Repository navigation
Bump coverlet.collector and 16 others - #39
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps coverlet.collector from 6.0.2 to 6.0.4 Bumps MessagePack from 2.5.187 to 2.5.205 Bumps Microsoft.CodeAnalysis.Analyzers from 3.3.4 to 3.11.0 Bumps Microsoft.CodeAnalysis.CSharp to 4.13.0, 4.14.0 Bumps Microsoft.Extensions.Caching.Memory to 9.0.16, 10.0.8 Bumps Microsoft.Extensions.Configuration from 9.0.0 to 9.0.16 Bumps Microsoft.Extensions.Configuration.Abstractions from 9.0.0 to 9.0.16 Bumps Microsoft.Extensions.Configuration.Binder from 9.0.0 to 9.0.16 Bumps Microsoft.Extensions.DependencyInjection to 9.0.16, 10.0.8 Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 9.0.0 to 9.0.16 Bumps Microsoft.Extensions.Logging to 9.0.16, 10.0.8 Bumps Microsoft.Extensions.Options to 9.0.16, 10.0.8 Bumps Serilog from 4.1.0 to 4.3.1 Bumps Serilog.Sinks.Console from 6.0.0 to 6.1.1 Bumps StackExchange.Redis from 2.8.16 to 2.13.17 Bumps Verify.SourceGenerators from 2.4.0 to 2.5.0 Bumps Verify.Xunit from 28.9.0 to 28.16.0 --- updated-dependencies: - dependency-name: coverlet.collector dependency-version: 6.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: MessagePack dependency-version: 2.5.205 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.CodeAnalysis.Analyzers dependency-version: 3.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.CodeAnalysis.CSharp dependency-version: 4.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.CodeAnalysis.CSharp dependency-version: 4.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Caching.Memory dependency-version: 9.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Options dependency-version: 9.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Caching.Memory dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Options dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Configuration dependency-version: 9.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Configuration.Abstractions dependency-version: 9.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Configuration.Binder dependency-version: 9.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.DependencyInjection dependency-version: 9.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.DependencyInjection dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions dependency-version: 9.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Logging dependency-version: 9.0.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Logging dependency-version: 10.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Serilog dependency-version: 4.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Serilog.Sinks.Console dependency-version: 6.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: StackExchange.Redis dependency-version: 2.13.17 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Verify.SourceGenerators dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Verify.Xunit dependency-version: 28.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
This was referenced Jun 4, 2026
Owner
|
Holding the StackExchange.Redis bump (2.8.16 → 2.13.17): it's a source-breaking change — @dependabot ignore StackExchange.Redis |
2 tasks done
Owner
|
Redis is now on the new Expiration API on main (#42), so future updates are safe again. @dependabot unignore StackExchange.Redis |
Contributor
Author
|
No dependency name (stackexchange.redis) or ignore conditions found to unignore. |
Owner
|
@dependabot recreate |
1 similar comment
Owner
|
@dependabot recreate |
2 tasks done
klomkling
added a commit
that referenced
this pull request
Jun 4, 2026
Microsoft.CodeAnalysis.CSharp 4.11.0->4.14.0 + .Analyzers 3.3.4->3.11.0 (the .NET 10 SDK's Roslyn — minor, unlike the held 5.3.0 major #24), Verify.Xunit 28.9.0->28.16.0, Verify.SourceGenerators 2.4.0->2.5.0, Serilog.Sinks.Console 6.0.0->6.1.1. Build + 434 tests green net8+net10. Finishes the minor/patch group (#39); the rest were already on main.
