chore(deps): update dependency polyfill to 9.9.0#878
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
DeepSource reviewed changes in the commit range For detailed review results, please see the PR on DeepSource ↗ PR Report Card
Code Review Summary
How are these analyzer statuses calculated?Administrators can configure which issue categories are reported and cause analysis to be marked as failed when detected. This helps prevent bad and insecure code from being introduced in the codebase. If you're an administrator, you can modify this in the repository's settings. |
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferences |
13c0c37 to
4eda3ce
Compare
4eda3ce to
7313a8b
Compare
Changes SummaryThis PR updates the Polyfill NuGet package dependency from version 9.5.0 to 9.7.1. The Polyfill library provides backward compatibility features for newer C# language features in older target frameworks, which is critical for this Roslyn analyzer project targeting netstandard2.0. Type: config Components Affected: build-configuration, compiler-dependencies Files Changed
Architecture Impact
Risk Areas: Potential API changes or behavioral differences in Polyfill 9.7.1 that could affect analyzer compilation, New polyfills or removed polyfills might affect code that relies on specific backward compatibility features, Build and test pipeline should verify compatibility with the updated version Suggestions
Full review in progress... | Powered by diffray |
7313a8b to
133af80
Compare
Changes SummaryThis PR updates the Polyfill NuGet package dependency from version 9.5.0 to 9.7.2 in the compiler build targets. This is an automated dependency update by Renovate that brings in minor version improvements to the Polyfill library used in this C# analyzer project. Type: config Components Affected: build-configuration, compiler-dependencies Files Changed
Architecture Impact
Risk Areas: Compatibility with existing C# code using polyfills, Build process stability, Potential API changes in Polyfill library between minor versions Suggestions
Full review in progress... | Powered by diffray |
133af80 to
8b99245
Compare
8b99245 to
45eea1a
Compare
45eea1a to
baeb67d
Compare
Changes SummaryThis PR updates the Polyfill NuGet package dependency from version 9.5.0 to 9.7.5. The change is an automated dependency update by Renovate bot that modifies the package version specification in the MSBuild props file used for compiler targets. Type: config Components Affected: build-configuration, dependencies Files Changed
Architecture Impact
Risk Areas: Potential behavioral changes or bug fixes in Polyfill library versions 9.5.1 through 9.7.5, Compatibility with existing code that may rely on specific polyfill behaviors from version 9.5.0 Suggestions
Full review in progress... | Powered by diffray |
baeb67d to
8271778
Compare
8271778 to
4020ff8
Compare
4020ff8 to
061be90
Compare
061be90 to
d973c4e
Compare
9ccadf8 to
51b992e
Compare
51b992e to
a1b07b5
Compare
rjmurillo
left a comment
There was a problem hiding this comment.
Polyfill 9.5.0 to 9.9.0: patch update, compiler polyfills only. All CI checks pass. Safe to merge.
…915) ## Summary - Disable dependabot for NuGet, consolidate to renovate-only - Consolidate 4 overlapping auto-approve/merge workflows into 1 - Update renovate.json with proper package grouping and exclusion rules - Add `docs/dependency-management.md` documenting package categories and upgrade policies ## Problem Both dependabot and renovate created duplicate PRs for every NuGet update. Dependabot NuGet PRs used "Bump X from A to B" titles that failed the required "Validate PR title" check (conventional commits required), so they could never auto-merge. Four overlapping auto-approve/merge workflows competed with each other, one of which had a broken step referencing a nonexistent step output (`steps.cpr.outputs`). ## Changes ### Dependabot config (`.github/dependabot.yml`) Removed the `nuget` ecosystem. Retained `github-actions` ecosystem (dependabot's fetch-metadata action provides update-type classification for major version gating). ### Workflow consolidation Deleted 3 workflows, kept and expanded 1: - **Deleted:** `auto-approve-and-merge-renovate.yml`, `dependabot-auto-approve.yml`, `dependabot-auto-merge.yml` - **Kept:** `dependabot-approve-and-auto-merge.yml` with separate jobs for dependabot and renovate ### Renovate config (`renovate.json`) - Added `ignoreDeps` for `Microsoft.CodeAnalysis.*` core packages (same policy as former dependabot ignore list) - Grouped `BenchmarkDotNet` + `Perfolizer` as `benchmark-tooling` with `automerge: false` (coordinated updates required due to transitive dependency constraints) - Disabled `System.CommandLine` and `System.CommandLine.Rendering` updates until PerfDiff rewrite (#914) ### Documentation New `docs/dependency-management.md` covers: - Package categories (shipped, build-time, test, benchmark, tools, infrastructure) - Upgrade policies per category - The VersionOverride pattern for non-shipped projects - Lessons from the CS8032/SCI incident (#850) ## Bot PR cleanup performed | Action | PRs | |--------|-----| | Closed (dependabot duplicates) | #903, #902, #890, #880, #909 | | Closed (superseded) | #877 (Meziantou 2.0.302, superseded by 3.x) | | Closed (build failures) | #834 (BenchmarkDotNet), #832 (Perfolizer) | | Closed (PerfDiff breakage) | #821 (dotnet monorepo) | | Merged | #878, #882, #881, #879, #883, #884 | ## Validation - `dotnet build /p:PedanticMode=true`: 0 warnings, 0 errors - `dotnet format`: no changes needed - Tests cannot run locally (machine has .NET 10 only, test TFM is net8.0); CI will validate ## Test plan - [ ] CI build passes - [ ] All tests pass - [ ] No new bot PRs from dependabot for NuGet packages - [ ] Renovate correctly picks up future dependency updates - [ ] Auto-approve/merge workflow fires for new renovate PRs 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Consolidated dependency-update process: moved NuGet management to Renovate, removed several automated auto-approve/auto-merge workflows for bot PRs, and adjusted automerge/approval behavior and rules. * Renovate configuration updated with new groups, ignore lists, and automerge adjustments. * **Documentation** * Added a dependency management guide detailing categories, upgrade policies, configuration patterns, and workflow recommendations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>
This PR contains the following updates:
9.5.0→9.9.0Release Notes
SimonCropp/Polyfill (Polyfill)
v9.9.0Compare Source
v9.8.1Compare Source
v9.8.0Compare Source
v9.7.7Compare Source
v9.7.6Compare Source
v9.7.5Compare Source
v9.7.4Compare Source
v9.7.3Compare Source
v9.7.2Compare Source
v9.7.1Compare Source
v9.7.0Compare Source
v9.6.0Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.