chore(deps): Bump the nuget group with 10 updates

[dependabot]

Updated Microsoft.Extensions.DependencyInjection from 10.0.12 to 10.0.13.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.FileSystemGlobbing from 10.0.12 to 10.0.13.

Release notes

Sourced from Microsoft.Extensions.FileSystemGlobbing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging from 10.0.12 to 10.0.13.

Release notes

Sourced from Microsoft.Extensions.Logging's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Options from 10.0.12 to 10.0.13.

Release notes

Sourced from Microsoft.Extensions.Options's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.TimeProvider.Testing from 10.10.0 to 10.11.0.

Release notes

Sourced from Microsoft.Extensions.TimeProvider.Testing's releases.

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package	Version
Microsoft.Extensions.AI.OpenAI	10.10.1
Microsoft.Extensions.AI.Abstractions	10.10.1

What's Changed

AI

• Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

• @​zxyao145 made their first contribution in #​7761
• @​zxyao145 submitted issue #​7760 (resolved by #​7761)
• @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Updated Microsoft.SourceLink.GitHub from 10.0.401 to 10.0.402.

Release notes

Sourced from Microsoft.SourceLink.GitHub's releases.

10.0.402

You can build .NET 10.0 from the repository by cloning the release tag v10.0.402 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Commits viewable in compare view.

Updated ritten from 0.10.0 to 0.24.0.

Release notes

Sourced from ritten's releases.

0.24.0

Added

• JobOption.Set is public, so a host that builds a job's arguments itself can apply what the command line gave.

Changed

• An enum option given a value it doesn't take names the ones it does, e.g. '--kind' takes host or docker, not 'nope'.

0.23.0

Changed

• Every service is registered once at the start, and runs are scoped. Workflows and jobs no longer register services: the host composes its clients in Program.cs.
• Jobs run with a typed arguments model. Job<TArguments> replaces Job<TSettings>; each property reaches steps as a Run parameter of its type.
• Project values moved out of client options. DotNetBuildSettings, PackageRepository, ReleaseSettings, DockerImages and TofuModule are arguments now; GitOptions and NuGetOptions keep only what the environment sets.
• Clients are scoped to the run. Anything registered as a singleton that depends on one fails Build.
• A resource detector reads the application's services, not the run's.
• IGit acts on the repository each call names. Every method takes the repository first, and InRepository is gone.
• A command with no directory of its own runs in the project root inside a run, and in the process's directory outside one.

Added

• WorkflowApplication.Run(workflow, job, arguments, directory, options), for a host that chooses the job and its arguments itself, and WorkflowApplication.Workflows.
• JobCommand.Create and a public WorkflowFlags, for a host building its own command line from Ritten's commands.
• WorkflowRegistry.Add<T>() builds the workflow from the application's services, so it can take dependencies.
• services.AddGit() and services.AddCommandRunner() register the clients with any host's services, such as a background service's. Outside a run nothing is narrated.
• The command runner logs what it runs through ILogger: the executable, its directory and its exit code, never its arguments.

Removed

• WorkflowSettings, SettingsValidator, JobArgument, JobArguments, WorkflowRunBuilder and WorkflowRun. Use an arguments model, ArgumentsValidator, and WorkflowApplication.Run.

0.22.0

Fixed

• check and deploy work on pull requests in CI again. 0.21.0 unconditionally diffed every PR against the branch, which doesn't exist in a standard CI clone. It now fetches the base first if needed.

Added

• IGit.FetchMergeBase. Fetches a branch with enough history for ChangedFilesSince to compare against it.

Changed

• ReadShippedChanges and ShippedChanges moved to Ritten.NuGet, in the Ritten.Releases and Ritten.Releases.Steps namespaces, beside the release cadence that decides whether they measure anything. The step now reads the cadence from NuGetOptions, so a job using it needs AddNuGet.

0.21.0

Added

• OpenTelemetry support. Add a package reference to Ritten.OpenTelemetry, call builder.AddOpenTelemetry(otel => …) and set OTEL_EXPORTER_OTLP_ENDPOINT._
• RunContext.Id and RunContext.Url. The GitHub and Forgejo runtimes expose the URL to see the build logs.
• More of the file system. Last-write times, moving a directory, listing directories recursively, and IFileSystem.CreateTempDirectory.
• IDocker.ComposeConfig and IDocker.Exec.
• IGit.Tags, IGit.IsShallow and IGit.TrackedFiles.

