Skip to content

Bump the tests group with 8 updates - #380

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/src/DNTCommon.Web.Core.Tests/tests-8191e82395
Open

Bump the tests group with 8 updates#380
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/src/DNTCommon.Web.Core.Tests/tests-8191e82395

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 26, 2026

Copy link
Copy Markdown
Contributor

Updated CancelCop.Analyzer from 1.38.0 to 1.52.51.

Release notes

Sourced from CancelCop.Analyzer's releases.

1.52.51

Changed

  • Package version synced to the release train; consolidated changelog backfill for the docs/test-only interim tags (1.52.47–1.52.50), split into per-tag entries with corrected dates.
  • Health-doc baseline updated.

Validation

  • 1587 tests on net10.0
  • Independent codex CLI review across multiple passes; APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.50

Tests

  • Completes the CC036 Socket arity-matrix pins:
    • SendFile(path) → SendFileAsync(path, ct) binds on modern .NET and is now a pinned rewrite.
    • ReceiveMessageFrom(buffer, offset, count, ref flags, ref remote, out ipPacketInformation) stays unfixed: the TAP form takes flags/endpoint by value and returns a result struct — a parameter-modifier/result-shape mismatch the verbatim argument copy cannot bridge.

Validation

  • 1587 tests on net10.0
  • Independent codex CLI review; APPROVED

1.52.49

Tests / Docs

  • Pins CC036 Disconnect(false) → DisconnectAsync(false, ct) (modern .NET adds the arity).
  • Pins that ReceiveFrom(buffer, ref remote) stays unfixed — the sync call passes the endpoint by ref while the TAP form takes it by value and returns the resolved endpoint; a correct rewrite needs hand-written code.
  • Adds the CC053 analyzer-only sample entry and refreshes the sample index.

Validation

  • 1585 tests on net10.0
  • Independent codex CLI review; APPROVED

1.52.48

Tests

  • Pins two more CC036 fixer mappings verified against the net9 ref pack: Accept() → AcceptAsync(ct) and Connect(host, port) → ConnectAsync(host, port, ct). The provider is member-generic, so these already worked — now they are pinned against regressions.

Validation

  • 1572 tests on net10.0
  • Independent codex CLI review; APPROVED

1.52.47

Documentation

  • Sample project entries for the three newest blocking-family rules: CC050 (Ping), CC051 (SslStream), CC052 (WebRequest) — each with violation, fixed, and clean shapes.
  • Sample index header refreshed (was stale since CC029); documents that CC053 is analyzer-only.

Validation

  • dotnet build samples/CancelCop.Sample: clean; suite 1572 green at merge.
  • Independent codex CLI review; APPROVED

1.52.46

Added

  • CC036 gets its first code fix: blocking Socket Receive/Send/Connect calls now rewrite wherever a compiling TAP arity exists — byte[] Receive/Send via the implicit Memory<byte> conversion (await socket.ReceiveAsync(buffer, ct)), flag-bearing sends via SendAsync(..., SocketFlags, ct), endpoint connects via ConnectAsync(EndPoint, ct). Every candidate is proven by speculative rebind with override-walk lineage to framework Socket; arities with no compiling form stay reported without a rewrite; null-conditional spines hoist; await-unsafe contexts are withheld.

Validation

  • 1581 tests on net10.0 (6 new CC036 fixer tests)
  • Independent codex CLI review across multiple passes; APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.45

Tests

  • The cross-analyzer clean-code false-positive guard now exercises clean TAP shapes for the newest blocking rules: SendPingAsync(IPAddress, TimeSpan, byte[], PingOptions, ct) and TcpClient.ConnectAsync(host, port, ct) must stay quiet across every shipped analyzer.

Validation

  • 1572 tests on net10.0
  • Independent codex CLI review; APPROVED

1.52.44

Tests

  • Two CC009 fixer regression pins, both previously verified only by hand:
    • A brace-less single-statement loop body is wrapped in a block with ct.ThrowIfCancellationRequested() inserted first — the check executes every iteration.
    • Nested loops without checks each report and each get their own check after fixing; insertion is scoped per diagnostic.

Validation

  • 1572 tests on net10.0
  • Independent codex CLI review; APPROVED

1.52.43

Changed

  • Refactor (behavior-neutral): the symbol-or-single-candidate method-group handler resolution duplicated between MinimalApiAnalyzer and MinimalApiCodeFixProvider now lives in one shared helper (CancellationTokenHelpers.ResolveMethodGroupHandler), so analyzer and fixer matching can never drift. Closes the last open P2 backlog item.

Validation

  • 1570 tests on net10.0; all 42 Minimal API tests pass unchanged.
  • Independent codex CLI review; APPROVED

1.52.42

Added

  • New rule CC053: flags blocking Thread.Join() / Join(int) / Join(TimeSpan) inside async code (Warning). Joining a raw thread parks a pool thread for an unbounded or timeout-bounded wait — a deadlock risk under a starving pool.
  • Analyzer-only by design, verified against the net9.0.19 and net10.0.11 ref packs: System.Threading.Thread declares only those three non-virtual overloads and no TAP JoinAsync on any shipped .NET, and is sealed. Every diagnostic reports without a rewrite; prefer awaiting the task that represents the work.
  • Symbol-gated to framework Thread; look-alikes, other member names, escaped @​Join spellings covered; provably-zero timeout probes (Join(0), Join(TimeSpan.Zero)) stay quiet per CC031 parity.

