Repository navigation
Update safe NuGet dependencies - #958
Merged
Merged
Conversation
nopara73
added
type: chore
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
.NET test coverage
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The grouped update in #957 cannot build because ImageSharp 3.2.0 and Drawing 2.2.0 add license validation without a configured Six Labors license. Its Dependency Review also reports five ImageSharp advisories. This integration takes the four independent updates while leaving #957 open for the licensing decision.
Only the two package manifests change. Official NuGet catalog hashes and package signatures verify the old and new versions; the MIT/Apache licenses are unchanged for these updates. NBitcoin's new .NET 10 asset matches the pinned SDK and verified production runtime. Quartz retains the in-memory store, UTC schedules, startup triggers and cancellation contracts; its optional database history migration does not apply here. No source API migration is required.
Verification: audited all-transitive restore at low severity, strict frontend checks/build, clean Release build with zero warnings/errors, and Node-free publish with Node/npm denied and exact parity for 33 scripts plus three generated dialog stylesheets pass. Focused Windows tests pass 117/117 with no skips: published signature vectors, immutable Nostr retries, receipts, cancellation, UTC schedules, API/Swagger contracts, image input defenses, and desktop/mobile footer and Swagger UI behavior. Full Windows Release coverage passes 2,846/2,846 with no skips, 81.90% line and 66.97% branch coverage; source fingerprints stayed unchanged and no assets were rebuilt during testing. Exact-head Linux CI passes all 2,846 tests with 80.6% line and 67.2% branch coverage; CodeQL and Dependency Review also pass, all on original attempt 1. The actual merged tree equals the validated source tree. Existing ImageSharp advisory exceptions remain unchanged; their TIFF/ICC/encoder preconditions are checked separately.
Auto Deploy completed on merged commit eecbce5. Independent readback verifies the active service, expected published packages, local/public health, read-only SQLite integrity, exact served script bytes, CORS and 404 behavior, feeds, and optional artwork API/Swagger contracts. Production-owned configuration and database paths retain their identity and permissions. The IndexNow ledger retains earlier acknowledgements and its key endpoint; its inode changes through the existing atomic persistence path. No manual production data, credential, configuration, runtime or SDK change was made.
Official sources: NBitcoin exact source comparison, Quartz 4.4 release, Quartz 4.3–4.4 migration, Swashbuckle 10.3 release, xUnit adapter 4.0.1 release.
Held updates: ImageSharp 3.2.0 and Drawing 2.2.0 both explicitly add license enforcement. No license bypass, new advisory suppression, secret or production configuration change is included.