Changed

• IDocker.Inspect returns null for a container that doesn't exist, rather than throwing.
• IFile, IDirectory and IFileSystem have new members.

0.20.1

Fixed

• Broken Forgejo link. The runner was reporting the address it connected with, rather than the public instance URL.

0.20.0

Added

• WriteAllText and ReadAllTextIfExists on every IFile. Writes are atomic by default.
• IFile.MoveTo, GetUnixFileMode and SetUnixFileMode, the primitives the atomic write is built from.

Changed

• IFile.OpenWrite truncates. It used to open an existing file without emptying it, so every whole-file writer carried the same SetLength(0) workaround; they all use WriteAllText now.

0.19.0

Added

• Ritten.NuGet. The feed client, NugetRead, CheckVersion, NugetAuthenticate, NugetPush, so a host composing its own jobs can check and publish packages without the tool.
• A continuous release cadence. release.cadence in ritten.json — curated or continuous. Under continuous every merge that changes what ships is a release, so a pull request that changes it must move the version.

0.18.0

Changed

• Empty reports no longer get commented. A run that stops early before any report section no longer gets posted as a comment on the PR.

0.17.0

Added

• ISecretProvider, the secrets provider a host registers. Resolve turns a reference into the secret it names.
• Ritten.OnePassword. The first provider: AddOnePassword() resolves op://vault/item/field references through the 1Password CLI, authenticated from the environment or a service-account token file.
• EnvironmentFile. Reads an env file the way docker compose --env-file does — NAME=value, comments, quotes — and resolves the references in it through the registered provider, so a file on disk holds the names of secrets and never a value.
• TofuEnvironment. The environment a root module is applied to: a variable file and env files, produced by a workflow's own step and read by every OpenTofu step after it.

Changed

• The OpenTofu client deploys to any environment. Init, Plan and Apply take the TofuEnvironment per call.
• TofuPlan produces its TofuPlanResult.

0.16.1

Fixed

• Ritten.OpenTofu is no longer missing. Forgot to include the project in ritten.json.

0.16.0

Added

• Ritten.OpenTofu. IOpenTofu over the tofu on the path, with TofuInit, TofuFormatCheck, TofuPlan and TofuApply steps.
• SectionName.Infrastructure. What a change would do, or did, to the infrastructure.
• Docker steps. ComposeCheck, BuildImages and ComposeUp in Ritten.Docker.
• IDocker.ComposeValidate. Resolves the compose file without touching anything, and hands back what compose objected to rather than a pass/fail.
• The tool registers the Forgejo runtime. ritten on a Forgejo runner now gets the job summary and the pull request comment Ritten.Forgejo already knew how to write.

0.15.0

Added

• Forgejo PR comments. Ritten.Forgejo now keeps one comment per workflow on the pull request under review.
• Better Forgejo envrionmen support. The runtime now reads the pull request's number and base ref from the run and registers a PullRequest info model.
• IGit.ChangedFilesSince. For checking what files have been changed in a given branch.

0.14.0

Added

• IDocker can stop and start a compose stack in place. ComposeStop/ComposeStart. Dry runs report the stop and start.

0.13.0

Added

• IGit.IsRepository. Whether the directory the client addresses is a working tree or inside one.
• Ritten.Forgejo. The Forgejo Actions runtime: detected on FORGEJO_ACTIONS, claiming the GITHUB_* mirrors the runner exports for GitHub-written workflows so it outranks the GitHub runtime where both are registered.
• Ritten.Docker. A docker client for workflows: IDocker builds, tags, pushes and logs in, runs a container to completion, and converges or removes a compose stack.

0.12.0

Added

• IGit can address a repository other than the workflow's. InRepository(directory) returns a client bound to that working tree, for a job that maintains a checkout beside its own.
• IGit commits and pushes. Stage, Commit, Push (with an optional GitCredential, handed to git through a one-shot credential helper in the environment so it never reaches the remote URL or an argument list), AddRemote, CurrentBranch, Upstream and CommitsAhead join the tagging operations. Dry runs report each write instead of making it.

0.11.0

Added

• Added shell auto-completion support through the completion command.

Fixed

• prepare no longer describes one version twice. A version whose packages had shipped in part was read as one that had never shipped at all, so prepare staged it a second time.
• Notes written after a prepare join the entry they belong to. Preparing a version the changelog already has an entry for now adds the unreleased notes to that entry rather than giving the version a second heading.

