Repository navigation
chore(deps): the GUI tests, transitive crates and the scanners' Python to current versions - #142
Conversation
ChronoMock.App.Tests stood on xunit.v3 4.0.0, xunit.runner.visualstudio 4.0.0 and Microsoft.NET.Test.Sdk 18.9.0 while the protocol tests had moved on, because Dependabot has never proposed an update for this project. It now has xunit.v3 4.0.2, the runner 4.0.1 and the SDK 18.11.0, the newest stable versions, and the lock file brings Microsoft.Testing.Platform 2.5.1 with them. The 22 packages the two test projects share resolve to the same versions in both. Neither project carries a package of the xunit v2 line. Why Dependabot skips this project is not known yet - its update logs are not public. Locked restore passes, also with the restoring machine's identifier set to linux-x64. The runner lists the same 842 tests before and after, and AnnounceTests, CalculatorDebounceTests, FocusKeeperTests and HistoryErrorTests pass (28), also through dotnet test on Microsoft.Testing.Platform. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dependabot proposes the crates the workspace names, never the ones under them, so six had fallen behind: cc 1.4.5 to 1.9.0, find-msvc-tools 0.1.12 to 0.1.15, equivalent 1.0.2 to 1.0.3, indexmap 2.14.1 to 2.14.2, syn 3.0.4 to 3.0.9 and unicode-ident 1.0.24 to 1.0.27. cc stops at 1.9.0 and not at 1.10.0, which is three days old - the same week the Dependabot entries wait before they propose a version. None of them ships. cc compiles the MinHook sources the hook links, so it was measured: the eight cl.exe commands are the same before and after (-MT -O2 -Brepro -W4), only the archiver takes the objects by relative path, and every section of the object files is byte for byte the same on both targets except .debug$S (the object's own path) and the checksum section over it. Both targets build in release, the session probe passes on the live core (15 of 15, x64 and x86), and clippy, clippy-pin, deny and the components, architecture, network, hygiene, names and shape guards pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The four jobs that set up Python (Semgrep, the dependency review gate and OSV-Scanner in security.yml, the weekly OSV report in audit.yml) asked for 3.12, which has had security fixes only since 2025-04. 3.14 has full support until 2027-10. 3.15 is out, but semgrep 1.181.0 publishes wheels up to 3.14 only. The gate scripts use the standard library alone. On 3.14.9 they compile with warnings as errors, their 16 unit tests pass with deprecation warnings as errors, and the Semgrep gate passes a clean report and refuses one that scanned no file. The jobs on this pull request are the measurement on the runner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
| Layer / File(s) | Summary |
|---|---|
Update workflow Python versions .github/workflows/audit.yml, .github/workflows/security.yml |
The OSV audit, Semgrep, dependency-review, and OSV jobs now configure Python 3.14 instead of Python 3.12. |
Test project package updates
| Layer / File(s) | Summary |
|---|---|
Update test tooling packages gui/ChronoMock.App.Tests/ChronoMock.App.Tests.csproj |
The project updates Microsoft.NET.Test.Sdk from 18.9.0 to 18.11.0, xunit.v3 from 4.0.0 to 4.0.2, and xunit.runner.visualstudio from 4.0.0 to 4.0.1. |
Priority:
Estimated code review effort: 2 (Simple) | ~5 minutes
Change: Other
Suggested labels: dependencies
Merge Risk: 
94d28
-
The dependency and Python-version updates are mergeable with no identified production or workflow risk.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title identifies the three main change areas: GUI test dependencies, transitive Rust crates, and scanner Python versions. It is specific enough for release notes and git history, although “current… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Tests For Changed Behavior PASS. The PR changes only CI Python versions, GUI test packages, and transitive Rust dependencies. The Rust updates are build-time, dev-only, or procedural-macro dependencies; no application source or… No Secrets Or Debug Leftovers PASS. The PR changes only standard workflow Python versions, package versions, and lockfile checksums. It adds no private agent files, .envfiles, credentials, tokens, API keys, private URLs, local …No Hardcoded Ui Styling PASS. The pull request does not add or change UI implementation code. Its GUI-path changes are limited to ChronoMock.App.Tests.csprojpackage references andpackages.lock.json; other changes updat…No Obvious