chore(deps): bump the safe dependency lot, with the Hangfire family in lockstep - #266
Merged
Conversation
…n lockstep All eleven Dependabot PRs (#241-#251) were closed unmerged, so the bumps are redone here as one verified change. This is the lot where the new version is a patch or minor within the same major; the major jumps (Npgsql 9->10, Microsoft.Data.Sqlite 9->10, Microsoft.Data.SqlClient 5->7, TestHost 8->10, Aspire 9.5->13.4) are deliberately left out and assessed separately. Hangfire.Core, Hangfire.SqlServer and Hangfire.AspNetCore move together to 1.8.24. Hangfire.NetCore arrives transitively and pins Hangfire.Core to an exact version, so bumping any one member alone fails restore with NU1608 — which is why #246 and #247 were red and could never have gone green on their own. dependabot.yml now groups Hangfire* so the family only ever travels as a unit. Microsoft.AspNetCore.TestHost goes to 8.0.29 rather than the available 10.0.10: the test projects target net8.0, so staying in the 8.x servicing line is the bump that belongs here. DocumentFormat.OpenXml 3.1.1 -> 3.5.1 made WorkbookPart.Workbook nullable, which TreatWarningsAsErrors turned into a build failure in XlsxRowReader. It is now checked rather than assumed; the existing "contains no worksheets" error covers that case. Verified after a --no-incremental rebuild: Core 303, AspNetCore 159, UI (bUnit 2.9) 245, WebUi E2E (Playwright 1.61) 24 passed / 0 skipped with NEOREPORTS_REQUIRE_BROWSER=1, Jobs 34, Sources.Xlsx 32, Formats.Xlsx 7, Formats.Csv 5, Destinations.S3 3, Destinations.Local 14 — 0 failures.
Sonar's new-code maintainability gate is a debt ratio, and this PR changes exactly three lines of C#, so a single 'use explicit type instead of var' on one of them was enough to take the rating to 3. Sheet[]? is also the clearer read next to the null-conditional chain that produces it.
…starts `ReadRows` contains `yield`, so none of its body — including `ArgumentNullException.ThrowIfNull(stream)` — executed until the caller's first MoveNext. A null stream therefore surfaced from inside the enumeration, with a stack that no longer pointed at the call that passed it. Splitting the eager wrapper from the iterator makes the check fire where the mistake was made. This is what SonarCloud's new-code maintainability gate flagged on the dependency-bump PR. The line is pre-existing (63deea1, 2026-07-17) and Sonar counts it as new because the master baseline has been broken since the 50k-LOC free-tier cap hit on 2026-07-12 — but the finding itself is real, and the file already had to change here for the OpenXml nullability guard, so it is fixed rather than worked around. No test: XlsxRowReader is internal with no InternalsVisibleTo, and the public surface takes a file path or S3 config rather than a Stream, so the null path is not reachable from outside. The existing 32 tests pass unchanged, which is what confirms the split did not alter enumeration semantics.
|
|
thiagoluga
added a commit
that referenced
this pull request
Aug 5, 2026
…al containers (#267) The remainder of the closed Dependabot set, held back from #266 because each crosses a major boundary and the risk is the same one: a provider that has moved to net10.0 would quietly stop supporting the net8.0 targets this repo multi-targets. Npgsql 9.0.5 -> 10.0.3 Microsoft.Data.Sqlite 9.0.18 -> 10.0.10 Microsoft.Data.SqlClient 5.2.2 -> 7.0.2 That risk did not materialize: a --no-incremental rebuild is clean on both net8.0 and net9.0, with no NU warnings. No source change was needed. Verified where it counts — against real database containers, not mocks: Postgres (Npgsql) 78 passed / 0 skipped SQL Server (SqlClient) 23 passed / 0 skipped, NEOREPORTS_REQUIRE_DOCKER=1 Sqlite 18 passed / 0 skipped Redshift (Npgsql driver) 6 passed Plus no regressions elsewhere: Core 303, AspNetCore 159, UI 245, Jobs 34, Sources.Common 22, Http 60, OData 51, Elasticsearch 55, MongoDb 9 — 0 failures. MySql and Oracle were not re-run locally (their containers exceeded the local time budget), and neither is affected: they use MySqlConnector and Oracle.ManagedDataAccess, which this change does not touch. CI runs them. Aspire.Hosting.* (9.5.2 -> 13.4.6) is still deliberately excluded: four majors is a framework migration, not a dependency bump, and it belongs to the maintainer.
thiagoluga
added a commit
that referenced
this pull request
Aug 5, 2026
…running one (#272) The last item from the closed Dependabot set (#241-#251), held out of #266 and #267 because 9.5.2 -> 13.4.6 crosses four majors and reads like a framework migration. It is not one. All six AppHosts compile clean on net8.0 with no source changes, no NU warnings and no deprecation warnings: every API the samples use — AddPostgres, WithDataVolume, AddDatabase, AddProject<>, WithReference, WaitFor, WithExternalHttpEndpoints — survived intact. A clean build proves nothing about an orchestrator, so sample 10 was actually run, both ways the docs offer: `dotnet run --project .../AppHost` and the new `aspire run` CLI. Both bring the Postgres container up (~10-25s) and connect it to the session network. The documented workflow is unchanged; the CLI is an addition, not a replacement. Two real findings from running it: - The default PostgreSQL image moved from 17.6 to 18.3 with the Aspire version. Sample 10's header comment asserted "postgres:17", which was now false; it no longer names a tag it does not control. The READMEs' `docker run ... postgres:17` lines are untouched — those describe running Postgres yourself as an alternative to Aspire, and remain accurate. - `aspire run` writes an `aspire.config.json` pinned to whichever AppHost ran last. With six in this repo, committing it would tie everyone to one sample, so it is gitignored. Full solution rebuilt with --no-incremental; Core 303, Jobs 39, AspNetCore 159, UI 245.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All eleven Dependabot PRs (#241–#251) were closed unmerged, so the bumps are redone here as one verified change rather than eleven unverified ones.
This is the lot where the new version is a patch or minor within the same major. The major jumps are deliberately excluded and assessed separately (see the bottom of this description).
The Hangfire family, and why #246/#247 were unfixable as filed
Hangfire.NetCorearrives transitively and pinsHangfire.Coreto an exact version, so bumping any single member fails restore with NU1608. #246 (AspNetCore) and #247 (Core) were red for that reason and could never have gone green on their own, whatever CI did — the family only moves as a unit.dependabot.ymlnow groupsHangfire*. That grouping is a correctness requirement, not noise reduction, and the config says so — otherwise the same two red PRs reappear next week.Two judgement calls
net8.0; staying in the 8.x servicing line is the bump that belongs in a "safe" lot. Dependabot proposed the same.@v4,@v5), which receive patch and minor updates automatically. Pinning them to4.37.3/5.6.0would trade that for a Dependabot PR every week and no benefit.One real break, caught by the build
DocumentFormat.OpenXml3.1.1 → 3.5.1 madeWorkbookPart.Workbooknullable, andTreatWarningsAsErrorsturned that into CS8602 inXlsxRowReader. It is now checked rather than assumed — the existing "contains no worksheets" error already describes that case correctly, so the guard needed no new error path.This is the argument for verifying bumps rather than merging them on green-badge faith: a one-package Dependabot PR for OpenXml would have failed CI with a compile error and sat there.
Verification
dotnet build --no-incremental(cache can hide a real compile error), then:0 failures. The E2E run matters here specifically because Playwright moved two minors and needs a matching browser build — I installed it via the package's own
playwright.ps1and ran with the skip-guard on, so a browser that failed to launch would fail the suite rather than silently skip it.Deliberately not in this PR
The first three get their own assessment next; Aspire 9 → 13 is the maintainer's call.