Brings every NuGet package to its latest stable release and clears the
last deprecated dependency. `dotnet list package --outdated`,
`--deprecated`, and `--vulnerable --include-transitive` now all report
nothing across all 12 projects.

Shipped packages:
  Microsoft.Extensions.Http               10.0.0  -> 10.0.10
  Microsoft.Extensions.Options            10.0.0  -> 10.0.10
  Microsoft.Extensions.Logging.Abstractions 10.0.0 -> 10.0.10
  System.Formats.Cbor                     9.0.4   -> 10.0.10
  Microsoft.EntityFrameworkCore.Relational 10.0.0 -> 10.0.10
  Microsoft.Extensions.Http.Resilience    10.0.0  -> 10.8.0

System.Formats.Cbor was the last package still on the .NET 9 line; it
now matches the net10.0 target. Aspire.Hosting / Aspire.AppHost.Sdk were
already current at 13.4.6.

Test packages:
  Microsoft.NET.Test.Sdk                  17.14.1 -> 18.8.1
  NSubstitute                             5.3.0   -> 6.0.0
  coverlet.collector                      6.0.4   -> 10.0.1
  Microsoft.AspNetCore.TestHost           10.0.5  -> 10.0.10
  Microsoft.EntityFrameworkCore.InMemory  10.0.0  -> 10.0.10
  xunit.runner.visualstudio               3.1.4   -> 3.1.5
  xunit 2.9.3                                     -> xunit.v3 3.2.2

xunit 2.x is deprecated on nuget.org (Legacy, superseded by xunit.v3)
with no non-deprecated 2.x release, so a version bump could not clear
it. The migration is contained because the suite never used
Xunit.Abstractions or ITestOutputHelper: the four IAsyncLifetime
implementations return ValueTask, and the five custom Fact/Theory
attributes forward [CallerFilePath]/[CallerLineNumber] to the base
constructor (xUnit3003). No test was rewritten and no assertion changed.

xUnit1051 (pass TestContext.Current.CancellationToken) is new in
xunit.v3 and fires at ~260 existing call sites; it is NoWarn'd in the
two test projects with a comment, to be done as its own change rather
than buried in a dependency bump. The solution still builds warning-free.

CI: actions/checkout@v4 -> v7, actions/setup-dotnet@v4 -> v6.

Verified: Debug and Release builds both clean (0 warnings, 0 errors),
1103 unit tests pass with the same 5 gated tests skipping as before, and
dotnet pack produces all 5 packages.

closes #73

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

claude-bot referenced this pull request

2026-07-25 23:22:19 +00:00

Update dependencies #73

claude-bot commented

2026-07-25 23:22:22 +00:00

Author

Collaborator

🤖 Reviewing this PR — follow along in the action run; the reply will link the full session transcript.

📜 Live transcript — updating every ~5 minutes while the task runs.

🤖 Reviewing this PR — follow along in [the action run](https://git.grandiras.net/Grandiras/claude-bot/actions/runs/92); the reply will link the full session transcript. 📜 [Live transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/ATProto.NET/pr-76/run-92.md) — updating every ~5 minutes while the task runs.

claude-reviewer approved these changes

2026-07-25 23:24:03 +00:00

claude-reviewer left a comment

✅ Verdict: approve — no blocking issues found.

Clean, well-scoped dependency and CI upgrade for issue #73. The xunit.v3 migration is handled correctly: all four IAsyncLifetime implementations (XrpcEndpointTests, XrpcAssemblyScanTests, EfCoreAtProtoTokenStoreTests, AuthenticatedClientFixture) were switched to ValueTask, and all five custom FactAttribute/TheoryAttribute subclasses now forward [CallerFilePath]/[CallerLineNumber] to the base constructor, matching xunit.v3's source-information requirement — I grepped both test projects and confirmed no IAsyncLifetime implementor or custom attribute was missed. The xUnit1051 suppression is scoped with an explanatory comment rather than silently blanket-ignored, and the CHANGELOG entries are detailed and accurate against the diff (package version bumps, migration rationale, CI action bumps). I wasn't able to actually run dotnet build/dotnet test against the PR branch in this sandbox (worktree/checkout operations were blocked), so I couldn't independently reverify the "all 1103 unit tests pass" claim, but nothing in the diff looks structurally wrong.

⏱ 1m 25s · 16 turns · tokens: 28.5k in / 6.0k out (+726.6k cache-read)
📜 Full session transcript

✅ **Verdict: approve** — no blocking issues found. Clean, well-scoped dependency and CI upgrade for issue #73. The xunit.v3 migration is handled correctly: all four `IAsyncLifetime` implementations (`XrpcEndpointTests`, `XrpcAssemblyScanTests`, `EfCoreAtProtoTokenStoreTests`, `AuthenticatedClientFixture`) were switched to `ValueTask`, and all five custom `FactAttribute`/`TheoryAttribute` subclasses now forward `[CallerFilePath]`/`[CallerLineNumber]` to the base constructor, matching xunit.v3's source-information requirement — I grepped both test projects and confirmed no `IAsyncLifetime` implementor or custom attribute was missed. The `xUnit1051` suppression is scoped with an explanatory comment rather than silently blanket-ignored, and the CHANGELOG entries are detailed and accurate against the diff (package version bumps, migration rationale, CI action bumps). I wasn't able to actually run `dotnet build`/`dotnet test` against the PR branch in this sandbox (worktree/checkout operations were blocked), so I couldn't independently reverify the "all 1103 unit tests pass" claim, but nothing in the diff looks structurally wrong. --- ⏱ 1m 25s · 16 turns · tokens: 28.5k in / 6.0k out (+726.6k cache-read) 📜 [Full session transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/ATProto.NET/pr-76/run-92.md)