Repository navigation
Conversation
Author
|
Overlaps #27 — worth reading alongside it. I opened this before spotting that PR. Where they meet, #27 is the better change: same What's here and not in #27:
If #27 lands first I'll happily rebase this down to just the Azure.Identity + Dependabot + CI parts, which is the non-overlapping half. Say the word and I'll do that now instead. |
added 2 commits
September 4, 2026 14:41
Picks up the remaining version bumps proposed in drewburlingame#27 by @dreik - CommandDotNet, JetBrains.Annotations, YamlDotNet, System.Text.Encoding.CodePages, and the test packages - so this branch is a superset rather than a competing subset. FluentAssertions 8 renames BeLessOrEqualTo to BeLessThanOrEqualTo, which ContainerTest needed. Solution builds clean and all 111 unit tests pass on net8.0.
Microsoft.Azure.KeyVault and Microsoft.Azure.Services.AppAuthentication are both deprecated, and between them they were the source of every vulnerability in the published package: Newtonsoft.Json 10.0.3 (CVE-2024-21907) and Microsoft.Rest.ClientRuntime 2.3.20 (GHSA-whph-446h-6m9v). KeyVault turned out to be referenced by no code at all, and AppAuthentication by exactly one method, so both are replaced with Azure.Identity - Microsoft's own successor. That fixes the vulnerabilities at the root and makes the transitive pins from the previous commit unnecessary, so they come back out. net10.0 joins the target frameworks: net9.0 reached end of support in May 2026 and net8.0 does in November, so the package currently ships nothing supported beyond this year. The .NET 10 SDK audits transitive packages by default, which with TreatWarningsAsErrors is what surfaced the ClientRuntime advisory as a hard build error. Dependabot was erroring every week: the dotnet-sdk ecosystem has no global.json to act on, so one is added. There was also no nuget ecosystem configured at all, which is the likely reason dbup-postgresql sat on a beta unnoticed.
datadot
force-pushed
the
feat/net10-and-dependabot
branch
from
September 4, 2026 13:44
0eb135a to
37fe13b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #29 — target .NET 10
Fixes #33 — deprecated Microsoft.Azure.* packages carry the only vulnerabilities
Fixes #34 — Dependabot failing every run, and never checking NuGet
Stacked on #31. Together they now supersede #27 — everything that PR proposed is included here, with credit to @dreik for the version sweep, plus the parts it doesn't cover.
From #27, adopted
All of its package bumps (CommandDotNet, JetBrains.Annotations, YamlDotNet, System.Text.Encoding.CodePages, and the test packages), the FluentAssertions 8
BeLessThanOrEqualTorename, and — importantly — its TFM choice over my original one. Droppingnet9.0rather than keeping it is right: it reached end of support in May 2026.What this adds beyond #27
1. The deprecated
Microsoft.Azure.*packages go entirely (#33). #27 pinsNewtonsoft.JsonandMicrosoft.Rest.ClientRuntimeto defuse their transitives. This removes the source instead:Microsoft.Azure.KeyVaultis referenced by no code at all, andAppAuthenticationby exactly one method, soAzure.Identityreplaces both and the pins become unnecessary.2. A third advisory that only appears once #27's bumps are applied. Testcontainers 4.8.1 resolves
SSH.NET2024.2.0 — GHSA-q939-rpr3-3284, high severity. On the .NET 10 SDK, which audits transitive packages by default,TreatWarningsAsErrorsturns that into a hard build failure:So #27 as it stands would not build on .NET 10. Pinned to 2026.0.0 here.
3. CI actually gets a .NET 10 SDK. #27 targets net10 but doesn't touch the workflows, which install only
8.0.x/9.0.x. Added10.0.x.4. Dependabot (#34). Failing every run for want of a
global.json, and never checking NuGet at all. This is arguably the change that prevents the next round of drift —dbup-postgresqlsat on a beta for a year because nothing was watching.Verification
TreatWarningsAsErrorsNewtonsoft.Json,Microsoft.Rest.ClientRuntime,Microsoft.Azure.KeyVaultandMicrosoft.Azure.Services.AppAuthenticationare all gone from the publish output$$) runs toUpgrade successful, 75 tablesNot verified
The Azure SQL auth path — I have no Azure SQL instance to point it at, and it is the one behavioural change here. It needs review from someone who can exercise it. The integration tests also weren't run (they need Testcontainers with a Docker daemon).