chore(deps): update dependency polyfill to 9.4.1

[thomhurst]

This PR contains the following updates:

Package	Type	Update	Change
Polyfill	nuget	minor	9.3.4 → 9.4.1

---

Release Notes

SimonCropp/Polyfill (Polyfill)

v9.4.1

Compare Source

v9.4.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[Copilot]

Pull request overview

This PR updates the Polyfill NuGet package dependency from version 9.3.4 to 9.4.0, representing a minor version increment. This is an automated dependency update generated by Renovate Bot to keep the project's dependencies current.

Key Changes

• Minor version bump of the Polyfill package from 9.3.4 to 9.4.0

[claude]

Pull Request Review

Summary

This PR updates the Polyfill dependency from 9.3.4 to 9.4.0 - a minor version update.

Review Analysis

✅ Code Quality: N/A - Dependency update only
✅ Breaking Changes: None expected (minor version bump follows SemVer)
✅ Security: No security concerns identified
✅ Performance: No performance impact expected
✅ Test Coverage: Existing tests should validate compatibility

Observations

1. Scope: Single line change in Directory.Packages.props - minimal risk
2. Usage: Polyfill is used across multiple TUnit projects (Engine, Core, Assertions, SourceGenerator, Analyzers)
3. Purpose: Provides polyfills for modern .NET APIs on older frameworks - aligns with TUnit's multi-targeting strategy
4. CI/CD: Automerge is enabled - tests should validate before merge

Recommendations

✅ Approve - This is a low-risk dependency update that:

• Follows semantic versioning (minor update)
• Aligns with TUnit's philosophy of using modern .NET features
• Has been generated by Renovate Bot (automated dependency management)
• Will be validated by CI before automerge

Notes for Maintainers

• Ensure all CI checks pass before merge
• No manual testing required beyond automated test suite
• No snapshot updates needed (no source generator or public API changes)
• No dual-mode implementation concerns (dependency-only change)

Verdict: ✅ Safe to merge after CI passes

[claude]

PR Review: Dependency Update - Polyfill 9.3.4 → 9.4.0

✅ Overall Assessment: APPROVED

This is a straightforward dependency update managed by Renovate Bot with minimal risk.

---

📋 Review Findings

✅ Scope & Impact

• Change: Single-line version bump in Directory.Packages.props
• Package: Polyfill (provides modern C# polyfills for older frameworks)
• Impact: Low - Polyfill is used internally with PrivateAssets=all, so no API surface changes
• Type: Minor version update (9.3.4 → 9.4.0)

✅ Code Quality

• Clean change, no code modifications required
• Polyfill is used correctly with embedded attributes (PolyUseEmbeddedAttribute=true)
• Private assets configuration prevents downstream dependency pollution

✅ TUnit-Specific Considerations

Per CLAUDE.md guidelines:

• ✅ No dual-mode implementation needed (dependency-only change)
• ✅ No snapshot updates required (no source generator or API changes)
• ✅ No performance impact expected
• ✅ No AOT/trimming concerns (Polyfill is AOT-compatible)

✅ Security & Compatibility

• ✅ Minor version bump follows SemVer (backward compatible)
• ✅ Polyfill is a well-maintained, trusted package by Simon Cropp
• ✅ No breaking changes expected in minor releases

---

🔍 Testing Recommendations

Since this is a polyfill library (compile-time impact), standard CI checks should cover:

1. All tests pass across target frameworks
2. No build warnings/errors
3. AOT compilation still works

Suggested verification (if not already in CI):

# Standard test suite
dotnet test

# Verify AOT compatibility (if applicable)
dotnet publish -c Release -p:PublishAot=true --use-current-runtime

---

✅ Recommendation

LGTM - Safe to merge once CI passes.

This is a low-risk dependency update with:

• No breaking changes expected
• No code modifications needed
• Automerge is appropriate for this change

Note: Polyfill typically adds new polyfills in minor versions, so 9.4.0 may include additional modern C# features for older frameworks, which could be beneficial for multi-targeting scenarios.

[claude]

Pull Request Review: Polyfill Dependency Update (9.3.4 to 9.4.0)

Overall Assessment: APPROVED

This is a straightforward dependency update managed by Renovate Bot. The change is minimal and low-risk.

