Skip to content

Bump the tests group with 5 updates#260

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/src/DNTCommon.Web.Core/tests-cfcab8d5c1
Closed

Bump the tests group with 5 updates#260
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/src/DNTCommon.Web.Core/tests-cfcab8d5c1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated CancelCop.Analyzer from 1.4.2 to 1.4.8.

Release notes

Sourced from CancelCop.Analyzer's releases.

1.4.8

Rule-catalog trust contract

  • New RuleCatalogTests drift guards: every shipped descriptor must have a README rule-table row (correct severity + fix mark), be tracked in AnalyzerReleases.Shipped.md with matching severity, and every exported code-fix provider must target a shipped rule. A rule can no longer be added, renamed, or re-severitied without the public docs following.

Full test suite: 205 passed on CI (5 new drift guards this release). No analyzer behavior changes.

See CHANGELOG.md and docs/ANALYZER_HEALTH.md.

1.4.7

Internal refactor: shared token-propagation pipeline

  • The triplicated tail of CC002/CC003/CC004 (token-argument check → scope walk → expression-tree guard → overload check → diagnostic construction) is now a single CancellationTokenHelpers.ReportIfTokenNotPropagated. Each analyzer is rule-specific gating plus one call.
  • No behavior change — all 200 tests pass unchanged (verified via CI).

See CHANGELOG.md and docs/ANALYZER_HEALTH.md.

1.4.6

Named-argument-safe code fixes (CC002/CC003/CC004)

  • The token-insertion fixes no longer produce CS8323 on calls using out-of-position named arguments: when any existing argument is named, the fix appends a named token argument (cancellationToken: ct) using the target overload''s declared parameter name, carried in new TokenArgumentName diagnostic metadata. Positional calls keep positional fixes.
  • The overload-name lookup prefers the overload the fixed call will actually bind to (matching non-token parameters by type, then count), so inconsistently-named token parameters across overloads cannot produce CS1739.

Verified via CI (build-and-test, 200 tests passing); local test execution is currently blocked by Windows Smart App Control on the dev machine (see docs/ANALYZER_HEALTH.md).

See CHANGELOG.md.

1.4.5

Token scope: constructors and primary constructors

  • The shared token-scope walk (CC002/CC003/CC004/CC009) now finds CancellationToken parameters declared on constructors and C# 12 primary constructors (classes and records), including capture from instance methods, instance field initializers, and partial-type parts whose primary constructor is declared elsewhere.
  • Conservative where capture is illegal: static members, static field and event-field initializers, non-primary constructor bodies (CS9105), and operators never see the primary-constructor token; the first containing type ends the search.
  • CC002/CC009 rule docs updated to match the widened scope.

Full test suite: 196 passed, 0 failed (12 new tests this release).

See CHANGELOG.md and docs/ANALYZER_HEALTH.md.

1.4.4

CC005C: method-group Minimal API handlers

  • CC005C now analyses method-group handlers — app.MapGet("/users", GetUsersAsync), UserHandlers.Get, Handler<T>, (Handler), and local-function method groups — flagging the referenced method when it is async-shaped without a CancellationToken parameter.
  • Code fix adds CancellationToken cancellationToken = default to the referenced method or local function (same-document only; = default keeps other call sites compiling).
  • Conservative guards: synchronous handlers, delegate variables, handler.Invoke, metadata-declared methods, ambiguous method groups, and externally-controlled signatures stay quiet. Virtual/abstract and partial handlers report but get no automatic fix (the rewrite would not compile — CS0115/CS8795).
  • The lambda fix now matches the diagnostic span exactly, so it can never patch an unrelated enclosing lambda. Fix All on routes sharing one handler inserts the parameter exactly once.

Full test suite: 184 passed, 0 failed (16 new tests this release).

See CHANGELOG.md and docs/ANALYZER_HEALTH.md.

1.4.3

CC003/CC004: token detection inside local functions and lambdas

  • CC003 (EF Core) and CC004 (HttpClient) now find the available CancellationToken with the same scope walk as CC002/CC009 — the nearest enclosing local function, lambda, or method that declares (or captures) a token. Previously a matching call inside a local function or lambda owning its own token was silently missed.
  • Both rules gained the expression-tree guard: calls inside Expression<TDelegate> lambdas are never flagged (the token cannot be propagated there).
  • The shared scope walk now stops at tokenless static lambdas / static local functions — the outer token is not capturable (CS8820/CS8421), so suggesting it was a false positive with a non-compiling fix (affected CC002/CC009 since v1.4.2; caught in review before shipping for CC003/CC004).
  • The walk now also recognises anonymous methods (async delegate (CancellationToken ct) { … }), previously a silent false negative for all four propagation rules.

Full test suite: 168 passed, 0 failed (14 new tests this release).

See CHANGELOG.md and docs/ANALYZER_HEALTH.md.

Commits viewable in compare view.

Updated DependencyInjection.Lifetime.Analyzers from 2.9.0 to 2.10.4.

Release notes

Sourced from DependencyInjection.Lifetime.Analyzers's releases.

2.10.4

DependencyInjection.Lifetime.Analyzers 2.10.4

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI020 explicit-argument false positive: a scoped-typed constructor parameter satisfied by an explicit UseMiddleware argument (app.UseMiddleware<MyMiddleware>(preBuilt) / app.UseMiddleware(typeof(MyMiddleware), preBuilt)) was still reported, even though ActivatorUtilities binds the supplied argument and never resolves that parameter from the container. Constructor selection now threads its argument-fill map through to reporting; a parameter explicitly supplied at every registration site stays quiet, while one unfilled site still reports.
  • DI020 conditional-access registration: app?.UseMiddleware<MyMiddleware>() on builder-typed instance members is now recognized (the receiver resolves through the enclosing conditional access). Extension-method registrations already worked through the reduced-method parameter type and are now pinned by tests.
  • DI020 audit-gap coverage: the 2026-06-10 health re-audit's untested paths are now all covered — non-generic UseMiddleware(typeof(T)) (positive and explicit-argument-suppressed), keyed scoped dependencies ([FromKeyedServices] reporting on key match, silent for a different-key singleton), IEndpointRouteBuilder registrations, and the extension-method (ReducedFrom) receiver path.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.10.4

What changed

Fixed

  • DI020 explicit-argument false positive: a scoped-typed constructor parameter satisfied by an explicit UseMiddleware argument (app.UseMiddleware<MyMiddleware>(preBuilt) / app.UseMiddleware(typeof(MyMiddleware), preBuilt)) was still reported, even though ActivatorUtilities binds the supplied argument and never resolves that parameter from the container. Constructor selection now threads its argument-fill map through to reporting; a parameter explicitly supplied at every registration site stays quiet, while one unfilled site still reports.

Added

  • DI020 conditional-access registration: app?.UseMiddleware<MyMiddleware>() on builder-typed instance members is now recognized (the receiver resolves through the enclosing conditional access). Extension-method registrations already worked through the reduced-method parameter type and are now pinned by tests.
  • DI020 audit-gap coverage: the 2026-06-10 health re-audit's untested paths are now all covered — non-generic UseMiddleware(typeof(T)) (positive and explicit-argument-suppressed), keyed scoped dependencies ([FromKeyedServices] reporting on key match, silent for a different-key singleton), IEndpointRouteBuilder registrations, and the extension-method (ReducedFrom) receiver path.

Learn more

2.10.3

DependencyInjection.Lifetime.Analyzers 2.10.3

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI002 collection and event-subscription escape sinks: scoped services now report when they escape through mutation of a field/property-held container (_cache.Add(service), _cache.Insert(...), Enqueue, Push, TryAdd — both for tracked locals and direct resolutions passed as arguments) and when a handler bound to the scoped service is subscribed to an event whose owner outlives the scope (_publisher.Changed += service.Handle, captured-delegate subscriptions, method-group delegate locals (EventHandler h = service.Handle;), static events, and events on the enclosing instance). Method groups on tracked service locals participate in delegate-capture tracking generally, so they also report through the existing field/property/ref-out/return delegate sinks. Mutation matching requires the resolved method to return void/bool/int (real mutator signatures) and the receiver type to actually be a collection (implement IEnumerable), so value-returning shapes — ImmutableList.Add, fluent builders — and ordinary field-held objects with Insert/Add-style methods (repositories persisting data) stay quiet; conditional-access mutations (_cache?.Add(service)) are recognized through the enclosing conditional access. The new sinks require the resolution to precede the sink in document order (a local reassigned to a scoped resolution after the Add/subscription escaped its previous value, not the scoped one), method-group recognition gates on the member actually being a method (delegate-valued properties returning static handlers stay quiet) and on the resolution preceding the conversion site (method groups bind their receiver at conversion time), and event receivers are classified by the root of the access chain, so wrapper.Publisher.Changed with a scope-local wrapper stays quiet while field/property/parameter/static roots report. Local containers and scope-local publishers stay quiet too — they live and die with the scope. Indexer assignment to a field dictionary (_byTenant[key] = service) was already detected through the indexer property symbol and is now pinned by a regression test. These were the two highest-frequency real-world escape shapes missing from the sink table per the 2026-06-10 health re-audit.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.10.3

