Skip to content

Bump the dependencies group with 6 updates#26

Closed
dependabot[bot] wants to merge 4 commits into
mainfrom
dependabot/nuget/src/Grimoire.Api/dependencies-52a5a29717
Closed

Bump the dependencies group with 6 updates#26
dependabot[bot] wants to merge 4 commits into
mainfrom
dependabot/nuget/src/Grimoire.Api/dependencies-52a5a29717

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 21, 2026

Updated coverlet.collector from 6.0.4 to 10.0.1.

Release notes

Sourced from coverlet.collector's releases.

10.0.1

Improvements

Fixed

  • Fix inconsistent paths in cobertura reports #​1723
  • Fix when using "is" with "and" in pattern matching, branch coverage is lower than normal #​1313
  • Fix Coverlet flagging a branch for an async functions finally block where none exists #​1337
  • Fix Coverlet Tracker Missing CompilerGeneratedAttribute #​1828

Maintenance

  • Add architecture docs and diagrams for all integrations #​1927
  • Update NuGet packages and .NET SDK versions #​1933

Diff between 10.0.0 and 10.0.1

10.0.0

Improvements

  • Unique Report Filenames (coverlet.MTP and AzDO) #​1866
  • Add --coverlet-file-prefix option for unique report files #​1869
  • Introduce .NET 10 support #​1823

Fixed

  • Fix [BUG] Wrong branch rate on IAsyncEnumerable for generic type #​1836
  • Fix [BUG] Missing Coverage after moving to MTP #​1843
  • Fix [BUG] No coverage reported when targeting .NET Framework with 8.0.1 #​1842
  • Fix [BUG] Behavior changes between MTP and Legacy (msbuild) #​1878
  • Fix [BUG] Coverlet.MTP - Unable to load coverlet.mtp.appsettings.json #​1880
  • Fix [BUG] Coverlet.Collector produces empty report when Mediator.SourceGenerator is referenced #​1718 by https://github.com/yusyd
  • Fix [BUG] Crash during instrumentation (Methods using LibraryImport/DllImport have no body) #​1762

Maintenance

  • Add comprehensive async method tests and documentation for issue #​1864
  • Replace Tmds.ExecFunction Package in coverlet.core.coverage.tests #​1833
  • Add net9.0 and net10.0 targets #​1822

Diff between 8.0.1 and 10.0.0

8.0.1

Fixed

  • Fix [BUG] TypeInitializationException when targeting .NET Framework #​1818
  • Fix [BUG] coverlet.MTP build fails with CS0400 due to developmentDependency=true #​1827

Improvements

  • Additional improvements needed for .NET Framework instrumentation type import #​1825

Diff between 8.0.0 and 8.0.1

8.0.0

Special Thanks: A huge thank you to @​Bertk for driving the majority of the work in this release! πŸŽ‰

Fixed

Improvements

  • Coverlet MTP extension feature #​1788
  • Generate SBOM for nuget packages #​1752
  • Use multi targets projects for coverlet.collector, coverlet.msbuild.tasks packages #​1742
  • Use .NET 8.0 target framework for coverlet.core and remove Newtonsoft.Json #​1733
  • Use latest System.CommandLine version #​1660
  • Upgraded minimum required .NET SDK and runtime to .NET 8.0 LTS (Long Term Support) (Breaking Change)
  • Use xunit.v3 for tests and example code

Diff between 6.0.4 and 8.0.0

Commits viewable in compare view.

Updated Mapster from 7.4.0 to 10.0.7.

Release notes

Sourced from Mapster's releases.

10.0.7

What's Changed

Full Changelog: MapsterMapper/Mapster@v10.0.6...10.0.7

10.0.7-pre04

What's Changed

Full Changelog: MapsterMapper/Mapster@v10.0.7-pre03...10.0.7-pre04

10.0.7-pre03

What's Changed

Full Changelog: MapsterMapper/Mapster@v10.0.7-pre02...v10.0.7-pre03

10.0.7-pre02

What's Changed

Full Changelog: MapsterMapper/Mapster@v10.0.7-pre01...v10.0.7-pre02

10.0.7-pre01

What's Changed

Full Changelog: MapsterMapper/Mapster@v10.0.6...v10.0.7-pre01

10.0.6

Breaking change in v10.0+ and new feature

New feature:

  • Fix #​883 - Add class ctor using default value for param

In version 7.4.0 this feature was only available for record types

If you encountered this mapping behavior in 7.4.0, it is possible that your class was recognized as a record type, or was mistakenly recognized as a record type See more.

If you need the mapping behavior as for Record, in v10.0+ you can use - [AdaptWith(AdaptDirectives.DestinationAsRecord)] .
If you need the ability to set this setting without using attributes, open issue on this topic.

Example:

[AdaptWith(AdaptDirectives.DestinationAsRecord)]
public class SimpleRecord
{
    public int Id { get; private set; }
    public string Name { get; private set; }

    public SimpleRecord(int id, string name)
    {
        this.Id = id;
        this.Name = name;
    }
}

What's Changed

Full Changelog: MapsterMapper/Mapster@v10.0.4...v10.0.6

10.0.4

Breaking change in v10.0+ and new feature

New feature:

In version 7.4.0 this feature was only available for record types

If you encountered this mapping behavior in 7.4.0, it is possible that your class was recognized as a record type, or was mistakenly recognized as a record type See more.

If you need the mapping behavior as for Record, in v10.0+ you can use - [AdaptWith(AdaptDirectives.DestinationAsRecord)] .
If you need the ability to set this setting without using attributes, open issue on this topic.

Example:

[AdaptWith(AdaptDirectives.DestinationAsRecord)]
public class SimpleRecord
{
    public int Id { get; private set; }
    public string Name { get; private set; }

    public SimpleRecord(int id, string name)
    {
        this.Id = id;
        this.Name = name;
    }
}

What's Changed

New Contributors

Full Changelog: MapsterMapper/Mapster@v10.0.0...v10.0.4

10.0.0

What's Changed

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 17.14.1 to 18.5.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.5.1

What's Changed

Full Changelog: microsoft/vstest@v18.5.0...v18.5.1

18.5.0

⚠️ Unlisted on Nuget, because of #​15718

What's Changed

Full Changelog: microsoft/vstest@v18.4.0...v18.5.0

18.4.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.3.0...v18.4.0

18.3.0

What's Changed

Internal fixes and updates

New Contributors

18.0.1

What's Changed

Fixing an issue with loading covrun64.dll on systems that have .NET 10 SDK installed: https://learn.microsoft.com/en-us/dotnet/core/compatibility/sdk/10.0/code-coverage-dynamic-native-instrumentation

Internal changes

Full Changelog: microsoft/vstest@v18.0.0...v18.0.1

18.0.0

What's Changed

Internal fixes and updates

Commits viewable in compare view.

Updated Swashbuckle.AspNetCore from 6.9.0 to 10.1.7.

Release notes

Sourced from Swashbuckle.AspNetCore's releases.

10.1.7

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.6...v10.1.7

10.1.6

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.5...v10.1.6

10.1.5

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.4...v10.1.5

10.1.4

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.3...v10.1.4

10.1.3

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.2...v10.1.3

10.1.2

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.1.1...v10.1.2

10.1.1

What's Changed

New Contributors

Full Changelog:

domaindrivendev/Swashbuckle.AspNetCore@v10.1.0...v10.1.1

10.1.0

What's Changed

New Features

Bug Fixes

Miscellaneous

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.0.1...v10.1.0

10.0.1

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v10.0.0...v10.0.1

10.0.0

Swashbuckle.AspNetCore v10.0.0

[!IMPORTANT]
This release contains major breaking changes.

Read our v10 migration guide for further information.

With this release, Swashbuckle.AspNetCore adds support for generating OpenAPI 3.1 documents and for ASP.NET Core 10.

Swashbuckle.AspNetCore v10 depends on OpenAPI.NET v2.3 which introduces many breaking changes to the public API surface. More information can be found in their OpenAPI.NET v2 Upgrade Guide.

To reduce the number of breaking behavioural changes in Swashbuckle.AspNetCore v10, generation of OpenAPI 3.1 documents is opt-in.
To generate OpenAPI 3.1 documents, change the OpenAPI version as shown in the code snippet below:

app.UseSwagger(options =>
{
    options.OpenApiVersion = OpenApiSpecVersion.OpenApi3_1;
});

[!TIP]
It is strongly recommended that you upgrade to Swashbuckle.AspNetCore v9.0.6 before upgrading to v10.

[!IMPORTANT]
Use of Swashbuckle.AspNetCore with the ASP.NET Core WithOpenApi() method is no longer supported.

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v9.0.6...v10.0.0

9.0.6

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v9.0.5...v9.0.6

9.0.5

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v9.0.4...v9.0.5

9.0.4

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v9.0.3...v9.0.4

9.0.3

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v9.0.2...v9.0.3

9.0.2

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v9.0.1...v9.0.2

9.0.1

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v9.0.0...v9.0.1

9.0.0

πŸ“£ This release contains the following breaking changes:

  • Drops support for netstandard2.0 and thus .NET Framework - now only net8.0 and net9.0 are supported.
  • Removes all public members annotated as [Obsolete] in previous releases.
  • Removes the deprecated --serializeasv2 option from Swashbuckle.AspNetCore.Cli, which was superseded by --openapiversion from version 8.0.0.

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v8.1.4...v9.0.0

8.1.4

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v8.1.3...v8.1.4

8.1.3

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v8.1.2...v8.1.3

8.1.2

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v8.1.1...v8.1.2

8.1.1

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v8.1.0...v8.1.1

8.1.0

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v8.0.0...v8.1.0

8.0.0

[!IMPORTANT]
Swashbuckle.AspNetCore drops support for .NET 6.

Swashbuckle.AspNetCore v8.0.0 makes the following notable changes:

  • Drops support for net6.0.
  • The netstandard2.0 TFM now depends on ASP.NET Core 2.3 instead of ASP.NET Core 2.1.
  • Updates Microsoft.OpenApi to v1.6.23. This update requires the use of swagger-ui v5.19.0 or later (v5.20.1 is included in the Swashbuckle.AspNetCore.SwaggerUI NuGet package). You may need to clear your browser's cache to pick up the latest JavaScript files for swagger-ui.
  • To prepare for future support for OpenAPI 3.1 documents, deprecates the SerializeAsV2 property by marking it as [Obsolete]. Users should update their code as illustrated below, depending on their use case:
    - options.SerializeAsV2 = true;
    + options.OpenApiVersion = Microsoft.OpenApi.OpenApiSpecVersion.OpenApi2_0;
    
    // or if explicitly disabling (the same as the default behaviour)
    - options.SerializeAsV2 = false;
    + options.OpenApiVersion = Microsoft.OpenApi.OpenApiSpecVersion.OpenApi3_0;
  • To prepare for future support for OpenAPI 3.1 documents, the Swashbuckle.AspNetCore.Cli tool has deprecated the --serializeasv2 option and logs a warning to the console. Users should update their usage as illustrated below, depending on their use case:
    - swagger tofile --output [output] [startupassembly] [swaggerdoc] --serializeasv2
    + swagger tofile --output [output] [startupassembly] [swaggerdoc] --openapiversion "2.0"

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v7.3.2...v8.0.0

7.3.2

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v7.3.1...v7.3.2

7.3.1

What's Changed

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v7.3.0...v7.3.1

7.3.0

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v7.2.0...v7.3.0

7.2.0

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v7.1.0...v7.2.0

7.1.0

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v7.0.0...v7.1.0

7.0.0

What's Changed

New Contributors

Full Changelog: domaindrivendev/Swashbuckle.AspNetCore@v6.9.0...v7.0.0

Commits viewable in compare view.

Updated Testcontainers from 3.10.0 to 4.12.0.

Release notes

Sourced from Testcontainers's releases.

4.12.0

What's Changed

Thanks to all contributors πŸ‘.

⚠️ Breaking Changes

  • chore(deps): Bump Docker.DotNet from 3.131.1 to 4.0.2 (#​1665) @​HofmeisterAn

πŸš€ Features

  • feat: Add Floci module (#​1690) @​object
  • feat: Ignore port-forwarding extra host in reuse hash (#​1689) @​HofmeisterAn
  • feat: Allow devs to override the reuse hash calculation (#​1688) @​HofmeisterAn
  • feat: Add connect to network API (#​1672) @​HofmeisterAn
  • feat(LocalStack): Require auth token for 4.15 and onwards (#​1667) @​HofmeisterAn
  • chore(deps): Bump Docker.DotNet from 3.131.1 to 4.0.2 (#​1665) @​HofmeisterAn

πŸ› Bug Fixes

  • fix: Trim tar record padding to avoid broken-pipe failure on Podman (#​1684) @​artiomchi
  • fix(Nats): Use healthz API for readiness probe (#​1679) @​eriblo01
  • fix: Remove KeepAlive socket option (#​1671) @​Angelinsky7

πŸ“– Documentation

  • docs: Extend WithCommand(params string[]) documentation (#​1685) @​HofmeisterAn

🧹 Housekeeping

  • feat: Prepare next release cycle (4.12.0) (#​1664) @​HofmeisterAn

πŸ“¦ Dependency Updates

  • chore(deps): Bump the actions group with 5 updates (#​1687) @dependabot[bot]
  • chore(deps): Bump Docker.DotNet from 4.1.0 to 4.2.0 (#​1686) @​HofmeisterAn
  • chore(deps): Bump the actions group with 5 updates (#​1676) @dependabot[bot]
  • chore(deps): Bump Docker.DotNet from 4.0.2 to 4.1.0 (#​1674) @​HofmeisterAn
  • chore(deps): Bump Docker.DotNet from 3.131.1 to 4.0.2 (#​1665) @​HofmeisterAn

4.11.0

What's Changed

Thanks to all contributors. Once again, really great contributions from everyone 🀝.

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​21198535.

Please be aware that we have changed the supported and underlying image used for the Cosmos DB module. The latest tag only supports certain environments and provides a limited set of features. Microsoft has introduced a new implementation, vnext-preview, which receives more updates and features. Due to the limitations of the latest tag, we decided to replace it with vnext-preview. You find more information about the image here: https://github.com/Azure/azure-cosmos-db-emulator-docker.

⚠️ Breaking Changes

  • feat(CosmosDb): Update base image from latest to vnext-preview (#​1324) @​NelsonBN

πŸš€ Features

  • feat(CosmosDb): Update base image from latest to vnext-preview (#​1324) @​NelsonBN
  • feat: Add typed WithResourceMapping(...) overloads (#​1497) @​cimnine
  • feat: Add Seq module (#​1276) @​montanehamilton
  • feat(PostgreSql): Add WithSsl builder API (#​1529) @​ozkanpakdil
  • feat: Add Temporal module (#​1635) @​bgener
  • feat: Add module connection string provider (#​1632) @​HofmeisterAn
  • fead: Add default container connection string provider (#​1630) @​HofmeisterAn
  • feat(ServiceBus): Add method to get HTTP connection string (#​1622) @​NelsonBN

πŸ› Bug Fixes

  • fix(MongoDb): Wait for post-init startup readiness before replica set initiation (#​1656) @​HofmeisterAn
  • fix(Seq): Assert connection string provider (#​1645) @​HofmeisterAn
  • fix(EventHubs): Ignore runtime property to support reuse (#​1644) @​franciscosamuel
  • fix(ServiceBus): Ignore runtime property to support reuse (#​1643) @​franciscosamuel
  • fix(ResourceReaper): Set wait strategy (#​1634) @​HofmeisterAn
  • fix(ServiceBus): Workaround health API timeout (#​1625) @​HofmeisterAn
  • fix: Do not set console buffer width (ConsoleLogger) (#​1623) @​HofmeisterAn
  • fix(EventHubs): Workaround health API timeout (#​1624) @​HofmeisterAn

πŸ“– Documentation

  • docs(CosmosDb): Replace unsupported tag 'latest' with 'vnext-preview' (#​1660) @​HofmeisterAn
  • docs(Redis): Add example (#​1641) @​HofmeisterAn

🧹 Housekeeping

  • chore(examples): Enable NuGet restore lock mode (#​1659) @​HofmeisterAn
  • chore: Pin image digest (#​1658) @​HofmeisterAn
  • fix: Run OpenSSF Scorecard only on default branch (#​1657) @​HofmeisterAn
  • chore: Remove Git LFS tracking for .snk (#​1655) @​HofmeisterAn
  • feat: Enable Dependabot for NuGet (repo) (#​1654) @​HofmeisterAn
  • feat: Enable Dependabot for NuGet (src) (#​1653) @​HofmeisterAn
  • fix: Replace branch protection with ruleset (#​1652) @​HofmeisterAn
  • fix: Do not enforce policies for admins (#​1651) @​HofmeisterAn
  • fix: Remove missing labels from Dependabot (#​1650) @​HofmeisterAn
    ... (truncated)

4.10.0

What's Changed

Happy New Year, everyone! πŸŽ‰

Please note that going forward, we expect developers to explicitly pin the image version (testcontainers/testcontainers-dotnet#1470). We consider this a best practice and it aligns with other language implementations.

Also, due to the recent Docker Engine v29 release, TC for .NET pins the Docker Engine API version to 1.44 (see the previous release notes). You can override this default and set it to the version you're using, ideally 1.52, which corresponds to v29, if you're already running it.

⚠️ Breaking Changes

  • feat: Add Docker Engine v29 support (#​1609) @​HofmeisterAn
  • chore: Remove EventStoreDb module (#​1599) @​HofmeisterAn

πŸš€ Features

  • feat: Require explicit container image in Testcontainers.Xunit (#​1612) @​0xced
  • feat: Add Platform property to IImage interface (#​1610) @​HofmeisterAn
  • feat: Add Docker Engine v29 support (#​1609) @​HofmeisterAn
  • feat: Require explicit container image when creating container builder (#​1584) @​digital88
  • feat: Add connection string provider (#​1588) @​HofmeisterAn

πŸ› Bug Fixes

  • fix(Kafka): Bump image version to prevent container crash on startup (#​1604) @​HofmeisterAn
  • fix(Elasticsearch): Use HTTP wait strategy (#​1593) @​digital88
  • fix(Milvus): Use healthcheck wait strategy (#​1585) @​verdie-g

πŸ“– Documentation

  • docs: Pin the image version explicitly (#​1605) @​HofmeisterAn

🧹 Housekeeping

  • chore: Remove Sonar findings (#​1611) @​HofmeisterAn
  • chore: Pin Docker Engine API for GH workflow to 1.47 (#​1608) @​HofmeisterAn
  • chore: Set remaining container image explicit (#​1606) @​digital88
  • fix(Kafka): Bump image version to prevent container crash on startup (#​1604) @​HofmeisterAn
  • chore: Remove EventStoreDb test project from SLNX file (#​1603) @​0xced
  • chore: Skip unnecessary work for empty or null sequences (#​1601) @​HofmeisterAn
  • chore: Delegate container builder ctor string to IImage (#​1600) @​HofmeisterAn
  • chore: Remove EventStoreDb module (#​1599) @​HofmeisterAn
  • feat: Prepare next release cycle (4.10.0) (#​1586) @​HofmeisterAn

4.9.0

What's Changed

This release adds a new configuration (DOCKER_API_VERSION) that lets you pin and downgrade the Docker Engine API version. This was needed because Docker Engine v29 introduced breaking changes that affect Docker.DotNet and Testcontainers for .NET. This release pins the API version to 1.44. So far, no issues or negative side effects have been observed.

I am also working on updating [Docker.DotNet](https:...

_Description ...

Description has been truncated

Bumps coverlet.collector from 6.0.4 to 10.0.1
Bumps Mapster from 7.4.0 to 10.0.7
Bumps Microsoft.NET.Test.Sdk from 17.14.1 to 18.5.1
Bumps Swashbuckle.AspNetCore from 6.9.0 to 10.1.7
Bumps Testcontainers from 3.10.0 to 4.12.0
Bumps xunit.runner.visualstudio from 2.8.2 to 3.1.5

---
updated-dependencies:
- dependency-name: coverlet.collector
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: coverlet.collector
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: coverlet.collector
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: Mapster
  dependency-version: 10.0.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.5.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.5.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.5.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: Swashbuckle.AspNetCore
  dependency-version: 10.1.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: Testcontainers
  dependency-version: 4.12.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 21, 2026

Labels

The following labels could not be found: .NET, dependencies, nuget, packages. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@guibranco guibranco enabled auto-merge (squash) May 21, 2026 02:02
@gstraccini gstraccini Bot added the β˜‘οΈ auto-merge Automatic merging of pull requests (gstraccini-bot) label May 21, 2026
Copy link
Copy Markdown
Owner

@guibranco guibranco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automatically approved by gstraccini[bot]

@gstraccini gstraccini Bot added the πŸ€– bot Automated processes or integrations label May 21, 2026
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 21, 2026

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "β–Ά" to expand/collapse)
Block High
High CVE: Improper Handling of Exceptional Conditions in Newtonsoft.Json

CVE: GHSA-5crp-9r3c-p9vr Improper Handling of Exceptional Conditions in Newtonsoft.Json (HIGH)

Affected versions: < 13.0.1

Patched version: 13.0.1

From: tests/Grimoire.IntegrationTests/Grimoire.IntegrationTests.csproj β†’ nuget/microsoft.net.test.sdk@15.0.0 β†’ nuget/newtonsoft.json@9.0.1

β„Ή Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/newtonsoft.json@9.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability in nuget system.formats.asn1

CVE: GHSA-447r-wph3-92pm Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability (HIGH)

Affected versions: >= 5.0.0-preview.7.20364.11 < 6.0.1; >= 7.0.0-preview.1.22076.8 < 8.0.1

Patched version: 8.0.1

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/system.formats.asn1@7.0.0

β„Ή Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.formats.asn1@7.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: .NET Core Information Disclosure in nuget system.net.http

CVE: GHSA-7jgj-8wvc-jh57 .NET Core Information Disclosure (HIGH)

Affected versions: < 4.3.4

Patched version: 4.3.4

From: tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj β†’ nuget/microsoft.net.test.sdk@15.0.0 β†’ nuget/system.net.http@4.1.0

β„Ή Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.net.http@4.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: Improper Certificate Validation in nuget system.security.cryptography.x509certificates

CVE: GHSA-7mfr-774f-w5r9 Improper Certificate Validation (HIGH)

