Skip to content

chore(deps): Bump the minor-and-patch group with 14 updates - #130

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/Daqifi.Avalonia/minor-and-patch-c816ff628e
Closed

chore(deps): Bump the minor-and-patch group with 14 updates#130
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/Daqifi.Avalonia/minor-and-patch-c816ff628e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Updated Avalonia.Controls.DataGrid from 12.1.0 to 12.1.2.

Release notes

Sourced from Avalonia.Controls.DataGrid's releases.

12.1.2

What's Changed

Full Changelog: AvaloniaUI/Avalonia.Controls.DataGrid@12.1.0...12.1.2

Commits viewable in compare view.

Updated Daqifi.Core from 1.3.0 to 1.7.0.

Release notes

Sourced from Daqifi.Core's releases.

1.7.0

Verified end-to-end against a DAQiFi Nyquist Nq1 (firmware 3.7.2) over USB: serial discovery, connect + populated init (16 analog in / 16 digital), 100 Hz streaming, SD card listing and storage, and LAN chip info all pass. Full unit suite green (7,847 tests) on net9.0 and net10.0.

Highlights

  • Acquisition statistics now report in the channel's own units — configure a channel with engineering units and AcquisitionStatistics still reported its min, max and mean in volts, with nothing in the snapshot saying which of the two you had. It now records the scaled value and carries the channel's Unit. This was not merely a mislabel: a negative gain transposes the extremes, so a consumer re-applying the scaling by hand got a MinValue that was really the maximum — a loss that could not be corrected after the fact. (#​554)
  • A silent device and an empty answer are no longer the same answer — GetSystemLogAsync returned an empty list both for a device whose log is genuinely empty and for a device that never answered, which is the least useful reply a diagnostics call can give: indistinguishable from a clean bill of health. Core now reads the firmware's always-present terminator as proof the device spoke. Alongside it, an SD listing for a directory that simply isn't on the card is told apart from a broken filesystem, and the device's new end-of-listing marker says whether a listing walked the whole tree, skipped entries, or failed outright. (#​552, #​551, #​550)
  • A stale blank line can no longer be mistaken for your reply — the blank that terminates a SYSTem:LOG? dump is the entire signal for "the device answered", and a leftover blank from an earlier command could still arrive while your command was queued or mid-send and be counted as your answer. Both windows are now closed. In the same engine, a reply that beat the wait loop's first poll was invisible to it, so the call sat out the full response timeout instead of the short completion one — a multi-second stall on an answer that had already arrived. (#​591, #​602, #​594)
  • The device you are using no longer disappears from discovery — SerialDeviceFinder identifies a device by opening its port, and a port your own process already holds open failed identically to "there is no device here". Run discovery next to a connected device — the normal shape for an app with a device list on screen — and after a few passes it called your device lost. A port that is present but locked is now carried as exactly that. (#​561)

Features

  • The eight memory-diagnostics fields the firmware sends but MemoryDiagnostics never surfaced now have typed properties — notably LargestFreeBlock, which, not HeapFree, is the largest allocation the device can still service. 7.5 KB free across twenty blocks and 7.5 KB free in one block report the same HeapFree and have completely different prospects. (#​556)
  • ChannelScaling.TryApply makes the overflow fallback detectable, so an unscaled reading can be kept out of an aggregate instead of silently mixing units into a window of correctly converted ones. (#​564)

Firmware & device behavior

  • Metadata.Health was documented as live telemetry but was a snapshot taken once at connect that never changed again. It now has a way to refresh, and the docs no longer claim otherwise. A connected Nyquist sends no unsolicited health frames at all: across a bench run of 1,587 inbound messages, exactly one carried health, and only because it was asked. (#​558)
  • An SD listing, storage query, delete, format or download defensively stopped streaming before touching the card and never restarted it, leaving a concurrent StreamSamplesAsync consumer permanently silent with no error. All five now resume it. (#​566)

Fixes

  • A throwing subscriber to StatusMessageReceived/StreamMessageReceived stopped delivery to every subscriber registered after it for the rest of the connection — the natural, wrong conclusion being "the device stopped sending". (#​563)
  • MessageProducer.IsIdle could report idle while a write was still in flight, which is the exact false "all quiet" the property exists to rule out. (#​547)
  • A blank field in an SD log header — # Serial Number: with nothing after it — counted as a real answer and beat the connected device's own value in the configuration merge. (#​627)

Performance

  • Windows discovery no longer slows down with every unrelated COM port on the machine. It asked Windows about each port one at a time, at roughly 100–500 ms per WMI query, so a laptop with a dozen ports burned seconds per pass; it is now one query per pass regardless of port count. (#​515)

