Skip to content

Bump the nuget group with 13 updates - #386

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/nuget-be00645238
Closed

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/nuget-be00645238

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Updated Meziantou.Analyzer from 3.0.280 to 3.0.299.

Release notes

Sourced from Meziantou.Analyzer's releases.

3.0.299

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.299

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.298...3.0.299

3.0.298

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.298

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.297...3.0.298

3.0.297

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.297

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.296...3.0.297

3.0.296

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.296

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.295...3.0.296

3.0.295

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.295

What's Changed

New Contributors

Full Changelog: meziantou/Meziantou.Analyzer@3.0.294...3.0.295

3.0.294

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.294

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.293...3.0.294

3.0.293

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.293

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.292...3.0.293

3.0.292

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.292

What's Changed

New Contributors

Full Changelog: meziantou/Meziantou.Analyzer@3.0.291...3.0.292

3.0.291

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.291

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.290...3.0.291

3.0.290

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.290

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.289...3.0.290

3.0.289

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.289

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.288...3.0.289

3.0.288

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.288

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.287...3.0.288

3.0.287

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.287

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.286...3.0.287

3.0.286

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.286

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.285...3.0.286

3.0.285

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.285

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.284...3.0.285

3.0.284

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.284

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.283...3.0.284

3.0.283

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.283

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.282...3.0.283

3.0.282

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.282

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.281...3.0.282

3.0.281

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.281

What's Changed

Full Changelog: meziantou/Meziantou.Analyzer@3.0.280...3.0.281

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.Analyzers from 3.3.4 to 3.11.0.

Release notes

Sourced from Microsoft.CodeAnalysis.Analyzers's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.CSharp from 4.8.0 to 4.14.0.

Release notes

Sourced from Microsoft.CodeAnalysis.CSharp's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.CSharp.Workspaces from 4.8.0 to 4.14.0.

Release notes

Sourced from Microsoft.CodeAnalysis.CSharp.Workspaces's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.Workspaces.Common from 4.8.0 to 4.14.0.

Release notes

Sourced from Microsoft.CodeAnalysis.Workspaces.Common's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging from 8.0.0 to 8.0.1.

Release notes

Sourced from Microsoft.Extensions.Logging's releases.

8.0.1

Release

Commits viewable in compare view.

Updated Microsoft.Testing.Extensions.CodeCoverage from 18.11.2 to 18.12.0.

Release notes

Sourced from Microsoft.Testing.Extensions.CodeCoverage's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Moq from 4.18.4 to 4.21.0.

Release notes

Sourced from Moq's releases.

4.21.0

What's Changed

✨ Implemented enhancements

🐛 Fixed bugs

🔨 Other

New Contributors

Full Changelog: devlooped/moq@v4.20.72...v4.21.0

Sponsors

The following sponsors made this release possible: @​clarius, @​MFB-Technologies-Inc, @​sandrock, @​drivenet, @​Keflon, @​tbolon, @​rbnswartz, @​jfoshee, @​Mrxx99, @​eajhnsn1, @​Jonathan-Hickey, @​KenBonny, @​SimonCropp, @​agileworks-eu, @​arsdragonfly, @​vezel-dev, @​ChilliCream, @​4OTC, @​DominicSchell, @​adalon, @​torutek, @​mccaffers, @​SeikaLogiciel, @​wizardness, @​eska-gmbh, @​geodata-no.

Thanks 💜

4.20.72

What's Changed

🔨 Other

Full Changelog: devlooped/moq@v4.20.71...v4.20.72

4.20.71

What's Changed

🔨 Other

New Contributors

Full Changelog: devlooped/moq@v4.20.70...v4.20.71

4.20.70

What's Changed

🔨 Other

New Contributors

Full Changelog: devlooped/moq@v4.20.69...v4.20.70

4.20.69

Let's make it more memorable when Moq became "safe" again.

