​2371)
• Fix PropertyChain.IsChildChainOf for sibling chains that share a name prefix (#​2372)
• Fix PropertyPath is incorrect in .When() on RuleForEach (#​2363)

Changes in 12.1.0

• Add Tamil language (#​2334)
• Add Telugu language (#​2333)
• Fixes to Japanese translations (#​2340)

Changes in 12.0.0

• Drops support for netstandard2.0, netstandard2.1, .net 5, .net 6 and .net 7. Minimum supported platform is now .net 8.
• Add support for dependent rules for custom rules (#​2170)
• Removes deprecated DI extensions
• Removes deprecated transform methods (#​2027)
• Remove the ability to disable the root-model null check (#​2069)
• Use Zomp.SyncMethodGenerator to clean up internal sync/async code paths and increase performance (#​2136)
• Add Serbian (Cyrillic) language; rename existing Serbian to Serbian (Latin) (#​2283)

Downloads

Binaries can be downloaded from nuget:

• FluentValidation - Main package

Commits viewable in compare view.

Updated Meziantou.Analyzer from 3.0.296 to 3.0.299.

Release notes

Sourced from Meziantou.Analyzer's releases.

3.0.299

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.299

What's Changed

• MA0031: do not suggest Skip(n).Any() when the value is not a constant by @​meziantou in MA0031: do not suggest Skip(n).Any() when the value is not a constant meziantou/Meziantou.Analyzer#1631
• chore(deps): update all dependencies by @​renovate[bot] in chore(deps): update all dependencies meziantou/Meziantou.Analyzer#1627

Full Changelog: meziantou/Meziantou.Analyzer@3.0.298...3.0.299

3.0.298

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.298

What's Changed

• chore(deps): update dependency meziantou.framework.roslyn to 1.2.1 by @​renovate[bot] in chore(deps): update dependency meziantou.framework.roslyn to 1.2.1 meziantou/Meziantou.Analyzer#1629

Full Changelog: meziantou/Meziantou.Analyzer@3.0.297...3.0.298

3.0.297

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.297

What's Changed

• Update Meziantou.NET.Sdk to 1.0.183 and use its SharedHttpClient by @​meziantou in Update Meziantou.NET.Sdk to 1.0.183 and use its SharedHttpClient meziantou/Meziantou.Analyzer#1628

Full Changelog: meziantou/Meziantou.Analyzer@3.0.296...3.0.297

Commits viewable in compare view.

Updated Microsoft.Testing.Extensions.CodeCoverage from 18.11.2 to 18.12.0.

Release notes

Sourced from Microsoft.Testing.Extensions.CodeCoverage's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated xunit.v3 from 4.0.1 to 4.0.2.

Release notes

Sourced from xunit.v3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

⛔ deps-audit : vulnérabilité(s) High/Critical détectée(s) — voir le log du job dotnet-audit de ce run. Corriger (bump/pin) ou documenter une exception datée via security/deps-review-TEMPLATE.md.