tidy: dependabot — pin WolverineFx at the 6.19.0 ceiling + refresh auth comment - #164
Merged
Merged
Conversation
…h-stack comment Add a Dependabot ignore rule blocking WolverineFx* >= 6.20.0 so the group update stops recreating a bump that crosses the documented CritterWatch coupling ceiling (see the COUPLING NOTE in Directory.Packages.props). Marten, JasperFx, and Weasel in the same group are unaffected and continue to flow. Also refresh the auth-stack pin comment: JwtBearer and Identity.EntityFrameworkCore moved 10.0.9 -> 10.0.10 (PRs #158/#159); the comment now describes tracking the floating aspnetcore 10.0.x patch line rather than naming the stale 10.0.9.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Dependabot opened #154 bumping WolverineFx.* 6.19.0 → 6.20.0, which crosses the documented pin ceiling in
Directory.Packages.props(the CritterWatch 6.18.0-target coupling — bumping past 6.19.0 throws a startupTypeLoadExceptiononce the console can boot). #154 was closed; this stops it recreating.What
.github/dependabot.yml— add anignorerule blockingWolverineFx* >= 6.20.0. Marten / JasperFx / Weasel in the samecritter-stackgroup are not ceilinged and still flow. Lift this when the CritterWatch trial renews and a 6.19.0+-targeting release lands.Directory.Packages.props— refresh the auth-stack pin comment: JwtBearer + Identity.EntityFrameworkCore moved 10.0.9 → 10.0.10 (Bump Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.9 to 10.0.10 #158/Bump Microsoft.AspNetCore.Identity.EntityFrameworkCore from 10.0.9 to 10.0.10 #159), so the comment now describes tracking the floating aspnetcore 10.0.x patch line instead of naming the stale 10.0.9.Context
Part of clearing the Dependabot backlog. Merged this pass: #151 (setup-dotnet 5→6), #158/#159 (auth 10.0.10), #155 (OTel 1.17.0), #157 (Test.Sdk 18.8.1), #132/#133/#152/#153 (frontend). Deferred: #134 (bundles a TypeScript 6→7 major) and #156 (microsoft-extensions — recreating after conflict). Closed: #154 (this pin).