chore(deps): bump the nuget group with 33 updates (re-cut of #649) - #650
Merged
Conversation
Re-cut of dependabot's #649, which was generated against e6d24ea and so conflicted with #647: both sides raise Testcontainers to 4.14.0, but #647 also added the GHSA-q939-rpr3-3284 comment above the three pins. Resolved by keeping that comment and taking dependabot's version for every other package. #649 is closed in favour of this branch — `@dependabot rebase` is unreliable here (it took 26 comments to answer on #642). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UPfL1CDdfcVaNaYiYGonH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-cut of dependabot's #649, which cannot be merged as-is.
Why #649 conflicts
Not a regression from the #644 grouping change — a race. Timeline (UTC):
main=e6d24eae6d24eaBoth sides land on Testcontainers 4.14.0; the only real difference is the three-line
GHSA-q939-rpr3-3284 comment that #647 added above the pins. Git cannot merge that automatically.
Resolution
Cherry-picked
e549f0eonto currentmain, keeping #647's comment and taking dependabot'sversion for every other package.
Directory.Packages.propsand.config/dotnet-tools.jsonare otherwise byte-identical to what dependabot produced — 33 updates, nothing dropped or added.
@dependabot rebasewas tried first and ignored; on #642 it took 26 comments before the botanswered at all, so this is re-cut by hand instead.
Verification
dotnet build -c Release— succeeded, 0 warnings (so NuGetAudit is clean)--collect "XPlat Code Coverage"smoke — coverlet.collector 8.0.1 → 10.0.1 is a major andboth CI workflows collect coverage, so this was checked explicitly; cobertura still emits
Closes #649.