From a98848a878d635fc8ba2c84fdd4f2cc42aa69ad2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 20:45:08 +0000 Subject: [PATCH 1/2] Bump the nuget-minor-patch group with 8 updates Bumps Microsoft.OpenApi from 2.9.0 to 2.11.0 Bumps Quartz from 3.19.0 to 3.19.1 Bumps Quartz.Extensions.Hosting from 3.19.0 to 3.19.1 Bumps Spectre.Console from 0.55.0 to 0.56.0 Bumps Spectre.Console.Json from 0.55.0 to 0.56.0 Bumps Spectre.Console.Testing from 0.55.0 to 0.57.2 Bumps SQLitePCLRaw.bundle_e_sqlite3 from 3.0.4 to 3.0.5 Bumps WireMock.Net from 2.13.0 to 2.14.0 --- updated-dependencies: - dependency-name: Microsoft.OpenApi dependency-version: 2.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Quartz dependency-version: 3.19.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Quartz.Extensions.Hosting dependency-version: 3.19.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Spectre.Console dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Spectre.Console.Json dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Spectre.Console.Testing dependency-version: 0.57.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: SQLitePCLRaw.bundle_e_sqlite3 dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: WireMock.Net dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch ... Signed-off-by: dependabot[bot] --- Directory.Packages.props | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 0076029..b34c82d 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -66,7 +66,7 @@ The 3.x line ships SQLite 3.50.4+ (via SourceGear.sqlite3) and closes the CVE — referenced directly by every project that references a *Sqlite package so the transitive graph resolves to the fixed native build. --> - + @@ -76,8 +76,8 @@ - - + + @@ -129,7 +129,7 @@ 2.9.0 is still 2.x so Swashbuckle's Models namespace stays compatible — do NOT take Microsoft.OpenApi 3.x while Swashbuckle 10.x asks for the 2.x surface. Also forced in Api.Tests over WireMock.Net.OpenApiParser's 2.4.1. --> - + @@ -149,10 +149,10 @@ and it pins Spectre.Console to its own version. Splitting the two would pair a 0.57 core with a CLI built against 0.55 — on a 0.x library that is a real risk, so the whole family moves together and waits for Spectre.Console.Cli 1.0. --> - + - - + + @@ -178,7 +178,7 @@ - + From 19702ac3dacf81bcd90a225c918938cd138f16fc Mon Sep 17 00:00:00 2001 From: Sev7eNup <79143581+Sev7eNup@users.noreply.github.com> Date: Sun, 9 Aug 2026 20:56:35 +0200 Subject: [PATCH 2/2] chore(deps): keep the Spectre family on 0.55.0 and close the ignore-rule gap The grouped run bumped Spectre.Console to 0.56.0 and Spectre.Console.Testing to 0.57.2 while Spectre.Console.Cli stayed on 0.55.0 - exactly the split the comment in Directory.Packages.props rules out. The CLI's stable line stops at 0.55.0 (everything after is a 1.0.0-alpha prerelease) and it pins Spectre.Console to its own version, so a newer core paired with a CLI built against 0.55 is a real risk on a 0.x library. Green CI does not refute that: the failure mode is behavioural drift, not a build break. Two gaps let this through, both fixed here: - Spectre.Console.Testing was never in the ignore list, so nothing capped it. - The floor was >=0.57.0, which still permits 0.56.0 and splits the family just the same. Now a single wildcard rule holds every Spectre.Console* package below 0.56.0, to be lifted when Spectre.Console.Cli 1.0 ships. The other six bumps in this PR are untouched. --- .github/dependabot.yml | 16 ++++++++++------ Directory.Packages.props | 6 +++--- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2f991ff..3c956a4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,15 +17,19 @@ updates: day: monday open-pull-requests-limit: 1 # Known-incompatible upgrades, each verified against this codebase — do not re-offer: - # Microsoft.OpenApi 3.x breaks the OpenAPI pipeline; Spectre.Console 0.57.x breaks the - # CLI rendering stack. Revisit deliberately, not via routine bumps. + # Microsoft.OpenApi 3.x breaks the OpenAPI pipeline. Spectre.Console must move as a + # FAMILY: Spectre.Console.Cli's stable line stops at 0.55.0 and pins Spectre.Console to + # its own version, so any bump of the other packages pairs a newer core with a CLI built + # against 0.55 — on a 0.x library that is a real risk (see the comment in + # Directory.Packages.props). The wildcard and the 0.56.0 floor are both deliberate: the + # previous rule named only Spectre.Console and Spectre.Console.Json at >=0.57.0, which + # let a grouped run bump the core to 0.56.0 and Spectre.Console.Testing to 0.57.2 while + # the CLI stayed at 0.55.0. Lift this when Spectre.Console.Cli 1.0 ships. ignore: - dependency-name: "Microsoft.OpenApi" versions: [">=3.0.0"] - - dependency-name: "Spectre.Console" - versions: [">=0.57.0"] - - dependency-name: "Spectre.Console.Json" - versions: [">=0.57.0"] + - dependency-name: "Spectre.Console*" + versions: [">=0.56.0"] groups: nuget-minor-patch: patterns: diff --git a/Directory.Packages.props b/Directory.Packages.props index b34c82d..5bcbb6a 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -149,10 +149,10 @@ and it pins Spectre.Console to its own version. Splitting the two would pair a 0.57 core with a CLI built against 0.55 — on a 0.x library that is a real risk, so the whole family moves together and waits for Spectre.Console.Cli 1.0. --> - + - - + +