Owner
auto-merge was automatically disabled
June 4, 2026 12:23
Pull request was closed
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
klomkling
added a commit
that referenced
this pull request
Jul 26, 2026
ASP.NET Core ships EF Core and Redis key repositories but no Dapper one, so on the Themia Dapper stack the default is per-container filesystem keys: a second instance starts, the key rings diverge, and auth cookies plus antiforgery tokens stop round-tripping across instances. A provider gap, not a new persistence layer (contrast the rejected #39). Follows the Themia.Exceptional shape — neutral core with an IDataProtectionKeyDialect seam plus one package per engine — over one data_protection_keys schema owned by FluentMigrator. - IDataProtectionBuilder extension, so SetApplicationName stays with the app; it is what keeps two apps sharing a table from reading each other's keys - keys are per application, not per tenant: no multi-tenancy dependency - created_at from the server clock, never the app's — a fleet disagrees - one unparseable row is skipped, not fatal: returning nothing would fail every unprotect in the application - keys are NOT encrypted at rest, matching ASP.NET's own EF/Redis providers; documented loudly since a DB spreads key material further than a filesystem
klomkling
added a commit
that referenced
this pull request
Jul 26, 2026
* feat: shared Data Protection key store (coord #42) ASP.NET Core ships EF Core and Redis key repositories but no Dapper one, so on the Themia Dapper stack the default is per-container filesystem keys: a second instance starts, the key rings diverge, and auth cookies plus antiforgery tokens stop round-tripping across instances. A provider gap, not a new persistence layer (contrast the rejected #39). Follows the Themia.Exceptional shape — neutral core with an IDataProtectionKeyDialect seam plus one package per engine — over one data_protection_keys schema owned by FluentMigrator. - IDataProtectionBuilder extension, so SetApplicationName stays with the app; it is what keeps two apps sharing a table from reading each other's keys - keys are per application, not per tenant: no multi-tenancy dependency - created_at from the server clock, never the app's — a fleet disagrees - one unparseable row is skipped, not fatal: returning nothing would fail every unprotect in the application - keys are NOT encrypted at rest, matching ASP.NET's own EF/Redis providers; documented loudly since a DB spreads key material further than a filesystem * fix: address review findings on the Data Protection key store (coord #42) Ten findings from a high-effort review, two of them security. Failing closed on an unreadable row resolves four at once. Skipping was unsafe in two directions: XmlKeyManager writes <revocation> elements through the same repository, so a dropped row could silently un-revoke compromised key material; and if the whole table is unreadable the survivors are an EMPTY ring, which Data Protection cannot tell from a fresh deployment — it mints a new key and signs out every user while reporting healthy. It also removes the ArgumentNullException escape on a NULL xml column and the need for a logger at all, which was a hard constructor dependency that broke hand-composed containers. - implement IDeletableXmlRepository (net10 only; net8 has no such API) so revoked key material can actually be deleted instead of living forever - AddSingleton, not TryAddSingleton: PersistKeysTo* is last-wins, and first-wins silently kept an earlier dialect while migrating a later DB - pass ThemiaMigrationOptions through, so callers can supply the logger the registration-time migration needs when instances contend on the boot lock - connectionString is required; it defaulted to null while runMigration defaulted to true, so the shortest legal call always threw - SetApplicationName is NOT an isolation boundary — corrected in 4 packages, the CHANGELOG and the tests; it only sets the purpose-chain discriminator - idempotency test asserted 0 == 0; now asserts a key exists and that the key itself, not just the count, survived the second instance * chore: bump to 0.10.0 for the Data Protection key store MINOR per the pre-1.0 policy in CHANGELOG.md — "a new module/package or a phase boundary" — since this adds four packages. Bumping in the feature PR follows the repo's normal pattern (#161 shipped 0.9.0, #160 shipped 0.8.8 this way); the separate release PR #172 was only needed because #169 merged without a bump.
klomkling
added a commit
that referenced
this pull request
Aug 5, 2026
…s (coord #58) (#198) * feat(identity): split the store into Dapper and EFCore engine packages Closes coord #58. ezy-assets filed it after reading the package graph: adopting Themia.Modules.Identity meant taking Themia.Framework.Data.EFCore and Microsoft.EntityFrameworkCore into an application that has no EF Core anywhere, deliberately, purely to reach a store they would then use through Dapper. propertiezy, who chose the Dapper path in #39, had been shipping four EF packages for an engine they never call. The coupling was three things: one file touching EF Core, one holding the Dapper mappings, and one registration hook. Every service was already written against Themia.Framework.Data.Abstractions, so the store was engine-agnostic all along — their inference from Abstractions being clean was right. The core now carries no data peer, no database driver and no migration runner. That is more than the request asked for and more than I promised: I told both consumers the three drivers would still arrive because the engine package needs Themia.Data.Migrations. It does — but only the engine package, so the core graph is clean and an adopter takes one engine's worth rather than three. Two silent-failure paths closed, which matter more than the dependency count: AddThemiaIdentityDapper throws when no EntityMappingRegistry is registered. The core used to scan the service collection and contribute to whatever it found, so the Dapper path was inferred rather than chosen — and inferred wrong, silently, whenever the peer registration ran second: no error, no log, identity mappings never applied until a query came back against unqualified users instead of identity.users. That is the ordering hazard propertiezy cites in #39. IdentityModule becomes IdentityDapperModule and IdentityEFCoreModule. One module serving both peers could only register the engine-agnostic core, which on Dapper reached the same unmapped-table failure from a different direction. Choosing wrong is now a compile error. The integration suites are what exposed the first one: 82 tests failed with "Invalid object name 'users'" because the shared conformance fixture called the core registration. Rather than change the call to make them pass, the fixture gained an abstract RegisterIdentity that each engine subclass must implement — the suite now picks its engine the same way an adopter has to, and deleting the override is a compile error rather than a silent regression. No compatibility shim for the two moved members. Both consumers confirmed zero call sites, and propertiezy argued against one better than I would have: a forwarding type nobody uses lets a caller keep an old assumption compiling, which is what NotificationResult.Success() did in 0.12.0. Type names and namespaces are unchanged for ApplyThemiaIdentity and IdentityDapperMappings.Apply — only the delivering package moves. * fix(identity): make every engine-split misconfiguration fail loudly Review of the split found three ways an adopter reaches a runtime failure with no build-time or startup signal. - AddThemiaIdentityServices kept its exact signature while silently dropping the Dapper mapping contribution, so a correct existing bootstrap recompiled clean and then queried unqualified `users`. Renamed to AddThemiaIdentityCore; the old name is [Obsolete(error: true)] naming the replacement. - IdentityDapperModule.ConfigureServices now throws on the wrong order, which MIGRATION.md documented only for the extension-method path. Documented for the module path, and the message names it. - AddThemiaIdentityEFCore was a pure pass-through, so the EF leg kept the silent-until-a-query failure the split removed from Dapper. It now registers IdentityModelValidation as a startup check over the built model. Also: - One mapping-contribution mechanism (DapperMappingRegistration) replaces four hand-rolled copies that had drifted into three behaviours; Storage and Notifications stop no-opping when a Dapper peer is present without a registry. - AddThemiaDapperCore reuses an existing EntityMappingRegistry instead of registering a second one that wins resolution with no mappings on it. - IdentityMigrations.Assembly, since the core carries the schema but no runner. - ModuleDescriptor.Name change called out in CHANGELOG and MIGRATION. - The core README stopped teaching the deleted IdentityModule. - EF registration unit tests; the migration-run body is now shared source.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Updated coverlet.collector from 6.0.2 to 6.0.4.
Release notes
Sourced from coverlet.collector's releases.
6.0.4
Fixed
Diff between 6.0.3 and 6.0.4
6.0.3
Fixed
Improvements
Diff between 6.0.2 and 6.0.3
Commits viewable in compare view.
Updated MessagePack from 2.5.187 to 2.5.205.
Release notes
Sourced from MessagePack's releases.
2.5.205
What's Changed
New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.192...v2.5.205
2.5.198
What's Changed
New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.192...v2.5.198
2.5.192
What's Changed
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.187...v2.5.192
Commits viewable in compare view.
Updated Microsoft.CodeAnalysis.Analyzers from 3.3.4 to 3.11.0.
Release notes
Sourced from Microsoft.CodeAnalysis.Analyzers's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated Microsoft.CodeAnalysis.CSharp from 4.11.0 to 4.13.0.
Updated Microsoft.CodeAnalysis.CSharp from 4.11.0 to 4.14.0.
Release notes
Sourced from Microsoft.CodeAnalysis.CSharp's releases.
No release notes found for this version range.
Commits viewable in compare view.
Updated Microsoft.Extensions.Caching.Memory from 9.0.0 to 9.0.16.
Release notes
Sourced from Microsoft.Extensions.Caching.Memory's releases.
9.0.16
Release
9.0.15
Release
9.0.14
Release
9.0.13
Release
What's Changed
Full Changelog: dotnet/runtime@v9.0.12...v9.0.13
9.0.12
Release
9.0.11
Release
What's Changed
UnsafeAccessor- ambiguous name and signature match by @AaronRobinsonMSFT in [release/9.0-staging]UnsafeAccessor- ambiguous name and signature match dotnet/runtime#120011Full Changelog: dotnet/runtime@v9.0.10...v9.0.11
9.0.10
Release
What's Changed
Full Changelog: dotnet/runtime@v9.0.9...v9.0.10
9.0.9
Release
What's Changed
Full Changelog: dotnet/runtime@v9.0.8...v9.0.9
9.0.8
Release
What's Changed
InvalidOperationExceptiononTestOutputHelperlogging. by @ilonatommy in [release/9.0-staging][wbt] PreventInvalidOperationExceptiononTestOutputHelperlogging. dotnet/runtime#116916Ping_TimedOut_*tests by @github-actions[bot] in [release/9.0-staging] HardenPing_TimedOut_*tests dotnet/runtime#116630Full Changelog: dotnet/runtime@v9.0.7...v9.0.8
9.0.7
Release
What's Changed
sort_mark_listby @github-actions in [release/9.0-staging] throw an exception instead of infinite loop insort_mark_listdotnet/runtime#115529Full Changelog: dotnet/runtime@v9.0.6...v9.0.7
9.0.6
Bug Fixes
Read messages from binlog if process output is missing build finished message (#114676)
Improves reliability of the WebAssembly build process by reading messages from the binlog when the process output does not contain the expected build finished message, preventing build failures in certain scenarios.
Fix debugger app hangs related to thread exit (#114917)
Resolves an issue where applications could hang during debugging when threads exit, ensuring smoother debugging experiences and preventing deadlocks.
