Skip to content

chore(deps): bump the safe dependency lot, with the Hangfire family in lockstep #266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thiagoluga merged 3 commits into from
Aug 5, 2026
Merged

chore(deps): bump the safe dependency lot, with the Hangfire family in lockstep #266

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
588cc1d
chore(deps): bump the safe dependency lot, with the Hangfire family i…
thiagoluga Aug 5, 2026
3e44a6c
chore(deps): use an explicit type on the OpenXml nullability guard
thiagoluga Aug 5, 2026
aacd8e7
fix(sources): validate XlsxRowReader's arguments before the iterator …
thiagoluga Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,13 @@ updates:
microsoft-extensions:
patterns:
- "Microsoft.Extensions.*"
# Not noise-reduction: a CORRECTNESS requirement. Hangfire.NetCore arrives transitively and
# pins Hangfire.Core to an exact version, so bumping any one member alone fails restore with
# NU1608 — PRs #246 and #247 could never go green on their own, whatever CI did. The family
# only moves as a unit.
hangfire:
patterns:
- "Hangfire*"
test-tooling:
patterns:
- "xunit*"
Expand Down
26 changes: 13 additions & 13 deletions build/Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

<ItemGroup>
<!-- Core -->
<PackageVersion Include="Polly.Core" Version="8.6.6" />
<PackageVersion Include="Polly.Core" Version="8.7.0" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.10" />
Expand All @@ -19,42 +19,42 @@
<PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.2" />
<PackageVersion Include="Npgsql" Version="9.0.5" />
<PackageVersion Include="MySqlConnector" Version="2.6.1" />
<PackageVersion Include="Oracle.ManagedDataAccess.Core" Version="23.26.200" />
<PackageVersion Include="Oracle.ManagedDataAccess.Core" Version="23.26.300" />
<PackageVersion Include="Microsoft.Data.Sqlite" Version="9.0.18" />
<PackageVersion Include="Snowflake.Data" Version="5.7.0" />
<PackageVersion Include="MongoDB.Driver" Version="3.10.0" />
<PackageVersion Include="ClosedXML" Version="0.105.0" />
<PackageVersion Include="DocumentFormat.OpenXml" Version="3.1.1" />
<PackageVersion Include="ClosedXML" Version="0.105.1" />
<PackageVersion Include="DocumentFormat.OpenXml" Version="3.5.1" />
<PackageVersion Include="Parquet.Net" Version="6.0.3" />
<PackageVersion Include="AWSSDK.S3" Version="4.0.100.2" />
<PackageVersion Include="AWSSDK.S3" Version="4.0.101.7" />

<!-- Scheduling -->
<PackageVersion Include="Cronos" Version="0.13.0" />

<!-- Jobs -->
<PackageVersion Include="Hangfire.Core" Version="1.8.14" />
<PackageVersion Include="Hangfire.SqlServer" Version="1.8.14" />
<PackageVersion Include="Hangfire.AspNetCore" Version="1.8.14" />
<PackageVersion Include="Hangfire.Core" Version="1.8.24" />
<PackageVersion Include="Hangfire.SqlServer" Version="1.8.24" />
<PackageVersion Include="Hangfire.AspNetCore" Version="1.8.24" />
<PackageVersion Include="Hangfire.InMemory" Version="1.0.0" />

<!-- Tests -->
<PackageVersion Include="xunit" Version="2.9.3" />
<PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
<PackageVersion Include="Shouldly" Version="4.2.1" />
<PackageVersion Include="Microsoft.Playwright" Version="1.56.0" />
<PackageVersion Include="Shouldly" Version="4.3.0" />
<PackageVersion Include="Microsoft.Playwright" Version="1.61.0" />
<PackageVersion Include="NSubstitute" Version="6.0.0" />
<PackageVersion Include="Testcontainers.MsSql" Version="4.13.0" />
<PackageVersion Include="Testcontainers.PostgreSql" Version="4.13.0" />
<PackageVersion Include="Testcontainers.MySql" Version="4.13.0" />
<PackageVersion Include="Testcontainers.Oracle" Version="4.13.0" />
<PackageVersion Include="Testcontainers.MongoDb" Version="4.13.0" />
<PackageVersion Include="Xunit.SkippableFact" Version="1.5.61" />
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="8.0.11" />
<PackageVersion Include="bunit" Version="2.6.2" />
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="8.0.29" />
<PackageVersion Include="bunit" Version="2.9.0" />

<!-- Benchmarks -->
<PackageVersion Include="BenchmarkDotNet" Version="0.14.0" />
<PackageVersion Include="BenchmarkDotNet" Version="0.15.8" />

<!-- Samples / Aspire (Epic H) — 9.5.2 is the last Aspire line targeting net8.0/net9.0;
Aspire 13.x's AppHost SDK forces net10.0, which would be inconsistent with every other
Expand Down
15 changes: 14 additions & 1 deletion src/Sources/NeoReports.Sources.Xlsx/XlsxRowReader.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,13 +51,23 @@
public static IEnumerable<object?[]> ReadRows(
Stream stream, string? sheetName, CancellationToken cancellationToken)
{
// Validated here rather than inside the iterator below: a method containing `yield` does not
// execute any of its body until the first MoveNext, so this check used to fire from inside
// the enumeration — with a stack that no longer points at the call that passed the null.
ArgumentNullException.ThrowIfNull(stream);

return Enumerate(stream, sheetName, cancellationToken);
}

/// <summary>The iterator half of <see cref="ReadRows"/>; arguments are already validated.</summary>
private static IEnumerable<object?[]> Enumerate(
Stream stream, string? sheetName, CancellationToken cancellationToken)
{
using var document = SpreadsheetDocument.Open(stream, isEditable: false);
var workbookPart = document.WorkbookPart

Check warning on line 67 in src/Sources/NeoReports.Sources.Xlsx/XlsxRowReader.cs

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use explicit type instead of 'var' 


See more on https://sonarcloud.io/project/issues?id=lugarini_NeoReports&issues=AZ_SNxA4VjJZEWYHV4Vx&open=AZ_SNxA4VjJZEWYHV4Vx&pullRequest=266
?? throw new InvalidOperationException("The XLSX package has no workbook part.");

var worksheetPart = ResolveWorksheetPart(workbookPart, sheetName);

Check warning on line 70 in src/Sources/NeoReports.Sources.Xlsx/XlsxRowReader.cs

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use explicit type instead of 'var' 


See more on https://sonarcloud.io/project/issues?id=lugarini_NeoReports&issues=AZ_SNxA4VjJZEWYHV4Vy&open=AZ_SNxA4VjJZEWYHV4Vy&pullRequest=266
var sharedStrings = SharedStringCache.Load(workbookPart);
var numberFormats = NumberFormatCache.Build(workbookPart);

Expand Down Expand Up @@ -110,7 +120,7 @@
return Array.Empty<object?>();

var row = new object?[maxColumn + 1];
foreach (var (column, value) in cells)

Check warning on line 123 in src/Sources/NeoReports.Sources.Xlsx/XlsxRowReader.cs

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use explicit type instead of 'var' 


See more on https://sonarcloud.io/project/issues?id=lugarini_NeoReports&issues=AZ_SNxA4VjJZEWYHV4Vz&open=AZ_SNxA4VjJZEWYHV4Vz&pullRequest=266
row[column] = value;

return row;
Expand All @@ -123,7 +133,7 @@
/// </remarks>
private static object? ReadCellValue(Cell cell, string[] sharedStrings, NumberFormatCache numberFormats)
{
var dataType = cell.DataType?.Value;

Check warning on line 136 in src/Sources/NeoReports.Sources.Xlsx/XlsxRowReader.cs

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use explicit type instead of 'var' 


See more on https://sonarcloud.io/project/issues?id=lugarini_NeoReports&issues=AZ_SNxA4VjJZEWYHV4V0&open=AZ_SNxA4VjJZEWYHV4V0&pullRequest=266

// Inline strings live in a child <is> element, not <v>, so they are handled before the empty check.
if (dataType == CellValues.InlineString)
Expand Down Expand Up @@ -153,7 +163,7 @@
if (dataType == CellValues.Date)
{
// ISO-8601 date stored as text (rare; most dates are numeric serials, see below).
return DateTime.TryParse(raw, CultureInfo.InvariantCulture, DateTimeStyles.None, out var isoDate)

Check warning on line 166 in src/Sources/NeoReports.Sources.Xlsx/XlsxRowReader.cs

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use explicit type instead of 'var' 


See more on https://sonarcloud.io/project/issues?id=lugarini_NeoReports&issues=AZ_SNxA4VjJZEWYHV4V1&open=AZ_SNxA4VjJZEWYHV4V1&pullRequest=266
? isoDate
: raw;
}
Expand Down Expand Up @@ -204,7 +214,10 @@
/// <summary>Finds the worksheet part by sheet name, or the first sheet when no name is given.</summary>
private static WorksheetPart ResolveWorksheetPart(WorkbookPart workbookPart, string? sheetName)
{
var sheets = workbookPart.Workbook.Sheets?.Elements<Sheet>().ToArray();
// Workbook became nullable in DocumentFormat.OpenXml 3.5 (it is populated lazily and a
// malformed package can genuinely lack it), so it is checked rather than assumed — the
// existing "no worksheets" message covers that case correctly either way.
Sheet[]? sheets = workbookPart.Workbook?.Sheets?.Elements<Sheet>().ToArray();
if (sheets is null || sheets.Length == 0)
throw new InvalidOperationException("The XLSX workbook contains no worksheets.");

Expand Down