Grandiras/ATProto.NET

Fork 0

chore: update dependencies and pin the CI PDS version #220

Merged

Grandiras merged 1 commit from issue-219-deps into main

2026-10-05 14:08:23 +00:00

Grandiras commented

2026-10-05 14:00:59 +00:00

Owner

Closes #219.

Packages

Package	From	To
`System.Formats.Cbor`, `Microsoft.Extensions.{Caching,Logging}.Abstractions`, EF Core (Relational, Sqlite), `AspNetCore.TestHost`	10.0.10	10.0.12
`Aspire.Hosting`, `.AppHost`, `.PostgreSQL`, `Aspire.AppHost.Sdk`	13.4.6	13.6.0
`Microsoft.Extensions.Http.Resilience` (sample)	10.8.0	10.10.0
`StackExchange.Redis` (sample)	2.13.17	3.3.1
`Microsoft.NET.Test.Sdk`	18.8.1	18.10.1
`coverlet.collector`	10.0.1	10.1.0
`NSubstitute`	6.0.0	6.2.0
`ZstdSharp.Port`	0.8.6	0.8.8
`xunit.v3` → `xunit.v3.mtp-off`, `xunit.runner.visualstudio`	3.2.2, 3.1.5	4.0.1, 4.0.0
`Microsoft.CodeAnalysis.CSharp` (doc-snippet generator)	4.14.0	5.0.0

Two deliberate choices:

xunit 4 as xunit.v3.mtp-off. The default xunit.v3 4.x runs on Microsoft.Testing.Platform v2, which refuses the VSTest mode of dotnet test on the .NET 10 SDK. Moving to MTP would change every documented and CI command line, --filter included. The mtp-off variant is the same xunit 4 run through xunit.runner.visualstudio.
Roslyn 5.0, not 5.9. A source generator can't reference a newer Roslyn than the compiler that loads it. The .NET 10.0.1xx SDK (locally 10.0.112, and the CI image) ships Roslyn 5.0.
Aspire 13.6 warns (ASPIRE010) when the CLI bundle is off. The sample AppHost runs, and CI generates its manifest, without the Aspire CLI, so the warning is suppressed there.

CI PDS

pds-integration now runs ghcr.io/bluesky-social/pds:0.4.5037 (the newest release, digest sha256:3a8feb34…, which equals today's latest). A runner that doesn't force pulls could keep an old latest cached indefinitely. CONTRIBUTING's local integration setup uses the same pin.

Build has 0 warnings; 5110 unit tests pass, including a --filter run.

🤖 Generated with Claude Code

Closes #219. ## Packages | Package | From | To | |---|---|---| | `System.Formats.Cbor`, `Microsoft.Extensions.{Caching,Logging}.Abstractions`, EF Core (Relational, Sqlite), `AspNetCore.TestHost` | 10.0.10 | 10.0.12 | | `Aspire.Hosting`, `.AppHost`, `.PostgreSQL`, `Aspire.AppHost.Sdk` | 13.4.6 | 13.6.0 | | `Microsoft.Extensions.Http.Resilience` (sample) | 10.8.0 | 10.10.0 | | `StackExchange.Redis` (sample) | 2.13.17 | 3.3.1 | | `Microsoft.NET.Test.Sdk` | 18.8.1 | 18.10.1 | | `coverlet.collector` | 10.0.1 | 10.1.0 | | `NSubstitute` | 6.0.0 | 6.2.0 | | `ZstdSharp.Port` | 0.8.6 | 0.8.8 | | `xunit.v3` → `xunit.v3.mtp-off`, `xunit.runner.visualstudio` | 3.2.2, 3.1.5 | 4.0.1, 4.0.0 | | `Microsoft.CodeAnalysis.CSharp` (doc-snippet generator) | 4.14.0 | 5.0.0 | Two deliberate choices: - **xunit 4 as `xunit.v3.mtp-off`.** The default `xunit.v3` 4.x runs on Microsoft.Testing.Platform v2, which refuses the VSTest mode of `dotnet test` on the .NET 10 SDK. Moving to MTP would change every documented and CI command line, `--filter` included. The `mtp-off` variant is the same xunit 4 run through `xunit.runner.visualstudio`. - **Roslyn 5.0, not 5.9.** A source generator can't reference a newer Roslyn than the compiler that loads it. The .NET 10.0.1xx SDK (locally 10.0.112, and the CI image) ships Roslyn 5.0. - **Aspire 13.6** warns (ASPIRE010) when the CLI bundle is off. The sample AppHost runs, and CI generates its manifest, without the Aspire CLI, so the warning is suppressed there. ## CI PDS `pds-integration` now runs `ghcr.io/bluesky-social/pds:0.4.5037` (the newest release, digest `sha256:3a8feb34…`, which equals today's `latest`). A runner that doesn't force pulls could keep an old `latest` cached indefinitely. CONTRIBUTING's local integration setup uses the same pin. Build has 0 warnings; 5110 unit tests pass, including a `--filter` run. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Grandiras added 1 commit

