Bump the verify group with 2 updates - #41
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps NUnit from 4.2.2 to 4.6.1 Bumps Verify.NUnit from 28.0.0 to 31.24.1 --- updated-dependencies: - dependency-name: NUnit dependency-version: 4.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: verify - dependency-name: Verify.NUnit dependency-version: 31.24.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: verify ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
Domantas
added a commit
that referenced
this pull request
Sep 16, 2026
) * [SDK-3] #41 #44 .NET: real coverage snapshots for every Hub module The 13 EndpointCoverageTests.Hub.*.verified.txt files lived in Norbix.Sdk.Tests, which only ever sees the Api catalogue — no test wrote them, so they were stale leftovers claiming coverage that did not exist. Norbix.Hub.Tests already shared the fixture and the endpoint driver; it now also shares EndpointCoverageTests.cs. The driver reads whichever NorbixEndpointCatalog is compiled into the assembly under test, so the one file yields the 6 Api modules in Norbix.Sdk.Tests and the 21 Hub modules here. The stale snapshots are deleted; the Hub ones are regenerated for real. Two driver fixes were needed to get there: - A module with one un-fillable route token used to return ONLY the MissingPathParameters list, so its other endpoints were never exercised. That is how Notifications (117 endpoints) showed no coverage at all. The broken endpoints are still reported, inside the module's own snapshot, and the rest of the module is covered. - The Hub MCP endpoint (POST /{version}/account/mcp) answers with a bare string, not a response envelope. The fake response builder always produced an object, so the whole Account module died on deserialization. Coverage now: 21 Hub modules, 489 endpoints; 6 Api modules, 77 endpoints. Every route in the accepted snapshots was checked against the freshly emitted gateway manifests (Routine C) — 472 of 489 Hub and 59 of 77 Api routes are confirmed there, and all 35 that the manifests do not list were confirmed by hand against [Route] attributes in the gateway source. The manifest emitter under-reports; see the report for the two causes. Still red as a known gap, unchanged by this commit: 4 Notifications request DTOs have no settable property for their route token, so the generated method cannot build a URL (DeleteEmailCampaign, Get{Email,Push,Sms}CampaignMessage). dotnet test Norbix.Sdk.sln: 142 passed, 0 failed (52 Api + 90 Hub). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(deps): update NuGet packages - Microsoft.Extensions.* 9.0.0 -> 10.0.12 (the libraries target net10.0). - NUnit 4.6.1, NUnit3TestAdapter 6.3.0, NUnit.Analyzers 4.15.0, Microsoft.NET.Test.Sdk 18.10.1. - Microsoft.CodeAnalysis.CSharp 4.11.0 -> 5.0.0 and Microsoft.CodeAnalysis.Analyzers 3.11.0 -> 4.14.0. The generator ships as an analyzer inside Norbix.Api / Norbix.Hub, so Roslyn must not be newer than the compiler in SDK 10.0.100 (5.0); Analyzers 5.x needs Roslyn 5.3+. - Verify.NUnit 28.0.0 -> 32.0.1, the last MIT release. Verify 33.0 changed the license to a paid EULA (OsmfEula.txt) and fails the build without a sponsorship property. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(packaging): make Norbix.Api and Norbix.Hub installable and compilable Both published packages were unusable for consumers: 1. Install failed with NU1101. The nuspecs depended on Norbix.Contracts and Norbix.Api.Types / Norbix.Hub.Types, which are IsPackable=false and do not exist on nuget.org (verified: `dotnet add package Norbix.Hub --version 1.3.1` fails). The project references are now PrivateAssets=all and their DLLs are packed into lib/net10.0 of each package. 2. Build failed with CS0122. The source generator was packed as an analyzer, so it ran again in the consumer's compilation and emitted modules against the internal INorbixTransport. The modules are already compiled into Norbix.Api.dll / Norbix.Hub.dll, so the generator is no longer packed. Verified by packing both, installing each into a fresh net10.0 console app from a clean package cache, and compiling + running the README quickstart code with -warnaserror. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * ci: bump GitHub Actions to current majors - actions/checkout v4 -> v7, actions/setup-dotnet v4 -> v6, actions/setup-node v4 -> v7, actions/upload-artifact v4 -> v7. - github/codeql-action v3 -> v4, marocchino/sticky-pull-request-comment v2 -> v3. - aquasecurity/trivy-action 0.35.0 -> 0.36.0, still SHA-pinned (ed142fd, same commit Dependabot proposed). - google/osv-scanner-action v1.9.0 -> v2.6.0; v2 removed --skip-git, so it is dropped from scan-args. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * ci(release): pin semantic-release tooling and stop committing to protected main The release failed in generateNotes: the workflow installed conventional-changelog-conventionalcommits unpinned, which resolved to v10. v10 needs conventional-changelog-writer@9, but @semantic-release/release-notes-generator 14.x ships writer 8 ("Missing helper"). The next step would have failed too: @semantic-release/git pushed a CHANGELOG.md commit to main, which MainBranchProtectionRuleSet rejects (the last successful release, 1.3.1, predates the ruleset). - scripts/install-semantic-release.sh installs pinned versions (semantic-release 25.0.9, preset 9.3.1, ...) for release.yml and release-preview.yml. - .releaserc.json: drop @semantic-release/git and @semantic-release/changelog. - release.yml: workflow_dispatch republish=true recovery that packs the latest tag from its own tree, pushes to NuGet and creates the GitHub Release if missing; summary links the GitHub Release. - dependabot.yml: ignore Verify >= 33 (license change) and Roslyn versions newer than SDK 10.0.100 supports. - CONTRIBUTING.md / CHANGELOG.md: current release flow and package names. Verified locally: analyzeCommits + generateNotes over v1.3.1..HEAD with the pinned versions render 1.4.0 (minor); preset v10 reproduces the CI error. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * build(packaging): support dotnet pack with NoBuild for bundled references IncludeBundledProjectReferences depends on ResolveReferences, which builds the referenced projects; CI's pack dry-run passes --no-build and failed with NETSDK1085. With NoBuild, BuildProjectReferences=false resolves their outputs without building. Both pack modes produce the same package contents. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated NUnit from 4.2.2 to 4.6.1.
Release notes
Sourced from NUnit's releases.
4.6.1
See release notes for details.
4.6.0
See release notes for details.
4.5.1
See release notes for details.
4.5.0
See release notes for details.
4.4.0
See release notes for details.
4.3.2
This is a hotfix release.
See release notes for details.
4.3.1
This is a hotfix release.
See release notes for details.
4.3.0
See release notes
Commits viewable in compare view.
Updated Verify.NUnit from 28.0.0 to 31.24.1.
Release notes
Sourced from Verify.NUnit's releases.
31.24.1
31.24.0
31.23.0
31.22.0
31.21.0
31.20.0
31.19.1
31.19.0
31.18.0
31.17.0
31.16.3
No issues in this milestone yet.
31.16.2
31.16.1
31.16.0
31.14.0
31.13.4
31.13.3
31.12.5
31.12.3
31.10.0
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions