Bump CancelCop.Analyzer and 4 others by dependabot[bot] · Pull Request #372 · VahidN/DNTCommon.Web.Core

dependabot · 2026-08-19T19:36:48Z

Updated CancelCop.Analyzer from 1.38.0 to 1.52.16.

Release notes

Sourced from CancelCop.Analyzer's releases.

1.52.16 Fixed

CC028 fixer: parenthesize await …Async(...) when the original File/Stream call is followed by ! (ReadAllText(p)!.Trim()). The fixer now uses the shared AwaitNeedsParentheses helper.

Validation

1442 tests on net10.0
Independent review vs origin/main (author grok-4.6; Claude clean)

NuGet publish is handled by publish.yml on this release.

1.52.15 Fixed

CC026 fixer: parenthesize await WaitAsync(...) when a bool-returning Wait is a receiver or is followed by !.
Withhold a rewrite when Wait sits on the left spine of a ?. WhenNotNull (holder?.Gate.Wait(1000)), which would otherwise emit unparseable await inside the ?. branch.

Validation

1440 tests on net10.0
Independent review vs origin/main (author grok-4.6; Codex gpt-5.4 fallback): no discrete compile/recursion/AD0001 bugs

NuGet publish is handled by publish.yml on this release.

1.52.14 Fixed

CC046 fixer: parenthesize await ExecuteReaderAsync(...) when the original call is a receiver or is followed by !. Without parentheses the await binds to .Dispose() on the Task.

NuGet publishing is handled by publish.yml.

1.52.13 Changed

CC044 fixer: rewrite Dns.GetHostEntry (string, string + AddressFamily, or IPAddress) to await GetHostEntryAsync, flowing an in-scope token when the rewritten call still binds to System.Net.Dns.
The IPAddress TAP is tokenless — the rewrite never invents a token.
The AddressFamily TAP has an optional token, so a tokenless rewrite still compiles.
Identifier-form using static rewrites that would bind a same-named helper are withheld.
Await-illegal positions are reported without a rewrite.
A numeric IP still reports (reverse DNS, not a parse).

NuGet publishing is handled by publish.yml.

1.52.12 Changed

CC043 fixer: rewrite Dns.GetHostAddresses (string, or string + AddressFamily) to await GetHostAddressesAsync, flowing an in-scope token when the rewritten call still binds to System.Net.Dns.
Tokenless fallback for the string TAP. The AddressFamily TAP has an optional token, so a tokenless rewrite still compiles.
Identifier-form using static rewrites that would bind a same-named helper are withheld.
Await-illegal positions are reported without a rewrite.
Dns is a static type. Compile-time constant IP literals stay quiet.

NuGet publishing is handled by publish.yml.

1.52.11 Changed

CC042 fixer: rewrite NamedPipeClientStream.Connect ((), int, TimeSpan) to await ConnectAsync, flowing an in-scope token when the rewritten call still binds.
Tokenless fallback for parameterless and int timeouts.
Connect(TimeSpan) without a token is reported without a rewrite (no tokenless TAP).
Null-conditional and await-illegal positions are reported without a rewrite.
NamedPipeClientStream is sealed.

NuGet publishing is handled by publish.yml.

1.52.10 Changed

CC041 fixer: rewrite NamedPipeServerStream.WaitForConnection() to await WaitForConnectionAsync, flowing an in-scope token when the rewritten call still binds.
Tokenless fallback when no token is in scope.
Null-conditional and await-illegal positions are reported without a rewrite.
NamedPipeServerStream is sealed.

NuGet publishing is handled by publish.yml.

1.52.9 Added

CC040 fixer rewrites a blocking HttpListener.GetContext() to await GetContextAsync(). The framework TAP is tokenless, so the rewrite never invents a token argument. Null-conditional calls and positions where await cannot compile are reported without a rewrite. HttpListener is sealed.

1390 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.8 Added

CC039 fixer rewrites a discarded UdpClient.Receive(ref endpoint) statement to var received = await ReceiveAsync(...) plus endpoint = received.RemoteEndPoint, flowing an in-scope CancellationToken when the rewritten call still binds. The TAP returns UdpReceiveResult and does not take the ref endpoint, so a value-use of the byte[] is reported without a rewrite. A braceless if/while body, null-conditional calls, await-illegal positions, and a this/base/this-alias call inside ReceiveAsync are reported without a rewrite.

1382 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.7 Added

CC038 fixer rewrites a blocking TcpListener.AcceptTcpClient / AcceptSocket to await AcceptTcpClientAsync / await AcceptSocketAsync, flowing an in-scope CancellationToken when the rewritten call still binds. The tokenless form is used when no token is in scope. Null-conditional calls, positions where await cannot compile, and a this/base/this-alias call (including a cast or as of this) inside the matching Accept*Async are reported without a rewrite. Unusable TAP hiders stay quiet.

1368 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.6 Added

CC037 fixer rewrites a blocking TcpClient.Connect to await ConnectAsync, flowing an in-scope CancellationToken when the rewritten call still binds. The tokenless form is used when no token is in scope. A named original argument keeps the token named when those names still bind (remoteEP:). Connect(hostname: …) is reported without a rewrite because ConnectAsync names that parameter host. Null-conditional calls, positions where await cannot compile, and a this/base/this-alias call inside ConnectAsync are reported without a rewrite.

1351 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.5 Added

CC049 fixer rewrites a blocking SmtpClient.Send (MailMessage or four strings) to await SendMailAsync, flowing an in-scope CancellationToken when the rewritten call still binds. Named original arguments keep the token named. Not the event-based SendAsync. A this/base call or this-alias inside a matching SendMailAsync is reported without a rewrite so the TAP entry cannot recurse.

1339 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.4 Added

CC048 fixer rewrites a blocking DbCommand.ExecuteScalar() to await ExecuteScalarAsync, flowing an in-scope CancellationToken when the rewritten call still binds to a Task<T> TAP method. The await is parenthesized when the result is used as a receiver, including through !. A this/base call or this-alias (local, field, property, nested capture) inside ExecuteScalarAsync is reported without a rewrite so the public TAP entry cannot recurse. A covariant TAP value-use falls back to the parameterless form so outer overloads cannot retarget.

1323 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.3 Added

CC047 fixer rewrites a blocking DbCommand.ExecuteNonQuery() to await ExecuteNonQueryAsync, flowing an in-scope CancellationToken when the rewritten call still binds to a Task<int> TAP method. The await is parenthesized when the result is used as a receiver. A this/implicit-this call inside ExecuteNonQueryAsync is reported without a rewrite so the public TAP entry cannot recurse.

1291 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.2 Added

CC046 fixer rewrites a blocking DbCommand.ExecuteReader / ExecuteReader(CommandBehavior) to await ExecuteReaderAsync, preserving the behavior argument and flowing an in-scope CancellationToken when the rewritten call still binds to a reader-returning TAP method. Named behavior: arguments keep the token named. Provider new TAP hiders still match (ExecuteReaderAsync() / token form are not virtual). Null-conditional calls, await-illegal positions, and token-required-only counterparts with no token in scope are reported without a fix.

1276 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.1 Added

CC045 fixer rewrites a blocking DbConnection.Open() to await OpenAsync, flowing an in-scope CancellationToken when the rewritten call still binds (including provider overrides). Parameterless OpenAsync() is used when no token is in scope. Null-conditional calls and positions where await cannot compile are reported without a fix.

1253 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.0 Added

CC049 (BlockingSmtpClientAnalyzer) flags blocking SmtpClient.Send in async code (MailMessage and the four-string overload).

Send parks a pool thread on an SMTP handshake. The TAP counterpart is SendMailAsync, not the event-based SendAsync. Token-taking SendMailAsync is .NET 5+; .NET Framework has the tokenless form. Send is not virtual; new hiders match by inheritance plus the framework shape.

1239 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.51.0 Added

CC048 (BlockingDbScalarAnalyzer) flags blocking DbCommand.ExecuteScalar in async code.

ExecuteScalar parks a pool thread on a single-value query. ExecuteScalarAsync yields and has accepted a CancellationToken since .NET Framework 4.5. Overrides and new hiders match by inheritance plus the framework shape (instance, arity 0, non-void return, no parameters), including a more-derived string return. Task/ValueTask hiders and Task-derived hiders stay quiet. CC046 is ExecuteReader; CC047 is ExecuteNonQuery.

1225 tests passing. 48 diagnostics. NuGet publishing is handled by the release workflow.

1.50.0 Added

CC047 (BlockingDbNonQueryAnalyzer) flags blocking DbCommand.ExecuteNonQuery in async code.

ExecuteNonQuery parks a pool thread on a command that does not return rows. ExecuteNonQueryAsync yields and has accepted a CancellationToken since .NET Framework 4.5. Overrides and new hiders match by inheritance plus the framework shape (instance, arity 0, int return, no parameters). Look-alikes, IDbCommand, generic helpers, and ExecuteScalar stay quiet. CC046 is ExecuteReader only.

1208 tests passing. 47 diagnostics. NuGet publishing is handled by the release workflow.

1.49.0 Added

CC046 (BlockingDbCommandAnalyzer) flags blocking DbCommand.ExecuteReader in async code (parameterless and CommandBehavior).

ExecuteReader parks a pool thread on a database query. ExecuteReaderAsync yields and has accepted a CancellationToken since .NET Framework 4.5. ExecuteReader is not virtual — providers hide it with new for a covariant reader — so the rule matches inheritance plus the framework shape (instance, arity 0, DbDataReader return, parameterless or one CommandBehavior). Look-alikes, IDbCommand, generic helpers, and ExecuteNonQuery stay quiet. CC003 is EF Core; CC045 is Open.

1193 tests passing. 46 diagnostics. NuGet publishing is handled by the release workflow.

1.48.0 Added

CC045 (BlockingDbConnectionAnalyzer) flags blocking DbConnection.Open in async code.

Open parks a pool thread on a database handshake. OpenAsync yields and has accepted a CancellationToken since .NET Framework 4.5. Concrete providers match through the override chain. CC003 is EF Core only.

1177 tests passing. 45 diagnostics. NuGet publishing is handled by the release workflow.

1.47.0 Added

CC044 (BlockingDnsGetHostEntryAnalyzer) flags blocking Dns.GetHostEntry in async code.

GetHostEntry parks a pool thread on a DNS query, including reverse lookup of a numeric IP. GetHostEntryAsync yields; on modern .NET the string overloads take a CancellationToken. The IPAddress async form is tokenless. CC043 is GetHostAddresses only — a numeric IP is not exempt here.

1169 tests passing. 44 diagnostics. NuGet publishing is handled by the release workflow.

1.46.1 Changed

CC043 stays quiet when the host argument is a compile-time constant IP ("127.0.0.1", "::1", const local). Those are parses, not DNS queries. IPv4 matching is host-independent (four octets, no leading zeros). "localhost", leading-zero IPv4, and non-const locals still report.

1160 tests passing. 43 diagnostics. NuGet publishing is handled by the release workflow.

1.46.0 Added

CC043 (BlockingDnsAnalyzer) flags blocking Dns.GetHostAddresses in async code.

GetHostAddresses parks a pool thread on a DNS query. GetHostAddressesAsync yields; on modern .NET it takes a CancellationToken. .NET Framework has the tokenless form. CC002 cannot see this method (no token overload). CC036–CC042 are Socket/Tcp/Udp/HttpListener/named-pipe; DNS produced zero diagnostics from every shipped rule.

1151 tests passing. 43 diagnostics. NuGet publishing is handled by the release workflow.

1.45.0 Added

CC042 (BlockingNamedPipeClientAnalyzer) flags blocking NamedPipeClientStream.Connect in async code.

Connect parks a pool thread until the server accepts (or a timeout elapses). ConnectAsync yields; on modern .NET it takes a CancellationToken. The rule stays quiet where ConnectAsync is absent. CC041 is the server accept wait; the client produced zero diagnostics from every shipped rule.

1144 tests passing. 42 diagnostics. NuGet publishing is handled by the release workflow.

1.44.0 Added

CC041 (BlockingNamedPipeAnalyzer) flags blocking NamedPipeServerStream.WaitForConnection in async code.

