build(deps): nuget group, with FluentAssertions held on the Apache-2.0 line - #55
Merged
Merged
Conversation
Bumps FluentAssertions from 6.12.2 to 8.10.0 Bumps Google.Api.CommonProtos from 2.15.0 to 2.17.0 Bumps Google.Protobuf to 3.31.1, 3.35.1 Bumps Grpc.Core.Api from 2.67.0 to 2.83.0 Bumps Grpc.Net.Client from 2.67.0 to 2.83.0 Bumps Grpc.Tools from 2.69.0 to 2.83.0 Bumps Microsoft.NET.Test.Sdk from 17.12.0 to 18.9.0 Bumps xunit.runner.visualstudio from 2.8.2 to 4.0.0 --- updated-dependencies: - dependency-name: FluentAssertions dependency-version: 8.10.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: Google.Api.CommonProtos dependency-version: 2.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Google.Protobuf dependency-version: 3.31.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Google.Protobuf dependency-version: 3.35.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Google.Protobuf dependency-version: 3.35.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Grpc.Core.Api dependency-version: 2.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Grpc.Core.Api dependency-version: 2.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Grpc.Net.Client dependency-version: 2.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Grpc.Net.Client dependency-version: 2.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Grpc.Tools dependency-version: 2.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.9.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.9.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: xunit.runner.visualstudio dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget ... Signed-off-by: dependabot[bot] <support@github.com>
…0 line Takes dependabot's #46 bumps, with two corrections. **FluentAssertions pinned to 7.2.2, not 8.10.0.** 8.x is not an ordinary version bump: it ships under a commercial (Xceed) licence. The nuspecs say so directly -- 6.12.2 and 7.2.2 both declare `<license type="expression">Apache-2.0</license>`, while 8.10.0 switches to `<license type="file">`. Moving an OSS-licensed test dependency onto a commercial licence is a decision for a human, not for dependabot, so the pin carries a comment saying why. 7.2.2 is the newest Apache-2.0 release, so this is still an upgrade from the 6.12.2 on main rather than a freeze. **The 17 example projects had to move with the group.** Dependabot bumped Microsoft.NET.Test.Sdk to 18.9.0 in the proto and client projects but left every example project on 17.12.0, which NuGet rejects as a downgrade: error NU1605: Detected package downgrade: Microsoft.NET.Test.Sdk from 18.9.0 to 17.12.0 That failed `dotnet restore`, and with it `dotnet format --verify-no-changes`, which is the C# lint job. The examples now carry the same Test.Sdk 18.9.0 and xunit.runner.visualstudio 4.0.0 as the rest of the solution. Everything else in the group is taken as proposed: Google.Protobuf 3.35.*, Google.Api.CommonProtos 2.17.*, Grpc.Net.Client / Grpc.Core.Api / Grpc.Tools 2.83.*. Verified locally after the fix: restore is clean, `mage -d spicedb-csharp lint` (`dotnet format --verify-no-changes`) exits 0, and all 252 unit tests pass on 7.2.2 -- the assertion API this suite uses is unchanged between 6 and 7. Supersedes #46. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #46 — same bumps, with two corrections.
FluentAssertions pinned to 7.2.2, not 8.10.0
8.x is not an ordinary version bump: it ships under a commercial (Xceed) licence. The
nuspecs say so directly:
<license>type="expression"→ Apache-2.0type="expression"→ Apache-2.0type="file"→ commercialMoving an OSS-licensed test dependency onto a commercial licence is a decision for a
human, not for dependabot, so the pin carries a comment explaining why it must not drift.
7.2.2 is the newest Apache-2.0 release, so this is still an upgrade from the 6.12.2 on
main, not a freeze. All 252 unit tests pass on it unchanged — the assertion API thissuite uses is the same across 6 and 7.
The 17 example projects had to move with the group
Dependabot bumped
Microsoft.NET.Test.Sdkto 18.9.0 in the proto and client projects butleft every example project on 17.12.0, which NuGet rejects outright:
That broke
dotnet restore, and with itdotnet format --verify-no-changes— the C# lintjob. The examples now carry the same
Test.Sdk18.9.0 andxunit.runner.visualstudio4.0.0 as the rest of the solution.
Taken as proposed
Google.Protobuf3.35.,Google.Api.CommonProtos2.17.,Grpc.Net.Client/Grpc.Core.Api/Grpc.Tools2.83.*.Verified locally
Restore clean ·
mage -d spicedb-csharp lintexits 0 · 252/252 unit tests pass.🤖 Generated with Claude Code