---

Review Summary

Change: Updates Polyfill package from version 9.3.4 to 9.4.0 in Directory.Packages.props

Type: Minor version bump (non-breaking change expected)

---

Positive Observations

1. Minimal Surface Area: Single line change in centralized package management
2. Proper Dependency Management: Uses Central Package Management (CPM) via Directory.Packages.props
3. Embedded Attributes: The project correctly uses PolyUseEmbeddedAttribute=true (Directory.Build.props:73) which means polyfills are embedded at compile-time with no runtime dependency
4. Private Assets: Polyfill is properly configured with PrivateAssets=all to avoid leaking into consumers
5. Minor Version: This is a minor version update (9.3.x to 9.4.x), so no breaking changes are expected per semantic versioning

---

Risk Analysis

Risk Level: Very Low

• Polyfill provides compile-time code generation for modern C# features on older frameworks
• Since attributes are embedded (PolyUseEmbeddedAttribute=true), the actual runtime impact is minimal
• The package is used internally across the codebase but does not affect public API surface
• Minor version bumps in the Polyfill library typically add new polyfills without breaking existing ones

---

Testing Recommendations

Standard CI checks should be sufficient, but if you want to be thorough:

• Run full test suite: dotnet test
• Test source generator: dotnet test TUnit.Core.SourceGenerator.Tests
• Verify AOT compatibility: dotnet publish -c Release -p:PublishAot=true

---

TUnit-Specific Compliance

Reviewing against CLAUDE.md requirements:

• No dual-mode changes needed (dependency update only)
• No snapshot updates required (no source generator output changes)
• No public API changes (internal dependency)
• Performance impact: None expected (compile-time only)
• AOT compatibility: Polyfill specifically supports AOT scenarios

---

Recommendation

APPROVE and MERGE once CI passes.

This is a routine maintenance update with minimal risk. The automerge configuration is appropriate for this type of change.

---

Review completed following TUnit CLAUDE.md guidelines

[claude]

Code Review - Polyfill Dependency Update

✅ Summary

This PR updates the Polyfill package from version 9.3.4 to 9.4.0 - a minor version bump that should be low-risk.

📋 Review Findings

✅ Code Quality

• Single-line dependency update in centralized package management (Directory.Packages.props)
• Follows TUnit's centralized package versioning approach
• Clean, straightforward change

✅ Best Practices

• Using Renovate Bot for automated dependency management is a good practice
• Minor version updates typically maintain backward compatibility
• Automerge is enabled, which is appropriate for low-risk dependency updates

✅ Security & Performance

• Polyfill package is from a reputable source (Simon Cropp)
• Used throughout TUnit for providing modern C# features on older frameworks
• No apparent security or performance concerns with a minor version bump

✅ Testing

• CI checks are running (currently in progress)
• This is a minor update, so existing test coverage should be sufficient
• The package is used in multiple projects (Core, Engine, Assertions, Analyzers, etc.)

🔍 Observations

1. Package Usage: Polyfill is used extensively in TUnit:

   • TUnit.Engine (e.g., PolyfillExtensions.cs)
   • TUnit.Core
   • TUnit.Assertions
   • TUnit.Analyzers
   • Source Generators

2. Purpose: Provides polyfills for modern .NET APIs on older framework targets, enabling modern C# syntax across multiple target frameworks

3. Risk Assessment: LOW

   • Minor version update (9.3.4 → 9.4.0)
   • Well-maintained package
   • Automated update from trusted bot
   • CI validation in progress

✅ Recommendation

APPROVE - This is a straightforward dependency update that follows best practices. Once CI checks pass, this PR is safe to merge.

📝 Notes

• No code changes required
• No snapshot updates needed
• No dual-mode implementation considerations (dependency only)
• Automerge is appropriately enabled for this type of change

---

Review conducted following TUnit's CLAUDE.md guidelines

[claude]

Pull Request Review - Polyfill Update (9.3.4 → 9.4.1)

⚠️ Critical Issue Found

Incomplete Version Update: While Directory.Packages.props correctly updates Polyfill to 9.4.1, there is a hardcoded version mismatch in TUnit.Core/TUnit.Core.targets that still references 9.4.0.

File: TUnit.Core/TUnit.Core.targets:11

<_TUnitPolyfillVersion>9.4.0</_TUnitPolyfillVersion>

Required Change:

<_TUnitPolyfillVersion>9.4.1</_TUnitPolyfillVersion>

Impact: This hardcoded version is used when TUnit automatically injects Polyfill for NuGet consumers targeting older frameworks (netstandard2.0, netstandard2.1, or .NET Framework). The version mismatch could cause:

• Consumers to receive an older version (9.4.0) instead of the intended 9.4.1
• Potential inconsistency between TUnit's internal usage and what gets distributed to consumers
• Build warnings or restore issues if package versions conflict

---

✅ What's Correct

1. Central Package Management Update: The Directory.Packages.props change correctly updates the centrally-managed version for internal TUnit projects
2. Minor Version Update: This is a safe minor version bump (9.3.4 → 9.4.1), unlikely to introduce breaking changes
3. Scope: Polyfill is used appropriately with PrivateAssets=all to provide compile-time polyfills without leaking runtime dependencies

---

📋 Additional Verification Needed

Once the version is corrected in TUnit.Core.targets, please verify:

1. Build Success: Run dotnet build -c Release to ensure all projects compile

2. Test Suite: Run dotnet test (excluding TUnit.TestProject integration tests per CLAUDE.md guidelines)

3. Snapshot Tests: If any source generator output changes due to Polyfill updates, run:

   dotnet test TUnit.Core.SourceGenerator.Tests
   dotnet test TUnit.PublicAPI

   And accept any .received.txt files if the changes are expected

4. AOT Compatibility: Since Polyfill provides compile-time polyfills, verify no regressions in Native AOT scenarios (especially important given Rule 5 in CLAUDE.md)

---

🎯 Recommendation

Action Required: Update TUnit.Core/TUnit.Core.targets:11 to reference 9.4.1 to match the version in Directory.Packages.props.

After this fix, the PR should be safe to merge, subject to CI passing. This is a low-risk dependency update once the version consistency is resolved.

---

Review Summary:

• ❌ Cannot approve - Version mismatch must be fixed
• 📊 Risk Level: Low (once corrected)
• 🔧 Fix Required: Single line change in TUnit.Core.targets
• ✅ Otherwise Clean: No code quality, security, or architectural concerns

[claude]

PR Review: Polyfill Dependency Update (9.3.4 → 9.4.1)

✅ Summary

This is a minor dependency update by Renovate Bot that updates the Polyfill package from version 9.3.4 to 9.4.1. The change is minimal and low-risk.

📋 Code Quality & Best Practices

✅ LGTM - The change follows TUnit's centralized dependency management pattern:

• Uses Directory.Packages.props for central package version management (best practice)
• Only touches a single version number in the central location
• No code changes required due to Polyfill's compile-time nature

🔍 Analysis

What is Polyfill?
Polyfill provides C# language feature backports for older target frameworks. TUnit uses it to:

• Enable modern C# features across multiple target frameworks (.NET 6.0+, .NET Framework, etc.)
• Provide polyfills for missing APIs (e.g., TryAdd in TUnit.Engine/Discovery/ReflectionHookDiscoveryService.cs:34, TUnit.Engine/Utilities/ScopedAttributeFilter.cs:34)
• Embedded attributes mode (PolyUseEmbeddedAttribute=true) prevents type conflicts with InternalsVisibleTo

Current Usage:

• Imported in hot-path code (TUnit.Engine/Discovery/ReflectionHookDiscoveryService.cs, TUnit.Engine/Utilities/ScopedAttributeFilter.cs)
• Used globally via Directory.Build.props with PrivateAssets=all
• Automatically included in consumer projects via TUnit.Core.targets

🚀 Performance Considerations

✅ No performance impact expected

• Polyfill is a compile-time-only dependency (embedded attributes)
• No runtime overhead
• Version bump unlikely to affect performance (minor version with no breaking changes listed)

🔒 Security Concerns

✅ Low risk

• Snyk security check: PASSED ✓
• Codacy static analysis: PASSED ✓
• Minor version bump (9.3.4 → 9.4.1) typically includes bug fixes and minor improvements
• Polyfill is a well-maintained package by Simon Cropp (trusted .NET community member)
• No security advisories visible for this version range

🧪 Test Coverage

⏳ CI tests are currently in progress

• All major test suites are running (ubuntu, windows, macos)
• Locale tests running (de-DE, fr-FR, pl-PL)
• CodeQL analysis completed successfully

Expected outcome: Should pass without issues as Polyfill updates are typically backward-compatible and compile-time only.

🎯 TUnit-Specific Considerations

Dual-Mode Compatibility: ✅

• Polyfill affects compile-time only, so both source-generated and reflection modes remain unaffected
• No implementation changes needed in either TUnit.Core.SourceGenerator or TUnit.Engine

Snapshot Testing: ✅ Not applicable

• No source generator output changes expected
• No public API changes expected
• If tests fail, snapshot updates would not be needed for this change

AOT/Trimming: ✅ Safe

• Polyfill uses embedded attributes (PolyUseEmbeddedAttribute=true)
• No new reflection usage introduced
• Compile-time dependency only

📝 Recommendations

1. ✅ Approve once CI passes - This is a routine dependency update
2. ✅ Auto-merge is enabled - Appropriate for this low-risk change
3. ℹ️ Monitor CI results - If any tests fail, investigate whether the failure is related to the Polyfill update (unlikely) or pre-existing issues

🎯 Verdict

APPROVE ✓ - This is a safe, routine dependency update that follows best practices. No code changes required, no breaking changes expected, and CI is validating the change. The use of Renovate Bot for automated dependency updates is excellent practice for keeping dependencies current.

---

Reviewed with TUnit's CLAUDE.md guidelines