Internal

  • A broad deduplication pass across the wire-facing parsers: SD card timestamp reconstruction and tick-delta rollover math, the "first parseable line" response loop, the SCPI error-code parse, both PIC32 bootloader acknowledgment decoders, HID string normalization, part-number to DeviceType mapping, the WiFi bridge-mode port sequence, and the SD operations' streaming-pause preamble each now have one implementation. (#​595, #​574, #​596, #​615, #​622, #​586, #​607, #​617, #​626, and others)
  • The SD-card members moved off the shared device-operation seam onto their own facet. (#​604, #​611)
  • New direct unit tests for the types previously covered only through their callers — the channel-control, diagnostics and network-configuration operations, both USB port descriptor providers, the SD card scaling and merge helpers, and the WiFi flash progress parser. (#​568, #​569, #​570, #​571, #​572, #​628, #​619, #​606)
  • Roughly two dozen assertions that structurally could not fail were pruned, and six tests that raced a wall clock were made deterministic. (#​603, #​620, #​610, #​601, #​609, #​589, #​587, #​578, #​575, #​633)
  • The binary-compatibility policy for appended record fields is now written down, as is per-connection thread accounting. (#​567, #​565)

Full Changelog: daqifi/daqifi-core@v1.6.0...v1.7.0

1.6.0

Verified end-to-end against a DAQiFi Nyquist Nq1 (firmware 3.7.2) over USB: serial discovery, connect + populated init, 100 Hz streaming with live acquisition statistics, mid-stream diagnostics, PWM/digital interlock, SD card list/storage/record/download/parse, and LAN chip info all pass. Full unit suite green (7,171 tests) on net9.0 and net10.0.

Highlights

  • Analog outputs are real channels you can see and write — a device's DACs now show up in Channels alongside its inputs, with their voltage range, resolution, and last-commanded value, instead of being a write-only command you had to know the syntax for. Writes are range-checked against what the device itself reported before anything reaches the wire, and a stage/latch pair lets several outputs change together. An MCP agent can drive them too, not just read them. Analog output is NQ3 hardware; Supports(DeviceFeature.AnalogOutput) tells you whether the board in front of you has it. (#​526, #​546)
  • "Am I actually getting the sample rate I asked for?" — AcquisitionStatistics answers that question from the samples themselves: measured rate, per-channel counts and value ranges, sample-interval spread, out-of-order counts, and how far behind the device's own clock the host is running. On our bench Nyquist it immediately surfaced that firmware 3.7.2 streams at 79.6% of the requested rate — the kind of thing that used to require hand-rolled instrumentation. (#​518)
  • A short SD download is now a failed download — a transfer that ended early used to be handed back as if it were the whole file, so a truncated log looked like a complete one. Core now checks the size it received against the size the device promised and raises a clear error instead. An SD download also takes exclusive ownership of the device for its duration, so a command issued on another thread can no longer interleave and corrupt the file. (#​540, #​506)
  • The per-configuration sample-rate cap moved into Core — the ceiling a given channel selection can actually sustain was previously computed in the MCP server alone, leaving the desktop app and every other consumer without it. Every consumer now gets the same answer from one place. (#​513)

Features

  • An MCP agent can read a measurement and read back what it recorded to the SD card, not just configure the device. (#​524, #​511)
  • Channels say what a reading means, not just what it measures — unit and scaling metadata travel with the channel. (#​523)

Firmware & device behavior

  • Three log-related commands stalled for a full 3 seconds each waiting for a reply the device had already sent; they now return as soon as the answer arrives. (#​542)
  • Reading diagnostic counters mid-stream reported a silently incomplete answer as a complete one — it now raises rather than under-reporting. (#​541)
  • Digital writes are blocked while PWM is driving that channel, instead of being silently ignored by the firmware. (#​473)
  • An idle connected device no longer burns CPU every second. (#​514)

Fixes

  • A live await foreach over samples now ends when the device does, instead of hanging forever. A clean disconnect ends the loop normally; an unplug or lost link throws, so an acquisition cut short can't be mistaken for one that finished. (#​507)
  • The synchronous Connect() helpers no longer freeze a UI thread. (#​508)
  • Send() racing a disconnect fails with a typed error instead of a NullReferenceException. (#​503)
  • A throwing StatusChanged subscriber no longer kills auto-reconnect or leaks the port handle. (#​504)
  • The backlog of sends parked during a long exclusive operation is now capped. (#​505)
  • discover_devices no longer gives up on a device that just needed a moment — the MCP timeout floor went from 250 ms to 1 s. (#​475)

Performance

  • Parsing an SD log no longer loads the whole file into memory first. (#​520)
  • Streaming stopped rebuilding the channel map and copying the buffer on every frame. (#​512)
  • Serial discovery no longer spends half its time waiting on its own reader thread, and discover_devices starts both transports at once instead of waiting one out. (#​509, #​510)

Internal

  • DaqifiStreamingDevice continues splitting into focused collaborators — the text-exchange engine is now its own type, and the file gives up the operation lock and its send backlog. (part of #​344 — #​479, #​530)
  • BootloaderSessionDevice moved into Core so it owns the bootloader stand-in, and the bootloader's duplicated wire constants were single-sourced. (#​478, #​519)
  • The DaqifiStreamingDevice downcast is gone from the device surface. (#​476)
  • One connected-guard replaces fifty copies of it. (#​521)
  • New test coverage for the MCP tool layer against an attached device, the PIC32 bootloader exchanges, the SD card text protocol, the WiFi updater's edge cases, and Linux serial-port identification. (#​525, #​527, #​528, #​522, #​529)

Full Changelog: daqifi/daqifi-core@v1.5.0...v1.6.0

1.5.0

Verified end-to-end against a DAQiFi Nyquist (firmware 3.7.2) over USB: serial discovery, connect + populated init, 100 Hz streaming, SD card list/storage, and LAN chip info all pass. Full unit suite green (2,853 tests) on net9.0 and net10.0.

Highlights

  • Cancellable async surface on IStreamingDevice, IAsyncDisposable on IDevice — connecting, streaming, and tearing down a device can now all be cancelled and awaited properly, instead of blocking or relying on manual cleanup. This makes it much easier to build responsive apps on top of Core — a UI can cancel a stuck connect attempt or cleanly dispose a device without extra plumbing. Note for anyone implementing these interfaces directly outside this repo: you'll need to add the new async members, DisposeAsync, and the 9 calibration confirmation members described below — sync-only callers are unaffected. (#​460, #​469)
  • Calibration and voltage-precision commands now confirm they actually landed — previously, if a device refused one of these commands, Core reported success anyway, because it never checked. That could leave a device silently uncalibrated with no way to tell. These commands now read the device's own error queue back and raise a clear error if the device didn't accept it, so a failure surfaces instead of hiding. (#​455)
  • WiFi firmware updates are more resilient — Core now handles the full update sequence itself instead of leaving apps to work around gaps: it powers the WiFi module on before an update so the update mode actually takes effect, recovers the module automatically if a flash fails partway through (instead of leaving it unreachable until a power cycle), and no longer triggers an unnecessary reflash just because it couldn't reach GitHub to check the latest version. (part of #​269 — #​443, #​444, #​445, #​434)

Fixes

  • Streaming rate limits are re-checked after enabling more channels, so a rate that was valid for a small channel set can no longer stay in effect once it exceeds what the larger channel set actually supports. (#​472)
  • Devices are now recognized as the same physical unit regardless of whether their serial number was reported in decimal or hex — previously a device could appear as two different devices depending on which form was seen first. (#​471)
  • The MCP server no longer reports made-up PWM duty-cycle/frequency values for state nobody actually commanded — it now reports "unknown" until a real command has been sent, instead of a plausible-looking guess. (#​470)
  • Serial device discovery no longer loses track of a device just because a prior discovery attempt timed out or was cancelled partway through. (#​454)
  • Fixed a defect where a device's binary status data could be misinterpreted as a text message and discarded. (part of #​268 — #​457)

Internal

  • SCPI wire strings single-sourced through ScpiMessageProducer. (#​468)
  • Dead-API sweep: TextMessage, SdCardBusyException, abandoned simulator docs. (#​467)
  • DaqifiStreamingDevice continues splitting into focused collaborators — channel/DIO/PWM/analog-output control, status-frame channel mapping, stream frame decode, connect/disconnect serialization, device administration, raw-command session interpretation, the live-sample async stream, session snapshot/restore, and USB stream-interface routing. (part of #​344 — #​432, #​433, #​435, #​436, #​437, #​439, #​440, #​441, #​442)
  • Shared ScaleRawAnalogValues helper extracted for SD card parsing. (#​466)
  • CI now runs on merge_group so a merge queue can gate main. (#​459)
  • Command history documented as oldest-first, not newest-first. (part of #​344 — #​452)
  • Assorted test hardening: bounded live-stream device test awaits, wall-clock-tight tests no longer race a stalled CI runner, WiFi update SCPI sequence expectations reconciled, canceled-settle case guarded against a persisted network config. (#​453, #​458, #​456, #​451)

Full Changelog: daqifi/daqifi-core@v1.4.0...v1.5.0

1.4.0

Verified end-to-end against a DAQiFi Nyquist (firmware 3.7.2) over USB: serial discovery, connect + populated init, 100 Hz streaming, SD card list/storage, and LAN chip info all pass. Full unit suite green (2,531 tests) on net9.0 and net10.0.