Performance Problems PASS. The pull request changes only CI Python version pins, test-package versions and lockfiles. It does not add UI work, collection processing, polling, per-item external calls, or other code paths m… Desktop Robustness PASS. The reviewed diff changes only CI Python version pins, Rust/NuGet lockfiles, and test-project package versions. It adds no application behavior that loads working-directory assets, writes files,… Safe File Parsing The PR changes only CI Python version pins, test package versions, and lockfile metadata. It adds no file-reading, deserialization, archive, CSV/XLSX, XML/XAML, YAML, or formula-writing API usage. The… System Changes Are Reversible The PR changes only CI Python versions, test package versions, and lockfile entries. It adds no application code that modifies system state. The hooking dependency remains minhook0.9.0; only its bu…Clear User-Facing Text No user-facing text changes are introduced. The diff only updates Python versions, package references, and lockfile dependency metadata; workflow labels, comments, UI resources, buttons, and messages … No Resource Leaks PASS. The reviewed range changes only workflow Python versions, test package versions, and lockfiles. It adds no event subscription, timer, file or process handle, native allocation, task, cache, queu… Scope, Duplication And Docs The diff is limited to the described dependency and CI-version updates: four scanner jobs move to Python 3.14, test packages and their lock entries are refreshed, and six Cargo.lock crates change. No … Full details: Title check
-
Explanation
The title identifies the three main change areas: GUI test dependencies, transitive Rust crates, and scanner Python versions. It is specific enough for release notes and git history, although “current versions” is less precise than naming the target versions.
Full details: Tests For Changed Behavior
-
Explanation
PASS. The PR changes only CI Python versions, GUI test packages, and transitive Rust dependencies. The Rust updates are build-time, dev-only, or procedural-macro dependencies; no application source or non-UI runtime behavior changes. The diff contains no deleted, skipped, or weakened tests.
Full details: No Secrets Or Debug Leftovers
-
Explanation
PASS. The PR changes only standard workflow Python versions, package versions, and lockfile checksums. It adds no private agent files,
.envfiles, credentials, tokens, API keys, private URLs, local absolute paths, hostnames/IPs, personal emails, or specified debug output/calls.
Full details: No Hardcoded Ui Styling
-
Explanation
PASS. The pull request does not add or change UI implementation code. Its GUI-path changes are limited to
ChronoMock.App.Tests.csprojpackage references andpackages.lock.json; other changes updateCargo.lockand workflow Python versions. No XAML, Slint, Fyne, Tkinter, or WPF code-behind changed.
Full details: No Obvious Performance Problems
-
Explanation
PASS. The pull request changes only CI Python version pins, test-package versions and lockfiles. It does not add UI work, collection processing, polling, per-item external calls, or other code paths matching the explicit performance failure conditions.
Full details: Desktop Robustness
-
Explanation
PASS. The reviewed diff changes only CI Python version pins, Rust/NuGet lockfiles, and test-project package versions. It adds no application behavior that loads working-directory assets, writes files, handles culture-sensitive values, starts operations, adds destructive actions, manages background work, requests admin rights, or makes user-facing network calls.
Full details: Safe File Parsing
-
Explanation
The PR changes only CI Python version pins, test package versions, and lockfile metadata. It adds no file-reading, deserialization, archive, CSV/XLSX, XML/XAML, YAML, or formula-writing API usage. The existing XAML copy rule is unchanged. No safe replacement is required.
Full details: System Changes Are Reversible
-
Explanation
The PR changes only CI Python versions, test package versions, and lockfile entries. It adds no application code that modifies system state. The hooking dependency remains
minhook0.9.0; only its build dependencyccchanges. The reversibility warning conditions are therefore not applicable.
Full details: Clear User-Facing Text
-
Explanation
No user-facing text changes are introduced. The diff only updates Python versions, package references, and lockfile dependency metadata; workflow labels, comments, UI resources, buttons, and messages are unchanged.
