From e54bb49744421fd4fac18f518de77eae559a4ecf Mon Sep 17 00:00:00 2001 From: Brenton Farmer Date: Mon, 31 Aug 2026 10:00:31 -0700 Subject: [PATCH] chore(deps): update Hyperbee.Expressions to 1.5.1 and clear all build warnings Update Hyperbee.Expressions and resolve every outstanding build warning (198 -> 0). All 1,446 tests pass across net8.0, net9.0 and net10.0. Hyperbee.Expressions 1.2.0/1.3.2 -> 1.5.1 1.5.1 ships net8.0, net9.0 and net10.0 assets, so the three conditional PackageVersion entries collapse into a single common one. From 1.4.9 onward Hyperbee.Expressions requires Microsoft.Extensions.DependencyInjection >= 10.0.3, which conflicted with the net8/net9 pins at 9.0.4/9.0.6 and raised NU1605; those pins move to 10.0.11. NU1901 - NuGet.* 7.0.1 -> 7.9.0 NuGet.Packaging and NuGet.Protocol 7.0.1 carry GHSA-g4vj-cjjj-v7hg. Patched at 7.0.3; taking 7.9.0, the current release. NU1903 - System.Security.Cryptography.Xml pinned to 9.0.19 / 10.0.11 Arrives transitively from Microsoft.DotNet.Interactive.PackageManagement at 9.0.6/10.0.0, which carry three high-severity .NET DoS advisories (CVE-2026-50648, CVE-2026-47302, CVE-2026-26171). Pinned via an explicit PackageReference scoped to the same '!= net8.0' condition as PackageManagement itself. NU1608 - align net8 with net9 net9 and net10 were already self-consistent; only net8 was stranded on Microsoft.DotNet.Interactive beta.24568.1, which requires Roslyn 4.11.0 while the net8 group pinned 4.13.0. The newer betas ship netstandard2.0 assets and so are net8-compatible; net8 now uses beta.25323.1 with Roslyn 4.14.0, matching net9. NU1510 - drop framework-provided references System.Reflection.Metadata and System.Text.Encodings.Web are provided by the framework on net8.0+ and unused in the codebase. System.Reflection.MetadataLoadContext is a real package and is retained. Also group Hyperbee.* updates in dependabot so the co-versioned family moves together. --- .github/dependabot.yml | 4 ++ Directory.Packages.props | 54 +++++++++---------- src/Hyperbee.XS.Cli/Hyperbee.Xs.Cli.csproj | 1 - .../Hyperbee.Xs.Interactive.csproj | 4 +- 4 files changed, 33 insertions(+), 30 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8ca517d..4a77016 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,3 +9,7 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" + groups: + hyperbee: + patterns: + - "Hyperbee.*" diff --git a/Directory.Packages.props b/Directory.Packages.props index d2e790a..0b38898 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -6,6 +6,7 @@ + all @@ -16,11 +17,11 @@ - - - - - + + + + + @@ -31,32 +32,32 @@ - + - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + - + + @@ -71,11 +72,11 @@ - - + + @@ -90,6 +91,5 @@ - \ No newline at end of file diff --git a/src/Hyperbee.XS.Cli/Hyperbee.Xs.Cli.csproj b/src/Hyperbee.XS.Cli/Hyperbee.Xs.Cli.csproj index 7f2b48b..65ebc1a 100644 --- a/src/Hyperbee.XS.Cli/Hyperbee.Xs.Cli.csproj +++ b/src/Hyperbee.XS.Cli/Hyperbee.Xs.Cli.csproj @@ -29,7 +29,6 @@ - diff --git a/src/Hyperbee.XS.Interactive/Hyperbee.Xs.Interactive.csproj b/src/Hyperbee.XS.Interactive/Hyperbee.Xs.Interactive.csproj index e60ede5..792079c 100644 --- a/src/Hyperbee.XS.Interactive/Hyperbee.Xs.Interactive.csproj +++ b/src/Hyperbee.XS.Interactive/Hyperbee.Xs.Interactive.csproj @@ -24,13 +24,13 @@ - - + +