[dependabot]

Updated Cocoar.Configuration from 6.0.0 to 6.1.0.

Release notes

Sourced from Cocoar.Configuration's releases.

6.1.0

Minor, fully additive release — no breaking changes, drop-in over 6.0.0. Four new configuration file formats, Kubernetes ConfigMap / Secret support, and a provider hardening pass.

✨ New file-format providers

All four sit on a shared, reusable FileBackedProvider base, so they get the same reactive file-watching, path-traversal protection, and per-file debounce as the JSON file provider.

YAML — new opt-in package Cocoar.Configuration.Yaml (YamlDotNet). Plain scalars map to their JSON types (true→bool, 42→number, null/~→null); quoted/block scalars stay strings.

rules.For<AppSettings>().FromYamlFile("appsettings.yaml")

TOML — new opt-in package Cocoar.Configuration.Toml (Tomlyn). TOML is strongly typed, so values map unambiguously to JSON (incl. arrays-of-tables → arrays of objects; dates → ISO-8601 strings).

rules.For<AppSettings>().FromTomlFile("appsettings.toml")

dotenv and INI — built into the core package, no extra dependency:

rules.For<AppSettings>().FromDotEnv()            // .env: KEY=value, # comments, export, quotes, :/__ nesting
rules.For<AppSettings>().FromIniFile("app.ini")  // [section] headers, ;/# comments, ./: nesting

INI keeps inline ;/# inside values intact (only whole-line comments are stripped), so connection strings survive.

☸️ Kubernetes ConfigMap / Secret support

A ConfigMap/Secret-mounted file is a symlink whose content is updated by an atomic swap of a sibling ..data symlink — not by rewriting the file. Opt in with followSymlinks (default off) on any file provider:

rules.For<AppSettings>().FromFile("/etc/config/appsettings.json", followSymlinks: true)
// also on FromYamlFile / FromTomlFile / FromDotEnv / FromIniFile

• Reads the symlinked file — the resolved final target must still resolve within the configured directory, so an escaping symlink is rejected (the path-traversal protection holds).
• Hot-reloads on the atomic ..data swap (via Cocoar.FileSystem 2.3.0 symlink-target tracking), even though the watched file's name and timestamp never change. Detection rides on the directory watcher's periodic re-scan — expect propagation within roughly a minute, in line with how Kubernetes itself rolls ConfigMap updates.

Default behaviour is unchanged: symlinks remain rejected as defense in depth.

🛠️ Provider hardening & internals

• Observable provider: fetch no longer hangs on a cold / complete-without-emit source, and no longer leaks its one-shot subscription.
• HTTP provider: the HttpResponseMessage is disposed after fetch; opt-in SseReadIdleTimeout reconnects a half-open SSE stream.
• Extracted the reusable FileBackedProvider base (watch / path+symlink security / debounce / dispose) shared by all file formats; FileSourceProvider is now a thin subclass.
• Documented the provider-contract invariants; parameterless FromCommandLine(); FileSourceProvider.Dispose made race-safe; removed dead MicrosoftConfigurationSource* code (the FromMicrosoftSource API was dropped in 6.0.0).

📦 Packages

... (truncated)

Commits viewable in compare view.

Updated Cocoar.Configuration.AspNetCore from 6.0.0 to 6.1.0.

Release notes

Sourced from Cocoar.Configuration.AspNetCore's releases.

6.1.0

Minor, fully additive release — no breaking changes, drop-in over 6.0.0. Four new configuration file formats, Kubernetes ConfigMap / Secret support, and a provider hardening pass.

✨ New file-format providers

All four sit on a shared, reusable FileBackedProvider base, so they get the same reactive file-watching, path-traversal protection, and per-file debounce as the JSON file provider.

YAML — new opt-in package Cocoar.Configuration.Yaml (YamlDotNet). Plain scalars map to their JSON types (true→bool, 42→number, null/~→null); quoted/block scalars stay strings.

rules.For<AppSettings>().FromYamlFile("appsettings.yaml")

TOML — new opt-in package Cocoar.Configuration.Toml (Tomlyn). TOML is strongly typed, so values map unambiguously to JSON (incl. arrays-of-tables → arrays of objects; dates → ISO-8601 strings).

rules.For<AppSettings>().FromTomlFile("appsettings.toml")

dotenv and INI — built into the core package, no extra dependency:

rules.For<AppSettings>().FromDotEnv()            // .env: KEY=value, # comments, export, quotes, :/__ nesting
rules.For<AppSettings>().FromIniFile("app.ini")  // [section] headers, ;/# comments, ./: nesting

INI keeps inline ;/# inside values intact (only whole-line comments are stripped), so connection strings survive.

☸️ Kubernetes ConfigMap / Secret support

A ConfigMap/Secret-mounted file is a symlink whose content is updated by an atomic swap of a sibling ..data symlink — not by rewriting the file. Opt in with followSymlinks (default off) on any file provider:

rules.For<AppSettings>().FromFile("/etc/config/appsettings.json", followSymlinks: true)
// also on FromYamlFile / FromTomlFile / FromDotEnv / FromIniFile

• Reads the symlinked file — the resolved final target must still resolve within the configured directory, so an escaping symlink is rejected (the path-traversal protection holds).
• Hot-reloads on the atomic ..data swap (via Cocoar.FileSystem 2.3.0 symlink-target tracking), even though the watched file's name and timestamp never change. Detection rides on the directory watcher's periodic re-scan — expect propagation within roughly a minute, in line with how Kubernetes itself rolls ConfigMap updates.

Default behaviour is unchanged: symlinks remain rejected as defense in depth.

🛠️ Provider hardening & internals

• Observable provider: fetch no longer hangs on a cold / complete-without-emit source, and no longer leaks its one-shot subscription.
• HTTP provider: the HttpResponseMessage is disposed after fetch; opt-in SseReadIdleTimeout reconnects a half-open SSE stream.
• Extracted the reusable FileBackedProvider base (watch / path+symlink security / debounce / dispose) shared by all file formats; FileSourceProvider is now a thin subclass.
• Documented the provider-contract invariants; parameterless FromCommandLine(); FileSourceProvider.Dispose made race-safe; removed dead MicrosoftConfigurationSource* code (the FromMicrosoftSource API was dropped in 6.0.0).

📦 Packages

... (truncated)

Commits viewable in compare view.

Updated Cocoar.SignalARRR.Server from 4.3.0 to 4.3.1.

Release notes

Sourced from Cocoar.SignalARRR.Server's releases.

4.3.1

Fixes fire-and-forget send server methods silently doing nothing (e.g. group joins), plus three Swift-client robustness bugs.

Documentation | Changelog

What was broken

Server methods invoked via send silently did nothing. The server routed fire-and-forget calls (SendMessage) through a detached Task.Run that started after the hub method returned — by which point SignalR had already disposed the Hub. The disposed hub's injected Context/Clients/Groups were then invalid, so any hub-dependent work (a Groups.AddToGroupAsync(...) group join, a server-to-client push, etc.) failed without an exception, a log line, or any effect.

This was easy to hit without explicitly choosing send: the typed proxy routes every void- or Task-returning server method through this path, so a Subscribe-style method that joins a group would silently never join — while the identical method declared with a return value (Task<T>, routed through invoke) worked. It affected all clients (.NET, Swift, TypeScript).

The Swift client additionally had three independent issues:

• Query strings broke the connection. A hub URL carrying a query (e.g. .../hub/sync?user=x) produced a malformed URL during negotiate (.../hub/sync?user=x/negotiate?...) and the WebSocket upgrade (...?user=x?id=...), so negotiate returned HTTP 400.
• localhost hung for ~30s. When localhost resolved to IPv6 (::1) against an IPv4-only server, the negotiate/WebSocket path hung on the OS connect timeout with no Happy-Eyeballs fallback (plain URLSession REST calls fell back fine).
• on(...) silently swallowed server→client contracts. Registering a SignalARRR server→client contract with on(...) (which only handles raw SignalR events) instead of onServerMethod(...) never fired and never logged.

What changed

• Server: SendMessage now awaits the handler within the hub invocation, keeping the Hub (and its Context/Clients/Groups) alive for the call's duration. The client-side send is non-blocking at the SignalR layer, so this is transparent to callers — fire-and-forget semantics are preserved.
• Swift: negotiate and WebSocket transport URLs are now built with URLComponents, preserving existing query parameters and inserting /negotiate into the path correctly.
• Swift: negotiate fast-fails on a timeout instead of hanging on the OS connect timeout; the 127.0.0.1 workaround for IPv4-only servers is documented.
• Swift: undispatched server→client calls now log a warning pointing to onServerMethod(...) (mirroring the .NET client), and the on(...) vs onServerMethod(...) distinction is documented on both APIs.
• Tests: added a .NET integration regression test that proves a send-routed server method joins a group against a live Hub (red on the old fire-and-forget behaviour), plus Swift unit tests for query-string-safe transport URLs.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: backend, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[windischb]

Superseded by #64 — consolidated into one branch and gated on a local build + full test run (per our local-upgrade policy). Note: JasperFx.Events.SourceGenerator is held at 2.5.0 there (2.8.2 reintroduces a source-gen CS0111 regression); a >2.5.0 ignore was added to dependabot.yml.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml