chore(deps): SourceLink/xunit/CodeCoverage bumps (safe subset of #89) - #92
Merged
Merged
Conversation
… of #89) Applies only the non-floored, non-runtime dependency bumps from the Dependabot group in #89: - Microsoft.SourceLink.GitHub 10.0.400 -> 10.0.401 (build tooling, PrivateAssets=All) - xunit.v3 4.0.0 -> 4.0.1 (test-only) - Microsoft.Testing.Extensions.CodeCoverage 18.11.0 -> 18.11.2 (test-only) Deliberately EXCLUDES the three per-TFM-floored packages (Microsoft.Extensions.DependencyInjection.Abstractions, Microsoft.Extensions.Http, System.Security.Cryptography.ProtectedData). #89 rewrote their net8.0 floors from 8.0.x to 10.0.12, which violates the deliberate per-TFM floor policy (net8 LTS consumers must stay on their 8.0.x servicing line). Those floors are bumped by hand, per TFM, in their own reviewed commit — never as a side effect of an automated group bump. The Dependabot `ignore` gap that let #89 rewrite the net8 floor (a name-scoped, major-only ignore cannot protect a per-TFM floor when the same package name also appears in the net10 block) is cross-referenced to STANDARD.md 4.10 and is fixed upstream in NextIteration.Standards, then synced here. Supersedes #89. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Sep 21, 2026
StuartMeeks
added a commit
that referenced
this pull request
Sep 21, 2026
#94) RetryHelper defaulted to 20 attempts x 25 ms ~= 500 ms. On a contended macos-15 runner that was too tight for cross-process Keychain visibility: the selection item written by RestoreCredentialAsync was not always visible within it, so RestoreCredentialAsync_PreservesAccountIdAndSelection timed out its IsSelected retry and the following Assert.True(restored.IsSelected) failed intermittently (seen red on #89 and #92, green on re-run and elsewhere). Raise the default budget to 40 x 50 ms ~= 2 s. Retries return as soon as the store is consistent, so a passing run does not pay the ceiling; only a genuine failure now waits the full ~2 s before surfacing. RetryHelperTests pass explicit values and are unaffected. Test-only change. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Dependabot PR #89 grouped six bumps, but three of them —
Microsoft.Extensions.DependencyInjection.Abstractions,Microsoft.Extensions.Http,System.Security.Cryptography.ProtectedData— rewrote the net8.0 floors from8.0.xto10.0.12. That violates the deliberate per-TFM floor policy (net8 LTS consumers must stay on their8.0.xservicing line), so #89 is not mergeable as-is.This PR takes only the safe, non-floored bumps from that group:
Microsoft.SourceLink.GitHubPrivateAssets=All)xunit.v3Microsoft.Testing.Extensions.CodeCoverageNone are shipped runtime dependencies, so there's no consumer-visible floor change. The three floored packages are left untouched and will be bumped by hand, per TFM, in their own reviewed commit.
Supersedes #89 (closed).
Follow-up (not in this PR)
The Dependabot
ignoregap that let #89 rewrite the net8 floor — a name-scoped,semver-major-only ignore can't protect a per-TFM floor when the same package name also appears in the net10 block, so a net10 minor/patch bump rewrites every entry of that name — is cross-referenced to STANDARD.md 4.10 and will be fixed upstream in NextIteration.Standards (ignore those three entirely), then synced here. Until then, Dependabot may re-propose the bad bump.Tests
Full suite green locally on net8.0 and net10.0 (428 total, 0 failed, 120 platform-skipped). CI matrix (3 OSes) runs on this PR.
🤖 Generated with Claude Code