Affected versions: >= 4.0.0 < 4.1.2

Patched version: 4.1.2

From: tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj β†’ nuget/microsoft.net.test.sdk@15.0.0 β†’ nuget/system.security.cryptography.x509certificates@4.1.0

β„Ή Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.security.cryptography.x509certificates@4.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability in nuget system.security.cryptography.xml

CVE: GHSA-37gx-xxp4-5rgx Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability (HIGH)

Affected versions: >= 10.0.0 < 10.0.6; >= 9.0.0 < 9.0.15; >= 8.0.0 < 8.0.3

Patched version: 9.0.15

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/microsoft.entityframeworkcore.design@10.0.0 β†’ nuget/system.security.cryptography.xml@9.0.0

β„Ή Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.security.cryptography.xml@9.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability in nuget system.security.cryptography.xml

CVE: GHSA-w3x6-4m5h-cxqf Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability (HIGH)

Affected versions: >= 10.0.0 < 10.0.6; >= 9.0.0 < 9.0.15; >= 8.0.0 < 8.0.3

Patched version: 9.0.15

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/microsoft.entityframeworkcore.design@10.0.0 β†’ nuget/system.security.cryptography.xml@9.0.0

β„Ή Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.security.cryptography.xml@9.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability in nuget system.text.json

CVE: GHSA-8g4q-xg66-9fp4 Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability (HIGH)

Affected versions: >= 8.0.0 < 8.0.5; >= 6.0.0 < 6.0.10

Patched version: 6.0.10

From: tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj β†’ nuget/testcontainers@3.0.0 β†’ nuget/system.text.json@6.0.7

β„Ή Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/system.text.json@6.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.bcl.asyncinterfaces

Location: Package overview

From: tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj β†’ nuget/testcontainers@3.0.0 β†’ nuget/microsoft.bcl.asyncinterfaces@6.0.0

β„Ή Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.bcl.asyncinterfaces@6.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget microsoft.build.tasks.core

Location: Package overview

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/microsoft.entityframeworkcore.design@10.0.0 β†’ nuget/microsoft.build.tasks.core@17.14.28

β„Ή Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.build.tasks.core@17.14.28. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget microsoft.build.tasks.core

Location: Package overview

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/microsoft.entityframeworkcore.design@10.0.0 β†’ nuget/microsoft.build.tasks.core@17.14.28

β„Ή Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.build.tasks.core@17.14.28. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.build.tasks.core

Location: Package overview

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/microsoft.entityframeworkcore.design@10.0.0 β†’ nuget/microsoft.build.tasks.core@17.14.28

β„Ή Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.build.tasks.core@17.14.28. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget microsoft.build.utilities.core

Location: Package overview

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/microsoft.entityframeworkcore.design@10.0.0 β†’ nuget/microsoft.build.utilities.core@17.14.28

β„Ή Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.build.utilities.core@17.14.28. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.build.utilities.core

Location: Package overview

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/microsoft.entityframeworkcore.design@10.0.0 β†’ nuget/microsoft.build.utilities.core@17.14.28

β„Ή Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.build.utilities.core@17.14.28. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.build

Location: Package overview

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/microsoft.entityframeworkcore.design@10.0.0 β†’ nuget/microsoft.build@17.7.2

β„Ή Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.build@17.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.csharp

Location: Package overview

From: tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj β†’ nuget/microsoft.net.test.sdk@15.0.0 β†’ nuget/microsoft.csharp@4.0.1

β„Ή Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.csharp@4.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.csharp

Location: Package overview

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/mapster@7.0.0 β†’ nuget/microsoft.csharp@4.3.0

β„Ή Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.csharp@4.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget microsoft.net.stringtools

Location: Package overview

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/microsoft.entityframeworkcore.design@10.0.0 β†’ nuget/microsoft.net.stringtools@17.14.28

β„Ή Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.net.stringtools@17.14.28. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.net.stringtools

Location: Package overview

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/microsoft.entityframeworkcore.design@10.0.0 β†’ nuget/microsoft.net.stringtools@17.14.28

β„Ή Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.net.stringtools@17.14.28. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget microsoft.openapi

Location: Package overview

From: src/Grimoire.Api/Grimoire.Api.csproj β†’ nuget/swashbuckle.aspnetcore@6.0.0 β†’ nuget/microsoft.openapi@1.2.3

β„Ή Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.openapi@1.2.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.win32.primitives

Location: Package overview

From: tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj β†’ nuget/microsoft.net.test.sdk@15.0.0 β†’ nuget/microsoft.win32.primitives@4.0.1

β„Ή Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.win32.primitives@4.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget microsoft.win32.registry

Location: Package overview

From: tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj β†’ nuget/microsoft.net.test.sdk@15.0.0 β†’ nuget/microsoft.win32.registry@4.0.0

β„Ή Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.win32.registry@4.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget microsoft.win32.registry

Location: Package overview

From: tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj β†’ nuget/microsoft.net.test.sdk@15.0.0 β†’ nuget/microsoft.win32.registry@4.0.0

β„Ή Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/microsoft.win32.registry@4.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: nuget newtonsoft.json

Location: Package overview

From: tests/Grimoire.IntegrationTests/Grimoire.IntegrationTests.csproj β†’ nuget/microsoft.net.test.sdk@15.0.0 β†’ nuget/newtonsoft.json@9.0.1

β„Ή Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/newtonsoft.json@9.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: nuget portable.bouncycastle

Location: Package overview

From: tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj β†’ nuget/testcontainers@3.0.0 β†’ nuget/portable.bouncycastle@1.9.0

β„Ή Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/portable.bouncycastle@1.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: nuget portable.bouncycastle

Location: Package overview

From: tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj β†’ nuget/testcontainers@3.0.0 β†’ nuget/portable.bouncycastle@1.9.0

β„Ή Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore nuget/portable.bouncycastle@1.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 244 more rows in the dashboard

View full report

@guibranco
Copy link
Copy Markdown
Owner

@gstraccini dotnet centralised package converter

@gstraccini
Copy link
Copy Markdown
Contributor

gstraccini Bot commented May 21, 2026

Converting projects to use centralized package management using central-pkg-converter! πŸ”§

@gstraccini
Copy link
Copy Markdown
Contributor

gstraccini Bot commented May 21, 2026

❌ Centralised Package Converter failed!

@guibranco
Copy link
Copy Markdown
Owner

@gstraccini dotnet centralised package converter

@gstraccini
Copy link
Copy Markdown
Contributor

gstraccini Bot commented May 21, 2026

Converting projects to use centralized package management using central-pkg-converter! πŸ”§

@gstraccini
Copy link
Copy Markdown
Contributor

gstraccini Bot commented May 21, 2026

πŸ“¦ Centralised Package Converter result:

οΏ½[38;5;8mWriting files with encoding: utf-8οΏ½[0m
οΏ½[38;5;8mPick lowest version (not max): FalseοΏ½[0m
οΏ½[38;5;8mVersionComparison: DefaultοΏ½[0m
Processing references for 
[green]/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/G
rimoire.Api/Grimoire.Api.csproj[/]...
οΏ½[38;5;11mCan't parse Version attribute '11.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="FluentValidation.AspNetCore" Version="11.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '10.*' in '<PackageReference Include="Mapster" οΏ½[0m
οΏ½[38;5;11mVersion="10.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '10.0.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.EntityFrameworkCore.Design" Version="10.0.*">οΏ½[0m
οΏ½[38;5;11m      <IncludeAssets>runtime; build; native; contentfiles; analyzers; οΏ½[0m
οΏ½[38;5;11mbuildtransitive</IncludeAssets>οΏ½[0m
οΏ½[38;5;11m      <PrivateAssets>all</PrivateAssets>οΏ½[0m
οΏ½[38;5;11m    </PackageReference>'οΏ½[0m
οΏ½[38;5;8mIgnoring Microsoft.EntityFrameworkCore.Design version .οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '10.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Serilog.AspNetCore" Version="10.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '7.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Serilog.Sinks.File" Version="7.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '10.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Swashbuckle.AspNetCore" Version="10.*" />'οΏ½[0m
Processing references for 
[green]/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/G
rimoire.Consumer/Grimoire.Consumer.csproj[/]...
οΏ½[38;5;11mCan't parse Version attribute '10.0.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.Extensions.Configuration" Version="10.0.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '10.0.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.*" />'οΏ½[0m
Processing references for 
[green]/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/G
rimoire.Core/Grimoire.Core.csproj[/]...
Processing references for 
[green]/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests
/Grimoire.E2eTests/Grimoire.E2eTests.csproj[/]...
οΏ½[38;5;11mCan't parse Version attribute '10.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="coverlet.collector" Version="10.*">οΏ½[0m
οΏ½[38;5;11m      <IncludeAssets>runtime; build; native; contentfiles; analyzers; οΏ½[0m
οΏ½[38;5;11mbuildtransitive</IncludeAssets>οΏ½[0m
οΏ½[38;5;11m      <PrivateAssets>all</PrivateAssets>οΏ½[0m
οΏ½[38;5;11m    </PackageReference>'οΏ½[0m
οΏ½[38;5;8mIgnoring coverlet.collector version .οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '18.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.NET.Test.Sdk" Version="18.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '4.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Testcontainers" Version="4.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '2.*' in '<PackageReference Include="xunit" οΏ½[0m
οΏ½[38;5;11mVersion="2.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '3.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="xunit.runner.visualstudio" Version="3.*" />'οΏ½[0m
Processing references for 
[green]/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/G
rimoire.Infrastructure/Grimoire.Infrastructure.csproj[/]...
οΏ½[38;5;11mCan't parse Version attribute '10.0.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '10.0.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.EntityFrameworkCore.Design" Version="10.0.*">οΏ½[0m
οΏ½[38;5;11m      <IncludeAssets>runtime; build; native; contentfiles; analyzers; οΏ½[0m
οΏ½[38;5;11mbuildtransitive</IncludeAssets>οΏ½[0m
οΏ½[38;5;11m      <PrivateAssets>all</PrivateAssets>οΏ½[0m
οΏ½[38;5;11m    </PackageReference>'οΏ½[0m
οΏ½[38;5;8mIgnoring Microsoft.EntityFrameworkCore.Design version .οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '10.0.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.Extensions.Configuration.Json" Version="10.0.*" />'οΏ½[0m
Processing references for 
[green]/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests
/Grimoire.IntegrationTests/Grimoire.IntegrationTests.csproj[/]...
οΏ½[38;5;11mCan't parse Version attribute '10.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="coverlet.collector" Version="10.*">οΏ½[0m
οΏ½[38;5;11m      <IncludeAssets>runtime; build; native; contentfiles; analyzers; οΏ½[0m
οΏ½[38;5;11mbuildtransitive</IncludeAssets>οΏ½[0m
οΏ½[38;5;11m      <PrivateAssets>all</PrivateAssets>οΏ½[0m
οΏ½[38;5;11m    </PackageReference>'οΏ½[0m
οΏ½[38;5;8mIgnoring coverlet.collector version .οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '10.0.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '10.0.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '18.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.NET.Test.Sdk" Version="18.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '2.*' in '<PackageReference Include="xunit" οΏ½[0m
οΏ½[38;5;11mVersion="2.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '3.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="xunit.runner.visualstudio" Version="3.*" />'οΏ½[0m
Processing references for 
[green]/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests
/Grimoire.Tests/Grimoire.Tests.csproj[/]...
οΏ½[38;5;11mCan't parse Version attribute '10.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="coverlet.collector" Version="10.*">οΏ½[0m
οΏ½[38;5;11m      <IncludeAssets>runtime; build; native; contentfiles; analyzers; οΏ½[0m
οΏ½[38;5;11mbuildtransitive</IncludeAssets>οΏ½[0m
οΏ½[38;5;11m      <PrivateAssets>all</PrivateAssets>οΏ½[0m
οΏ½[38;5;11m    </PackageReference>'οΏ½[0m
οΏ½[38;5;8mIgnoring coverlet.collector version .οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '10.0.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '18.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="Microsoft.NET.Test.Sdk" Version="18.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '2.*' in '<PackageReference Include="xunit" οΏ½[0m
οΏ½[38;5;11mVersion="2.*" />'οΏ½[0m
οΏ½[38;5;11mCan't parse Version attribute '3.*' in '<PackageReference οΏ½[0m
οΏ½[38;5;11mInclude="xunit.runner.visualstudio" Version="3.*" />'οΏ½[0m
Writing 1 refs to Directory.Packages.props to ./Directory.Packages.props...
Processing Complete.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 21, 2026

πŸ”₯ Formatting issues detected

File Line
./src/Grimoire.Infrastructure/Grimoire.Infrastructure.csproj 14
./Directory.Packages.props 7
./src/Grimoire.Api/Grimoire.Api.csproj 16
./tests/Grimoire.IntegrationTests/Grimoire.IntegrationTests.csproj 15
./tests/Grimoire.Tests/Grimoire.Tests.csproj 15
./tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj 11

⚑ Please run dotnet csharpier . locally to fix the formatting issues.

@guibranco
Copy link
Copy Markdown
Owner

@gstraccini dotnet centralised package converter

@gstraccini
Copy link
Copy Markdown
Contributor

gstraccini Bot commented May 21, 2026

Converting projects to use centralized package management using central-pkg-converter! πŸ”§

@gstraccini
Copy link
Copy Markdown
Contributor

gstraccini Bot commented May 21, 2026

πŸ“¦ Centralised Package Converter result:

Writing files with encoding: utf-8
Pick lowest version (not max): False
VersionComparison: Default
Please specify a directory to scan instead of a file.
Aborting...
Processing Complete.

--- Validation (dotnet restore) ---
  Determining projects to restore...
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.IntegrationTests/Grimoire.IntegrationTests.csproj : error NU1010: The following PackageReference items do not define a corresponding PackageVersion item: coverlet.collector, Microsoft.AspNetCore.Mvc.Testing, Microsoft.EntityFrameworkCore.Sqlite, Microsoft.NET.Test.Sdk, xunit, xunit.runner.visualstudio. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.Tests/Grimoire.Tests.csproj : error NU1010: The following PackageReference items do not define a corresponding PackageVersion item: coverlet.collector, Microsoft.EntityFrameworkCore.InMemory, Microsoft.NET.Test.Sdk, xunit, xunit.runner.visualstudio. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Consumer/Grimoire.Consumer.csproj : error NU1008: The following PackageReference items cannot define a value for Version: Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions. Projects using Central Package Management must define a Version value on a PackageVersion item. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Infrastructure/Grimoire.Infrastructure.csproj : error NU1010: The following PackageReference items do not define a corresponding PackageVersion item: Microsoft.EntityFrameworkCore.Sqlite, Microsoft.EntityFrameworkCore.Design, Microsoft.Extensions.Configuration.Json. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Consumer/Grimoire.Consumer.csproj (in 76 ms).
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Infrastructure/Grimoire.Infrastructure.csproj (in 76 ms).
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.IntegrationTests/Grimoire.IntegrationTests.csproj (in 76 ms).
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.Tests/Grimoire.Tests.csproj (in 76 ms).
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj : error NU1010: The following PackageReference items do not define a corresponding PackageVersion item: coverlet.collector, Microsoft.NET.Test.Sdk, Testcontainers, xunit, xunit.runner.visualstudio. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Api/Grimoire.Api.csproj : error NU1010: The following PackageReference items do not define a corresponding PackageVersion item: FluentValidation.AspNetCore, Mapster, Microsoft.EntityFrameworkCore.Design, Serilog.AspNetCore, Serilog.Sinks.File, Swashbuckle.AspNetCore. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj (in 1 ms).
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Api/Grimoire.Api.csproj (in 2 ms).
  Restored /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Core/Grimoire.Core.csproj (in 31 ms).

@guibranco
Copy link
Copy Markdown
Owner

@gstraccini dotnet centralised package converter autofix true

@gstraccini
Copy link
Copy Markdown
Contributor

gstraccini Bot commented May 21, 2026

Converting projects to use centralized package management using central-pkg-converter! πŸ”§

@gstraccini
Copy link
Copy Markdown
Contributor

gstraccini Bot commented May 21, 2026

πŸ“¦ Centralised Package Converter result:

Writing files with encoding: utf-8
Pick lowest version (not max): False
VersionComparison: Default
Processing references for 
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/G
rimoire.Api/Grimoire.Api.csproj...
Ignoring Microsoft.EntityFrameworkCore.Design version .
Processing references for 
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/G
rimoire.Consumer/Grimoire.Consumer.csproj...
Can't parse Version attribute '10.0.*' in '<PackageReference 
Include="Microsoft.Extensions.Configuration" Version="10.0.*" />'
Can't parse Version attribute '10.0.*' in '<PackageReference 
Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.*" />'
Processing references for 
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/G
rimoire.Core/Grimoire.Core.csproj...
Processing references for 
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests
/Grimoire.E2eTests/Grimoire.E2eTests.csproj...
Ignoring coverlet.collector version .
Processing references for 
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/G
rimoire.Infrastructure/Grimoire.Infrastructure.csproj...
Ignoring Microsoft.EntityFrameworkCore.Design version .
Processing references for 
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests
/Grimoire.IntegrationTests/Grimoire.IntegrationTests.csproj...
Ignoring coverlet.collector version .
Processing references for 
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests
/Grimoire.Tests/Grimoire.Tests.csproj...
Ignoring coverlet.collector version .
Writing 1 refs to Directory.Packages.props to ./Directory.Packages.props...
Processing Complete.

--- Autofix ---
Added 2 missing PackageVersion entries to Directory.Packages.props:
  Microsoft.Extensions.Configuration 10.0.*
  Microsoft.Extensions.Configuration.Abstractions 10.0.*

Removed stale Version attribute from 1 project file(s) (NU1008 fix):
  src/Grimoire.Consumer/Grimoire.Consumer.csproj

--- Validation (dotnet restore) ---
  Determining projects to restore...
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Infrastructure/Grimoire.Infrastructure.csproj : error NU1010: The following PackageReference items do not define a corresponding PackageVersion item: Microsoft.EntityFrameworkCore.Sqlite, Microsoft.EntityFrameworkCore.Design, Microsoft.Extensions.Configuration.Json. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.Tests/Grimoire.Tests.csproj : error NU1010: The following PackageReference items do not define a corresponding PackageVersion item: coverlet.collector, Microsoft.EntityFrameworkCore.InMemory, Microsoft.NET.Test.Sdk, xunit, xunit.runner.visualstudio. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.IntegrationTests/Grimoire.IntegrationTests.csproj : error NU1010: The following PackageReference items do not define a corresponding PackageVersion item: coverlet.collector, Microsoft.AspNetCore.Mvc.Testing, Microsoft.EntityFrameworkCore.Sqlite, Microsoft.NET.Test.Sdk, xunit, xunit.runner.visualstudio. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Api/Grimoire.Api.csproj : error NU1010: The following PackageReference items do not define a corresponding PackageVersion item: FluentValidation.AspNetCore, Mapster, Microsoft.EntityFrameworkCore.Design, Serilog.AspNetCore, Serilog.Sinks.File, Swashbuckle.AspNetCore. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.Tests/Grimoire.Tests.csproj : error NU1011: The following PackageVersion items cannot specify a floating version: Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions. For more information on how to enable this functionality for projects using Central Package Management, visit https://aka.ms/nu1011 [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Infrastructure/Grimoire.Infrastructure.csproj : error NU1011: The following PackageVersion items cannot specify a floating version: Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions. For more information on how to enable this functionality for projects using Central Package Management, visit https://aka.ms/nu1011 [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.IntegrationTests/Grimoire.IntegrationTests.csproj : error NU1011: The following PackageVersion items cannot specify a floating version: Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions. For more information on how to enable this functionality for projects using Central Package Management, visit https://aka.ms/nu1011 [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Api/Grimoire.Api.csproj : error NU1011: The following PackageVersion items cannot specify a floating version: Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions. For more information on how to enable this functionality for projects using Central Package Management, visit https://aka.ms/nu1011 [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Infrastructure/Grimoire.Infrastructure.csproj (in 81 ms).
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.Tests/Grimoire.Tests.csproj (in 81 ms).
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Api/Grimoire.Api.csproj (in 81 ms).
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.IntegrationTests/Grimoire.IntegrationTests.csproj (in 81 ms).
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj : error NU1010: The following PackageReference items do not define a corresponding PackageVersion item: coverlet.collector, Microsoft.NET.Test.Sdk, Testcontainers, xunit, xunit.runner.visualstudio. Projects using Central Package Management must declare PackageReference and PackageVersion items with matching names. For more information, visit https://aka.ms/nuget/cpm/gettingstarted [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj : error NU1011: The following PackageVersion items cannot specify a floating version: Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions. For more information on how to enable this functionality for projects using Central Package Management, visit https://aka.ms/nu1011 [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Core/Grimoire.Core.csproj : error NU1011: The following PackageVersion items cannot specify a floating version: Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions. For more information on how to enable this functionality for projects using Central Package Management, visit https://aka.ms/nu1011 [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Consumer/Grimoire.Consumer.csproj : error NU1011: The following PackageVersion items cannot specify a floating version: Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions. For more information on how to enable this functionality for projects using Central Package Management, visit https://aka.ms/nu1011 [/home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/Grimoire.slnx]
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/tests/Grimoire.E2eTests/Grimoire.E2eTests.csproj (in 1 ms).
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Core/Grimoire.Core.csproj (in 1 ms).
  Failed to restore /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/src/Grimoire.Consumer/Grimoire.Consumer.csproj (in 1 ms).

@github-actions
Copy link
Copy Markdown

Infisical secrets check: βœ… No secrets leaked!

πŸ’» Scan logs
2026-05-21T14:50:53Z INF scanning for exposed secrets...
2:50PM INF 20 commits scanned.
2026-05-21T14:50:53Z INF scan completed in 84.3ms
2026-05-21T14:50:53Z INF no leaks found

@guibranco
Copy link
Copy Markdown
Owner

@dependabot recreate

@guibranco guibranco closed this May 21, 2026
auto-merge was automatically disabled May 21, 2026 14:58

Pull request was closed

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 21, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@guibranco guibranco deleted the dependabot/nuget/src/Grimoire.Api/dependencies-52a5a29717 branch May 21, 2026 14:58
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 21, 2026

Oh no! Something went wrong on our end. Please try again later.

If the problem persists, please contact GitHub support for assistance πŸ™‡

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

β˜‘οΈ auto-merge Automatic merging of pull requests (gstraccini-bot) πŸ€– bot Automated processes or integrations

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant