Skip to content

Bump CrispyWaffle and CrispyWaffle.I18n.PtBr#348

Merged
guibranco merged 2 commits into
mainfrom
dependabot/nuget/BancosBrasileiros.MergeTool/multi-9a8841acb9
Jul 21, 2026
Merged

Bump CrispyWaffle and CrispyWaffle.I18n.PtBr#348
guibranco merged 2 commits into
mainfrom
dependabot/nuget/BancosBrasileiros.MergeTool/multi-9a8841acb9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated CrispyWaffle from 10.2.9 to 10.2.12.

Release notes

Sourced from CrispyWaffle's releases.

10.2.12

What's Changed

Full Changelog: guibranco/CrispyWaffle@v10.2.11...v10.2.12

10.2.11

What's Changed

Full Changelog: guibranco/CrispyWaffle@v10.2.10...v10.2.11

10.2.10

What's Changed

Full Changelog: guibranco/CrispyWaffle@v10.2.9...v10.2.10

Commits viewable in compare view.

Updated CrispyWaffle.I18n.PtBr from 10.2.9 to 10.2.12.

Release notes

Sourced from CrispyWaffle.I18n.PtBr's releases.

10.2.12

What's Changed

Full Changelog: guibranco/CrispyWaffle@v10.2.11...v10.2.12

10.2.11

What's Changed

Full Changelog: guibranco/CrispyWaffle@v10.2.10...v10.2.11

10.2.10

What's Changed

Full Changelog: guibranco/CrispyWaffle@v10.2.9...v10.2.10

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump CrispyWaffle and CrispyWaffle.I18n.PtBr
2aa92ad 
Bumps CrispyWaffle from 10.2.9 to 10.2.12
Bumps CrispyWaffle.I18n.PtBr from 10.2.9 to 10.2.12

---
updated-dependencies:
- dependency-name: CrispyWaffle
  dependency-version: 10.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: CrispyWaffle.I18n.PtBr
  dependency-version: 10.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET dependencies Pull requests that update a dependency file labels Jul 20, 2026
@dependabot dependabot Bot mentioned this pull request Jul 20, 2026
Closed
@github-actions github-actions Bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jul 20, 2026
@socket-security

socket-security Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedcrispywaffle@​10.2.9 ⏵ 10.2.129410090100100
Updatedcrispywaffle.i18n.ptbr@​10.2.9 ⏵ 10.2.129910090100100

View full report

@socket-security

socket-security Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Low
Potential code anomaly (AI signal): nuget crispywaffle is 65.0% likely to have a medium risk anomaly

Notes: Overall risk is driven by XmlTemplateRender: it loads and transforms XSLT directly from the provided template string with XslCompiledTransform.Load/Transform, which is a high-risk sink if templates are user-influenced (XSLT injection / unsafe transformation execution). Additionally, the library performs an outbound network request to https://api.ipify.org to obtain external IP, which is a privacy/egress concern. Other components (DynamicSerialization, filesystem save/logging, and assembly auto-loading) add general security considerations but are not definitive malware indicators from this snippet alone.

Confidence: 0.65

Severity: 0.68

From: BancosBrasileiros.MergeTool/BancosBrasileiros.MergeTool.csproj → nuget/crispywaffle@10.2.12

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/crispywaffle@10.2.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@codacy-production

codacy-production Bot commented Jul 20, 2026

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@guibranco
guibranco enabled auto-merge (squash) July 21, 2026 01:02
@gstraccini gstraccini Bot added the ☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) label Jul 21, 2026
guibranco
guibranco approved these changes Jul 21, 2026
View reviewed changes

@guibranco guibranco left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automatically approved by gstraccini[bot]

@gstraccini gstraccini Bot added 🤖 bot Automated processes or integrations nuget 📦 dependencies Dependencies labels Jul 21, 2026
@sonarqubecloud

sonarqubecloud Bot commented Jul 21, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@guibranco
guibranco merged commit 0190ed8 into main Jul 21, 2026
15 of 18 checks passed
@guibranco
guibranco deleted the dependabot/nuget/BancosBrasileiros.MergeTool/multi-9a8841acb9 branch July 21, 2026 01:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@guibranco guibranco guibranco approved these changes
@gstraccini gstraccini[bot] gstraccini[bot] approved these changes

Assignees

@guibranco guibranco

Labels

☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) 🤖 bot Automated processes or integrations 📦 dependencies Dependencies dependencies Pull requests that update a dependency file .NET nuget size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@guibranco