From f07ce58fa1d99e3c6297c15d320d1b9d9f161633 Mon Sep 17 00:00:00 2001
From: Paul Davis <paul.davis@flexjet.com>
Date: Sun, 3 May 2026 22:14:55 -0400
Subject: [PATCH] fix(deps): migrate FluentAssertions to AwesomeAssertions 8.x
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #98.

FluentAssertions v8+ is governed by the Xceed Commercial license and emits a runtime warning on every test run requiring a paid subscription for commercial use. AwesomeAssertions is the community Apache 2.0 fork of FluentAssertions v7.

Why AwesomeAssertions 8.x specifically (not 9.x or alternatives):
- AwesomeAssertions 8.x kept the FluentAssertions namespace verbatim — package rename only, ZERO source changes across all 19 test files. v9 renames to AwesomeAssertions namespace; deferred to a follow-up PR.
- 6 named maintainers + Tidelift backing + 19 releases since the early-2025 fork = strongest fork-as-strategy position in recent .NET history (case studies: Moq, IdentityServer4, ImageSharp).
- API-compatible exit path remains: if the fork stalls in 2027, switch to Shouldly or paid Xceed without re-paying the namespace cost.
- Shouldly was considered but requires rewriting every assertion site (different invocation model: x.ShouldBe(y) vs x.Should().Be(y); no BeOneOf, ThrowAsync invocation flips).

Changes:
- ExpertiseApi.Tests.csproj: PackageReference Include="FluentAssertions" Version="8.*" → Include="AwesomeAssertions" Version="8.*"
- .github/dependabot.yml: added ignore rule for the original FluentAssertions package so future Dependabot PRs cannot re-introduce the commercial v8

Validation:
- dotnet build: 0 errors, 219 warnings (same baseline)
- 86/86 unit tests pass
- No Xceed commercial-license warning in test output
---
 .github/dependabot.yml                             |  6 ++++++
 tests/ExpertiseApi.Tests/ExpertiseApi.Tests.csproj | 11 ++++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b34b0ca..fc88d32 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,6 +12,12 @@ updates:
     commit-message:
       prefix: chore
       include: scope
+    ignore:
+      # FluentAssertions v8+ is governed by the Xceed Commercial license and
+      # requires a paid subscription for commercial use. This repo migrated to
+      # AwesomeAssertions (Apache 2.0 community fork). Any future Dependabot PR
+      # that tries to re-add FluentAssertions must be rejected.
+      - dependency-name: "FluentAssertions"
     groups:
       ef-core:
         patterns:
diff --git a/tests/ExpertiseApi.Tests/ExpertiseApi.Tests.csproj b/tests/ExpertiseApi.Tests/ExpertiseApi.Tests.csproj
index b10c04a..3d4ec01 100644
--- a/tests/ExpertiseApi.Tests/ExpertiseApi.Tests.csproj
+++ b/tests/ExpertiseApi.Tests/ExpertiseApi.Tests.csproj
@@ -15,7 +15,16 @@
     <PackageReference Include="Microsoft.Extensions.Diagnostics.Testing" Version="10.5.0" />
     <PackageReference Include="Testcontainers.PostgreSql" Version="4.*" />
     <PackageReference Include="NSubstitute" Version="5.*" />
-    <PackageReference Include="FluentAssertions" Version="8.*" />
+    <!--
+      AwesomeAssertions is the community Apache 2.0 fork of FluentAssertions v7.
+      Pinning at the 8.x line preserves the FluentAssertions namespace verbatim,
+      so existing `using FluentAssertions;` statements continue to compile with
+      zero source changes. v9 renamed the namespace to AwesomeAssertions; defer
+      that sweep to a follow-up PR. Dependabot has an explicit ignore rule for
+      the original FluentAssertions package (which is now Xceed-commercial v8+)
+      so it cannot re-land here.
+    -->
+    <PackageReference Include="AwesomeAssertions" Version="8.*" />
     <PackageReference Include="xunit" Version="2.9.*" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.*">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>