Skip to content

chore(deps): backend NuGet + frontend npm upgrade wave (supersedes #26–#35) #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
windischb merged 2 commits into from
Jun 2, 2026
Merged

chore(deps): backend NuGet + frontend npm upgrade wave (supersedes #26–#35) #36

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5d3dfc5
chore(deps): upgrade backend NuGet packages
windischb Jun 1, 2026
06a9d2d
chore(deps): upgrade frontend npm packages
windischb Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 0 additions & 7 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,13 +60,6 @@ updates:
labels:
- "dependencies"
- "backend"
ignore:
# Pinned in Directory.Packages.props — 2.1.x generates an extra
# Evolve(...) overload that collides with PrincipalProjectionBase.
# Revisit when the codegen collision is fixed. Dependabot wants a
# semver range here, glob-style "2.1.x" is ignored silently.
- dependency-name: "JasperFx.Events.SourceGenerator"
versions: [">=2.1.0 <3.0.0"]
groups:
critter-stack:
patterns:
Expand Down
16 changes: 11 additions & 5 deletions dev-docs/engineering-gotchas/critter-stack-2026.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,17 @@ Pinned in `src/dotnet/Directory.Packages.props`:

| Package | Version |
| --- | --- |
| `Marten` | 9.0.0 |
| `Marten.AspNetCore` | 9.0.0 |
| `WolverineFx.Marten` | 6.0.0 |
| `JasperFx.Events.SourceGenerator` | 2.0.0 |
| `WolverineFx.RuntimeCompilation` | 6.0.0 |
| `Marten` | 9.3.5 |
| `Marten.AspNetCore` | 9.3.5 |
| `WolverineFx.Marten` | 6.3.2 |
| `JasperFx.Events.SourceGenerator` | 2.4.1 |
| `WolverineFx.RuntimeCompilation` | 6.3.2 |

> **JasperFx.Events.SourceGenerator pin lifted (2026-06).** It was held at
> `2.0.0` because `2.1.x` source-generated an extra `Evolve(...)` overload that
> collided with `PrincipalProjectionBase`. That collision is gone as of `2.4.x`
> — verified by a clean build + green test suite — so the pin (and its
> `dependabot.yml` ignore) were removed.

The two V8 event-store defaults Modgud still pins (and the reasoning for
each) are in
Expand Down
29 changes: 13 additions & 16 deletions src/dotnet/Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
</PropertyGroup>
<ItemGroup>
<PackageVersion Include="Cocoar.Json.Mutable" Version="1.0.1" />
<PackageVersion Include="Cocoar.Json.Mutable" Version="1.2.0" />
<!-- SAST analyzer; injected by Directory.Build.props as
analyzer-only PackageReference (PrivateAssets=all). -->
<PackageVersion Include="SecurityCodeScan.VS2019" Version="5.6.7" />
Expand All @@ -15,7 +15,7 @@
<PackageVersion Include="Cocoar.SignalARRR.Server" Version="4.3.0" />
<!-- Microsoft packages -->
<PackageVersion Include="Fido2.AspNet" Version="4.0.1" />
<PackageVersion Include="MailKit" Version="4.16.0" />
<PackageVersion Include="MailKit" Version="4.17.0" />
<PackageVersion Include="Postmark" Version="5.3.0" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.8" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.8" />
Expand All @@ -29,24 +29,20 @@
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.8" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.8" />
<PackageVersion Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.23.0" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.5.1" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.6.0" />
<!-- Marten & Wolverine — Critter Stack 2026 (Marten 9 + Wolverine 6 +
JasperFx 2). Migrated from 8.37 / 5.32 in chore/critter-stack-2026.
Gotchas: dev-docs/engineering-gotchas/critter-stack-2026.md -->
<PackageVersion Include="Marten" Version="9.0.2" />
<PackageVersion Include="Marten.AspNetCore" Version="9.0.2" />
<PackageVersion Include="WolverineFx.Marten" Version="6.0.2" />
<PackageVersion Include="Marten" Version="9.3.5" />
<PackageVersion Include="Marten.AspNetCore" Version="9.3.5" />
<PackageVersion Include="WolverineFx.Marten" Version="6.3.2" />
<!-- Marten 9 source-generates projection apply-dispatchers; every
`.csproj` that declares a partial Projection class needs this as
analyzer-style PackageReference. -->
<!-- Pinned to 2.0.0 — 2.1.1 generates an additional Evolve(...) overload
that collides with the existing one in PrincipalProjectionBase.
Revisit when fixing source-gen collision: see
dev-docs/engineering-gotchas/critter-stack-2026.md. -->
<PackageVersion Include="JasperFx.Events.SourceGenerator" Version="2.0.0" />
<PackageVersion Include="JasperFx.Events.SourceGenerator" Version="2.4.1" />
<!-- Wolverine 6 decoupled the Roslyn runtime codegen from core;
IMessageBus.InvokeAsync<T> needs it in the host project. -->
<PackageVersion Include="WolverineFx.RuntimeCompilation" Version="6.0.2" />
<PackageVersion Include="WolverineFx.RuntimeCompilation" Version="6.3.2" />
<!-- Other packages -->
<PackageVersion Include="Serilog.AspNetCore" Version="10.0.0" />
<PackageVersion Include="System.Reactive" Version="6.1.0" />
Expand Down Expand Up @@ -79,9 +75,10 @@
Schedules don't survive restart; SchedulingBootstrap re-applies
JobConfig overrides from Marten on every boot. -->
<PackageVersion Include="Quartz.Extensions.Hosting" Version="3.18.1" />
<!-- Cocoar Configuration (v5 — Secrets merged into main package) -->
<PackageVersion Include="Cocoar.Configuration" Version="5.0.0" />
<PackageVersion Include="Cocoar.Configuration.AspNetCore" Version="5.0.0" />
<!-- Cocoar Configuration v6 — additive over v5 (aggregate rules, multi-tenant
+ DI-backed config); no breaking API changes for our usage. -->
<PackageVersion Include="Cocoar.Configuration" Version="6.0.0" />
<PackageVersion Include="Cocoar.Configuration.AspNetCore" Version="6.0.0" />
<!-- OpenTelemetry (Audit-Followup 2026-05-13, Phase 1 foundation).
Prometheus AspNetCore exporter stays officially beta in upstream
OTel-dotnet but is widely used; OTLP exporter is GA. -->
Expand All @@ -94,6 +91,6 @@
<!-- Health-checks: Npgsql probe for /health/ready. -->
<PackageVersion Include="AspNetCore.HealthChecks.NpgSql" Version="9.0.0" />
<!-- OpenTelemetry Phase 3: Postgres-query tracing via Npgsql's own ActivitySource. -->
<PackageVersion Include="Npgsql.OpenTelemetry" Version="10.0.2" />
<PackageVersion Include="Npgsql.OpenTelemetry" Version="10.0.3" />
</ItemGroup>
</Project>
10 changes: 5 additions & 5 deletions src/dotnet/Modgud.Api/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,9 +129,9 @@
builder.Services.AddSingleton<IMagicLinkConfiguration>(sp => sp.GetRequiredService<MagicLinkConfiguration>());