[Mono] Workaround MSVC miscompiling sgen_clz (#114903)
Addresses a compiler miscompilation issue in MSVC affecting the Mono garbage collector, improving runtime stability and correctness on affected platforms.
Do not set the salt or info if they are NULL for OpenSSL HKDF (#114877)
Fixes a cryptographic issue by ensuring that the salt or info parameters are not set when they are NULL in OpenSSL HKDF, preventing potential errors or unexpected behavior in key derivation.
[Test Only] Fix Idn tests (#115032)
Corrects issues in Internationalized Domain Name (Idn) tests, ensuring accurate and reliable test results for domain name handling.
JIT: revised fix for fp division issue in profile synthesis (#115026)
Provides a more robust fix for floating-point division issues in JIT profile synthesis, improving numerical accuracy and preventing incorrect calculations.
Handle OSSL 3.4 change to SAN:othername formatting (#115361)
Updates certificate handling to accommodate changes in Subject Alternative Name (SAN) formatting introduced in OpenSSL 3.4, ensuring compatibility and correct parsing of certificates.
[Mono] Fix c11 ARM64 atomics to issue full memory barrier (#115635)
Fixes atomic operations on ARM64 in Mono to issue a full memory barrier, ensuring correct synchronization and preventing subtle concurrency bugs.
Performance Improvements
[WinHTTP] Certificate caching on WinHttpHandler to eliminate extra call to Custom Certificate Validation (#114678)
Improves HTTP performance by caching certificates in WinHttpHandler, reducing redundant calls to custom certificate validation and speeding up secure connections.
Improve distribute_free_regions (#115167)
Optimizes memory management by enhancing the algorithm for distributing free memory regions, leading to better memory utilization and potentially improved application performance.
Technical Improvements
Strip trailing slash from source dir for cmake4 (#114905)
Refines build scripts by removing trailing slashes from source directories when using CMake 4, preventing potential build path issues and improving build reliability.
Don't expose TrustedCertificatesDirectory() and StartNewTlsSessionContext() to NetFx (#114995)
Restricts certain internal APIs from being exposed to .NET Framework, reducing surface area and preventing unintended usage.
Add support for more libicu versions (#115376)
Expands compatibility by supporting additional versions of the International Components for Unicode (ICU) library, enhancing globalization features across more environments.
Infrastructure
Optimizes CI/CD resources by limiting the outerloop pipeline to run only on release branches, reducing unnecessary test runs and speeding up development workflows.
... (truncated)
9.0.5
Release
What's Changed
osx.14.arm64.openandosx.15.amd64.openqueues by @github-actions in [release/9.0-staging] [infra][apple-mobile] Migrate MacCatalyst and iOS/tvOS simulator jobs toosx.14.arm64.openandosx.15.amd64.openqueues dotnet/runtime#114617... (truncated)
9.0.4
Release
What's Changed
BigInteger.Rotate{Left,Right}for backport by @github-actions in [release/9.0] FixBigInteger.Rotate{Left,Right}for backport dotnet/runtime#112991Full Changelog: dotnet/runtime@v9.0.3...v9.0.4
9.0.3
Release
What's Changed
NO-MERGElabel is applied by @github-actions in [release/9.0-staging] Add workflow to prevent merging a PR when theNO-MERGElabel is applied dotnet/runtime#111961Full Changelog: dotnet/runtime@v9.0.2...v9.0.3
9.0.2
Release
What's Changed
SetChecksumcreating invalid pdb by @github-actions in [release/9.0-staging] Fix System.Reflection.EmitSetChecksumcreating invalid pdb dotnet/runtime#110205BlockDominancePredsto avoid a JIT crash by @github-actions in [release/9.0-staging] JIT: Include more edges inBlockDominancePredsto avoid a JIT crash dotnet/runtime#110568SIGSEGVnative crashes to the defaultSIGSEGVhandler by @github-actions in [release/9.0-staging] [mono] ChainSIGSEGVnative crashes to the defaultSIGSEGVhandler dotnet/runtime#110863IsOSVersionAtLeastwhen build or revision are not provided by @github-actions in [release/9.0-staging] FixIsOSVersionAtLeastwhen build or revision are not provided dotnet/runtime#109332... (truncated)
9.0.1
Release
What's Changed
TensorPrimitivesXML docs:MinNumber/ReciprocalSqrt/ReciprocalSqrtEstimateoversights by @github-actions in [release/9.0-staging]TensorPrimitivesXML docs:MinNumber/ReciprocalSqrt/ReciprocalSqrtEstimateoversights dotnet/runtime#109922UnsafeAccessorfield targets by @github-actions in [release/9.0-staging] Ignore modopts/modreqs forUnsafeAccessorfield targets dotnet/runtime#109709Description has been truncated