WaitForConnection parks a pool thread until a client connects. WaitForConnectionAsync yields; on modern .NET it takes a CancellationToken. CC028 maps File/Stream Read/Write/CopyTo/Flush only; CC036–CC040 are Socket/TcpClient/TcpListener/UdpClient/HttpListener; the named-pipe server produced zero diagnostics from every shipped rule.

1136 tests passing. 41 diagnostics. NuGet publishing is handled by the release workflow.

1.43.0 Added

CC040 (BlockingHttpListenerAnalyzer) flags blocking HttpListener.GetContext in async code.

GetContext parks a pool thread until a request arrives. GetContextAsync yields (it does not take a token). CC036–CC039 are Socket/TcpClient/TcpListener/UdpClient; the HTTP listener produced zero diagnostics from every shipped rule.

1130 tests passing. 40 diagnostics. NuGet publishing is handled by the release workflow.

1.42.0 Added

CC039 (BlockingUdpClientAnalyzer) flags blocking UdpClient.Receive in async code.

Receive parks a pool thread until a datagram arrives. ReceiveAsync yields and accepts a token on modern .NET. CC036 is Socket-only, CC037 is TcpClient.Connect, and CC038 is TcpListener accept; the UDP wrapper produced zero diagnostics from every shipped rule.

if (client.Available > 0), while (Available > 0), the inverted poll (if (Available == 0) continue; then receive), and client.Client.Blocking = false stay quiet.

1124 tests passing. 39 diagnostics. NuGet publishing is handled by the release workflow.

1.41.1 Changed

CC038 now reports AcceptTcpClient / AcceptSocket when the Pending() guard is negated.

if (!listener.Pending()) AcceptTcpClient() is the blocking path (no client is queued). if (Pending() == false) is the same. A positive probe stays quiet: if (Pending()), while (Pending()), while (flag && Pending()), Pending() is true, if (!Pending()) { } else Accept, and the inverted poll (if (!Pending()) continue/return; then accept).

1103 tests passing. 38 diagnostics. NuGet publishing is handled by the release workflow.

1.41.0 Added

CC038 (BlockingTcpListenerAnalyzer) flags blocking TcpListener.AcceptTcpClient and AcceptSocket in async code.

Both park a pool thread until a client connects. Accept*Async yields and accepts a token on modern .NET. CC036 is Socket-only and CC037 is TcpClient.Connect; the listener path produced zero diagnostics from every shipped rule.

if (listener.Pending()) and listener.Server.Blocking = false stay quiet. Reassignment / ref/out invalidate the exemption.

1091 tests passing. 38 diagnostics. NuGet publishing is handled by the release workflow.

1.40.0 Added

CC037 (BlockingTcpClientAnalyzer) flags blocking TcpClient.Connect in async code.

Connect parks a pool thread until the handshake finishes or TCP times out. ConnectAsync yields and accepts a token on modern .NET. CC036 already covers Socket.Connect; application code almost always uses the TcpClient wrapper, which none of the 36 shipped rules reported.

Hostname Connect still reports after Client.Blocking = false (synchronous DNS). The non-blocking exemption applies only to IP/endpoint overloads on a simple local, parameter, or field.

1076 tests passing. 37 diagnostics. NuGet publishing is handled by the release workflow.

1.39.4 Changed

CC031 now flags ReaderWriterLock.UpgradeToWriterLock in async code.

The v1.39.3 slice covered Acquire*Lock but left the upgrade path silent. UpgradeToWriterLock parks on contention, including the zero-timeout form: a failed upgrade restores the read lock with Timeout.Infinite. Acquire*Lock(0) remains a try-acquire.

1051 tests passing. 36 diagnostics. NuGet publishing is handled by the release workflow.

1.39.3 Changed

CC031 now flags ReaderWriterLock.AcquireReaderLock / AcquireWriterLock in async code.

The pre-Slim lock is not a WaitHandle and has no …Async counterpart, so the previous type map never saw it. Acquire*Lock(Timeout.Infinite) is an unbounded wait. A zero timeout is a non-blocking try-acquire and stays quiet.

// ❌ CC031
public async Task ReadAsync(ReaderWriterLock gate)
{
    gate.AcquireReaderLock(Timeout.Infinite);
    try { await Task.Yield(); }
    finally { gate.ReleaseReaderLock(); }
}

1049 tests passing. 36 diagnostics. NuGet publishing is handled by the release workflow.

1.39.2 Changed

CC031 now flags Barrier.SignalAndWait in async code.

Barrier is not a WaitHandle and has no …Async counterpart, so the previous type map never saw it. SignalAndWait parks every participant until the last one arrives. Zero-timeout overloads still report: the last arriver runs the post-phase action synchronously before returning.

// ❌ CC031
public async Task RendezvousAsync(Barrier barrier)
{
    barrier.SignalAndWait();
    await Task.Yield();
}

1044 tests passing. 36 diagnostics. NuGet publishing is handled by the release workflow.

1.39.1 Changed

CC031 now flags ReaderWriterLockSlim.Enter*Lock and TryEnter*Lock in async code.

Those members park a thread-pool thread and have no …Async counterpart, but they are not WaitHandle methods, so the previous type map never saw them. TryEnterWriteLock(Timeout.Infinite) is an unbounded enter. Zero-timeout TryEnter probes, look-alikes, and synchronous methods stay quiet.

// ❌ CC031 — parks a pooled thread until every writer exits
public async Task ReadAsync(ReaderWriterLockSlim gate)
{
    gate.EnterReadLock();
    try { await Task.Yield(); }
    finally { gate.ExitReadLock(); }
}

// ❌ CC031 — Timeout.Infinite is EnterWriteLock by another name
if (gate.TryEnterWriteLock(Timeout.Infinite)) { ... }

// ✅ zero-timeout probe stays quiet
_ = gate.TryEnterReadLock(0);

1038 tests passing. 36 diagnostics. NuGet publishing is handled by the release workflow.

1.39.0 Framework cancellation tokens are now in-scope

HttpContext.RequestAborted and ServerCallContext.CancellationToken participate in the shared token walk that powers CC002/CC003/CC004 and sibling rules (CC009, CC010, CC012, CC013, CC026, CC028, CC029, CC030, CC034). A CancellationToken parameter still wins when both exist.

// ❌ CC004 — RequestAborted is in scope but not passed
public async Task InvokeAsync(HttpContext context)
{
    return await _http.GetStringAsync(url);
}

// ✅
public async Task InvokeAsync(HttpContext context)
{
    return await _http.GetStringAsync(url, context.RequestAborted);
}

CC001 skips convention middleware Invoke / InvokeAsync(HttpContext). Adding a token parameter is not injected by the pipeline and can throw at runtime. Use RequestAborted instead. Closes the remaining half of #1.

Code fixes emit member-access expressions (context.RequestAborted), not dotted identifiers. CC028's speculative bind uses the same expression so blocking file I/O in middleware is no longer silent.

1030 tests passing. Focused Stryker.NET on the walk at 96% mutation score. 36 diagnostics.

Commits viewable in compare view.

Updated iTextSharp.LGPLv2.Core from 3.8.4 to 3.8.5.

Release notes

Sourced from iTextSharp.LGPLv2.Core's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.19.

Release notes

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 19, 2026

1.52.16

Fixed

Validation

1.52.15

Fixed

Validation

1.52.14

Fixed

1.52.13

Changed

1.52.12

Changed

1.52.11

Changed

1.52.10

Changed

1.52.9

Added

1.52.8

Added

1.52.7

Added

1.52.6

Added

1.52.5

Added

1.52.4

Added

1.52.3

Added

1.52.2

Added

1.52.1

Added

1.52.0

Added

1.51.0

Added

1.50.0

Added

1.49.0

Added

1.48.0

Added

1.47.0

Added

1.46.1

Changed

1.46.0

Added

1.45.0

Added

1.44.0

Added

1.43.0

Added

1.42.0

Added

1.41.1

Changed

1.41.0

Added

1.40.0

Added

1.39.4

Changed

1.39.3

Changed

1.39.2

Changed

1.39.1

Changed

1.39.0

Framework cancellation tokens are now in-scope

9.0.19

What's Changed

9.0.18