diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ccfe019..35d2bb6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,29 +23,26 @@ updates: - dependencies - nuget # ------------------------------------------------------------------------- - # REPO-SPECIFIC. STANDARD.md 4.10 defines this list as exactly the packages - # *this* repo floors per target framework, and those differ per repo — an - # ignore entry for a package the tree does not reference asserts a dependency - # that is not there. This repo floors exactly one, in Directory.Packages.props. + # These carry deliberate per-TFM floors (Directory.Packages.props): a net8.0 + # consumer must stay on its own 8.0.x servicing line. They are ignored + # ENTIRELY (no update-types filter = every version update), STANDARD.md 4.10. # - # It carries a deliberate per-TFM floor: a net8.0 consumer must stay on its own - # 8.0.x servicing line, so an 8.x -> 10.x major PR is never mergeable here and - # would just be weekly noise. + # A major-only ignore is NOT enough. `ignore` matches by dependency NAME and + # cannot be scoped to one target framework, and each name appears under BOTH + # the net8.0 and net10.0 ItemGroups. Dependabot tracks a single version per + # name, so a net10 MINOR/PATCH bump — which a semver-major filter does not + # catch — is applied to every entry of that name, silently rewriting the + # net8.0 floor to a 10.x version (Auth PR #89). Ignoring the package outright + # is the only name-scoped rule that protects a per-TFM floor; both floors are + # bumped by hand. # - # Two caveats, both inherent to Dependabot rather than to this repo: - # 1. `ignore` matches by dependency NAME and cannot be scoped to a single - # target framework. The package is referenced under BOTH the net8.0 and - # net10.0 ItemGroups, so this also suppresses a future net10 major - # (10.x -> 11.x). Bump it by hand when a new .NET major lands. - # 2. `ignore` conditions filter SECURITY updates as well as version - # updates, so a major-version security fix would also be suppressed. Low - # risk in practice (a CVE fix for 8.0.x ships as 8.0.y, a patch), but - # worth knowing. + # Caveat, inherent to Dependabot: `ignore` also filters SECURITY updates, so + # a security fix for these is suppressed too. Low risk (a CVE fix for a + # floored line ships as a patch on that line, applied by hand), but worth + # knowing. # ------------------------------------------------------------------------- ignore: - dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions - update-types: - - version-update:semver-major groups: nuget-minor-patch: patterns: diff --git a/CHANGELOG.md b/CHANGELOG.md index e8a55eb..4ae6408 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 _Nothing yet._ +## [1.1.0] — 2026-10-06 + +Moves to **Spectre.Console.Cli 0.57.2**. Spectre.Console.Cli now ships on its own release +line, and 0.57 changed `AsyncCommand.ExecuteAsync` from `protected` to `public`. +`ListSettingsCommand` and `ResetSettingsCommand` follow suit. Widening an override is a +compatible change for this package, but **raising the floor affects your own commands**: +once you upgrade, every `AsyncCommand`/`Command` in your app built against 0.55 has to +declare its `Execute`/`ExecuteAsync` override `public`, or the build fails with CS0507. + +### Changed + +- **Spectre.Console.Cli floor raised from 0.55.0 to 0.57.2**, matching Spectre.Console. +- **`ExecuteAsync` on `ListSettingsCommand` and `ResetSettingsCommand` is now `public`**, + as Spectre.Console.Cli 0.57 requires. +- **`net10.0` floor for `Microsoft.Extensions.DependencyInjection.Abstractions` raised from + 10.0.11 to 10.0.12**, the current servicing release. The `net8.0` floor (8.0.2) is + unchanged. +- **Dependabot now ignores the per-TFM-floored package outright** (STANDARD.md 4.10). + The previous `semver-major`-only ignore let a net10 minor/patch bump rewrite the net8 + floor to a 10.x version. Both floors are now bumped by hand. +- Build and test tooling: Microsoft.SourceLink.GitHub 10.0.401, xunit.v3 4.0.1, + Microsoft.Testing.Extensions.CodeCoverage 18.11.2, Microsoft.Extensions.DependencyInjection + 10.0.12 (tests only). None ship to consumers. + +### Documentation + +- README: Requirements was stale. It claimed .NET 10 only, Spectre.Console 0.54+ and + Spectre.Console.Cli 0.53+. It now lists both target frameworks and the real floors. + ## [1.0.1] — 2026-08-22 A patch release with **no consumer-visible API or runtime behaviour change**. The @@ -291,6 +320,8 @@ runtime change is a servicing bump to the `net10.0` - Package icon, with the editable source vector kept under `design/icons/`. [Unreleased]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.Settings/compare/v1.0.1...HEAD +[Unreleased]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.Settings/compare/v1.1.0...HEAD +[1.1.0]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.Settings/compare/v1.0.1...v1.1.0 [1.0.1]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.Settings/compare/v1.0.0...v1.0.1 [1.0.0]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.Settings/compare/v0.3.0...v1.0.0 [0.3.0]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.Settings/releases/tag/v0.3.0 diff --git a/Directory.Packages.props b/Directory.Packages.props index d16e905..c94a804 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -16,9 +16,10 @@ runtime, so a per-TFM floor would be meaningless (breaking changes land between minors) — keep the version actually built/tested against. --> - - + + @@ -39,6 +40,6 @@ - + diff --git a/README.md b/README.md index 1135a7d..0f03b46 100644 --- a/README.md +++ b/README.md @@ -236,9 +236,13 @@ A reset restores defaults **in place** on the live instance and persists immedia ## Requirements -- **.NET 10.0** or later -- **Spectre.Console** 0.54+ and **Spectre.Console.Cli** 0.53+ -- **Microsoft.Extensions.DependencyInjection.Abstractions** 10.0+ +- **.NET 8.0** or **.NET 10.0** (the package multi-targets `net8.0;net10.0`) +- **Spectre.Console** 0.57.2+ and **Spectre.Console.Cli** 0.57.2+ +- **Microsoft.Extensions.DependencyInjection.Abstractions** — 8.0.2+ on `net8.0`, + 10.0.12+ on `net10.0` + +Dependency floors are set per target framework, so a `net8.0` consumer is never dragged +off its own 8.0.x servicing line. Everything else is transitive. diff --git a/src/NextIteration.SpectreConsole.Settings/Commands/ListSettingsCommand.cs b/src/NextIteration.SpectreConsole.Settings/Commands/ListSettingsCommand.cs index 59f9563..81d9057 100644 --- a/src/NextIteration.SpectreConsole.Settings/Commands/ListSettingsCommand.cs +++ b/src/NextIteration.SpectreConsole.Settings/Commands/ListSettingsCommand.cs @@ -32,7 +32,7 @@ public sealed class Settings : SettingsCommandSettings } /// - protected override Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) + public override Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) { try { diff --git a/src/NextIteration.SpectreConsole.Settings/Commands/ResetSettingsCommand.cs b/src/NextIteration.SpectreConsole.Settings/Commands/ResetSettingsCommand.cs index c8598aa..b9f2ed6 100644 --- a/src/NextIteration.SpectreConsole.Settings/Commands/ResetSettingsCommand.cs +++ b/src/NextIteration.SpectreConsole.Settings/Commands/ResetSettingsCommand.cs @@ -38,7 +38,7 @@ public sealed class Settings : SettingsCommandSettings } /// - protected override async Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) { try { diff --git a/src/NextIteration.SpectreConsole.Settings/NextIteration.SpectreConsole.Settings.csproj b/src/NextIteration.SpectreConsole.Settings/NextIteration.SpectreConsole.Settings.csproj index f49d0b0..ce83996 100644 --- a/src/NextIteration.SpectreConsole.Settings/NextIteration.SpectreConsole.Settings.csproj +++ b/src/NextIteration.SpectreConsole.Settings/NextIteration.SpectreConsole.Settings.csproj @@ -10,7 +10,7 @@ NextIteration.SpectreConsole.Settings - 1.0.1 + 1.1.0 Strongly-typed, JSON-persisted settings for CLI tools, with automatic or explicit persistence and ready-made Spectre.Console settings commands. true $(MSBuildThisFileDirectory)..\..\artifacts\packages