release: 1.1.0 — Spectre.Console.Cli 0.57.2

.github/dependabot.yml

@@ -23,33 +23,27 @@ updates:
       - dependencies
       - nuget
     # -------------------------------------------------------------------------
-    # These two carry deliberate per-TFM floors (see Directory.Packages.props): a
-    # net8.0 consumer must stay on its own 8.0.x servicing line, so an
-    # 8.x -> 10.x major PR is never mergeable and would just be weekly noise.
+    # These carry deliberate per-TFM floors (Directory.Packages.props): a net8.0
+    # consumer must stay on its own 8.0.x servicing line. They are ignored
+    # ENTIRELY (no update-types filter = every version update), STANDARD.md 4.10.
     #
-    # The list is exactly this repo's per-TFM floors and nothing else
-    # (STANDARD.md 4.10). Auth additionally floors
-    # System.Security.Cryptography.ProtectedData; this package does not
-    # reference it, so naming it here would assert a dependency that is not in
-    # the tree.
+    # A major-only ignore is NOT enough. `ignore` matches by dependency NAME and
+    # cannot be scoped to one target framework, and each name appears under BOTH
+    # the net8.0 and net10.0 ItemGroups. Dependabot tracks a single version per
+    # name, so a net10 MINOR/PATCH bump — which a semver-major filter does not
+    # catch — is applied to every entry of that name, silently rewriting the
+    # net8.0 floor to a 10.x version (Auth PR #89). Ignoring the package outright
+    # is the only name-scoped rule that protects a per-TFM floor; both floors are
+    # bumped by hand.
     #
-    # Two caveats, both inherent to Dependabot rather than to this repo:
-    #  1. `ignore` matches by dependency NAME and cannot be scoped to a single
-    #     target framework. These packages are referenced under BOTH the net8.0
-    #     and net10.0 ItemGroups, so this also suppresses a future net10 major
-    #     (10.x -> 11.x). Bump those by hand when a new .NET major lands.
-    #  2. `ignore` conditions filter SECURITY updates as well as version
-    #     updates, so a major-version security fix for these would also be
-    #     suppressed. Low risk in practice (a CVE fix for 8.0.x ships as
-    #     8.0.y, a patch), but worth knowing.
+    # Caveat, inherent to Dependabot: `ignore` also filters SECURITY updates, so
+    # a security fix for these is suppressed too. Low risk (a CVE fix for a
+    # floored line ships as a patch on that line, applied by hand), but worth
+    # knowing.
     # -------------------------------------------------------------------------
     ignore:
       - dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions
-        update-types:
-          - version-update:semver-major
       - dependency-name: Microsoft.Extensions.Http
-        update-types:
-          - version-update:semver-major
     groups:
       nuget-minor-patch:
         patterns:

CHANGELOG.md

@@ -9,9 +9,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+---
+
+## [1.1.0] — 2026-10-06
+
+Moves to **Spectre.Console.Cli 0.57.2**. Spectre.Console.Cli now ships on its own release
+line, and 0.57 changed `AsyncCommand<TSettings>.ExecuteAsync` from `protected` to `public`.
+`UpdateCommand` and `UpdateCheckCommand` follow suit. Widening an override is a compatible
+change for this package (package validation against the 1.0.1 baseline passes), but **raising the floor affects your own commands**: once you upgrade, every
+`AsyncCommand`/`Command` in your app built against 0.55 has to declare its
+`Execute`/`ExecuteAsync` override `public`, or the build fails with CS0507.
+
 ### Changed
 
+- **Spectre.Console.Cli floor raised from 0.55.0 to 0.57.2**, matching Spectre.Console.
+- **`ExecuteAsync` on `UpdateCommand` and `UpdateCheckCommand` is now `public`**, as
+  Spectre.Console.Cli 0.57 requires.
+- **`net10.0` floors for `Microsoft.Extensions.DependencyInjection.Abstractions` and
+  `Microsoft.Extensions.Http` raised from 10.0.11 to 10.0.12**, the current servicing
+  release. The `net8.0` floors (8.0.2 / 8.0.1) are unchanged.
 - **`PackageValidationBaselineVersion` moved to `1.0.1`**, now that 1.0.1 is published and restorable. From here an accidental break in the public surface fails the build against the first stable release rather than against `0.3.1`, so a break is a 2.0.0 rather than a judgement call. There is no 1.0.0 to baseline against — it was never published.
+- **Dependabot now ignores the per-TFM-floored packages outright** (STANDARD.md 4.10).
+  The previous `semver-major`-only ignore let a net10 minor/patch bump rewrite the net8
+  floor to a 10.x version. Both floors are now bumped by hand.
+- Build and test tooling: Microsoft.SourceLink.GitHub 10.0.401, xunit.v3 4.0.1,
+  Microsoft.Testing.Extensions.CodeCoverage 18.11.2. None ship to consumers.
+
+### Documentation
+
+- README: Install now lists the Spectre.Console / Spectre.Console.Cli floors and the
+  per-TFM `Microsoft.Extensions.*` floors.
 
 ---
 
@@ -277,7 +304,8 @@ Initial commit. Never published to nuget.org — superseded by 0.1.1 before the
 - Full XML documentation on the public surface, `TreatWarningsAsErrors=true`, `AnalysisLevel=latest`.
 - SourceLink, deterministic builds, published symbol packages.
 
-[Unreleased]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/compare/v1.0.1...HEAD
+[Unreleased]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/compare/v1.0.1...v1.1.0
 [1.0.1]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/releases/tag/v1.0.1
 [0.3.1]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/releases/tag/v0.3.1
 [0.3.0]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.SelfUpdate/releases/tag/v0.3.0

Directory.Packages.props

@@ -24,9 +24,12 @@
 		net8.0 sits at 8.0.2 / 8.0.1 because those are the final 8.0.x servicing
 		versions — there is nothing further to move to on that line.
 
-		Both are also listed under `ignore` in .github/dependabot.yml with
-		update-types: [version-update:semver-major] (STANDARD.md 4.10), so
-		Dependabot never proposes the 8.x -> 10.x bump that can never be merged.
+		Both are also listed under `ignore` in .github/dependabot.yml with NO
+		update-types filter (STANDARD.md 4.10), so Dependabot never touches them
+		on either TFM. A name-scoped major-only ignore is not enough: because the
+		same package name lives in both the net8 and net10 groups, a net10
+		minor/patch bump would rewrite the net8 floor to a 10.x version (Auth
+		PR #89). Both floors are bumped by hand.
 
 		Versions here are unchanged from the per-project references they replaced.
 		This migration is deliberately behaviour-preserving: raising a floor is a
@@ -37,8 +40,8 @@
 		<PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.1" />
 	</ItemGroup>
 	<ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
-		<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.11" />
-		<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.11" />
+		<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.12" />
+		<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.12" />
 	</ItemGroup>
 
 	<!--
@@ -47,15 +50,16 @@
 		between minors, so a low floor would be both meaningless and risky.
 		STANDARD.md 1.5.
 
-		Spectre.Console.Cli's latest stable is 0.55.0 (no 0.56/0.57 exists); it
-		requires Spectre.Console >= 0.55.0, which 0.57.2 satisfies.
+		Spectre.Console.Cli moved to its own release line and now matches
+		Spectre.Console at 0.57.2. 0.57 made AsyncCommand.ExecuteAsync public
+		(it was protected), so every override here is public.
 
 		Spectre.Console.Testing is test-only but tracks Spectre.Console's version
 		exactly — it is the same repo and the pair must not drift apart.
 	-->
 	<ItemGroup>
 		<PackageVersion Include="Spectre.Console" Version="0.57.2" />
-		<PackageVersion Include="Spectre.Console.Cli" Version="0.55.0" />
+		<PackageVersion Include="Spectre.Console.Cli" Version="0.57.2" />
 		<PackageVersion Include="Spectre.Console.Testing" Version="0.57.2" />
 	</ItemGroup>
 

README.md

@@ -34,6 +34,10 @@ dotnet add package NextIteration.SpectreConsole.SelfUpdate
 
 Targets `net8.0` and `net10.0`. Both targets carry an identical public surface and are covered by the same test suite on Linux, macOS, and Windows.
 
+Requires **Spectre.Console** 0.57.2+ and **Spectre.Console.Cli** 0.57.2+. The
+`Microsoft.Extensions.*` dependencies are floored per target framework (8.0.x on `net8.0`,
+10.0.12+ on `net10.0`), so a `net8.0` consumer stays on its own servicing line.
+
 ## Quick start
 
 ```csharp

src/NextIteration.SpectreConsole.SelfUpdate/Commands/UpdateCheckCommand.cs

@@ -47,7 +47,7 @@ public UpdateCheckCommand(IUpdateChecker checker, IAnsiConsole console)
         }
 
         /// <inheritdoc />
-        protected override async Task<int> ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken)
+        public override async Task<int> ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken)
         {
             ArgumentNullException.ThrowIfNull(settings);
 

src/NextIteration.SpectreConsole.SelfUpdate/Commands/UpdateCommand.cs

@@ -80,7 +80,7 @@ public UpdateCommand(
         }
 
         /// <inheritdoc />
-        protected override async Task<int> ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken)
+        public override async Task<int> ExecuteAsync(CommandContext context, Settings settings, CancellationToken cancellationToken)
         {
             ArgumentNullException.ThrowIfNull(settings);
 

src/NextIteration.SpectreConsole.SelfUpdate/NextIteration.SpectreConsole.SelfUpdate.csproj

@@ -11,7 +11,7 @@
 
 	<PropertyGroup>
 		<PackageId>NextIteration.SpectreConsole.SelfUpdate</PackageId>
-		<Version>1.0.1</Version>
+		<Version>1.1.0</Version>
 		<Description>Self-update for Spectre.Console CLIs: pluggable update sources (GitHub Releases over HTTP, GitHub Releases via gh CLI for private repos, generic HTTPS manifest, custom), SHA-256 verification, atomic file swap, and a drop-in `update` command.</Description>
 		<GeneratePackageOnBuild Condition="'$(Configuration)' == 'Release'">true</GeneratePackageOnBuild>
 		<PackageOutputPath>$(MSBuildThisFileDirectory)..\..\artifacts\packages</PackageOutputPath>