var configManager = builder.GetCocoarConfigManager();
var conf = configManager.GetRequiredConfig<StartUpConfiguration>();
var conf = configManager.GetConfig<StartUpConfiguration>();

if (!string.IsNullOrWhiteSpace(conf.CertPath))

Check warning on line 134 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Analyze (csharp) 

Dereference of a possibly null reference.

Check warning on line 134 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Backend Build & Test 

Dereference of a possibly null reference.
{
var certPath = PathHelper.GetFullPath(conf.CertPath);
var cert = X509CertificateLoader.LoadPkcs12FromFile(certPath, conf.CertPassword,
Expand Down Expand Up @@ -169,8 +169,8 @@
{
foreach (var entry in allowed.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
{
if (Microsoft.AspNetCore.HttpOverrides.IPNetwork.TryParse(entry, out var network))

Check warning on line 172 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Analyze (csharp) 

'IPNetwork' is obsolete: 'Please use System.Net.IPNetwork instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)

Check warning on line 172 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Backend Build & Test 

'IPNetwork' is obsolete: 'Please use System.Net.IPNetwork instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)
options.KnownNetworks.Add(network);

Check warning on line 173 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Analyze (csharp) 

'ForwardedHeadersOptions.KnownNetworks' is obsolete: 'Please use KnownIPNetworks instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)

Check warning on line 173 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Backend Build & Test 

'ForwardedHeadersOptions.KnownNetworks' is obsolete: 'Please use KnownIPNetworks instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)
}
}
// ForwardLimit caps the X-Forwarded-* depth — defence against a
Expand All @@ -181,8 +181,8 @@
{
// Dev convenience: trust loopback so localhost reverse-proxies
// (Vite, Docker port-forwards) work without ENV setup.
options.KnownNetworks.Add(new Microsoft.AspNetCore.HttpOverrides.IPNetwork(System.Net.IPAddress.Parse("127.0.0.0"), 8));

Check warning on line 184 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Analyze (csharp) 

'IPNetwork' is obsolete: 'Please use System.Net.IPNetwork instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)

Check warning on line 184 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Analyze (csharp) 

'ForwardedHeadersOptions.KnownNetworks' is obsolete: 'Please use KnownIPNetworks instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)

Check warning on line 184 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Backend Build & Test 

'IPNetwork' is obsolete: 'Please use System.Net.IPNetwork instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)

Check warning on line 184 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Backend Build & Test 

'ForwardedHeadersOptions.KnownNetworks' is obsolete: 'Please use KnownIPNetworks instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)
options.KnownNetworks.Add(new Microsoft.AspNetCore.HttpOverrides.IPNetwork(System.Net.IPAddress.IPv6Loopback, 128));

Check warning on line 185 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Analyze (csharp) 

'IPNetwork' is obsolete: 'Please use System.Net.IPNetwork instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)

Check warning on line 185 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Analyze (csharp) 

'ForwardedHeadersOptions.KnownNetworks' is obsolete: 'Please use KnownIPNetworks instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)

Check warning on line 185 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Backend Build & Test 

'IPNetwork' is obsolete: 'Please use System.Net.IPNetwork instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)

Check warning on line 185 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Backend Build & Test 

'ForwardedHeadersOptions.KnownNetworks' is obsolete: 'Please use KnownIPNetworks instead. For more information, visit https://aka.ms/aspnet/deprecate/005.' (https://aka.ms/aspnet/deprecate/005)
}
});

Expand Down Expand Up @@ -643,10 +643,10 @@
{
EmailProvider.Postmark => new PostmarkEmailService(() =>
{
var c = configManager.GetRequiredConfig<EmailConfiguration>();
var c = configManager.GetConfig<EmailConfiguration>();
return new PostmarkEmailServiceOptions
{
ServerToken = c.Postmark.ServerToken,

Check warning on line 649 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Analyze (csharp) 

Dereference of a possibly null reference.

Check warning on line 649 in src/dotnet/Modgud.Api/Program.cs

View workflow job for this annotation

GitHub Actions / Backend Build & Test 

Dereference of a possibly null reference.
FromAddress = c.Postmark.FromAddress,
FromName = c.Postmark.FromName,
MessageStream = c.Postmark.MessageStream,
Expand All @@ -654,7 +654,7 @@
}),
_ => new SmtpEmailService(() =>
{
var c = configManager.GetRequiredConfig<EmailConfiguration>();
var c = configManager.GetConfig<EmailConfiguration>();
return new SmtpEmailServiceOptions
{
Host = c.Smtp.Host, Port = c.Smtp.Port, UseSsl = c.Smtp.UseSsl,
Expand Down Expand Up @@ -722,7 +722,7 @@

// OpenTelemetry foundation (Phase 1). See
// dev-docs/future-features/observability-opentelemetry.md.
var observabilitySettings = configManager.GetRequiredConfig<ObservabilitySettings>();
var observabilitySettings = configManager.GetConfig<ObservabilitySettings>();
builder.Services.AddModgudObservability(
observabilitySettings,
conf.DbSettings.ConnectionString);
Expand All @@ -739,7 +739,7 @@
// OpenIddict OAuth 2.0 / OIDC server — uses our custom Marten stores. Settings are
// captured at config time so signing certs / lifetimes can be pinned before the
// host is built. Per-realm issuer is applied at request time via RealmIssuerHandler.
var openIddictSettings = configManager.GetRequiredConfig<OpenIddictSettings>();
var openIddictSettings = configManager.GetConfig<OpenIddictSettings>();

// CERT-01 / OAUTH-05: ensure signing + encryption certs exist on disk
// before OpenIddict tries to load them. Convention: passwordless PFX
Expand Down
22 changes: 11 additions & 11 deletions src/frontend-vue/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,26 +15,26 @@
},
"dependencies": {
"@cocoar/signalarrr": "^4.3.0",
"@cocoar/vue-data-grid": "2.5.1",
"@cocoar/vue-fragment-parser": "2.5.1",
"@cocoar/vue-localization": "2.5.1",
"@cocoar/vue-page-builder": "2.5.1",
"@cocoar/vue-script-editor": "2.5.1",
"@cocoar/vue-ui": "2.5.1",
"@cocoar/vue-data-grid": "2.5.2",
"@cocoar/vue-fragment-parser": "2.5.2",
"@cocoar/vue-localization": "2.5.2",
"@cocoar/vue-page-builder": "2.5.2",
"@cocoar/vue-script-editor": "2.5.2",
"@cocoar/vue-ui": "2.5.2",
"monaco-editor": "^0.55.1",
"pinia": "^3.0.4",
"vue": "^3.5.34",
"vue-router": "^5.0.7"
"vue": "^3.5.35",
"vue-router": "^5.1.0"
},
"devDependencies": {
"@playwright/test": "^1.60.0",
"@tailwindcss/vite": "^4.3.0",
"@vitejs/plugin-vue": "^6.0.7",
"otplib": "^13.4.0",
"otplib": "^13.4.1",
"tailwindcss": "^4.3.0",
"typescript": "~6.0.3",
"vite": "^8.0.14",
"vue-tsc": "^3.3.2"
"vite": "^8.0.16",
"vue-tsc": "^3.3.3"
},
"volta": {
"node": "22.17.1",
Expand Down
Loading
Loading