build(deps): second dependency sweep + VSTest → Microsoft.Testing.Platform; Dependabot to security-only - #98
Merged
Conversation
…ng.Platform Lands the 12 Dependabot PRs that accumulated since the first-pass sweep as one change, verified behind a green suite rather than merged one at a time. NuGet: - xunit.v3 3.2.2 -> 4.0.0, xunit.runner.visualstudio 3.1.5 -> 4.0.0 - Microsoft.NET.Test.Sdk 18.7.0 -> 18.9.0, AwesomeAssertions 9.4.0 -> 9.6.0 - BouncyCastle.Cryptography 2.5.1 -> 2.7.0 (both projects) - MinVer 6.0.0 -> 7.0.0, Microsoft.SourceLink.GitHub 8.0.0 -> 10.0.400 Actions (SHA-pinned, comments corrected): - actions/setup-dotnet v5.4.0 -> v6.0.0 (all three workflows) - github/codeql-action init+analyze v4.37.0 -> v4.37.1 - EnricoMi/publish-unit-test-result-action v2.17.1 -> v2.24.0 - softprops/action-gh-release v2.2.1 -> v3.0.2 The xunit.v3 major is not a drop-in. xunit.v3 4.x runs on Microsoft.Testing Platform, and MTP dropped the VSTest bridge on the .NET 10 SDK, so every `dotnet test` failed outright with "Testing with VSTest target is no longer supported". Migrating: - global.json selects the MTP runner for `dotnet test` (the .NET 10 opt-in; the older TestingPlatformDotnetTestSupport property does not apply here). - coverlet.collector and --collect:"XPlat Code Coverage" are VSTest data collectors and silently collect nothing under MTP. Replaced with Microsoft.Testing.Extensions.CodeCoverage (--coverage, cobertura) and .TrxReport (--report-trx) so the PR test check and the Cobertura coverage comment keep working unchanged. - _test.yml passes the MTP flags after `--`. release.yml needs no change; its plain `dotnet test -c Release` picks up the runner from global.json. No library API or protocol-math change. 1695 tests green, zero warnings, dotnet format clean, dotnet pack verified (MinVer 7 still stamps 1.0.0). Coverage after the collector swap: 84.9% line / 73.2% branch.
Sets open-pull-requests-limit: 0 on both ecosystems. That switches off routine version-bump PRs while leaving Dependabot security updates untouched -- those are driven by the repository's "Dependabot security updates" setting (verified enabled, alerts on) and are still raised against a published advisory. Routine currency moves to periodic test-verified sweeps instead. The 12 PRs this replaces had sat open for six weeks, and the xunit.v3 major in the sweep that just landed shows why: it needed a test-platform migration, not a merge button.
CLAUDE.md: correct the stale test count (292 -> 1695), document that tests now run on Microsoft.Testing.Platform and that global.json is load-bearing, note the MTP reporting flags that replace the VSTest ones, list the current test and crypto dependencies, and record the security-updates-only Dependabot policy. CHANGELOG.md: add the sweep and the MTP migration under [Unreleased].
SummarySummary
CoverageUniswapSharp - 85.3%
|
This was referenced Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lands the 12 open Dependabot PRs as one verified change, migrates the test stack off VSTest (forced by the
xunit.v3major), and switches Dependabot to security updates only.Closes #25. Supersedes and closes #82, #83, #84, #85, #86, #90, #92, #93, #94, #95, #96, #97.
Dependencies
xunit.v3xunit.runner.visualstudioMicrosoft.NET.Test.SdkAwesomeAssertionsBouncyCastle.CryptographyMinVerMicrosoft.SourceLink.GitHubactions/setup-dotnetgithub/codeql-action(init + analyze)EnricoMi/publish-unit-test-result-actionsoftprops/action-gh-releaseNo library API change and no protocol-math change — the runtime deps under the math (Nethereum, ExtendedNumerics.BigRational) are untouched.
The
xunit.v3major is not a drop-inxunit.v3 4.x runs on Microsoft.Testing.Platform, and MTP dropped the VSTest bridge on the .NET 10 SDK. Straight after the bump, every
dotnet testfailed:So this PR carries the migration:
global.jsonselects the MTP runner fordotnet test. This is the .NET 10 opt-in; the olderTestingPlatformDotnetTestSupportMSBuild property does not work here, and neither doesdotnet.config. The file is load-bearing — deleting it breaks the build.coverlet.collectoris gone. It is a VSTest data collector, as is--collect:"XPlat Code Coverage"; under MTP they collect nothing. Replaced byMicrosoft.Testing.Extensions.CodeCoverage(--coverage, cobertura output) andMicrosoft.Testing.Extensions.TrxReport(--report-trx)._test.ymlpasses the MTP flags after--. The TRX test-result check, the ReportGenerator Cobertura summary and the sticky coverage comment all keep working; only the flags changed.release.ymlneeds no change — its plaindotnet test -c Releasepicks the runner up fromglobal.json.Dependabot → security updates only
open-pull-requests-limit: 0on both ecosystems stops routine version-bump PRs. Security updates are unaffected: they come from the repo's "Dependabot security updates" setting, which is enabled (automated-security-fixes→{"enabled":true,"paused":false}) with alerts on. Routine currency moves to periodic verified sweeps like this one.The 12 PRs this replaces had been open for up to six weeks, and the
xunit.v3one is the argument: it needed a platform migration, not a merge button.Verification (local, Linux)
dotnet build -c Release— succeeded, 0 warningsdotnet test -c Release— 1695/1695 passed, 0 failed, 0 skippeddotnet format UniswapSharp.sln --verify-no-changes— cleandotnet pack—UniswapSharp.1.0.0.nupkg+.snupkgproduced (MinVer 7 still stamps the right version from thev1.0.0tag)UniswapSharpassembly onlyCI re-runs all of this on ubuntu / windows / macos.