2026-10-05 14:01:00 +00:00

chore: update dependencies and pin the CI PDS version (closes #219 )

CI / pds-integration (pull_request) Successful in 27s

Details

CI / build-and-test (pull_request) Successful in 57s

Details

Sync Closures to GitHub / sync-closure (pull_request) Successful in 8s

Details

3f7a655b91

- .NET packages 10.0.10 -> 10.0.12, Aspire 13.4.6 -> 13.6.0, test tooling
  (Test.Sdk, coverlet, NSubstitute, ZstdSharp) to latest, Roslyn for the
  doc-snippet generator 4.14 -> 5.0 (the SDK's own compiler).
- xunit.v3 3.2 -> 4.0 as xunit.v3.mtp-off, so `dotnet test` keeps running
  on VSTest and every documented command line, --filter included, works.
- The pds-integration job pins ghcr.io/bluesky-social/pds:0.4.5037 instead
  of :latest, which a runner without forced pulls could keep stale.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

opencode-bot commented

2026-10-05 14:01:01 +00:00

Collaborator

🤖 Reviewing this PR — the review will link the full session transcript.

📜 Live transcript — updating every ~5 minutes while the review runs.

🤖 Reviewing this PR — the review will link the full session transcript.  📜 [Live transcript](https://git.grandiras.net/Grandiras/opencode-bot/src/branch/opencode-logs/transcripts/Grandiras/ATProto.NET/pr-220/run-2026-10-05T14-01-01-296Z.md) — updating every ~5 minutes while the review runs.

claude-bot commented

2026-10-05 14:01:03 +00:00

Collaborator

🤖 Reviewing this PR — follow along in the action run; the reply will link the full session transcript.

📜 Live transcript — updating every ~5 minutes while the task runs.

🤖 Reviewing this PR — follow along in [the action run](https://git.grandiras.net/Grandiras/claude-bot/actions/runs/748); the reply will link the full session transcript.  📜 [Live transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/ATProto.NET/pr-220/run-748.md) — updating every ~5 minutes while the task runs.

claude-reviewer approved these changes

2026-10-05 14:01:29 +00:00

claude-reviewer left a comment

✅ Verdict: approve — no blocking issues found.

This is a clean dependency bump, and I found nothing that should block merging. I read the diff and grepped the repo, but didn't build or run the tests; the PR reports a 0-warning build and 5110 passing unit tests.

Version consistency: the EF Core, Microsoft.Extensions and System.Formats.Cbor versions all move together, as the comments in the csproj files require. The Roslyn 5.0 pin for the source generator is a sound choice, as the PR explains. No stale 10.0.10 or 13.4.6 references remain.
CHANGELOG: the bullet is in the right section and follows the style rules.
Left-over pds:latest: docs/managed-pds.md:483 and samples/ManagedPdsSample/README.md:65 still say ghcr.io/bluesky-social/pds:latest. These are user-facing examples for running a managed PDS, so leaving them unpinned is defensible. If you want one pinned version across the repo, update them too.
Redis major bump: StackExchange.Redis goes from 2.x to 3.x, but it is only used in the doc-snippets project. The compiled doc build is the check there, and the PR says it passes.

🧠 claude-sonnet-5-5 · ⏱ 0m 10s · 3 turns · tokens: 18.7k in / 783 out (+42.4k cache-read)
📜 Full session transcript

✅ **Verdict: approve** — no blocking issues found. This is a clean dependency bump, and I found nothing that should block merging. I read the diff and grepped the repo, but didn't build or run the tests; the PR reports a 0-warning build and 5110 passing unit tests. - **Version consistency:** the EF Core, `Microsoft.Extensions` and `System.Formats.Cbor` versions all move together, as the comments in the csproj files require. The Roslyn 5.0 pin for the source generator is a sound choice, as the PR explains. No stale `10.0.10` or `13.4.6` references remain. - **CHANGELOG:** the bullet is in the right section and follows the style rules. - **Left-over `pds:latest`:** `docs/managed-pds.md:483` and `samples/ManagedPdsSample/README.md:65` still say `ghcr.io/bluesky-social/pds:latest`. These are user-facing examples for running a managed PDS, so leaving them unpinned is defensible. If you want one pinned version across the repo, update them too. - **Redis major bump:** `StackExchange.Redis` goes from 2.x to 3.x, but it is only used in the doc-snippets project. The compiled doc build is the check there, and the PR says it passes. --- 🧠 claude-sonnet-5-5 · ⏱ 0m 10s · 3 turns · tokens: 18.7k in / 783 out (+42.4k cache-read) 📜 [Full session transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/ATProto.NET/pr-220/run-748.md)

opencode-reviewer approved these changes

2026-10-05 14:03:02 +00:00

opencode-reviewer left a comment

✅ Verdict: approve — no blocking issues found.

Good, careful dependency bump. Verified against reality:

PDS pin is correct and current: 0.4.5037 resolves on ghcr, and at review time its digest (sha256:3a8feb34…) is identical to what latest points at, matching the PR's claim. Pinning CI and CONTRIBUTING's local setup to the same tag removes the stale-cached-latest ambiguity in the service container.
xunit switch checks out: xunit.v3.mtp-off 4.0.1 exists and is exactly the "xunit 4 without Microsoft.Testing.Platform" package (it pulls xunit.v3.core.mtp-off), so dotnet test keeps its VSTest mode and documented --filter behavior with xunit.runner.visualstudio 4.0.0. tests/Directory.Build.props already carries the xUnit1051 NoWarn with an honest comment, and CI's TreatNoTestsAsError=true guards on both filtered test runs remain in place.
Roslyn 5.0.0 provides a netstandard2.0 dependency group, so the doc-snippet generator's target framework stays consistent with the compiler-loaded-generator constraint as described.
All other version numbers referenced exist as stable NuGet releases on the stated lines (Aspire 13.6.0, EF Core/TestHost/Cbor 10.0.12, NSubstitute 6.2.0, ZstdSharp 0.8.8, Test.Sdk 18.10.1, coverlet 10.1.0, Http.Resilience 10.10.0). The EF Core "keep tests on exactly the src version" pinning rule is respected (Relational and Sqlite both moved to 10.0.12 together), and Aspire.AppHost.Sdk was bumped in lockstep with the hosting packages.

One non-blocking consistency point (no action required for this PR): docs/managed-pds.md (~line 483) and samples/ManagedPdsSample/README.md (~line 65) still show pds:latest in their run-your-own-PDS instructions. Those target end users standing up a persistent server rather than the test setup, so latest is defensible there, but if the intent is "pin everywhere the docs tell a human to launch the reference PDS," these are the two spots left behind. Similarly, AtProtoPdsHostingExtensions.DefaultTag is still "latest" for the Aspire resource default — reasonable for a library API, just noting both in case you want them tracked.

⏱ 2m 1s · 28 steps · $0.0268 · tokens: 49.9k in / 3.0k out (+510.5k cache-read) · Go: 5h 3% · wk 2% · mo 92%
📜 Full session transcript

✅ **Verdict: approve** — no blocking issues found. Good, careful dependency bump. Verified against reality: - **PDS pin is correct and current**: `0.4.5037` resolves on ghcr, and at review time its digest (`sha256:3a8feb34…`) is identical to what `latest` points at, matching the PR's claim. Pinning CI and CONTRIBUTING's local setup to the same tag removes the stale-cached-`latest` ambiguity in the service container. - **xunit switch checks out**: `xunit.v3.mtp-off` 4.0.1 exists and is exactly the "xunit 4 without Microsoft.Testing.Platform" package (it pulls `xunit.v3.core.mtp-off`), so `dotnet test` keeps its VSTest mode and documented `--filter` behavior with `xunit.runner.visualstudio` 4.0.0. `tests/Directory.Build.props` already carries the `xUnit1051` NoWarn with an honest comment, and CI's `TreatNoTestsAsError=true` guards on both filtered test runs remain in place. - **Roslyn 5.0.0** provides a netstandard2.0 dependency group, so the doc-snippet generator's target framework stays consistent with the compiler-loaded-generator constraint as described. - All other version numbers referenced exist as stable NuGet releases on the stated lines (Aspire 13.6.0, EF Core/TestHost/Cbor 10.0.12, NSubstitute 6.2.0, ZstdSharp 0.8.8, Test.Sdk 18.10.1, coverlet 10.1.0, Http.Resilience 10.10.0). The EF Core "keep tests on exactly the src version" pinning rule is respected (Relational and Sqlite both moved to 10.0.12 together), and Aspire.AppHost.Sdk was bumped in lockstep with the hosting packages. One non-blocking consistency point (no action required for this PR): `docs/managed-pds.md` (~line 483) and `samples/ManagedPdsSample/README.md` (~line 65) still show `pds:latest` in their run-your-own-PDS instructions. Those target end users standing up a persistent server rather than the test setup, so `latest` is defensible there, but if the intent is "pin everywhere the docs tell a human to launch the reference PDS," these are the two spots left behind. Similarly, `AtProtoPdsHostingExtensions.DefaultTag` is still `"latest"` for the Aspire resource default — reasonable for a library API, just noting both in case you want them tracked. --- ⏱ 2m 1s · 28 steps · $0.0268 · tokens: 49.9k in / 3.0k out (+510.5k cache-read) · Go: 5h 3% · wk 2% · mo 92% 📜 [Full session transcript](https://git.grandiras.net/Grandiras/opencode-bot/src/branch/opencode-logs/transcripts/Grandiras/ATProto.NET/pr-220/run-2026-10-05T14-01-01-296Z.md)

Grandiras merged commit 25cd9ba9bd into main

2026-10-05 14:08:23 +00:00

Grandiras deleted branch issue-219-deps

2026-10-05 14:08:23 +00:00

Grandiras referenced this pull request from a commit

2026-10-05 14:08:24 +00:00

chore: update dependencies and pin the CI PDS version (#220)