What's Changed

4.20.2

What's Changed

🐛 Fixed bugs

NOTE: in addition, there were potential privacy issues raised with regards to the SHA256 hashing of
user' email to check for sponsorship, so it won't be coming back until that's properly addressed

Full Changelog: moq/moq.spikes@v4.20.1...v4.20.2

4.20.1

What's Changed

✨ Implemented enhancements

  • Add Sponsor button to package readme 💜

Full Changelog: moq/moq.spikes@v4.20.0...v4.20.1

4.20.0

What's Changed

✨ Implemented enhancements

🔨 Other

New Contributors

Full Changelog: moq/moq.spikes@v4.18.4...v4.20.0

4.20.0-rc

What's Changed

🔨 Other

Full Changelog: moq/moq.spikes@v4.20.0-beta...v4.20.0-rc

4.20.0-beta

What's Changed

✨ Implemented enhancements

🔨 Other

New Contributors

Full Changelog: moq/moq.spikes@v4.18.4...v4.20.0-beta

4.20.0-alpha

What's Changed

✨ Implemented enhancements

🔨 Other

New Contributors

Full Changelog: moq/moq.spikes@v4.18.4...v4.20.0-alpha

Commits viewable in compare view.

Updated Nerdbank.GitVersioning from 3.7.115 to 3.10.94.

Release notes

Sourced from Nerdbank.GitVersioning's releases.

3.10.94

What's Changed

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.10.91...v3.10.94

3.10.91

What's Changed

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.10.85...v3.10.91

3.10.85

What's Changed

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.10.70...v3.10.85

3.10.70

What's Changed

Fixes

Enhancements

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.9.50...v3.10.70

3.10.44-alpha

What's Changed

Fixes

Enhancements

Dependency updates

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.10.8-alpha...v3.10.44-alpha

3.10.8-alpha

What's Changed

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.9.50...v3.10.8-alpha

3.9.50

What's Changed

New Contributors

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.8.118...v3.9.50

3.9.37-alpha

What's Changed

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.9.32-alpha...v3.9.37-alpha

3.9.32-alpha

What's Changed

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.9.17-alpha...v3.9.32-alpha

3.9.17-alpha

What's Changed

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.9.15-alpha...v3.9.17-alpha

3.9.15-alpha

What's Changed

New Contributors

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.8.118...v3.9.15-alpha

3.8.118

Fixes

Enhancements

Other changes

New Contributors

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.7.115...v3.8.118

3.8.106-alpha

What's Changed

Enhancements

Fixes

Other changes

New Contributors

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.8.38-alpha...v3.8.106-alpha

3.8.38-alpha

Fixes

Enhancements

New Contributors

Full Changelog: dotnet/Nerdbank.GitVersioning@v3.7.115...v3.8.38-alpha

Commits viewable in compare view.

Updated Polly.Core from 8.4.2 to 8.8.0.

Release notes

Sourced from Polly.Core's releases.

8.8.0

Highlights

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.7.0...8.8.0

8.7.0

Highlights

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.6.6...8.7.0

8.6.6

Highlights

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.6.5...8.6.6

8.6.5

What's Changed

Full Changelog: App-vNext/Polly@8.6.4...8.6.5

8.6.4

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.6.3...8.6.4

8.6.3

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.6.2...8.6.3

8.6.2

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.6.1...8.6.2

8.6.1

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.6.0...8.6.1

8.6.0

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.5.2...8.6.0

8.5.2

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.5.1...8.5.2

8.5.1

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.5.0...8.5.1

8.5.0

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.4.2...8.5.0

Commits viewable in compare view.

Updated Swashbuckle.AspNetCore from 10.2.3 to 10.3.0.

Release notes

Sourced from Swashbuckle.AspNetCore's releases.

10.3.0

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.2.3...v10.3.0

Commits viewable in compare view.

Updated xunit.v3 from 4.0.1 to 4.0.2.

Release notes

Sourced from xunit.v3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Yarp.ReverseProxy from 2.2.0 to 2.3.0.

Release notes

Sourced from Yarp.ReverseProxy's releases.

2.3.0

This release supports .NET 8.0 and newer. See Getting Started.
Note that while this version also includes targets for .NET 6 and .NET 7, those runtimes are no longer supported.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

  • More errors triggered by the client disconnecting are now logged under a Debug severity (#​2765 by @​MihaZupan).
    • ForwarderError.ResponseBodyCanceled and UpgradeResponseCanceled are no longer logged with a Warning severity.
    • This is a continuation of a change we've made in 2.2 where we've done the same with RequestCanceled, RequestBodyCanceled, and UpgradeRequestCanceled.
  • Replacing the HttpRequestMessage.Content property in a request transform will throw an exception (#​2722 by @​MihaZupan).
    • While setting the property may have appeared to work during limited testing, it could lead to various issues as YARP internally relies on the property remaining unchanged. See the pull request for more context on this change.
  • We now always enforce the HttpVersionPolicy during HTTP version negotiation (#​2729 by @​MihaZupan).
    • It was previously possible for YARP to initiate HTTP/1.1 connections for WebSocket and SPDY requests even if the specified HttpVersionPolicy disallowed it. This was breaking scenarios such as outgoing HTTP/2 WebSockets without TLS.
    • If the policy disallows the use of outbound HTTP/1.1, SPDY requests will not be proxied and will instead return a RequestCreation error.
    • This does not affect the default YARP configuration, which is Version=2.0, Policy=RequestVersionOrLower.

Major changes

  • YARP has always logically been a part of .NET and we have now moved the repository from the microsoft to the dotnet organization.
    • The license has been updated to the .NET foundation, but remains MIT as before (#​2738 by @​adityamandaleeka).
    • As part of the repository move, we have moved the documentation to learn.microsoft.com.
  • We've created a JSON schema for YARP configuration! Editing now comes with validation and autocompletions (#​2758 by @​MihaZupan).
    • The change is automatic when referencing the 2.3.0 version of the YARP package and editing the ReverseProxy section in appsettings.json.
      image
      image
    • If you encounter any issues with the schema, please let us know by opening an issue.
    • False positives can be safely ignored until we're able to update the schema. Runtime interpretation of the configuration remains unchanged and is unaffected by schema validation.
    • You can manually reference the latest version of the schema without changing the package by pointing Visual Studio at https://raw.githubusercontent.com/dotnet/yarp/refs/heads/main/src/ReverseProxy/ConfigurationSchema.json.
      image
  • We've started shipping a minimal YARP container image at mcr.microsoft.com (#​2710 by @​benjaminpetit).
    • More functionality will be added to the image over time.

Other changes

  • We've added optional parameters to AddForwarded and AddXForwarded request transforms that allow you to opt-out of removing the other variant of the header (#​2728 by @​rkargMsft).
    ctx.AddForwarded(removeAllXForwardedHeaders: false);
    ctx.AddXForwarded(removeForwardedHeader: false);
  • Improved HttpSysDelegator logging and retry logic (#​2671 by @​NGloreous).
  • YARP can now be published with NativeAOT when targetting .NET 8.0 again (#​2759 by @​MihaZupan).
  • We've added a workaround for an error in .NET builds from the Ubuntu package feed (#​2673 by @​MihaZupan).

New Contributors

For a full list of changes see here.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Meziantou.Analyzer from 3.0.280 to 3.0.299
Bumps Microsoft.CodeAnalysis.Analyzers from 3.3.4 to 3.11.0
Bumps Microsoft.CodeAnalysis.CSharp from 4.8.0 to 4.14.0
Bumps Microsoft.CodeAnalysis.CSharp.Workspaces from 4.8.0 to 4.14.0
Bumps Microsoft.CodeAnalysis.Workspaces.Common from 4.8.0 to 4.14.0
Bumps Microsoft.Extensions.Logging from 8.0.0 to 8.0.1
Bumps Microsoft.Testing.Extensions.CodeCoverage from 18.11.2 to 18.12.0
Bumps Moq from 4.18.4 to 4.21.0
Bumps Nerdbank.GitVersioning from 3.7.115 to 3.10.94
Bumps Polly.Core from 8.4.2 to 8.8.0
Bumps Swashbuckle.AspNetCore from 10.2.3 to 10.3.0
Bumps xunit.v3 from 4.0.1 to 4.0.2
Bumps Yarp.ReverseProxy from 2.2.0 to 2.3.0

---
updated-dependencies:
- dependency-name: Meziantou.Analyzer
  dependency-version: 3.0.299
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 3.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 4.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.CodeAnalysis.CSharp.Workspaces
  dependency-version: 4.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.CodeAnalysis.Workspaces.Common
  dependency-version: 4.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Microsoft.Extensions.Logging
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Microsoft.Testing.Extensions.CodeCoverage
  dependency-version: 18.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Moq
  dependency-version: 4.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Nerdbank.GitVersioning
  dependency-version: 3.10.94
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Polly.Core
  dependency-version: 8.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: Swashbuckle.AspNetCore
  dependency-version: 10.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: xunit.v3
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Yarp.ReverseProxy
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from no1ross as a code owner October 19, 2026 00:32
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Oct 19, 2026
@andrew-ross-elv

Copy link
Copy Markdown
Collaborator

Superseded by #388 (#387). This PR could not build: the packages.lock.json files were not updated, so locked-mode restore failed. #388 drops the lock files and takes these updates, except Roslyn 4.14 (it raises the compiler needed to load the shipped Kaleido.Analyzers) and Moq 4.21 (the HP-010 pin). Dependabot now ignores both.

@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/nuget/nuget-be00645238 branch October 19, 2026 13:06
andrew-ross-elv pushed a commit that referenced this pull request Oct 23, 2026
Dependabot updates Directory.Packages.props but not the 41 packages.lock.json files, and CI restored with --locked-mode, so every Dependabot NuGet PR failed restore (NU1004), as #386 did. The lock files (MP-024) added a content-hash check and visible transitive diffs on top of central package management with exact versions; NuGet signature verification, NuGetAudit, the dependency-review workflow and the 7-day Dependabot cooldown remain.

RestorePackagesWithLockFile and RestoreLockedMode are removed from Directory.Build.props, the lock files are deleted, and the build and CodeQL workflows restore without --locked-mode.

Refs #387

Gate: build 0 errors / 0 warnings (--no-incremental); tests 2547 passed, 0 failed; no packages.lock.json generated
andrew-ross-elv pushed a commit that referenced this pull request Oct 23, 2026
Updated: Meziantou.Analyzer 3.0.299, Microsoft.CodeAnalysis.Analyzers 3.11.0, Microsoft.Extensions.Logging 8.0.1, Microsoft.Testing.Extensions.CodeCoverage 18.12.0, Nerdbank.GitVersioning 3.10.94, Polly.Core 8.8.0, Swashbuckle.AspNetCore 10.3.0, xunit.v3 4.0.2, Yarp.ReverseProxy 2.3.0.

Not taken, and now ignored by Dependabot with the reason in dependabot.yml:
- Microsoft.CodeAnalysis.CSharp / .Workspaces / Workspaces.Common stay at 4.8.0: the Roslyn version Kaleido.Analyzers references is the minimum compiler a consumer needs to load it, and 4.14 also caused a System.Collections.Immutable 8/9 conflict (MSB3277) in src/Kaleido.
- Moq stays at 4.18.4: the HP-010 pin (pre-SponsorLink); 4.21 also added 15 nullable warnings in tests.

Fixes #387

Gate: build 0 errors / 0 warnings (--no-incremental); tests 2547 passed, 0 failed; dependabot.yml parses with the new ignores
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant