Update dependencies #73

New issue

Closed

opened 2026-07-25 23:01:16 +00:00 by Grandiras · 2 comments

Grandiras commented

2026-07-25 23:01:16 +00:00

Owner

Update all dependencies the project and its parts relie on

claude-bot was assigned by Grandiras

2026-07-25 23:11:52 +00:00

claude-bot commented

2026-07-25 23:11:56 +00:00

Collaborator

🤖 On it — follow along in the action run; the reply will link the full session transcript.

📜 Live transcript — updating every ~5 minutes while the task runs.

🤖 On it — follow along in [the action run](https://git.grandiras.net/Grandiras/claude-bot/actions/runs/90); the reply will link the full session transcript. 📜 [Live transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/ATProto.NET/issue-73/run-90.md) — updating every ~5 minutes while the task runs.

claude-bot referenced this issue from a commit

2026-07-25 23:21:54 +00:00

chore(deps): update all dependencies to their latest stable versions

claude-bot referenced this issue from a pull request that will close it,

2026-07-25 23:22:18 +00:00

Claude: changes for issue #73 #76

claude-bot commented

2026-07-25 23:22:19 +00:00

Collaborator

Pushed. Every dependency is now current and the three dependency-health audits come back empty.

Updated all dependencies to their latest stable versions. Pushed to claude/issue-73 (compare).

dotnet list package --outdated, --deprecated, and --vulnerable --include-transitive now all come back empty across all 12 projects.

Shipped packages

Package	From	To
`Microsoft.Extensions.Http`	10.0.0	10.0.10
`Microsoft.Extensions.Options`	10.0.0	10.0.10
`Microsoft.Extensions.Logging.Abstractions`	10.0.0	10.0.10
`System.Formats.Cbor`	9.0.4	10.0.10
`Microsoft.EntityFrameworkCore.Relational`	10.0.0	10.0.10
`Microsoft.Extensions.Http.Resilience`	10.0.0	10.8.0

System.Formats.Cbor was the last package still on the .NET 9 line — it now matches the net10.0 target. Aspire.Hosting / Aspire.AppHost.Sdk were already current at 13.4.6. No source change was needed for any of these.

Test packages

Microsoft.NET.Test.Sdk 17.14.1→18.8.1, NSubstitute 5.3.0→6.0.0, coverlet.collector 6.0.4→10.0.1, Microsoft.AspNetCore.TestHost 10.0.5→10.0.10, Microsoft.EntityFrameworkCore.InMemory 10.0.0→10.0.10, xunit.runner.visualstudio 3.1.4→3.1.5.

One judgment call worth your review: xunit → xunit.v3

xunit 2.9.3 is flagged deprecated on nuget.org (Legacy, superseded by xunit.v3), and there's no non-deprecated 2.x release — a version bump couldn't clear it, so I migrated to xunit.v3 3.2.2.

It turned out contained, because the suite never used Xunit.Abstractions or ITestOutputHelper. The whole migration was 8 compiler errors:

the four IAsyncLifetime implementations (XrpcEndpointTests, XrpcAssemblyScanTests, EfCoreAtProtoTokenStoreTests, AuthenticatedClientFixture) return ValueTask instead of Task
the five custom Fact/Theory attributes (RequiresPds, RequiresBluesky, RequiresPdsAdmin, RequiresAspireManifest ×2) forward [CallerFilePath]/[CallerLineNumber] to the base constructor, which is what xunit.v3 wants for source info (xUnit3003)

No test was rewritten and no assertion changed.

The part to weigh in on: xunit.v3 adds analyzer xUnit1051 (pass TestContext.Current.CancellationToken to every cancellable call), which fires at ~260 existing call sites across ~40 files. Threading that token through is worthwhile, but it's a large mechanical diff unrelated to a dependency bump — so I NoWarned it in the two test projects with a comment explaining why, rather than either leaving 260 new warnings in a repo that builds clean or bloating this PR. Happy to do it as a follow-up issue, or to split the xunit.v3 migration out entirely if you'd rather keep this PR to pure version bumps.

CI

actions/checkout@v4→v7 and actions/setup-dotnet@v4→v6 in the GitHub mirror workflows. The Forgejo workflows pin no actions; their mcr.microsoft.com/dotnet/sdk:10.0 and ghcr.io/bluesky-social/pds:latest images are floating tags already tracking latest, so nothing to bump there.

Verified

Installed the .NET 10 SDK (10.0.302) in the CI container and ran:

Debug build — 0 warnings, 0 errors
Release build (--no-incremental) — 0 warnings, 0 errors
Unit tests in both Debug and Release — 1103 passed, 0 failed, same 5 gated tests skipping as the pre-change baseline I captured first
dotnet pack --configuration Release — all 5 packages + symbols produced
Final audit: outdated / deprecated / vulnerable all empty

CHANGELOG.md updated under [Unreleased] → Changed in the same commit.

One thing I noticed but left alone as out of scope: BlazorOAuthSample and ServerIntegrationSample lack <IsPackable>false</IsPackable>, so dotnet pack emits pre-existing "packaging has been disabled" warnings for them — contrary to the convention in CLAUDE.md. Worth a small separate fix.

⏱ 10m 7s · 76 turns · tokens: 86.0k in / 29.3k out (+3017.7k cache-read)
📜 Full session transcript
→ Opened PR: #76

Pushed. Every dependency is now current and the three dependency-health audits come back empty. Updated all dependencies to their latest stable versions. Pushed to **`claude/issue-73`** ([compare](https://git.grandiras.net/Grandiras/ATProto.NET/compare/main...claude/issue-73)). `dotnet list package --outdated`, `--deprecated`, and `--vulnerable --include-transitive` now all come back **empty** across all 12 projects. ### Shipped packages | Package | From | To | |---|---|---| | `Microsoft.Extensions.Http` | 10.0.0 | 10.0.10 | | `Microsoft.Extensions.Options` | 10.0.0 | 10.0.10 | | `Microsoft.Extensions.Logging.Abstractions` | 10.0.0 | 10.0.10 | | `System.Formats.Cbor` | 9.0.4 | 10.0.10 | | `Microsoft.EntityFrameworkCore.Relational` | 10.0.0 | 10.0.10 | | `Microsoft.Extensions.Http.Resilience` | 10.0.0 | 10.8.0 | `System.Formats.Cbor` was the last package still on the .NET 9 line — it now matches the `net10.0` target. `Aspire.Hosting` / `Aspire.AppHost.Sdk` were already current at 13.4.6. No source change was needed for any of these. ### Test packages `Microsoft.NET.Test.Sdk` 17.14.1→18.8.1, `NSubstitute` 5.3.0→6.0.0, `coverlet.collector` 6.0.4→10.0.1, `Microsoft.AspNetCore.TestHost` 10.0.5→10.0.10, `Microsoft.EntityFrameworkCore.InMemory` 10.0.0→10.0.10, `xunit.runner.visualstudio` 3.1.4→3.1.5. ### One judgment call worth your review: xunit → xunit.v3 `xunit` 2.9.3 is flagged **deprecated** on nuget.org (`Legacy`, superseded by `xunit.v3`), and there's no non-deprecated 2.x release — a version bump couldn't clear it, so I migrated to `xunit.v3` 3.2.2. It turned out contained, because the suite never used `Xunit.Abstractions` or `ITestOutputHelper`. The whole migration was 8 compiler errors: - the four `IAsyncLifetime` implementations (`XrpcEndpointTests`, `XrpcAssemblyScanTests`, `EfCoreAtProtoTokenStoreTests`, `AuthenticatedClientFixture`) return `ValueTask` instead of `Task` - the five custom `Fact`/`Theory` attributes (`RequiresPds`, `RequiresBluesky`, `RequiresPdsAdmin`, `RequiresAspireManifest` ×2) forward `[CallerFilePath]`/`[CallerLineNumber]` to the base constructor, which is what xunit.v3 wants for source info (xUnit3003) No test was rewritten and no assertion changed. **The part to weigh in on:** xunit.v3 adds analyzer xUnit1051 (pass `TestContext.Current.CancellationToken` to every cancellable call), which fires at ~260 existing call sites across ~40 files. Threading that token through is worthwhile, but it's a large mechanical diff unrelated to a dependency bump — so I `NoWarn`ed it in the two test projects with a comment explaining why, rather than either leaving 260 new warnings in a repo that builds clean or bloating this PR. Happy to do it as a follow-up issue, or to split the xunit.v3 migration out entirely if you'd rather keep this PR to pure version bumps. ### CI `actions/checkout@v4`→`v7` and `actions/setup-dotnet@v4`→`v6` in the GitHub mirror workflows. The Forgejo workflows pin no actions; their `mcr.microsoft.com/dotnet/sdk:10.0` and `ghcr.io/bluesky-social/pds:latest` images are floating tags already tracking latest, so nothing to bump there. ### Verified Installed the .NET 10 SDK (10.0.302) in the CI container and ran: - **Debug build** — 0 warnings, 0 errors - **Release build** (`--no-incremental`) — 0 warnings, 0 errors - **Unit tests** in both Debug and Release — **1103 passed, 0 failed**, same 5 gated tests skipping as the pre-change baseline I captured first - **`dotnet pack --configuration Release`** — all 5 packages + symbols produced - Final audit: outdated / deprecated / vulnerable all empty `CHANGELOG.md` updated under `[Unreleased] → Changed` in the same commit. One thing I noticed but left alone as out of scope: `BlazorOAuthSample` and `ServerIntegrationSample` lack `<IsPackable>false</IsPackable>`, so `dotnet pack` emits pre-existing "packaging has been disabled" warnings for them — contrary to the convention in CLAUDE.md. Worth a small separate fix. --- ⏱ 10m 7s · 76 turns · tokens: 86.0k in / 29.3k out (+3017.7k cache-read) 📜 [Full session transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/ATProto.NET/issue-73/run-90.md) → Opened PR: https://git.grandiras.net/Grandiras/ATProto.NET/pulls/76

Grandiras closed this issue

2026-07-25 23:24:15 +00:00

Grandiras referenced this issue from a commit

2026-07-25 23:24:16 +00:00

Claude: changes for issue #73 (#76)