What changed

Added

  • DI002 collection and event-subscription escape sinks: scoped services now report when they escape through mutation of a field/property-held container (_cache.Add(service), _cache.Insert(...), Enqueue, Push, TryAdd — both for tracked locals and direct resolutions passed as arguments) and when a handler bound to the scoped service is subscribed to an event whose owner outlives the scope (_publisher.Changed += service.Handle, captured-delegate subscriptions, method-group delegate locals (EventHandler h = service.Handle;), static events, and events on the enclosing instance). Method groups on tracked service locals participate in delegate-capture tracking generally, so they also report through the existing field/property/ref-out/return delegate sinks. Mutation matching requires the resolved method to return void/bool/int (real mutator signatures) and the receiver type to actually be a collection (implement IEnumerable), so value-returning shapes — ImmutableList.Add, fluent builders — and ordinary field-held objects with Insert/Add-style methods (repositories persisting data) stay quiet; conditional-access mutations (_cache?.Add(service)) are recognized through the enclosing conditional access. The new sinks require the resolution to precede the sink in document order (a local reassigned to a scoped resolution after the Add/subscription escaped its previous value, not the scoped one), method-group recognition gates on the member actually being a method (delegate-valued properties returning static handlers stay quiet) and on the resolution preceding the conversion site (method groups bind their receiver at conversion time), and event receivers are classified by the root of the access chain, so wrapper.Publisher.Changed with a scope-local wrapper stays quiet while field/property/parameter/static roots report. Local containers and scope-local publishers stay quiet too — they live and die with the scope. Indexer assignment to a field dictionary (_byTenant[key] = service) was already detected through the indexer property symbol and is now pinned by a regression test. These were the two highest-frequency real-world escape shapes missing from the sink table per the 2026-06-10 health re-audit.

Learn more

2.10.2

DependencyInjection.Lifetime.Analyzers 2.10.2

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI021/DI022 cross-method knob proofs (same-tree helper methods): concurrency-knob evaluation now follows options built by helper methods — var options = CreateOptions(); or client.CreateProcessor("q", CreateOptions()) where the helper is non-virtual, singly-declared, and in the same file. A helper that provably returns a fresh creation with MaxConcurrentCalls = 8 upgrades the config-gated DI022 Info to the DI021 warning; one that pins the knob to 1 silences the sink (the fresh creation is instance-correlated by construction). Supported helper shapes: expression-bodied => new Options {...}, a single return new Options {...};, and a single returned local initialized with a creation (collecting its in-helper member writes). Stale proofs are invalidated: reassigning the options local from another helper re-derives the proof from the replacement, a fresh-creation replacement discards every value collected for the discarded instance (a stale MaxDegreeOfParallelism = 1 can no longer silence a default-unlimited ParallelOptions), opaque reassignments make the knob unprovable, writes inside nested lambdas/local functions poison sequential proofs as unknown candidates (without erasing construction-time concurrent constants, and regardless of where the nested function is declared — declaration position says nothing about execution order), and writes or reassignments after the sink consumed the options (the SDK snapshots values at the creation call) are ignored as later variable reuse. Virtual/overridable helpers, parameter-driven knob values, multiple returns, and shared-instance returns likewise stay unproven (DI022) — reducing the Info-tier noise the health doc watchlists without weakening the instance-correlation principle. Applies to ServiceBus processor options and ParallelOptions alike.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.10.2

What changed

Changed

  • DI021/DI022 cross-method knob proofs (same-tree helper methods): concurrency-knob evaluation now follows options built by helper methods — var options = CreateOptions(); or client.CreateProcessor("q", CreateOptions()) where the helper is non-virtual, singly-declared, and in the same file. A helper that provably returns a fresh creation with MaxConcurrentCalls = 8 upgrades the config-gated DI022 Info to the DI021 warning; one that pins the knob to 1 silences the sink (the fresh creation is instance-correlated by construction). Supported helper shapes: expression-bodied => new Options {...}, a single return new Options {...};, and a single returned local initialized with a creation (collecting its in-helper member writes). Stale proofs are invalidated: reassigning the options local from another helper re-derives the proof from the replacement, a fresh-creation replacement discards every value collected for the discarded instance (a stale MaxDegreeOfParallelism = 1 can no longer silence a default-unlimited ParallelOptions), opaque reassignments make the knob unprovable, writes inside nested lambdas/local functions poison sequential proofs as unknown candidates (without erasing construction-time concurrent constants, and regardless of where the nested function is declared — declaration position says nothing about execution order), and writes or reassignments after the sink consumed the options (the SDK snapshots values at the creation call) are ignored as later variable reuse. Virtual/overridable helpers, parameter-driven knob values, multiple returns, and shared-instance returns likewise stay unproven (DI022) — reducing the Info-tier noise the health doc watchlists without weakening the instance-correlation principle. Applies to ServiceBus processor options and ParallelOptions alike.

Learn more

2.10.1

DependencyInjection.Lifetime.Analyzers 2.10.1

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI021/DI022 RabbitMQ consumer sinks: EventingBasicConsumer.Received (v6 sync), AsyncEventingBasicConsumer.Received (v6 async), and AsyncEventingBasicConsumer.ReceivedAsync (v7) handlers now participate in concurrent-handler shared-state analysis — RabbitMQ consumers are among the most common .NET message-handler surfaces sharing a single DbContext across deliveries. The dispatch pump's ConsumerDispatchConcurrency knob lives on the ConnectionFactory (v7: also per-channel options), typically in another method or bound from configuration, so reports default to the config-gated DI022 Info tier; a constant knob above 1 in the containing type upgrades to the DI021 warning. Knob constants are recognized across integral types (RabbitMQ.Client v7 declares the property as ushort), consumer types match by fully-qualified name, and all existing guardrails apply (in-handler scopes, IDbContextFactory<T>, inline creation, serialization guards, whitelisted captures). Instance-correlated factory→connection→channel→consumer tracing for sequential proofs remains a v2 target.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.10.1

What changed

Added

  • DI021/DI022 RabbitMQ consumer sinks: EventingBasicConsumer.Received (v6 sync), AsyncEventingBasicConsumer.Received (v6 async), and AsyncEventingBasicConsumer.ReceivedAsync (v7) handlers now participate in concurrent-handler shared-state analysis — RabbitMQ consumers are among the most common .NET message-handler surfaces sharing a single DbContext across deliveries. The dispatch pump's ConsumerDispatchConcurrency knob lives on the ConnectionFactory (v7: also per-channel options), typically in another method or bound from configuration, so reports default to the config-gated DI022 Info tier; a constant knob above 1 in the containing type upgrades to the DI021 warning. Knob constants are recognized across integral types (RabbitMQ.Client v7 declares the property as ushort), consumer types match by fully-qualified name, and all existing guardrails apply (in-handler scopes, IDbContextFactory<T>, inline creation, serialization guards, whitelisted captures). Instance-correlated factory→connection→channel→consumer tracing for sequential proofs remains a v2 target.

Learn more

2.10.0

DependencyInjection.Lifetime.Analyzers 2.10.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI021: Non-thread-safe service shared across concurrent handler invocations (Warning): catches the deferred captive dependency — a non-thread-safe service (EF Core DbContext and derived contexts, DbConnection/DbCommand/DbTransaction/DbDataReader and their interfaces, IDbContextTransaction, HttpContext) created or resolved once and captured via field, closure, or enclosing-method parameter into a handler a framework invokes concurrently. v1 sinks: ServiceBusProcessor/ServiceBusSessionProcessor message and error handlers, EventProcessorClient event handlers, System.Threading.Timer callbacks with a finite period, System.Timers.Timer.Elapsed, and Parallel.For/ForEach/ForEachAsync/Invoke bodies. Also detects resolution from a long-lived scope captured from outside the handler (the "moved GetRequiredService inside the lambda" loophole). Stays quiet for in-handler scopes, IDbContextFactory<T>, inline creation, proven-sequential configurations (MaxConcurrentCalls = 1, MaxConcurrentSessions = 1, MaxDegreeOfParallelism = 1, one-shot timers, AutoReset = false, SynchronizingObject), and handlers that serialize themselves (lock, SemaphoreSlim wait/finally-release, Interlocked/Monitor.TryEnter reentrancy guards, timer re-arm, disposable async-lock idiom). Scope-per-message frameworks (MassTransit, NServiceBus, Quartz, Hangfire, SignalR, Azure Functions) are deliberately not sinks.
  • DI022: Service instance reused across handler invocations (Info): the same capture shape on a config-gated sink whose concurrency knob cannot be proven at compile time (canonically ServiceBusProcessor.MaxConcurrentCalls from configuration or default). Conditional wording: raising the knob above 1 makes it a concurrency crash, and even sequential dispatch accumulates state across all messages. Proven > 1 upgrades to DI021; proven == 1 is silent.
  • DI021/DI022 code fix: rewrites the handler to scope-per-invocation — inserts await using var scope = _scopeFactory.CreateAsyncScope(); (or the sync CreateScope form for synchronous delegates, converting expression-bodied lambdas to blocks), re-resolves the service from the new scope, plumbs IServiceScopeFactory through the constructor when no factory field exists, and removes the captured field, its constructor assignment, and the feeding parameter when the handler was their only consumer. Refuses safely for static handlers, scope-resolution diagnostics, and types without a declared constructor.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.10.0

What changed

Added

  • DI021: Non-thread-safe service shared across concurrent handler invocations (Warning): catches the deferred captive dependency — a non-thread-safe service (EF Core DbContext and derived contexts, DbConnection/DbCommand/DbTransaction/DbDataReader and their interfaces, IDbContextTransaction, HttpContext) created or resolved once and captured via field, closure, or enclosing-method parameter into a handler a framework invokes concurrently. v1 sinks: ServiceBusProcessor/ServiceBusSessionProcessor message and error handlers, EventProcessorClient event handlers, System.Threading.Timer callbacks with a finite period, System.Timers.Timer.Elapsed, and Parallel.For/ForEach/ForEachAsync/Invoke bodies. Also detects resolution from a long-lived scope captured from outside the handler (the "moved GetRequiredService inside the lambda" loophole). Stays quiet for in-handler scopes, IDbContextFactory<T>, inline creation, proven-sequential configurations (MaxConcurrentCalls = 1, MaxConcurrentSessions = 1, MaxDegreeOfParallelism = 1, one-shot timers, AutoReset = false, SynchronizingObject), and handlers that serialize themselves (lock, SemaphoreSlim wait/finally-release, Interlocked/Monitor.TryEnter reentrancy guards, timer re-arm, disposable async-lock idiom). Scope-per-message frameworks (MassTransit, NServiceBus, Quartz, Hangfire, SignalR, Azure Functions) are deliberately not sinks.
  • DI022: Service instance reused across handler invocations (Info): the same capture shape on a config-gated sink whose concurrency knob cannot be proven at compile time (canonically ServiceBusProcessor.MaxConcurrentCalls from configuration or default). Conditional wording: raising the knob above 1 makes it a concurrency crash, and even sequential dispatch accumulates state across all messages. Proven > 1 upgrades to DI021; proven == 1 is silent.
  • DI021/DI022 code fix: rewrites the handler to scope-per-invocation — inserts await using var scope = _scopeFactory.CreateAsyncScope(); (or the sync CreateScope form for synchronous delegates, converting expression-bodied lambdas to blocks), re-resolves the service from the new scope, plumbs IServiceScopeFactory through the constructor when no factory field exists, and removes the captured field, its constructor assignment, and the feeding parameter when the handler was their only consumer. Refuses safely for static handlers, scope-resolution diagnostics, and types without a declared constructor.

Learn more

2.9.6

DependencyInjection.Lifetime.Analyzers 2.9.6

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI014 wrapped-result disposal precision: DI014 now treats root providers assigned or returned through parenthesized, provable upcast, or null-forgiving BuildServiceProvider() results as disposed or caller-owned when appropriate — including combinations with conditional-access creations such as (services?.BuildServiceProvider())!. Flows that pass the result through a user-defined conversion (explicit or implicit operator) or an unproven downcast ((Wrapper)(object)..., downcast from an interface) still report, because they are not proven to hand the root provider itself to the disposal or return site.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.9.6

What changed

Changed

  • DI014 wrapped-result disposal precision: DI014 now treats root providers assigned or returned through parenthesized, provable upcast, or null-forgiving BuildServiceProvider() results as disposed or caller-owned when appropriate — including combinations with conditional-access creations such as (services?.BuildServiceProvider())!. Flows that pass the result through a user-defined conversion (explicit or implicit operator) or an unproven downcast ((Wrapper)(object)..., downcast from an interface) still report, because they are not proven to hand the root provider itself to the disposal or return site.

Learn more

2.9.5

DependencyInjection.Lifetime.Analyzers 2.9.5

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI004 conditional-access resolution tracking: DI004 now tracks services resolved through conditional access, so service = scope?.ServiceProvider.GetRequiredService<T>(); inside a using block is recognized and a later use after the scope is disposed reports as it does for the plain form. Chained scope?.ServiceProvider?.GetRequiredService<T>() resolutions and scopes created with using (var scope = factory?.CreateScope()) (declaration, using-statement, predeclared, and reassignment forms) participate too. Conditional resolutions consumed inside the scope stay quiet. Conditional uses after dispose (service?.DoWork()) were already covered.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.9.5

What changed

Changed

  • DI004 conditional-access resolution tracking: DI004 now tracks services resolved through conditional access, so service = scope?.ServiceProvider.GetRequiredService<T>(); inside a using block is recognized and a later use after the scope is disposed reports as it does for the plain form. Chained scope?.ServiceProvider?.GetRequiredService<T>() resolutions and scopes created with using (var scope = factory?.CreateScope()) (declaration, using-statement, predeclared, and reassignment forms) participate too. Conditional resolutions consumed inside the scope stay quiet. Conditional uses after dispose (service?.DoWork()) were already covered.

Learn more

2.9.4

DependencyInjection.Lifetime.Analyzers 2.9.4

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI002 conditional-access escape detection: DI002 now reports scoped services that escape their scope through conditional-access shapes. Previously return scope?.ServiceProvider.GetRequiredService<T>();, chained scope?.ServiceProvider?.GetRequiredService<T>(), field captures _field = scope?.ServiceProvider.GetRequiredService<T>();, and locals resolved through scope?.ServiceProvider... that later escape were all silent, because resolution recognition required a plain MemberAccessExpressionSyntax receiver and the consumption-shape checks matched the invocation's direct parent. The analyzer now resolves the provider receiver through MemberBindingExpressionSyntax/ConditionalAccessExpressionSyntax shapes (including using var scope = factory?.CreateScope(); creations) and classifies consumption from the outermost enclosing conditional access. Transient resolutions and locally-consumed services through the same shapes stay quiet.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.9.4

What changed

Changed

  • DI002 conditional-access escape detection: DI002 now reports scoped services that escape their scope through conditional-access shapes. Previously return scope?.ServiceProvider.GetRequiredService<T>();, chained scope?.ServiceProvider?.GetRequiredService<T>(), field captures _field = scope?.ServiceProvider.GetRequiredService<T>();, and locals resolved through scope?.ServiceProvider... that later escape were all silent, because resolution recognition required a plain MemberAccessExpressionSyntax receiver and the consumption-shape checks matched the invocation's direct parent. The analyzer now resolves the provider receiver through MemberBindingExpressionSyntax/ConditionalAccessExpressionSyntax shapes (including using var scope = factory?.CreateScope(); creations) and classifies consumption from the outermost enclosing conditional access. Transient resolutions and locally-consumed services through the same shapes stay quiet.

Learn more

2.9.3

DependencyInjection.Lifetime.Analyzers 2.9.3

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI014 conditional-access disposal proofs: DI014 no longer reports root providers created through conditional access (services?.BuildServiceProvider()) that are in fact handled. As with DI001 in 2.9.2, the consumption-shape checks matched the invocation's direct parent, so var provider = services?.BuildServiceProvider(); with a later provider?.Dispose() (including finally cleanup and predeclared reassignment), return services?.BuildServiceProvider();, and arrow-bodied returns all produced false positives. The analyzer now resolves the enclosing ConditionalAccessExpressionSyntax before matching initializer/assignment/return/arrow parents. Undisposed conditional-access creations still report, and using var provider = services?.BuildServiceProvider(); stays quiet as before.
  • DI014 fixer conditional-access support: The dispose-provider code fix now also offers the using / await using rewrite for conditional-access creations. The rewrite stays valid for that shape because the local is a nullable reference type (ServiceProvider implements both IDisposable and IAsyncDisposable, and using accepts null values).

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.9.3

What changed

Changed

  • DI014 conditional-access disposal proofs: DI014 no longer reports root providers created through conditional access (services?.BuildServiceProvider()) that are in fact handled. As with DI001 in 2.9.2, the consumption-shape checks matched the invocation's direct parent, so var provider = services?.BuildServiceProvider(); with a later provider?.Dispose() (including finally cleanup and predeclared reassignment), return services?.BuildServiceProvider();, and arrow-bodied returns all produced false positives. The analyzer now resolves the enclosing ConditionalAccessExpressionSyntax before matching initializer/assignment/return/arrow parents. Undisposed conditional-access creations still report, and using var provider = services?.BuildServiceProvider(); stays quiet as before.
  • DI014 fixer conditional-access support: The dispose-provider code fix now also offers the using / await using rewrite for conditional-access creations. The rewrite stays valid for that shape because the local is a nullable reference type (ServiceProvider implements both IDisposable and IAsyncDisposable, and using accepts null values).

Learn more

2.9.2

DependencyInjection.Lifetime.Analyzers 2.9.2

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI001 conditional-access disposal proofs: DI001 no longer reports scopes created through conditional access (_provider?.CreateScope()) that are in fact handled. The consumption-shape checks (IsReturned, explicit-disposal local extraction) previously matched the invocation's direct parent, but a conditional-access creation hangs the initializer/assignment/return/arrow shape off the enclosing ConditionalAccessExpressionSyntax, so var scope = _provider?.CreateScope(); with a later scope?.Dispose() (including finally cleanup and predeclared reassignment), return _provider?.CreateScope();, and arrow-bodied => _provider?.CreateScope() all produced false positives. Undisposed conditional-access creations still report, and using var scope = _provider?.CreateScope(); stays quiet as before.
  • DI001 fixer await-using guardrail: The "Add 'await using'" fix is no longer offered for conditional-access creations. factory?.CreateAsyncScope() produces a nullable AsyncServiceScope (a Nullable<T> with no DisposeAsync), so the rewrite could not compile; the plain "Add 'using'" fix remains available and valid for that shape because the scope local is a nullable reference type.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.9.2

What changed

Changed

  • DI001 conditional-access disposal proofs: DI001 no longer reports scopes created through conditional access (_provider?.CreateScope()) that are in fact handled. The consumption-shape checks (IsReturned, explicit-disposal local extraction) previously matched the invocation's direct parent, but a conditional-access creation hangs the initializer/assignment/return/arrow shape off the enclosing ConditionalAccessExpressionSyntax, so var scope = _provider?.CreateScope(); with a later scope?.Dispose() (including finally cleanup and predeclared reassignment), return _provider?.CreateScope();, and arrow-bodied => _provider?.CreateScope() all produced false positives. Undisposed conditional-access creations still report, and using var scope = _provider?.CreateScope(); stays quiet as before.
  • DI001 fixer await-using guardrail: The "Add 'await using'" fix is no longer offered for conditional-access creations. factory?.CreateAsyncScope() produces a nullable AsyncServiceScope (a Nullable<T> with no DisposeAsync), so the rewrite could not compile; the plain "Add 'using'" fix remains available and valid for that shape because the scope local is a nullable reference type.

Learn more

2.9.1

DependencyInjection.Lifetime.Analyzers 2.9.1

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI019 conditional-access receiver hardening: DI019 now resolves the true provider receiver of a resolution call before classifying it. Previously, for host?.Services.GetRequiredService<T>() the analyzer classified the conditional-access receiver host (never a known root provider) instead of the .Services member binding, so scoped resolutions through host?.Services..., chained app?.Services?..., and local aliases such as var rootServices = app?.Services; were silently missed. Known root-provider properties (Services, ApplicationServices, ServiceProvider) and known scoped-provider properties (RequestServices, scope ServiceProvider) are now recognised when they appear as a MemberBindingExpressionSyntax, with the owner resolved from the enclosing ConditionalAccessExpressionSyntax. The scoped-provider recognition keeps httpContext?.RequestServices... and scope?.ServiceProvider... quiet inside singleton implementations now that the receiver reorder makes those shapes reachable.
  • DI019 code fix conditional-access guardrail: The scope-wrapping code fix now refuses resolutions evaluated inside a conditional access's WhenNotNull (e.g. var s = host?.Services.GetRequiredService<T>();). Lifting that receiver into using var scope = ....CreateScope(); would have emitted a standalone member binding that does not compile, and the wrap would also have dropped the null-shortcut semantics.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.9.1

What changed

Changed

  • DI019 conditional-access receiver hardening: DI019 now resolves the true provider receiver of a resolution call before classifying it. Previously, for host?.Services.GetRequiredService<T>() the analyzer classified the conditional-access receiver host (never a known root provider) instead of the .Services member binding, so scoped resolutions through host?.Services..., chained app?.Services?..., and local aliases such as var rootServices = app?.Services; were silently missed. Known root-provider properties (Services, ApplicationServices, ServiceProvider) and known scoped-provider properties (RequestServices, scope ServiceProvider) are now recognised when they appear as a MemberBindingExpressionSyntax, with the owner resolved from the enclosing ConditionalAccessExpressionSyntax. The scoped-provider recognition keeps httpContext?.RequestServices... and scope?.ServiceProvider... quiet inside singleton implementations now that the receiver reorder makes those shapes reachable.
  • DI019 code fix conditional-access guardrail: The scope-wrapping code fix now refuses resolutions evaluated inside a conditional access's WhenNotNull (e.g. var s = host?.Services.GetRequiredService<T>();). Lifting that receiver into using var scope = ....CreateScope(); would have emitted a standalone member binding that does not compile, and the wrap would also have dropped the null-shortcut semantics.

Learn more

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.17.

Release notes

Sourced from Microsoft.Extensions.Http.Polly's releases.

9.0.17

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.16...v9.0.17

9.0.16

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.15...v9.0.16

9.0.15

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.13...v9.0.14

9.0.13

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.12...v9.0.13)

9.0.12

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.11...v9.0.12

9.0.11

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.10...v9.0.11

9.0.10

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.9...v9.0.10

9.0.9

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.8...v9.0.9

9.0.7

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.6...v9.0.7

9.0.6

Bug Fixes

  • Forwarded Headers Middleware: Ignore X-Forwarded-Headers from Unknown Proxy (#​61622)
    The Forwarded Headers Middleware now ignores X-Forwarded-Headers sent from unknown proxies. This change improves security by ensuring that only trusted proxies can influence forwarded header values, preventing potential spoofing or misrouting issues.

Dependency Updates

  • Bump src/submodules/googletest from 52204f7 to 04ee1b4 (#​61762)
    Updates the GoogleTest submodule to a newer commit, bringing in the latest improvements and bug fixes from the upstream project.
  • Update dependencies from dotnet/arcade (#​61714)
    Updates internal build and infrastructure dependencies from the dotnet/arcade repository, ensuring compatibility and access to the latest build tools.
  • Update dependencies from dotnet/extensions (#​61571)
    Refreshes dependencies from the dotnet/extensions repository, incorporating the latest features and fixes from the extensions libraries.
  • Update dependencies from dotnet/extensions (#​61877)
    Further updates dependencies from dotnet/extensions, ensuring the project benefits from recent improvements and bug fixes.
  • Update dependencies from dotnet/arcade (#​61892)
    Additional updates to build and infrastructure dependencies from dotnet/arcade, maintaining up-to-date tooling and build processes.

Miscellaneous

  • Update branding to 9.0.6 (#​61831)
    Updates the project version and branding to 9.0.6, reflecting the new release and ensuring version consistency across the codebase.
  • Merging internal commits for release/9.0 (#​61925)
    Incorporates various internal commits into the release/9.0 branch, ensuring that all relevant changes are included in this release.

This summary is generated and may contain inaccuracies. For complete details, please review the linked pull requests.

Full Changelog: v9.0.5...v9.0.6

9....

Description has been truncated

@dependabot
Bump the tests group with 5 updates
8200b38 
Bumps CancelCop.Analyzer from 1.4.2 to 1.4.8
Bumps DependencyInjection.Lifetime.Analyzers from 2.9.0 to 2.10.4
Bumps Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.17
Bumps System.IO.Hashing from 10.0.8 to 10.0.9
Bumps System.ServiceModel.Syndication from 9.0.0 to 9.0.17

---
updated-dependencies:
- dependency-name: CancelCop.Analyzer
  dependency-version: 1.4.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: DependencyInjection.Lifetime.Analyzers
  dependency-version: 2.10.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: Microsoft.Extensions.Http.Polly
  dependency-version: 9.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: System.IO.Hashing
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: System.ServiceModel.Syndication
  dependency-version: 9.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Jun 10, 2026
This was referenced Jun 10, 2026
Closed
Closed
Closed
@dependabot @github

dependabot Bot commented on behalf of github Jun 11, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 11, 2026
@dependabot dependabot Bot deleted the dependabot/nuget/src/DNTCommon.Web.Core/tests-cfcab8d5c1 branch June 11, 2026 19:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants