From 15dc4a3ad3deda2f81c3e6ed2e2b1e69dd664b22 Mon Sep 17 00:00:00 2001 From: kkdev92 Date: Mon, 21 Sep 2026 14:44:15 +0900 Subject: [PATCH] chore(deps): bring package versions current Updates the two centrally managed runtime package versions and moves the CodeQL action pin onto a tag Dependabot can read. Microsoft.Extensions.Http 10.0.10 -> 10.0.12 Microsoft.Extensions.Options 10.0.10 -> 10.0.12 Both entries matter even though only the first is referenced directly: transitive pinning is on, so the Options version is what the Http package resolves against. ## Why the CodeQL pin changes shape Its trailing comment named the CodeQL bundle version, `codeql-bundle-v2.26.2`, rather than the action's own version. The pinned commit carries no semantic-version tag, only that bundle tag, so Dependabot cannot derive a current version for the pin and has never proposed an update for it. Every other action used here has stayed current over the same period. The pin now points at the commit tagged v4.38.1, which is the only tag on it, so the action rejoins the weekly update cycle. This moves the action itself from 4.37.4 to 4.38.1. ## Verification Restore, Release build with no warnings, and the full suite: 587 tests across six assemblies, 586 passing and one skipped. The generator verify reports 236 files matching the committed sources, `dotnet format --verify-no-changes` reports none, and the vulnerable-package listing including transitive dependencies is empty. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/scorecard.yml | 2 +- Directory.Packages.props | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index eb3921b..19ccff0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -56,6 +56,6 @@ jobs: publish_results: true - name: Upload to code scanning - uses: github/codeql-action/upload-sarif@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2 + uses: github/codeql-action/upload-sarif@c23de5a82f64bb08c6d9f28844551440ca298e76 # v4.38.1 with: sarif_file: results.sarif diff --git a/Directory.Packages.props b/Directory.Packages.props index b80fe4e..98138ef 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -35,8 +35,8 @@ Referenced by that package only. --> - - + +