From 59209fbd59007327b66916b6ca542978962e8904 Mon Sep 17 00:00:00 2001 From: Stuart Meeks Date: Tue, 6 Oct 2026 03:42:21 +0000 Subject: [PATCH] =?UTF-8?q?release:=201.1.0=20=E2=80=94=20Spectre.Console.?= =?UTF-8?q?Cli=200.57.2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Spectre.Console.Cli 0.57 made AsyncCommand.ExecuteAsync public (was protected), so the 0.55 -> 0.57.2 bump needs every override widened; Dependabot's version-only bump (#38) fails CS0507. Also raises the net10 Microsoft.Extensions.* floors to 10.0.12 (by hand, per STANDARD.md 4.10) and makes Dependabot ignore the per-TFM-floored packages outright - the semver-major-only filter could rewrite the net8 floor. README requirements corrected; CHANGELOG 1.1.0. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 36 ++++++++----------- CHANGELOG.md | 30 +++++++++++++++- Directory.Packages.props | 20 ++++++----- README.md | 4 +++ .../Commands/UpdateCheckCommand.cs | 2 +- .../Commands/UpdateCommand.cs | 2 +- ...Iteration.SpectreConsole.SelfUpdate.csproj | 2 +- 7 files changed, 63 insertions(+), 33 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d7063f8..fcf5daf 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,33 +23,27 @@ updates: - dependencies - nuget # ------------------------------------------------------------------------- - # These two carry deliberate per-TFM floors (see Directory.Packages.props): a - # net8.0 consumer must stay on its own 8.0.x servicing line, so an - # 8.x -> 10.x major PR is never mergeable and would just be weekly noise. + # These carry deliberate per-TFM floors (Directory.Packages.props): a net8.0 + # consumer must stay on its own 8.0.x servicing line. They are ignored + # ENTIRELY (no update-types filter = every version update), STANDARD.md 4.10. # - # The list is exactly this repo's per-TFM floors and nothing else - # (STANDARD.md 4.10). Auth additionally floors - # System.Security.Cryptography.ProtectedData; this package does not - # reference it, so naming it here would assert a dependency that is not in - # the tree. + # A major-only ignore is NOT enough. `ignore` matches by dependency NAME and + # cannot be scoped to one target framework, and each name appears under BOTH + # the net8.0 and net10.0 ItemGroups. Dependabot tracks a single version per + # name, so a net10 MINOR/PATCH bump — which a semver-major filter does not + # catch — is applied to every entry of that name, silently rewriting the + # net8.0 floor to a 10.x version (Auth PR #89). Ignoring the package outright + # is the only name-scoped rule that protects a per-TFM floor; both floors are + # bumped by hand. # - # Two caveats, both inherent to Dependabot rather than to this repo: - # 1. `ignore` matches by dependency NAME and cannot be scoped to a single - # target framework. These packages are referenced under BOTH the net8.0 - # and net10.0 ItemGroups, so this also suppresses a future net10 major - # (10.x -> 11.x). Bump those by hand when a new .NET major lands. - # 2. `ignore` conditions filter SECURITY updates as well as version - # updates, so a major-version security fix for these would also be - # suppressed. Low risk in practice (a CVE fix for 8.0.x ships as - # 8.0.y, a patch), but worth knowing. + # Caveat, inherent to Dependabot: `ignore` also filters SECURITY updates, so + # a security fix for these is suppressed too. Low risk (a CVE fix for a + # floored line ships as a patch on that line, applied by hand), but worth + # knowing. # ------------------------------------------------------------------------- ignore: - dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions - update-types: - - version-update:semver-major - dependency-name: Microsoft.Extensions.Http - update-types: - - version-update:semver-major groups: nuget-minor-patch: patterns: diff --git a/CHANGELOG.md b/CHANGELOG.md index fdabb03..957b657 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,9 +9,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +--- + +## [1.1.0] — 2026-10-06 + +Moves to **Spectre.Console.Cli 0.57.2**. Spectre.Console.Cli now ships on its own release +line, and 0.57 changed `AsyncCommand.ExecuteAsync` from `protected` to `public`. +`UpdateCommand` and `UpdateCheckCommand` follow suit. Widening an override is a compatible +change for this package (package validation against the 1.0.1 baseline passes), but **raising the floor affects your own commands**: once you upgrade, every +`AsyncCommand`/`Command` in your app built against 0.55 has to declare its +`Execute`/`ExecuteAsync` override `public`, or the build fails with CS0507. + ### Changed +- **Spectre.Console.Cli floor raised from 0.55.0 to 0.57.2**, matching Spectre.Console. +- **`ExecuteAsync` on `UpdateCommand` and `UpdateCheckCommand` is now `public`**, as + Spectre.Console.Cli 0.57 requires. +- **`net10.0` floors for `Microsoft.Extensions.DependencyInjection.Abstractions` and + `Microsoft.Extensions.Http` raised from 10.0.11 to 10.0.12**, the current servicing + release. The `net8.0` floors (8.0.2 / 8.0.1) are unchanged. - **`PackageValidationBaselineVersion` moved to `1.0.1`**, now that 1.0.1 is published and restorable. From here an accidental break in the public surface fails the build against the first stable release rather than against `0.3.1`, so a break is a 2.0.0 rather than a judgement call. There is no 1.0.0 to baseline against — it was never published. +- **Dependabot now ignores the per-TFM-floored packages outright** (STANDARD.md 4.10). + The previous `semver-major`-only ignore let a net10 minor/patch bump rewrite the net8 + floor to a 10.x version. Both floors are now bumped by hand. +- Build and test tooling: Microsoft.SourceLink.GitHub 10.0.401, xunit.v3 4.0.1, + Microsoft.Testing.Extensions.CodeCoverage 18.11.2. None ship to consumers. + +### Documentation + +- README: Install now lists the Spectre.Console / Spectre.Console.Cli floors and the + per-TFM `Microsoft.Extensions.*` floors. --- @@ -277,7 +304,8 @@ Initial commit. Never published to nuget.org — superseded by 0.1.1 before the - Full XML documentation on the public surface, `TreatWarningsAsErrors=true`, `AnalysisLevel=latest`. - SourceLink, deterministic builds, published symbol packages. -[Unreleased]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/compare/v1.0.1...HEAD +[Unreleased]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/compare/v1.1.0...HEAD +[1.1.0]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/compare/v1.0.1...v1.1.0 [1.0.1]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/releases/tag/v1.0.1 [0.3.1]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/releases/tag/v0.3.1 [0.3.0]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/releases/tag/v0.3.0 diff --git a/Directory.Packages.props b/Directory.Packages.props index af2a81e..49ffae1 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -24,9 +24,12 @@ net8.0 sits at 8.0.2 / 8.0.1 because those are the final 8.0.x servicing versions — there is nothing further to move to on that line. - Both are also listed under `ignore` in .github/dependabot.yml with - update-types: [version-update:semver-major] (STANDARD.md 4.10), so - Dependabot never proposes the 8.x -> 10.x bump that can never be merged. + Both are also listed under `ignore` in .github/dependabot.yml with NO + update-types filter (STANDARD.md 4.10), so Dependabot never touches them + on either TFM. A name-scoped major-only ignore is not enough: because the + same package name lives in both the net8 and net10 groups, a net10 + minor/patch bump would rewrite the net8 floor to a 10.x version (Auth + PR #89). Both floors are bumped by hand. Versions here are unchanged from the per-project references they replaced. This migration is deliberately behaviour-preserving: raising a floor is a @@ -37,8 +40,8 @@ - - + + - + diff --git a/README.md b/README.md index b3e2d24..df406ac 100644 --- a/README.md +++ b/README.md @@ -34,6 +34,10 @@ dotnet add package NextIteration.SpectreConsole.SelfUpdate Targets `net8.0` and `net10.0`. Both targets carry an identical public surface and are covered by the same test suite on Linux, macOS, and Windows. +Requires **Spectre.Console** 0.57.2+ and **Spectre.Console.Cli** 0.57.2+. The +`Microsoft.Extensions.*` dependencies are floored per target framework (8.0.x on `net8.0`, +10.0.12+ on `net10.0`), so a `net8.0` consumer stays on its own servicing line. + ## Quick start ```csharp diff --git a/src/NextIteration.SpectreConsole.SelfUpdate/Commands/UpdateCheckCommand.cs b/src/NextIteration.SpectreConsole.SelfUpdate/Commands/UpdateCheckCommand.cs index 2ef7821..139750a 100644 --- a/src/NextIteration.SpectreConsole.SelfUpdate/Commands/UpdateCheckCommand.cs +++ b/src/NextIteration.SpectreConsole.SelfUpdate/Commands/UpdateCheckCommand.cs @@ -47,7 +47,7 @@ public UpdateCheckCommand(IUpdateChecker checker, IAnsiConsole console) } /// - protected override async Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) { ArgumentNullException.ThrowIfNull(settings); diff --git a/src/NextIteration.SpectreConsole.SelfUpdate/Commands/UpdateCommand.cs b/src/NextIteration.SpectreConsole.SelfUpdate/Commands/UpdateCommand.cs index c8db644..778fff7 100644 --- a/src/NextIteration.SpectreConsole.SelfUpdate/Commands/UpdateCommand.cs +++ b/src/NextIteration.SpectreConsole.SelfUpdate/Commands/UpdateCommand.cs @@ -80,7 +80,7 @@ public UpdateCommand( } /// - protected override async Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) + public override async Task ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken) { ArgumentNullException.ThrowIfNull(settings); diff --git a/src/NextIteration.SpectreConsole.SelfUpdate/NextIteration.SpectreConsole.SelfUpdate.csproj b/src/NextIteration.SpectreConsole.SelfUpdate/NextIteration.SpectreConsole.SelfUpdate.csproj index 17ee9fb..07af6e4 100644 --- a/src/NextIteration.SpectreConsole.SelfUpdate/NextIteration.SpectreConsole.SelfUpdate.csproj +++ b/src/NextIteration.SpectreConsole.SelfUpdate/NextIteration.SpectreConsole.SelfUpdate.csproj @@ -11,7 +11,7 @@ NextIteration.SpectreConsole.SelfUpdate - 1.0.1 + 1.1.0 Self-update for Spectre.Console CLIs: pluggable update sources (GitHub Releases over HTTP, GitHub Releases via gh CLI for private repos, generic HTTPS manifest, custom), SHA-256 verification, atomic file swap, and a drop-in `update` command. true $(MSBuildThisFileDirectory)..\..\artifacts\packages