Commits viewable in compare view.

Updated System.CommandLine from 2.0.12 to 2.0.13.

Release notes

Sourced from System.CommandLine's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Verify.XunitV3 from 32.0.1 to 33.3.3.

Release notes

Sourced from Verify.XunitV3's releases.

33.3.3

• #​1965 Better WSL support

33.3.2

• #​1960 Reduce assembly size

33.3.1

• #​1953 Update to Argon 0.38.0

33.3.0

• #​1951 Paged documents: source and derived targets

33.2.0

• #​1943 Update NUnit to v5
• #​1947 Show a text diff in the exception message for a text mismatch

33.1.5

• #​1942 Bump DiffEngine and TUnit packages

33.1.4

• #​1940 Exclude TUnit CancellationToken parameters from snapshot naming

33.1.3

• #​1938 Withdraw a raised delete once its file is in use again

33.1.2

• #​1933 inline switch records fixes
• #​1934 Bump SponsorCheck to 0.26.0
• #​1936 Bump DiffEngine to 20.5.0
• #​1937 Settle by value

33.1.1

• #​1931 Bump SponsorCheck to 0.25.0

33.1.0

• #​1910 Allow custom converters to override built-in converters
• #​1930 Better Dangling snapshots detection

33.0.2

• #​1919 Update to SponsorCheck 0.24.0

33.0.1

• #​1918 Bump SponsorCheck to 0.23.0

33.0.0

The most impactful change in this release is the adoption of the Open Source Maintenance Fee.
So a subset of consumers will be required to sponsor the project

• #​1848 xunit3 v4
• #​1882 Sponsor check
• #​1883 Upgrade Argon to 0.36.0
• #​1884 Parse the built in ISO date format with the invariant culture
• #​1885 Fix appended file reuse
• #​1886 Rename the misnamed NUnit VerifyBase.ThrowsValueTask overload
• #​1887 Fix combination callbacks
• #​1888 Track verified files nested under the indexed target namespace
• #​1889 Overlap the two reads when comparing binary snapshots
• #​1890 Cache whether a type is a collection
• #​1891 Re-run WriteVerifyAttributes when the values change
• #​1892 Read VerifyResult.Text with the configured encoding
• #​1893 Validate UseTextForParameters as a file name
• #​1894 Guard TUnit parameter binding and null TestContext
• #​1895 Stop copied settings sharing mutations of the source serialization
• #​1896 Allow a recording to be started again once consumed
• #​1897 Format fallback parameter names with the invariant culture
• #​1898 Release named recording state on dispose
• #​1899 Compile the MSTest generator against the Roslyn version it is packed for
• #​1900 Resolve the OS platform on demand
• #​1901 Drop the null forgiving operator from generated TestContext getter
• #​1902 Describe the real Fixie setup in the No State found error
• #​1903 Run before callbacks from the file level InnerVerifier constructor
• #​1904 Never report the current process as locking a file
• #​1905 Always write an object for ClaimsPrincipal
• #​1906 Key the date scrubber caches on DateTimeFormat
• #​1907 Do not let a clipboard failure replace the snapshot diff
• #​1908 Format UTC offsets with invariant culture
• #​1909 Nest snapshots under razor parents and Content items
• #​1916 Bump DiffEngine to 20.3.0

33.0.0-beta.11

33.0.0-beta.10

33.0.0-beta.9

33.0.0-beta.8

33.0.0-beta.7

33.0.0-beta.6

33.0.0-beta.5

33.0.0-beta.4

33.0.0-beta.3

33.0.0-beta.1

Commits viewable in compare view.

Updated xunit.v3 from 4.0.1 to 4.0.2.

Release notes

Sourced from xunit.v3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

❌ Ritten

✅ Version

Version 0.24.0 is the latest published version; nothing new to release.

All 12 packages agree on 0.24.0.

✅ Metadata

All 12 packages carry everything a feed asks for.

✅ Changelog

New changes accrue under [Unreleased] until a release is prepared.

❌ Restore

The solution's packages failed to restore.

Restore output

error NU1902: Warning As Error: Package 'System.Security.Cryptography.Pkcs' 8.0.1 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-2fmv-rv2c-59x7
error NU1903: Warning As Error: Package 'System.Security.Cryptography.Pkcs' 8.0.1 has a known high severity vulnerability, https://github.com/advisories/GHSA-846f-f764-76mx

View the run logs

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml