chore(deps): update Hyperbee.Expressions to 1.5.1 and clear all build warnings - #94
Merged
Merged
Conversation
… warnings Update Hyperbee.Expressions and resolve every outstanding build warning (198 -> 0). All 1,446 tests pass across net8.0, net9.0 and net10.0. Hyperbee.Expressions 1.2.0/1.3.2 -> 1.5.1 1.5.1 ships net8.0, net9.0 and net10.0 assets, so the three conditional PackageVersion entries collapse into a single common one. From 1.4.9 onward Hyperbee.Expressions requires Microsoft.Extensions.DependencyInjection >= 10.0.3, which conflicted with the net8/net9 pins at 9.0.4/9.0.6 and raised NU1605; those pins move to 10.0.11. NU1901 - NuGet.* 7.0.1 -> 7.9.0 NuGet.Packaging and NuGet.Protocol 7.0.1 carry GHSA-g4vj-cjjj-v7hg. Patched at 7.0.3; taking 7.9.0, the current release. NU1903 - System.Security.Cryptography.Xml pinned to 9.0.19 / 10.0.11 Arrives transitively from Microsoft.DotNet.Interactive.PackageManagement at 9.0.6/10.0.0, which carry three high-severity .NET DoS advisories (CVE-2026-50648, CVE-2026-47302, CVE-2026-26171). Pinned via an explicit PackageReference scoped to the same '!= net8.0' condition as PackageManagement itself. NU1608 - align net8 with net9 net9 and net10 were already self-consistent; only net8 was stranded on Microsoft.DotNet.Interactive beta.24568.1, which requires Roslyn 4.11.0 while the net8 group pinned 4.13.0. The newer betas ship netstandard2.0 assets and so are net8-compatible; net8 now uses beta.25323.1 with Roslyn 4.14.0, matching net9. NU1510 - drop framework-provided references System.Reflection.Metadata and System.Text.Encodings.Web are provided by the framework on net8.0+ and unused in the codebase. System.Reflection.MetadataLoadContext is a real package and is retained. Also group Hyperbee.* updates in dependabot so the co-versioned family moves together.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
Hyperbee.Expressionsto the current release and clears every outstanding build warning.198 warnings → 0. All 1,446 tests pass across net8.0, net9.0 and net10.0.
Hyperbee.Expressions 1.2.0/1.3.2 → 1.5.1
1.5.1ships net8.0, net9.0 and net10.0 assets, so the three conditionalPackageVersionentries collapse into a single common one. The split only existed because1.2.0shipped net8/net9 only.From
1.4.9onward Hyperbee.Expressions requiresMicrosoft.Extensions.DependencyInjection >= 10.0.3, which conflicted with the net8/net9 pins at9.0.4/9.0.6and raised NU1605. Those pins move to10.0.11.Warning fixes
System.Security.Cryptography.Xml9.0.6/10.0.0 viaMicrosoft.DotNet.Interactive.PackageManagement— three high severity .NET DoS advisories9.0.19/10.0.11Microsoft.DotNet.Interactivebeta.24568.1 (wants Roslyn 4.11.0) while net8 pinned Roslyn 4.13.0NuGet.Packaging/NuGet.Protocol7.0.1 — GHSA-g4vj-cjjj-v7hg7.9.0System.Reflection.Metadata/System.Text.Encodings.Webare framework-provided on net8.0+ and unusedAdvisories addressed: CVE-2026-50648, CVE-2026-47302, CVE-2026-26171, GHSA-g4vj-cjjj-v7hg.
Notes
netstandard2.0assets, so they are net8-compatible.System.Reflection.MetadataLoadContextis a real package and is retained.System.Security.Cryptography.Xmlsecurity pin onHyperbee.XS.Interactive.Hyperbee.*so the co-versioned family moves together. Note it has never opened a PR forHyperbee.Expressionsin this repo, which is how it sat on 1.2.0 since May 2025.Downstream
Hyperbee.Templatingpicks upHyperbee.Expressions 1.5.1and the NuGet.* advisory fix once this is released and it bumps to the newHyperbee.XS.🤖 Generated with Claude Code