Highlights

  • Auto-reconnect and streaming session resume — opt in, and a device that drops mid-capture reconnects and picks the stream back up instead of leaving you to rebuild it. (#​379, #​418)
  • Cancellable async connect/disconnect and IAsyncDisposable — connect and teardown now honor a CancellationToken, and devices can be await using'd. (#​341, #​416)
  • Per-device operation serialization — concurrent callers no longer read each other's replies; every exchange takes its turn on the device. (#​342, #​421)
  • SD card operations over WiFi — list, storage, download, and logging control now work over the TCP transport, not just USB. (#​327, #​420)

Features

  • DeviceCapabilities merges the device's own live capability document, so what a device reports wins over compiled-in assumptions. (#​390, #​404)
  • Managed WINC serial-bridge protocol plus a read-only WiFi module inspector. (part of #​271, #​423)
  • Producer write failures surface through a SendFailed event instead of vanishing. (#​413)
  • An opt-in connect that attaches to a device without disturbing a stream already running on it. (#​385, #​414)

Reliability & fixes

  • A physically dropped serial or TCP connection is detected, making ConnectionStatus.Lost reachable. (#​403)
  • Core's connectivity guards throw a typed DeviceNotConnectedException. (#​395, #​402)
  • Four downstream workarounds retired: SD stall typing, empty-transfer guard, ResetAll semantics, and the Verifying overload. (#​398, #​405)
  • SD download is bounded, so a wedged card can't hang the call or ignore cancellation. (#​399, #​401)
  • A timed-out SD LIST is no longer reported as an empty card. (#​396, #​400)
  • The SD bus switch and the SD→LAN restore both run inside the exchange lock. (#​406, #​407, #​417)
  • Background failures are visible, and the last silent read-loop spin is gone. (#​377, #​378, #​394, #​415)
  • Analog IsEnabled tracks the device — protobuf field 22 is parsed. (#​409, #​411)
  • Serial connect failures are named for what they are instead of all reading as access denials. (#​424, #​427)
  • Firmware's malformed first stream frame is no longer broadcast to consumers. (#​425, #​428)
  • SD log parsing uses the device's own timestamp clock. (#​426, #​429)
  • The MCP server rejects over-max sample rates instead of silently clamping them. (#​412)

Internal

  • DaqifiStreamingDevice and FirmwareUpdateService split into focused collaborators. (part of #​344, #​419, #​422)
  • WINC abandoned-open tests are deterministic rather than timing-based. (#​430)
  • Dependency bump. (#​393)

Full Changelog: daqifi/daqifi-core@v1.3.0...v1.4.0

Commits viewable in compare view.

Updated Microsoft.Data.Sqlite from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.Data.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Sqlite from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Sqlite's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Tools from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Tools's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.Extensions.Http's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated NLog from 6.1.4 to 6.2.0.

Release notes

Sourced from NLog's releases.

6.2

Improvements

  • #​6215 FileTarget - Added FileLifecycleHooks for extending archive logic. (@​Dave-Senn)
  • #​6218 ScopeContext - Optimize collection of properties in reverse order. (@​snakefoot)
  • #​6230 PropertyTypeConverter - Disable legacy TypeDescriptor when AOT. (@​snakefoot)
  • #​6231 Replacing ProcessInfo-LayoutRenderer with ProcessStart-LayoutRenderer. (@​snakefoot)
  • #​6229 GarbageCollectorInfoLayoutRenderer - WorkingSet + Format. (@​snakefoot)
  • #​6246 AsyncTaskTarget - Added Jitter on Retry to reduce thundering herd. (@​snakefoot)
  • #​6248 AsyncTaskTarget - Changed Jitter to use Stopwatch instead of TickCount. (@​snakefoot)
  • #​6245 AsyncTaskTarget - Refactor to reduce code complexity. (@​snakefoot)
  • #​6148 AppEnvironmentWrapper - Return Unknown_ProcessId when empty ProcessName. (@​snakefoot)
  • #​6187 ConfigurationItemFactory - Marked ParseMessageTemplates as obsolete. (@​snakefoot)
  • #​6243 ConditionParser - Marked as obsolete, so it can become internal. (@​snakefoot)
  • #​6087 Target - Reduce code complexity of WriteAsyncLogEvents. (@​snakefoot)
  • #​6200 SimpleLayout - Marked Renderers-property as obsolete. (@​snakefoot)
  • #​6239 LogFactory - FlushAsync and DisposeAsync with explict usage of CancellationToken.None. (@​snakefoot)

Release notes for NLog v6.2: https://nlog-project.org/2026/08/16/nlog-6-2-aot-build-size.html

Commits viewable in compare view.

Updated Sentry from 6.8.0 to 6.9.0.

Release notes

Sourced from Sentry's releases.

6.9.0

Features ✨

  • feat: Allow users to control Mechanism.Handled for captured exceptions by @​vladbrincoveanu in #​5449

Fixes 🐛

  • fix(serilog): logs from application namespaces beginning with "Sentry" are discarded by @​jamescrosswell in #​5456
  • fix: rate limit on one data category no longer blocks all others by @​jamescrosswell in #​5482

Dependencies ⬆️

Deps

  • chore(deps): update Native SDK to v0.16.3 by @​github-actions in #​5486
  • chore(deps): update Cocoa SDK to v9.26.0 by @​github-actions in #​5485
  • chore(deps): update Cocoa SDK to v9.25.0 by @​github-actions in #​5472
  • chore(deps): update Native SDK to v0.16.2 by @​github-actions in #​5477
  • chore(deps): update Java SDK to v8.52.0 by @​github-actions in #​5471
  • chore(deps): update Cocoa SDK to v9.24.0 by @​github-actions in #​5460
  • chore(deps): update Java SDK to v8.51.0 by @​github-actions in #​5457
  • chore(deps): update Native SDK to v0.16.1 by @​github-actions in #​5459
  • chore(deps): update Native SDK to v0.16.0 by @​github-actions in #​5452
  • chore(deps): update Java SDK to v8.50.1 by @​github-actions in #​5441
  • chore(deps): update CLI to v3.6.2 by @​github-actions in #​5443
  • chore(deps): update Cocoa SDK to v9.23.0 by @​github-actions in #​5442

Other

  • ref: migrate Cocoa bindings from PrivateSentrySDKOnly to SentryObjCSDK.internal by @​jamescrosswell in #​5409

Commits viewable in compare view.

Updated SQLitePCLRaw.bundle_e_sqlite3 from 3.0.4 to 3.0.5.

Release notes

Sourced from SQLitePCLRaw.bundle_e_sqlite3's releases.

3.0.5

Update the lib dependency for SQLitePCLRaw.bundle_e_sqlite3 to package ID SQLite version 3.53.4.

Commits viewable in compare view.

Updated System.Configuration.ConfigurationManager from 10.0.10 to 10.0.11.

Release notes

Sourced from System.Configuration.ConfigurationManager's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.IO.Ports from 10.0.10 to 10.0.11.

Release notes

Sourced from System.IO.Ports's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Management from 10.0.10 to 10.0.11.

Release notes

Sourced from System.Management's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Xaml.Behaviors.Avalonia from 12.0.5 to 12.0.7.

Release notes

Sourced from Xaml.Behaviors.Avalonia's releases.

12.0.7

What's Changed

Full Changelog: wieslawsoltes/Xaml.Behaviors@v12.0.6...v12.0.7

12.0.6

What's Changed

New Contributors

Full Changelog: wieslawsoltes/Xaml.Behaviors@v12.0.5...v12.0.6

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the minor-and-patch group with 14 updates
b0d4cfe 
Bumps Avalonia.Controls.DataGrid from 12.1.0 to 12.1.2
Bumps Daqifi.Core from 1.3.0 to 1.7.0
Bumps Microsoft.Data.Sqlite from 10.0.10 to 10.0.11
Bumps Microsoft.EntityFrameworkCore from 10.0.10 to 10.0.11
Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.10 to 10.0.11
Bumps Microsoft.EntityFrameworkCore.Tools from 10.0.10 to 10.0.11
Bumps Microsoft.Extensions.Http from 10.0.10 to 10.0.11
Bumps NLog from 6.1.4 to 6.2.0
Bumps Sentry from 6.8.0 to 6.9.0
Bumps SQLitePCLRaw.bundle_e_sqlite3 from 3.0.4 to 3.0.5
Bumps System.Configuration.ConfigurationManager from 10.0.10 to 10.0.11
Bumps System.IO.Ports from 10.0.10 to 10.0.11
Bumps System.Management from 10.0.10 to 10.0.11
Bumps Xaml.Behaviors.Avalonia from 12.0.5 to 12.0.7

---
updated-dependencies:
- dependency-name: Avalonia.Controls.DataGrid
  dependency-version: 12.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Daqifi.Core
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: System.IO.Ports
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: System.Management
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Data.Sqlite
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Tools
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.Http
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: NLog
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Sentry
  dependency-version: 6.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: SQLitePCLRaw.bundle_e_sqlite3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: System.Configuration.ConfigurationManager
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Xaml.Behaviors.Avalonia
  dependency-version: 12.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Tools
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Sentry
  dependency-version: 6.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: SQLitePCLRaw.bundle_e_sqlite3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Xaml.Behaviors.Avalonia
  dependency-version: 12.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 31, 2026
This was referenced Aug 31, 2026
Closed
Merged
tylerkron added a commit that referenced this pull request Aug 31, 2026
@tylerkron @claude
fix(ci): count lock files as evidence a claimed bump landed
fe4eaed 
check_dependabot_claims.py only looked at .csproj PackageReference pins,
so a transitive-only update — a security bump to something no csproj
names — would have failed the check. That is the most costly PR to block
on a false positive.

Lock files are safe to trust here: in #130 the lock file recorded
Daqifi.Core at 1.3.0 right alongside the csproj, because the bump landed
nowhere. Re-verified against the repo's real Dependabot PRs — still
passes #93/#95/#96, still fails #130 on all ten unapplied claims.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
tylerkron added a commit that referenced this pull request Aug 31, 2026
@tylerkron @claude
fix(ci): check a claimed bump in every project that pins it, not just…
582c9af 
… one

Qodo, correctly: accepting a claim because SOME manifest reached the new
version lets a grouped multi-directory PR move one head and leave another
stale. Avalonia.Fonts.Inter is pinned by three projects here, so that is a
real input shape, not a hypothetical.

Now every project pinning the package must be at the claimed version —
scoped to the `directories` Dependabot actually manages, read from
dependabot.yml at check time. The scope matters in both directions: the
iOS head is not managed, so its pins drift on purpose and must not fail a
PR that could never have touched them; and if the list grows later, the
check grows with it. An unreadable config is exit 2, never a silently
widened scope.

Qodo's suggested fix — carrying per-claim directory context out of the PR
body — does not work: Dependabot dedupes a package across directories, so
a grouped body states each bump once regardless of how many directories
it touches.

Lock files stay evidence-only, never grounds for failure. A legitimate
single-directory PR leaves the other directories' lock files recording
the old transitive version (#93 changed only Daqifi.Avalonia/), so
failing on that would reject good PRs.

Re-verified against the repo's real Dependabot PRs: passes #93/#95/#96,
fails #130 on all ten unapplied claims, and the scope correctly excludes
the iOS head. Self-test grows to 28 cases, including Qodo's exact
scenario.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
tylerkron added a commit that referenced this pull request Aug 31, 2026
@tylerkron @claude
chore(deps): make Daqifi.Core updates visible instead of silently ski…
c544a54 
…pped (#137)

* chore(deps): make Daqifi.Core updates visible instead of silently skipped

Daqifi.Core sat at 1.3.0 for five weeks while four releases shipped, and
nothing said so. The assumption was that Dependabot had never opened a PR
for it. It had — twice — but never in a way anyone could see:

  #93  bumped Core 1.3.0 -> 1.4.0, titled "the minor-and-patch group with
       3 updates"; Core appears nowhere in the title.
  #95  superseded it with 1.3.0 -> 1.5.0, titled after Avalonia.
  08-17 Dependabot auto-closed #95 and opened no replacement. Two weeks of
       silence while 1.6.0 and 1.7.0 shipped.
  #130 announced Core 1.3.0 -> 1.7.0 in its body and never touched the
       csproj. Ten of its fourteen announced updates are missing from the
       diff.

The NU1605 downgrade theory does not explain it: Core 1.4.0/1.5.0/1.6.0
all depend on System.IO.Ports 10.0.10, exactly what was pinned. Only 1.7.0
raised the floor.

Three guards, one per failure:

- Daqifi.Core is excluded from the minor-and-patch group, so it always
  gets its own "Bump Daqifi.Core from X to Y" PR — visible in a PR list,
  and not droppable from a group whose other members moved.
- check_dependabot_claims.py fails a Dependabot PR whose body claims a
  bump its manifests do not show. Verified against this repo's history:
  passes #93/#95/#96, fails #130 on all ten unapplied claims.
- check_core_drift.py compares the pin against nuget.org weekly and files
  a rolling issue, independent of Dependabot having done anything at all.

Both guards ship with self-tests, and build.yml now runs every
.github/scripts self-test on each push and PR — without that, these two
would only be exercised on a Dependabot PR or on a Monday.

.github/dependency-updates/README.md records the investigation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(ci): count lock files as evidence a claimed bump landed

check_dependabot_claims.py only looked at .csproj PackageReference pins,
so a transitive-only update — a security bump to something no csproj
names — would have failed the check. That is the most costly PR to block
on a false positive.

Lock files are safe to trust here: in #130 the lock file recorded
Daqifi.Core at 1.3.0 right alongside the csproj, because the bump landed
nowhere. Re-verified against the repo's real Dependabot PRs — still
passes #93/#95/#96, still fails #130 on all ten unapplied claims.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(ci): check a claimed bump in every project that pins it, not just one

Qodo, correctly: accepting a claim because SOME manifest reached the new
version lets a grouped multi-directory PR move one head and leave another
stale. Avalonia.Fonts.Inter is pinned by three projects here, so that is a
real input shape, not a hypothetical.

Now every project pinning the package must be at the claimed version —
scoped to the `directories` Dependabot actually manages, read from
dependabot.yml at check time. The scope matters in both directions: the
iOS head is not managed, so its pins drift on purpose and must not fail a
PR that could never have touched them; and if the list grows later, the
check grows with it. An unreadable config is exit 2, never a silently
widened scope.

Qodo's suggested fix — carrying per-claim directory context out of the PR
body — does not work: Dependabot dedupes a package across directories, so
a grouped body states each bump once regardless of how many directories
it touches.

Lock files stay evidence-only, never grounds for failure. A legitimate
single-directory PR leaves the other directories' lock files recording
the old transitive version (#93 changed only Daqifi.Avalonia/), so
failing on that would reject good PRs.

Re-verified against the repo's real Dependabot PRs: passes #93/#95/#96,
fails #130 on all ten unapplied claims, and the scope correctly excludes
the iOS head. Self-test grows to 28 cases, including Qodo's exact
scenario.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(ci): measure Core drift from the oldest pin, not the first one read

Same class of bug Qodo found in the sibling guard: check_core_drift.py
returned the first manifest pinning Daqifi.Core and stopped. Two projects
pinning it at different versions would report whichever happened to be
read first — which could report "up to date" while another project sat
four releases back.

Drift is now measured from the oldest pin, with disagreeing pins called
out explicitly, and the verdict no longer depends on manifest order.
Today only Daqifi.Avalonia.csproj pins Core, so this changes nothing
about the current repo; it stops the guard going quiet the moment that
is no longer true.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* style(ci): early-continue the lock-file walk instead of a wide ternary

Drops a 92-character line to within the file's own width; no behaviour
change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(ci): keep every Daqifi.Core reference, not one per project file

Qodo, correctly: pinned_versions keyed by manifest path, so a second
reference to the package in the SAME project overwrote the first.
Conditional ItemGroups per framework or RID are an ordinary MSBuild
shape, and since drift is measured from the oldest pin, a newer
reference could hide an older one and report the repo current while a
conditional pin sat four releases back.

It now returns every (version, manifest) pair. Ties resolve by manifest
name rather than filesystem order, so the reported file is stable across
runs.

check_dependabot_claims.py does not share this: it keeps a set of
versions per package per file, so a duplicate reference at a stale
version already fails the claim.

Tests cover both orderings of a doubly-referenced project — the verdict
must not depend on which reference is read last.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@tylerkron tylerkron mentioned this pull request Aug 31, 2026
Merged
tylerkron added a commit that referenced this pull request Aug 31, 2026
@tylerkron @claude
deps: explain why Dependabot PRs land red, and add the one command th…
97540c6 
…at fixes them (#140)

* deps: document the lock-file commit every shared-library Dependabot PR needs, and script it

#139 left a decision open: the Android head is in Dependabot's `directories`
but Dependabot cannot refresh its packages.lock.json, so the choice was
between documenting a manual refresh and dropping the head the way the iOS
head is dropped. This takes the first option, because investigating it turned
up a bigger problem that decides the question.

Four of the five app lock files reach their packages through a
ProjectReference to Daqifi.Avalonia and record its full transitive closure.
Dependabot rewrites the lock file only in the directory whose manifest it
edited. So a one-line bump in the shared library invalidates five lock files
and refreshes one, and locked mode fails the other four with NU1004. That is
23 of the 28 packages managed here, and it is the current state of the repo:
#96 and #130 are both red on it now, on the Android and iOS heads alike.

That refutes the alternative. Dropping /Daqifi.Avalonia.Android would fix
nothing — its NU1004 comes from the ProjectReference closure, not from its own
two pins, and the iOS head proves it by already being out of `directories` and
failing identically. The guard offered as cover cannot help either:
avalonia-graph `needs: [desktop, android, ios]`, so it is SKIPPED on exactly
the PRs in question. Dropping the head would only cost the one automated watch
on Avalonia.Android.

Reproduced on the pinned SDK 10.0.302 by doing what Dependabot does — bump
Sentry 6.8.0 -> 6.9.0 in the shared library, refresh only its own lock file,
then restore each head in locked mode. All four fail NU1004; the new script
makes all four pass.

- refresh_lock_files.sh regenerates all six lock files. It refuses to do a
  partial job: wrong SDK or a missing android/ios workload exits 2 without
  writing, because a half-refresh looks finished and leaves the skipped head
  failing NU1004 anyway. $DOTNET is authoritative rather than one candidate
  among several. It iterates projects rather than the slnx, which does not
  contain AvaloniaCapture, and never passes -r, which would prune the lock
  file to one RID.
- test_refresh_lock_files.py drives it with a stub dotnet across four refusal
  cases and asserts nothing is written. Picked up by the existing `scripts`
  job, which globs test_*.py. Verified to fail when the refusal is removed.
- The README section that deferred this decision now records it, and the
  dependabot.yml comment says which PRs are affected before someone tries to
  merge one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(ci): roll back the lock files when a refresh fails partway

Qodo review on #140, finding 2. The preflight refuses to start without the
pinned SDK and both workloads, but once restores begin they run one project at
a time — so a failure on the fourth left the first three already rewritten.
That is the same partial refresh the preflight exists to prevent, arriving by a
different door, and it looks like an ordinary refresh diff on the way out.

The script now snapshots every lock file before the first restore and rolls all
of them back on failure, exiting 1. The snapshot is of the WORKING TREE, not
HEAD: on a Dependabot branch the shared library's lock file is already
legitimately modified, and rolling back to HEAD would discard Dependabot's own
work along with ours.

Exit codes are now 0 refreshed / 1 a restore failed, rolled back / 2 could not
run, which lines up with the contract the other scripts here follow.

The self-test grows a rollback group: a stub dotnet that mutates each lock file
it restores and fails on the third. It carries a CONTROL case whose stub never
fails, because a rollback test whose stub never wrote anything would pass
without proving anything. Verified to fail when the rollback call is removed —
three lock files left modified.

Also records what the review's other finding got wrong. --force-evaluate IS
what overrides RestoreLockedMode, so CI=true does not block the refresh.
NuGet's own NU1004 text says so, and it is verified: same state, obj cleared,
CI=true, RestoreLockedMode evaluating true — a plain restore fails NU1004 and
the same restore with --force-evaluate regenerates the lock file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@tylerkron

tylerkron commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Closing as superseded by #138.

Verified rather than assumed: this PR's four applied csproj bumps are a strict subset of #138's eleven.

package #130 #138
Xaml.Behaviors.Avalonia 12.0.5 → 12.0.7 same
Microsoft.EntityFrameworkCore.Tools 10.0.10 → 10.0.11 same
Sentry 6.8.0 → 6.9.0 same
SQLitePCLRaw.bundle_e_sqlite3 3.0.4 → 3.0.5 same
Avalonia.Controls.DataGrid — 12.1.0 → 12.1.2
Microsoft.Data.Sqlite — 10.0.10 → 10.0.11
Microsoft.EntityFrameworkCore — 10.0.10 → 10.0.11
Microsoft.EntityFrameworkCore.Sqlite — 10.0.10 → 10.0.11
Microsoft.Extensions.Http — 10.0.10 → 10.0.11
NLog — 6.1.4 → 6.2.0
System.Configuration.ConfigurationManager — 10.0.10 → 10.0.11

Nothing here is lost by closing it, and keeping both open only guarantees that whichever merged second needed another rebase.

#138 has been rebased onto main (this branch was 43 commits behind) and carries the lock-file refresh that fixes the NU1004 all three heads were failing with — the one documented at the top of .github/dependabot.yml.

For the record, the Daqifi.Core 1.3.0 -> 1.7.0 this PR announced in its body and never applied — the incident that check_dependabot_claims.py and the Daqifi.Core group exclusion exist for — is moot now: main pins 1.7.0 already.

@tylerkron tylerkron closed this Sep 2, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/nuget/Daqifi.Avalonia/minor-and-patch-c816ff628e branch September 2, 2026 22:35
@tylerkron tylerkron mentioned this pull request Sep 2, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tylerkron