Full details: No Resource Leaks
-
Explanation
PASS. The reviewed range changes only workflow Python versions, test package versions, and lockfiles. It adds no event subscription, timer, file or process handle, native allocation, task, cache, queue, or image lifecycle code. No resource requires release.
Full details: Scope, Duplication And Docs
-
Explanation
The diff is limited to the described dependency and CI-version updates: four scanner jobs move to Python 3.14, test packages and their lock entries are refreshed, and six Cargo.lock crates change. No product code, CLI, public API, persisted format, UI, or user-facing configuration changes. The title and description cover all changed areas, so README or CHANGELOG updates are not required.
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
coderabbitai
Bot
added
the
dependencies
…nel does Every_command_whose_answer_changed_during_a_session_was_told_so failed on this pull request's CI, 1 of 1035: "JumpToEntered went False -> True at VerdictKind untold". The promise it checks - every command whose answer changed is told so before the panel's next change is announced - holds one change after another on one thread. The panel runs the session on the UI thread, and the session loop comes back to the thread that started it. The test ran on the pool, so the loop's changes and the test's own went out from several threads, and a command could change between the gate check of one property change and the test's look at it. Measured with a counter of the threads the test's look ran on: two or three threads in each of 12 runs before, one in each of 12 runs after. Run alone, the test failed 3 times in 215 runs on xunit 4.0.2 before (0 in 130 on 4.0.0, so the update made it show more often), and 0 in 100 after, alternating under load with the unchanged test, which failed once in those 100. The test body now runs through WpfTestHost.RunAsync. The mutation entry it guards, "r5-6c WY4 a gate left off the watch", is still caught. SessionAnnouncementTests 5 of 5, hygiene and format-cs pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dependabot's NuGet updater takes a target framework that names a Windows version, as net10.0-windows10.0.17763.0 does, for one that no package is compatible with (dependabot/dependabot-core#12274). Its log says "not compatible" for every package of the window and its tests, the versions in use included. So it proposes every update for the projects on plain net10.0 and none for those two, and the window's tests sat a release behind the protocol's on xunit, its runner and the test SDK with nothing to notice it. every_package_the_gui_projects_share_has_one_version reads the PackageReference items of every project under gui/ and requires a package two of them reference to be at one version in all of them. A Dependabot pull request that moves one now stays red until the same pull request moves the rest, and the message names the package, the versions, the projects and the fix. The projects are found rather than listed. A reference with no Version attribute is refused rather than skipped: under central package management the check would otherwise compare nothing and pass. A reference inside a comment is not read. Two mutation entries, a split version and a reference with no Version attribute, are both caught. By hand the same two go red with their messages and a commented reference stays green. components runs 14 tests, one more than before. dependabot.yml now says which of its three NuGet folders gets pull requests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Summary
A sweep of everything the repository pins against its newest stable release, after #138 folded in the open Dependabot pull requests. Three things move, the rest is current or left on purpose, each with the reason. A fourth commit fixes a test race the new xunit made show, and a fifth keeps the GUI projects from drifting apart again.
Everything the repository pins was compared with its newest stable release (NuGet, crates.io, PyPI, GitHub releases, the .NET release index). What was behind and at least a week old, the age every Dependabot entry here waits for, moves:
2317b8a-ChronoMock.App.Teststo xunit.v3 4.0.2, xunit.runner.visualstudio 4.0.1 and Microsoft.NET.Test.Sdk 18.11.0 (from 4.0.0, 4.0.0 and 18.9.0). Dependabot has never proposed an update for this project, while the protocol tests got every one. Both test projects now resolve their 22 shared packages to the same versions, and neither carries a package of the xunit v2 line. Locked restore passes, also as on Linux. The runner lists the same 842 tests, and a sample of four classes passes (28), also throughdotnet teston Microsoft.Testing.Platform.91a3d23- six transitive crates Dependabot does not propose (it proposes only the crates the workspace names): cc 1.9.0, find-msvc-tools 0.1.15, equivalent 1.0.3, indexmap 2.14.2, syn 3.0.9, unicode-ident 1.0.27. None ships. cc compiles the vendored MinHook, so it was measured: the same eightcl.execommands, and every object file section byte for byte the same on both targets except the object's own path in.debug$Sand the checksum over it. Both release targets build, the live session probe passes on x64 and x86 (15 of 15 each), and the dependency and source guards pass.94d289f- the Python of the four scanner jobs from 3.12 (security fixes only since 2025-04) to 3.14. 3.15 is out, but semgrep 1.181.0 publishes wheels up to 3.14. The gate scripts use the standard library alone, compile with warnings as errors, and their 16 unit tests pass on 3.14.9.Left as they are, on purpose:
Swatinem/rust-cachev2.9.3,actions/setup-pythonv7.1.0,github/codeql-actionv4.39.1. Dependabot will propose them once they are a week old.resolver = "2"inCargo.toml. The only change "3" brings is to prefer dependency versions whoserust-versionthe running compiler meets. Measured here, it resolves the same lock file. With norust-versiondeclared, it would tie the choice to whichever compiler runs the update, Dependabot's included.Already current: WPF-UI 4.3.0, every crate the workspace names, Rust 1.99.1 (CI takes stable), edition 2024, C#
latest, OSV-Scanner 2.7.0, cargo-deny 0.20.2 and the other eleven actions.Why Dependabot skips the two window projects
The NuGet update job's log says it for every package of
ChronoMock.App.Tests, the versions in use included: "The package xunit.v3.4.0.2 is not compatible. Incompatible project frameworks: net10.0-windows10.0.17763". The projects are discovered without an error, and the packages are compatible (they targetnet8.0, and the project builds and runs them). Dependabot's NuGet updater treats a TFM with a Windows platform version as compatible with nothing - dependabot/dependabot-core#12274 (open since 2025-05,net9.0-windows10.0.17763) and dependabot/dependabot-core#13923. Every NuGet pull request Dependabot opened here was for the protocol tests, the one project on plainnet10.0.The workaround reported in #12274 splits the TFM into
TargetFrameworkplusTargetPlatformIdentifier,TargetPlatformVersionandTargetPlatformMinVersion. That changes how the window is built - the version floor, the lock files' framework keys, and the Windows Runtime projection #138 measured - so it is not in this pull request. Until then the two window projects are kept current by hand, as here.c85a193- so the drift cannot come back unseen.every_package_the_gui_projects_share_has_one_versionincrates/cli/tests/components.rsreads thePackageReferenceitems of every project undergui/and requires a package two of them reference to be at one version in all of them. A Dependabot pull request that moves xunit for the protocol tests now stays red until the same pull request moves the window's tests, and the message names the package, the versions, the projects and the fix. The projects are found rather than listed, so one added later is held to it too.Versionattribute. The guard refuses such a reference rather than skipping it, because under central package management it would otherwise compare nothing and pass. Both are caught.componentsruns 14 tests, one more than before..github/dependabot.ymlnow says which of its three NuGet folders gets pull requests. WPF-UI, which only the window takes, has nothing to be compared with and stays a manual check.The red CI on
94d289f(b1322bc)SessionAnnouncementTests.Every_command_whose_answer_changed_during_a_session_was_told_sofailed, 1 of 1035: "JumpToEntered went False -> True at VerdictKind untold". It checks that every command whose answer changed is told so before the panel's next change is announced, a promise that holds one change after another on one thread. The panel runs the session on the UI thread, and the loop comes back to the thread that started it. The test ran on the pool, so its own changes and the loop's went out from several threads.WpfTestHost.RunAsync. Its mutation entry ("r5-6c WY4 a gate left off the watch") is still caught,SessionAnnouncementTests5 of 5,hygieneandformat-cspass.Why a separate pull request
These three commits were made on the #138 branch and pushed after it was merged, so they reached that branch and not main. They are the same commits, picked onto main, and the tree is the one that was measured.
🤖 Generated with Claude Code