Bump gitversion.tool from 6.8.1 to 6.8.2

[dependabot]

Updated gitversion.tool from 6.8.1 to 6.8.2.

Release notes

Sourced from gitversion.tool's releases.

6.8.2

As part of this release we had 10 commits which resulted in 4 issues being closed.

Dependencies

• !5022 (deps): Bump SharpYaml from 3.11.0 to 3.12.0 by dependabot[bot]
• !5024 (build deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 in /.github/workflows by dependabot[bot]
• !5027 (build deps): bump the codeql group across 1 directory with 3 updates by dependabot[bot]

Improvements

• #​5026 [ISSUE]: Incorrect label placeholders should not throw exception by robertcoltheart resolved in !5025 by robertcoltheart

Contributors

2 contributors made this release possible.

SHA256 Hashes of the release artifacts

• gitversion-linux-arm64-6.8.2.tar.gz — 1b51227f88ddf705fc01a3b04ca15eb50fe76baf78013f99c731a2fac729dd8e
• gitversion-linux-musl-arm64-6.8.2.tar.gz — f55140d5a94c046561528e1746f7ad1bf530ee9a71cf4414843090964f9ce273
• gitversion-linux-musl-x64-6.8.2.tar.gz — a850cf6a02bf2cadf647fbfead9570179b50da8190fa59dc85405363f5e2cf86
• gitversion-linux-x64-6.8.2.tar.gz — 4b9c361952a7bd8230e3dfeb68189ac99fc3059b561b186d8c1fce22a2287dc2
• gitversion-osx-arm64-6.8.2.tar.gz — 02eb6ec6f65a0661bf5f0d0b12a503762372db6bf7e28bc2657015aaf1e0c38f
• gitversion-osx-x64-6.8.2.tar.gz — 34b79fa8dc9ee659dc4a7c57f8e3a89ff25fd3959f555d00c8d0d6ad9cb01a01
• gitversion-win-arm64-6.8.2.zip — 13d95502e3888055df077ed4383ed2e010ec659a3a0f0b3db726e9d7a8fa6724
• gitversion-win-x64-6.8.2.zip — 73219908a616847bd4049680dff389fc3623d4fbe8585e92198a5572da63f796

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 13, 2026, 2:24 AM ET / 06:24 UTC.

Summary
Updates the repository-local GitVersion .NET tool from 6.8.1 to 6.8.2 in .config/dotnet-tools.json.

Reproducibility: not applicable. This PR updates a pinned repository build tool rather than addressing a reported runtime defect.

Review metrics: 2 noteworthy metrics.

• Manifest scope: 1 file changed; 1 addition, 1 deletion. The patch has no unrelated code, workflow, or lockfile churn.
• Version delta: 6.8.1 → 6.8.2. This is a patch-level update to the existing pinned build tool rather than a new dependency or major upgrade.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Wait for the full build, test, and setup-recovery E2E checks to finish successfully on head 13564671a5582b2d86bc31fd02951973d2fc4a20.

Risk before merge

• [P1] GitVersion participates in build/version metadata generation, so an upstream regression could disrupt packaging or release automation; the exact-head build and test checks should complete before merge.
• [P1] GitVersion 6.8.2 includes an upstream SharpYaml dependency update, making successful restore and execution in repository CI the relevant supply-chain compatibility check.

Maintainer options:

1. Decide the mitigation before merge
   Merge the single-line patch update only after the exact PR head completes the repository build and test workflows successfully, preserving the existing pinned-tool manifest and versioning workflow.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] No repair is identified; this PR needs only normal exact-head CI completion and maintainer merge review.

Security
Cleared: The diff only updates an existing pinned tool version and introduces no new source, permission, workflow, secret access, lifecycle hook, or unrelated executable path.

Review details

Best possible solution:

Merge the single-line patch update only after the exact PR head completes the repository build and test workflows successfully, preserving the existing pinned-tool manifest and versioning workflow.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this PR updates a pinned repository build tool rather than addressing a reported runtime defect.

Is this the best way to solve the issue?

Yes, conditionally: changing the existing local tool-manifest pin is the narrowest maintainable way to adopt GitVersion 6.8.2, with the exact-head CI suite serving as the merge gate.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 06b4f6362594.

Label changes

Label changes:

• add P3: This is routine, narrowly scoped build-tool dependency maintenance with no reported user-facing regression or urgent impact.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a bot-authored dependency update, so the external-contributor real-behavior proof gate does not apply; successful exact-head build and test automation is the appropriate evidence.

Label justifications:

• P3: This is routine, narrowly scoped build-tool dependency maintenance with no reported user-facing regression or urgent impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a bot-authored dependency update, so the external-contributor real-behavior proof gate does not apply; successful exact-head build and test automation is the appropriate evidence.

Evidence reviewed

What I checked:

• Current main remains on 6.8.1: The current default-branch tool manifest pins gitversion.tool to version 6.8.1, so the requested dependency update is not already implemented. (.config/dotnet-tools.json:6, 06b4f6362594)
• PR is narrowly scoped: The proposed head changes only the GitVersion tool version from 6.8.1 to 6.8.2, with one addition and one deletion. (.config/dotnet-tools.json:6, 13564671a558)
• Patch-release provenance: The supplied upstream release notes describe ten commits, one behavior improvement, and dependency maintenance in GitVersion 6.8.2; the PR does not change package sources or add a second tool. (.config/dotnet-tools.json:6, 13564671a558)
• Validation state: Repository hygiene succeeded and CodeQL completed neutrally, while the main test and setup-recovery E2E jobs were still running on the exact PR head at review time. (.github/workflows/ci.yml, 13564671a558)
• Repository validation policy: The full repository policy requires a complete build plus shared and tray tests after changes; the GitHub checks are the appropriate read-only evidence path for this bot-authored tool update. (AGENTS.md:1, 06b4f6362594)

Likely related people:

• shanselman: Historical repository development documentation and merged project work connect this handle to the repository's build and development conventions, although direct authorship of the current tool pin could not be established. (role: adjacent repository and build-documentation owner; confidence: low; files: DEVELOPMENT.md, .config/dotnet-tools.json)
• RBrid: Recent merged repository and release work makes this handle a plausible routing candidate for build-tool maintenance, but the manifest-specific history trail is weak. (role: recent area contributor; confidence: low; files: .config/dotnet-tools.json, build.ps1)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[arturict]

Same for this patch: could you add a short note that this is patch-only dependency bump with no runtime behavioral impact, if changelog policy requires it?