Changed

  • CC031: Thread.Join moved out of the sync-primitive family into the dedicated CC053 so each join call reports exactly once. CC031 now covers ManualResetEventSlim.Wait, CountdownEvent.Wait, WaitHandle.WaitOne/WaitAll/WaitAny, Monitor.Wait, the ReaderWriterLockSlim/ReaderWriterLock families, and Barrier.SignalAndWait.
  • Rule count: 53.

Validation

  • 1570 tests on net10.0
  • Independent codex CLI review across multiple passes; APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.41

Documentation

  • Full docs audit: NEXT_STEPS.md updated from a stale 29-rule claim to the current 52 rules (CC001–CC006, CC009–CC052), with the family overview now listing every shipped rule including the unawaited-call (CC032), CTS-field (CC033), ParallelOptions (CC034), and empty-catch (CC035) rules.
  • README Project Quality test total refreshed to the actual 1,500+ suite (1,558 tests).
  • Verified cross-document consistency: README rule table (52 rows), AnalyzerReleases.Shipped.md, ANALYZER_HEALTH scorecard and verification baselines, package Description/release notes, CHANGELOG.

Validation

  • 1558 tests on net10.0
  • Sample project builds clean against all rules
  • Independent codex CLI review across two passes; APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.40

Added

  • New rule CC052: flags blocking WebRequest.GetResponse() inside async code (Warning, code fix). The TAP counterpart is the virtual parameterless GetResponseAsync() — verified against the net9 ref pack; no CancellationToken arity exists anywhere in the family, so rewrites are honestly tokenless.
  • Symbol-gated to System.Net.WebRequest; both GetResponse and GetResponseAsync are virtual, so legitimate overrides keep coverage through the .OverriddenMethod lineage walk while unrelated same-named members are rejected. APM BeginGetResponse/EndGetResponse never count as counterparts.
  • Null-conditional spines hoist via NullConditionalHoist; lock/unsafe positions and self-calls inside a GetResponseAsync-shaped member on a derived type are reported without a fix.
  • Rule count: 52.

Validation

  • 1558 tests on net10.0
  • Independent codex CLI review across two passes; APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.39

Added

  • New rule CC051: flags blocking SslStream.AuthenticateAsClient(...) inside async code (Warning, code fix). TLS handshakes park the calling thread for multiple network round trips.
  • Symbol-gated to System.Net.Security.SslStream through the override walk; look-alike types, other member names (including the APM BeginAuthenticateAsClient pair), and sync methods stay quiet.
  • Fixer rewrites a safe call to await AuthenticateAsClientAsync. Verified against the net9 ref pack: only the SslClientAuthenticationOptions arity accepts a CancellationToken, so string-arity rewrites are honestly tokenless even with a token in scope; token flow is exercised on the options arity. Null-conditional spines hoist via NullConditionalHoist.
  • Inside an AuthenticateAsClientAsync-shaped member on an SslStream-derived type, a fix is offered only when the receiver is provably fresh (new SslStream(...)); every other receiver is withheld so the rewrite can never virtually dispatch back into the enclosing member.
  • Rule count: 51.

Validation

  • 1544 tests on net10.0
  • Independent codex CLI review across multiple passes; APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.38

Added

  • New rule CC050: flags blocking System.Net.NetworkInformation.Ping.Send inside async code (Warning, code fix). The TAP counterpart is SendPingAsync — Ping's event-based SendAsync is deliberately not treated as one.
  • Symbol-gated to framework Ping through the override walk; look-alike types with their own Send/SendPingAsync, EAP SendAsync calls, and sync methods stay quiet.
  • Fixer rewrites a safe Send to await SendPingAsync. Token flow only when the rewritten call speculatively rebinds (the token-taking overloads exist on the TimeSpan arity, modern .NET only); otherwise the honest tokenless rewrite. Null-conditional statement spines hoist via the shared NullConditionalHoist; lock/unsafe positions and bare self-calls inside a SendPingAsync member are reported without a fix.
  • Rule count: 50.

Validation

  • 1520 tests on net10.0 (10 new CC050 analyzer/fixer tests)
  • Independent codex CLI review across four passes; APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.37

Fixed

  • CC013 fixer: Thread.Sleep(millisecondsTimeout: n) was rewritten to Task.Delay(millisecondsTimeout: n, ct), which fails to compile with CS1739 — Task.Delay names the parameter millisecondsDelay (int) / delay (TimeSpan). The rewrite now strips name colons and binds positionally, which is valid for every Delay overload the rule can reach.

Added

  • CC013 fixer pins for TimeSpan, named-argument, and Timeout.InfiniteTimeSpan arguments, each verifying token flow into the awaited call.

Validation

  • 1508 tests on net10.0
  • Independent codex CLI review across two passes; APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.36

Changed

  • CC028 fixer: null-conditional statement spines now rewrite instead of being withheld. reader?.ReadLine(); becomes if (reader is not null) { await reader.ReadLineAsync(ct); }; chained spines like holder?.Reader.ReadLine(); splice the operation under the receiver.
  • Covers StreamReader ReadLine/ReadToEnd, StreamWriter Write/WriteLine/Flush, and the Stream primitives; an in-scope token flows into the awaited call.
  • NoFix reasons re-ordered: renamed-parameter calls (named-argument-mismatch) and await-forbidden contexts (lock bodies, unsafe) stay unfixable even on a ?. spine — the hoist lands in the same context and copies arguments verbatim. A conditional-access diagnostic the hoist cannot apply stays fix-free instead of falling through to an invalid in-place rewrite.

Validation

  • 1505 tests on net10.0
  • Independent codex CLI review across two passes; APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.35

Changed

  • CC042 fixer: null-conditional Connect(...) statements now rewrite instead of being withheld. pipe?.Connect(); becomes if (pipe is not null) { await pipe.ConnectAsync(cancellationToken); }, and chained spines like host?.Pipe.Connect(); splice the pipe into the awaited call.
  • Candidate ordering (cancellable first, tokenless fallback) with per-candidate speculative rebind requiring the framework ConnectAsync on System.IO.Pipes.NamedPipeClientStream; non-token parameters must mirror the original Connect arguments.

Validation

  • 1499 tests on net10.0
  • Independent codex CLI review across two passes (parameter-count gate); APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.34

Changed

  • CC041 fixer: null-conditional WaitForConnection() statements now rewrite instead of being withheld. pipe?.WaitForConnection(); becomes if (pipe is not null) { await pipe.WaitForConnectionAsync(cancellationToken); }, and chained spines like host?.Pipe.WaitForConnection(); splice the pipe into the awaited call.
  • Candidate ordering (cancellable first, parameterless fallback) with per-candidate speculative rebind — hidden unrelated members withhold the rewrite.

Validation

  • 1497 tests on net10.0
  • Independent codex CLI review across three passes (tokenless fallback ordering, leftover debug throw); APPROVED

NuGet publish is handled by publish.yml on this release.

1.52.33

Changed

  • CC048 fixer: null-conditional ExecuteScalar() statements now rewrite instead of being withheld. command?.ExecuteScalar(); becomes if (command is not null) { await command.ExecuteScalarAsync(cancellationToken); }, and chained spines like host?.Command.ExecuteScalar(); splice the command into the awaited call.
  • Candidate ordering (cancellable first, tokenless fallback) with per-candidate override-chain validation — hidden unrelated members withhold the rewrite; provider overrides qualify via inheritance.

Validation

  • 1495 tests on net10.0
  • Independent codex CLI review across three passes (unsafe-overload acceptance, provider overrides, candidate ordering); APPROVED

NuGet publish is handled by publish.yml (release event + per-tag dispatch) on this release.

1.52.32

Changed

  • CC047 fixer: null-conditional ExecuteNonQuery() statements now rewrite instead of being withheld. command?.ExecuteNonQuery(); becomes if (command is not null) { await command.ExecuteNonQueryAsync(cancellationToken); }, and chained spines like host?.Command.ExecuteNonQuery(); splice the command into the awaited call.
  • A speculative rebind requires a Task-returning ExecuteNonQueryAsync whose override chain reaches the framework's DbCommand.ExecuteNonQueryAsync — hidden unrelated members withhold the rewrite.
  • Self-recursion guard now recognizes member-binding receivers on a this spine (this?.ExecuteNonQuery() inside an ExecuteNonQueryAsync override stays unfixed), including parenthesized forms; other-receiver spines still get the safe fix.

Validation

  • 1494 tests on net10.0
  • Independent codex CLI review across five passes (Task shape validation, override-chain walk, this-spine scoping with parentheses, unrelated-overload hiders); all findings addressed

NuGet publish is handled by publish.yml on this release.

1.52.31

Changed

  • CC046 fixer: null-conditional ExecuteReader() statements now rewrite instead of being withheld. command?.ExecuteReader(); becomes if (command is not null) { await command.ExecuteReaderAsync(cancellationToken); }, and chained spines like host?.Command.ExecuteReader(); splice the command into the awaited call.
  • A speculative rebind requires the framework's Task-shaped ExecuteReaderAsync; hidden unrelated members withhold the rewrite.

Validation

  • 1489 tests on net10.0
  • Independent codex CLI review across two passes (reader-shaped result validation); APPROVED

NuGet publish is handled by publish.yml on this release.

1.52.30

Changed

  • CC040 fixer: null-conditional GetContext() statements now rewrite instead of being withheld. listener?.GetContext(); becomes if (listener is not null) { await listener.GetContextAsync(); }, and chained spines like host?.Listener.GetContext(); splice the listener into the awaited call.
  • GetContextAsync is tokenless, so the hoist never invents a token argument; a speculative rebind withholds the rewrite when a subclass hides GetContextAsync with a non-awaitable member.

Validation

  • 1489 tests on net10.0
  • Independent codex CLI review: APPROVED

NuGet publish is handled by publish.yml on this release.

1.52.29

Changed

  • CC038 fixer: null-conditional AcceptTcpClient() / AcceptSocket() statements now rewrite instead of being withheld. listener?.AcceptTcpClient(); becomes if (listener is not null) { await listener.AcceptTcpClientAsync(cancellationToken); }, and chained spines like host?.Listener.AcceptTcpClient(); splice the listener into the awaited call.
  • The cancellable form is preferred with a parameterless fallback, and a speculative rebind withholds the rewrite when a subclass hides the Accept*Async member with a non-awaitable one.

Validation

  • 1487 tests on net10.0
  • Independent codex CLI review across three passes (leftover throw, tokenless fallback); APPROVED

NuGet publish is handled by publish.yml on this release.

1.52.27

Changed

  • CC037 fixer: null-conditional Connect(...) statements now rewrite instead of being withheld. client?.Connect(host, port); becomes if (client is not null) { await client.ConnectAsync(host, port, cancellationToken); }, and chained spines like wrapper?.Client.Connect(...) splice the client into the awaited call.
  • The in-scope token is re-resolved by the fixer; positional, named, and tokenless forms are tried in priority order with speculative rebinding requiring the framework's ConnectAsync on System.Net.Sockets.TcpClient.

Validation

  • 1487 tests on net10.0
  • Independent codex CLI review across four passes (exact binding, tokenless fallback, named-token form); APPROVED

NuGet publish is handled by publish.yml on this release.

1.52.26

Changed

  • CC045 fixer: null-conditional Open() statements now rewrite instead of being withheld. connection?.Open(); becomes if (connection is not null) { await connection.OpenAsync(cancellationToken); }, and chained spines like host?.Connection.Open(); splice the operation into the awaited call.
  • Shared hoist machinery: extracted TryPrepareHoistedCall into NullConditionalHoist; new hoists build on it, keeping spine detection, terminality, receiver resolution, and splicing in one place.
  • The rebind check walks the override chain so provider OpenAsync overrides qualify while unrelated hiders do not.

Validation

  • 1484 tests on net10.0
  • Independent codex CLI review across two passes (override-chain walk, changelog accuracy); APPROVED

NuGet publish is handled by publish.yml on this release.

1.52.25

Changed

  • CC049 fixer: null-conditional Send(...) statements now rewrite instead of being withheld. client?.Send(message); becomes if (client is not null) { await client.SendMailAsync(message, cancellationToken); }, and chained spines like smtp?.Client.Send(message); splice the client into the awaited call.
  • The in-scope token is re-resolved by the fixer (the analyzer drops it for spine shapes) and appended positionally or by the counterpart's own token-parameter name; a tokenless fallback covers .NET Framework's SendMailAsync.
  • A speculative rebind validates the emitted call against the analyzer's counterpart-shape rules (Task return, non-token parameters mirroring the Send signature, accessible within the compilation), withholding hidden non-awaitable members.

Validation

  • 1482 tests on net10.0
  • Independent codex CLI review across six passes (signature-shape validation, containing-type equality, tokenless fallback, named-token resolution, detached-node type lookup, accessibility); all findings addressed or documented

NuGet publish is handled by publish.yml on this release.

1.52.24

Changed

  • CC030 fixer: null-conditional WaitForExit() statements now rewrite instead of being withheld. process?.WaitForExit(); becomes if (process is not null) { await process.WaitForExitAsync(cancellationToken); }, and chained spines like host?.Child.WaitForExit(); splice the operation into the awaited call.
  • A speculative rebind withholds the rewrite when a subclass hides WaitForExitAsync with a non-awaitable member; the parameterless fallback carries over from the direct-path fix.

Validation

  • 1478 tests on net10.0
  • Independent codex CLI review across two passes (exact-emitted-invocation binding); APPROVED

NuGet publish is handled by publish.yml on this release.

1.52.23

Changed

  • CC026 fixer: null-conditional Wait() statements now rewrite instead of being withheld. gate?.Wait(); becomes if (gate is not null) { await gate.WaitAsync(cancellationToken); }, and chained spines like holder?.Gate.Wait(1000); carry the timeout through: await holder.Gate.WaitAsync(1000);.
  • Argument lists are carried verbatim; parameterless Wait() gains the in-scope token exactly like the direct-path fix.
  • A speculative rebind withholds the rewrite when a subclass hides WaitAsync with an unrelated member — for direct and null-conditional calls alike.

Validation

  • 1478 tests on net10.0
  • Independent codex CLI review across three passes (hidden WaitAsync members on both paths, parameterless GetAwaiter-style shape checks); all findings addressed

NuGet publish is handled by publish.yml on this release.

1.52.22

Changed

  • CC015 fixer: null-conditional blocking statements now rewrite instead of being withheld. task?.Wait(); and holder?.Work.GetAwaiter().GetResult(); hoist to if (x is not null) { await x.Work; }. A bare .Result read is not a legal statement on its own and keeps reporting without a rewrite in expression positions.
  • Shared hoist machinery: the null-conditional statement hoist from v1.52.21 (CC022) moved into a shared NullConditionalHoist helper used by both fixers; eligibility rules are identical (local/parameter/this operations only, no surviving nested ?., no nullable-struct receivers, C# 9+, dangling-else guard), the blocking operation must be the terminal expression of the statement, and a speculative type check confirms the spliced task still binds to the original task.
  • The awaiter must be a parameterless GetAwaiter(); direct-spine task?.GetAwaiter().GetResult(); is supported.

Validation

  • 1475 tests on net10.0
  • Independent codex CLI review across five passes (trailing-work drop, wrong-spine splice, direct GetAwaiter, parameterless GetAwaiter, trivia, docs); all findings addressed

NuGet publish is handled by publish.yml on this release.

1.52.21

Changed

  • CC022 fixer: null-conditional Cancel() statements now rewrite instead of being withheld. cts?.Cancel() becomes if (cts is not null) { await cts.CancelAsync(); }, and chained spines like holder?.Cts.Cancel() get the operation spliced back into the awaited call (await holder.Cts.CancelAsync()).
  • Still withheld when the rewrite would change behavior or not compile: a nested ?. surviving the hoist, receivers that are not locals/parameters/this, nullable-struct receivers, element-access or ! spines, unbraced if bodies whose parent has an else, language versions below C# 9, and calls whose rewritten CancelAsync() does not speculatively rebind to the framework's parameterless Task-returning method.
  • Known semantic note: like any hand-written null check, the hoist reads the receiver twice; concurrent reassignment between check and call keeps its pre-existing race.

Validation

  • 1468 tests on net10.0
  • Independent codex CLI review across five passes (receiver double-evaluation, splice shapes, nullable structs, dangling else, language version, hidden members); all findings addressed or documented

NuGet publish is handled by publish.yml on this release.

1.52.20

Fixed

  • CC022 fixer: holder?.Cts.Cancel() is reported without a rewrite. Replacing Cancel() with await .Cts.CancelAsync() produced holder? await.Cts.CancelAsync(), which does not parse. Direct cts?.Cancel() stays without a rewrite. Cancel() nested inside an async lambda argument of an unrelated ?. still rewrites.

Validation

  • 1455 tests on net10.0
  • Independent review vs origin/main (author grok-4.6; Claude primary): first pass flagged stale PackageReleaseNotes; after update, no discrete compile/recursion/AD0001 bugs

NuGet publish is handled by publish.yml on this release.

1.52.19

Fixed

  • CC015 fixer: host?.Work.Result is reported without a rewrite. Replacing .Result with (await .Work) produced host?(await .Work), which does not parse. .Wait() / GetResult() on the same spine are also withheld. .Result as an argument inside an unrelated ?. still rewrites.

Validation

  • 1452 tests on net10.0
  • Independent review vs origin/main (author grok-4.6; Codex gpt-5.4 fallback): no discrete compile/AD0001 bugs

NuGet publish is handled by publish.yml on this release.

1.52.18

Fixed

  • CC046 fixer: rewrite ExecuteReader when it is an argument inside an unrelated ?.. host?.Command.ExecuteReader() is still reported without a rewrite.

Validation

  • 1447 tests on net10.0
  • Independent review vs origin/main (author grok-4.6; Codex gpt-5.4 fallback): no discrete correctness issues

NuGet publish is handled by publish.yml on this release.

1.52.17

Fixed

  • CC028: holder?.Reader.ReadLine() no longer crashes the analyzer (AD0001) and is reported without a rewrite. Speculative bind stays parented under the original ?. so TAP hiders through a chain stay quiet.

Validation

  • 1446 tests on net10.0
  • Independent review vs origin/main (author grok-4.6; Codex gpt-5.4 fallback): no discrete AD0001/FP/compile bugs

NuGet publish is handled by publish.yml on this release.

1.52.16

Fixed

  • CC028 fixer: parenthesize await …Async(...) when the original File/Stream call is followed by ! (ReadAllText(p)!.Trim()). The fixer now uses the shared AwaitNeedsParentheses helper.

Validation

  • 1442 tests on net10.0
  • Independent review vs origin/main (author grok-4.6; Claude clean)

NuGet publish is handled by publish.yml on this release.

1.52.15

Fixed

  • CC026 fixer: parenthesize await WaitAsync(...) when a bool-returning Wait is a receiver or is followed by !.
  • Withhold a rewrite when Wait sits on the left spine of a ?. WhenNotNull (holder?.Gate.Wait(1000)), which would otherwise emit unparseable await inside the ?. branch.

Validation

  • 1440 tests on net10.0
  • Independent review vs origin/main (author grok-4.6; Codex gpt-5.4 fallback): no discrete compile/recursion/AD0001 bugs

NuGet publish is handled by publish.yml on this release.

1.52.14

Fixed

  • CC046 fixer: parenthesize await ExecuteReaderAsync(...) when the original call is a receiver or is followed by !. Without parentheses the await binds to .Dispose() on the Task.

NuGet publishing is handled by publish.yml.

1.52.13

Changed

  • CC044 fixer: rewrite Dns.GetHostEntry (string, string + AddressFamily, or IPAddress) to await GetHostEntryAsync, flowing an in-scope token when the rewritten call still binds to System.Net.Dns.
  • The IPAddress TAP is tokenless — the rewrite never invents a token.
  • The AddressFamily TAP has an optional token, so a tokenless rewrite still compiles.
  • Identifier-form using static rewrites that would bind a same-named helper are withheld.
  • Await-illegal positions are reported without a rewrite.
  • A numeric IP still reports (reverse DNS, not a parse).

NuGet publishing is handled by publish.yml.

1.52.12

Changed

  • CC043 fixer: rewrite Dns.GetHostAddresses (string, or string + AddressFamily) to await GetHostAddressesAsync, flowing an in-scope token when the rewritten call still binds to System.Net.Dns.
  • Tokenless fallback for the string TAP. The AddressFamily TAP has an optional token, so a tokenless rewrite still compiles.
  • Identifier-form using static rewrites that would bind a same-named helper are withheld.
  • Await-illegal positions are reported without a rewrite.
  • Dns is a static type. Compile-time constant IP literals stay quiet.

NuGet publishing is handled by publish.yml.

1.52.11

Changed

  • CC042 fixer: rewrite NamedPipeClientStream.Connect ((), int, TimeSpan) to await ConnectAsync, flowing an in-scope token when the rewritten call still binds.
  • Tokenless fallback for parameterless and int timeouts.
  • Connect(TimeSpan) without a token is reported without a rewrite (no tokenless TAP).
  • Null-conditional and await-illegal positions are reported without a rewrite.
  • NamedPipeClientStream is sealed.

NuGet publishing is handled by publish.yml.

1.52.10

Changed

  • CC041 fixer: rewrite NamedPipeServerStream.WaitForConnection() to await WaitForConnectionAsync, flowing an in-scope token when the rewritten call still binds.
  • Tokenless fallback when no token is in scope.
  • Null-conditional and await-illegal positions are reported without a rewrite.
  • NamedPipeServerStream is sealed.

NuGet publishing is handled by publish.yml.

1.52.9

Added

CC040 fixer rewrites a blocking HttpListener.GetContext() to await GetContextAsync(). The framework TAP is tokenless, so the rewrite never invents a token argument. Null-conditional calls and positions where await cannot compile are reported without a rewrite. HttpListener is sealed.

1390 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.8

Added

CC039 fixer rewrites a discarded UdpClient.Receive(ref endpoint) statement to var received = await ReceiveAsync(...) plus endpoint = received.RemoteEndPoint, flowing an in-scope CancellationToken when the rewritten call still binds. The TAP returns UdpReceiveResult and does not take the ref endpoint, so a value-use of the byte[] is reported without a rewrite. A braceless if/while body, null-conditional calls, await-illegal positions, and a this/base/this-alias call inside ReceiveAsync are reported without a rewrite.

1382 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.7

Added

CC038 fixer rewrites a blocking TcpListener.AcceptTcpClient / AcceptSocket to await AcceptTcpClientAsync / await AcceptSocketAsync, flowing an in-scope CancellationToken when the rewritten call still binds. The tokenless form is used when no token is in scope. Null-conditional calls, positions where await cannot compile, and a this/base/this-alias call (including a cast or as of this) inside the matching Accept*Async are reported without a rewrite. Unusable TAP hiders stay quiet.

1368 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.6

Added

CC037 fixer rewrites a blocking TcpClient.Connect to await ConnectAsync, flowing an in-scope CancellationToken when the rewritten call still binds. The tokenless form is used when no token is in scope. A named original argument keeps the token named when those names still bind (remoteEP:). Connect(hostname: …) is reported without a rewrite because ConnectAsync names that parameter host. Null-conditional calls, positions where await cannot compile, and a this/base/this-alias call inside ConnectAsync are reported without a rewrite.

1351 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.5

Added

CC049 fixer rewrites a blocking SmtpClient.Send (MailMessage or four strings) to await SendMailAsync, flowing an in-scope CancellationToken when the rewritten call still binds. Named original arguments keep the token named. Not the event-based SendAsync. A this/base call or this-alias inside a matching SendMailAsync is reported without a rewrite so the TAP entry cannot recurse.

1339 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.4

Added

CC048 fixer rewrites a blocking DbCommand.ExecuteScalar() to await ExecuteScalarAsync, flowing an in-scope CancellationToken when the rewritten call still binds to a Task<T> TAP method. The await is parenthesized when the result is used as a receiver, including through !. A this/base call or this-alias (local, field, property, nested capture) inside ExecuteScalarAsync is reported without a rewrite so the public TAP entry cannot recurse. A covariant TAP value-use falls back to the parameterless form so outer overloads cannot retarget.

1323 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.3

Added

CC047 fixer rewrites a blocking DbCommand.ExecuteNonQuery() to await ExecuteNonQueryAsync, flowing an in-scope CancellationToken when the rewritten call still binds to a Task<int> TAP method. The await is parenthesized when the result is used as a receiver. A this/implicit-this call inside ExecuteNonQueryAsync is reported without a rewrite so the public TAP entry cannot recurse.

1291 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.2

Added

CC046 fixer rewrites a blocking DbCommand.ExecuteReader / ExecuteReader(CommandBehavior) to await ExecuteReaderAsync, preserving the behavior argument and flowing an in-scope CancellationToken when the rewritten call still binds to a reader-returning TAP method. Named behavior: arguments keep the token named. Provider new TAP hiders still match (ExecuteReaderAsync() / token form are not virtual). Null-conditional calls, await-illegal positions, and token-required-only counterparts with no token in scope are reported without a fix.

1276 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.1

Added

CC045 fixer rewrites a blocking DbConnection.Open() to await OpenAsync, flowing an in-scope CancellationToken when the rewritten call still binds (including provider overrides). Parameterless OpenAsync() is used when no token is in scope. Null-conditional calls and positions where await cannot compile are reported without a fix.

1253 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.52.0

Added

CC049 (BlockingSmtpClientAnalyzer) flags blocking SmtpClient.Send in async code (MailMessage and the four-string overload).

Send parks a pool thread on an SMTP handshake. The TAP counterpart is SendMailAsync, not the event-based SendAsync. Token-taking SendMailAsync is .NET 5+; .NET Framework has the tokenless form. Send is not virtual; new hiders match by inheritance plus the framework shape.

1239 tests passing. 49 diagnostics. NuGet publishing is handled by the release workflow.

1.51.0

Added

CC048 (BlockingDbScalarAnalyzer) flags blocking DbCommand.ExecuteScalar in async code.

ExecuteScalar parks a pool thread on a single-value query. ExecuteScalarAsync yields and has accepted a CancellationToken since .NET Framework 4.5. Overrides and new hiders match by inheritance plus the framework shape (instance, arity 0, non-void return, no parameters), including a more-derived string return. Task/ValueTask hiders and Task-derived hiders stay quiet. CC046 is ExecuteReader; CC047 is ExecuteNonQuery.

1225 tests passing. 48 diagnostics. NuGet publishing is handled by the release workflow.

1.50.0

Added

CC047 (BlockingDbNonQueryAnalyzer) flags blocking DbCommand.ExecuteNonQuery in async code.

ExecuteNonQuery parks a pool thread on a command that does not return rows. ExecuteNonQueryAsync yields and has accepted a CancellationToken since .NET Framework 4.5. Overrides and new hiders match by inheritance plus the framework shape (instance, arity 0, int return, no parameters). Look-alikes, IDbCommand, generic helpers, and ExecuteScalar stay quiet. CC046 is ExecuteReader only.

1208 tests passing. 47 diagnostics. NuGet publishing is handled by the release workflow.

1.49.0

Added

CC046 (BlockingDbCommandAnalyzer) flags blocking DbCommand.ExecuteReader in async code (parameterless and CommandBehavior).

ExecuteReader parks a pool thread on a database query. ExecuteReaderAsync yields and has accepted a CancellationToken since .NET Framework 4.5. ExecuteReader is not virtual — providers hide it with new for a covariant reader — so the rule matches inheritance plus the framework shape (instance, arity 0, DbDataReader return, parameterless or one CommandBehavior). Look-alikes, IDbCommand, generic helpers, and ExecuteNonQuery stay quiet. CC003 is EF Core; CC045 is Open.

1193 tests passing. 46 diagnostics. NuGet publishing is handled by the release workflow.

1.48.0

Added

CC045 (BlockingDbConnectionAnalyzer) flags blocking DbConnection.Open in async code.

Open parks a pool thread on a database handshake. OpenAsync yields and has accepted a CancellationToken since .NET Framework 4.5. Concrete providers match through the override chain. CC003 is EF Core only.

1177 tests passing. 45 diagnostics. NuGet publishing is handled by the release workflow.

1.47.0

Added

CC044 (BlockingDnsGetHostEntryAnalyzer) flags blocking Dns.GetHostEntry in async code.

GetHostEntry parks a pool thread on a DNS query, including reverse lookup of a numeric IP. GetHostEntryAsync yields; on modern .NET the string overloads take a CancellationToken. The IPAddress async form is tokenless. CC043 is GetHostAddresses only — a numeric IP is not exempt here.

1169 tests passing. 44 diagnostics. NuGet publishing is handled by the release workflow.

1.46.1

Changed

CC043 stays quiet when the host argument is a compile-time constant IP ("127.0.0.1", "::1", const local). Those are parses, not DNS queries. IPv4 matching is host-independent (four octets, no leading zeros). "localhost", leading-zero IPv4, and non-const locals still report.

1160 tests passing. 43 diagnostics. NuGet publishing is handled by the release workflow.

1.46.0

Added

CC043 (BlockingDnsAnalyzer) flags blocking Dns.GetHostAddresses in async code.

GetHostAddresses parks a pool thread on a DNS query. GetHostAddressesAsync yields; on modern .NET it takes a CancellationToken. .NET Framework has the tokenless form. CC002 cannot see this method (no token overload). CC036–CC042 are Socket/Tcp/Udp/HttpListener/named-pipe; DNS produced zero diagnostics from every shipped rule.

1151 tests passing. 43 diagnostics. NuGet publishing is handled by the release workflow.

1.45.0

Added

CC042 (BlockingNamedPipeClientAnalyzer) flags blocking NamedPipeClientStream.Connect in async code.

Connect parks a pool thread until the server accepts (or a timeout elapses). ConnectAsync yields; on modern .NET it takes a CancellationToken. The rule stays quiet where ConnectAsync is absent. CC041 is the server accept wait; the client produced zero diagnostics from every shipped rule.

1144 tests passing. 42 diagnostics. NuGet publishing is handled by the release workflow.

1.44.0

Added

CC041 (BlockingNamedPipeAnalyzer) flags blocking NamedPipeServerStream.WaitForConnection in async code.

WaitForConnection parks a pool thread until a client connects. WaitForConnectionAsync yields; on modern .NET it takes a CancellationToken. CC028 maps File/Stream Read/Write/CopyTo/Flush only; CC036–CC040 are Socket/TcpClient/TcpListener/UdpClient/HttpListener; the named-pipe server produced zero diagnostics from every shipped rule.

1136 tests passing. 41 diagnostics. NuGet publishing is handled by the release workflow.

1.43.0

Added

CC040 (BlockingHttpListenerAnalyzer) flags blocking HttpListener.GetContext in async code.

GetContext parks a pool thread until a request arrives. GetContextAsync yields (it does not take a token). CC036–CC039 are Socket/TcpClient/TcpListener/UdpClient; the HTTP listener produced zero diagnostics from every shipped rule.

1130 tests passing. 40 diagnostics. NuGet publishing is handled by the release workflow.

1.42.0

Added

CC039 (BlockingUdpClientAnalyzer) flags blocking UdpClient.Receive in async code.

Receive parks a pool thread until a datagram arrives. ReceiveAsync yields and accepts a token on modern .NET. CC036 is Socket-only, CC037 is TcpClient.Connect, and CC038 is TcpListener accept; the UDP wrapper produced zero diagnostics from every shipped rule.

if (client.Available > 0), while (Available > 0), the inverted poll (if (Available == 0) continue; then receive), and client.Client.Blocking = false stay quiet.

1124 tests passing. 39 diagnostics. NuGet publishing is handled by the release workflow.

1.41.1

Changed

CC038 now reports AcceptTcpClient / AcceptSocket when the Pending() guard is negated.

if (!listener.Pending()) AcceptTcpClient() is the blocking path (no client is queued). if (Pending() == false) is the same. A positive probe stays quiet: if (Pending()), while (Pending()), while (flag && Pending()), Pending() is true, if (!Pending()) { } else Accept, and the inverted poll (if (!Pending()) continue/return; then accept).

1103 tests passing. 38 diagnostics. NuGet publishing is handled by the release workflow.

1.41.0

Added

CC038 (BlockingTcpListenerAnalyzer) flags blocking TcpListener.AcceptTcpClient and AcceptSocket in async code.

Both park a pool thread until a client connects. Accept*Async yields and accepts a token on modern .NET. CC036 is Socket-only and CC037 is TcpClient.Connect; the listener path produced zero diagnostics from every shipped rule.

if (listener.Pending()) and listener.Server.Blocking = false stay quiet. Reassignment / ref/out invalidate the exemption.

1091 tests passing. 38 diagnostics. NuGet publishing is handled by the release workflow.

1.40.0

Added

CC037 (BlockingTcpClientAnalyzer) flags blocking TcpClient.Connect in async code.

Connect parks a pool thread until the handshake finishes or TCP times out. ConnectAsync yields and accepts a token on modern .NET. CC036 already covers Socket.Connect; application code almost always uses the TcpClient wrapper, which none of the 36 shipped rules reported.

Hostname Connect still reports after Client.Blocking = false (synchronous DNS). The non-blocking exemption applies only to IP/endpoint overloads on a simple local, parameter, or field.

1076 tests passing. 37 diagnostics. NuGet publishing is handled by the release workflow.

1.39.4

Changed

CC031 now flags ReaderWriterLock.UpgradeToWriterLock in async code.

The v1.39.3 slice covered Acquire*Lock but left the upgrade path silent. UpgradeToWriterLock parks on contention, including the zero-timeout form: a failed upgrade restores the read lock with Timeout.Infinite. Acquire*Lock(0) remains a try-acquire.

1051 tests passing. 36 diagnostics. NuGet publishing is handled by the release workflow.

1.39.3

Changed

CC031 now flags ReaderWriterLock.AcquireReaderLock / AcquireWriterLock in async code.

The pre-Slim lock is not a WaitHandle and has no …Async counterpart, so the previous type map never saw it. Acquire*Lock(Timeout.Infinite) is an unbounded wait. A zero timeout is a non-blocking try-acquire and stays quiet.

// ❌ CC031
public async Task ReadAsync(ReaderWriterLock gate)
{
    gate.AcquireReaderLock(Timeout.Infinite);
    try { await Task.Yield(); }
    finally { gate.ReleaseReaderLock(); }
}

1049 tests passing. 36 diagnostics. NuGet publishing is handled by the release workflow.

1.39.2

Changed

CC031 now flags Barrier.SignalAndWait in async code.

Barrier is not a WaitHandle and has no …Async counterpart, so the previous type map never saw it. SignalAndWait parks every participant until the last one arrives. Zero-timeout overloads still report: the last arriver runs the post-phase action synchronously before returning.

// ❌ CC031
public async Task RendezvousAsync(Barrier barrier)
{
    barrier.SignalAndWait();
    await Task.Yield();
}

1044 tests passing. 36 diagnostics. NuGet publishing is handled by the release workflow.

1.39.1

Changed

CC031 now flags ReaderWriterLockSlim.Enter*Lock and TryEnter*Lock in async code.

Those members park a thread-pool thread and have no …Async counterpart, but they are not WaitHandle methods, so the previous type map never saw them. TryEnterWriteLock(Timeout.Infinite) is an unbounded enter. Zero-timeout TryEnter probes, look-alikes, and synchronous methods stay quiet.

// ❌ CC031 — parks a pooled thread until every writer exits
public async Task ReadAsync(ReaderWriterLockSlim gate)
{
    gate.EnterReadLock();
    try { await Task.Yield(); }
    finally { gate.ExitReadLock(); }
}

// ❌ CC031 — Timeout.Infinite is EnterWriteLock by another name
if (gate.TryEnterWriteLock(Timeout.Infinite)) { ... }

// ✅ zero-timeout probe stays quiet
_ = gate.TryEnterReadLock(0);

1038 tests passing. 36 diagnostics. NuGet publishing is handled by the release workflow.

1.39.0

Framework cancellation tokens are now in-scope

HttpContext.RequestAborted and ServerCallContext.CancellationToken participate in the shared token walk that powers CC002/CC003/CC004 and sibling rules (CC009, CC010, CC012, CC013, CC026, CC028, CC029, CC030, CC034). A CancellationToken parameter still wins when both exist.

// ❌ CC004 — RequestAborted is in scope but not passed
public async Task InvokeAsync(HttpContext context)
{
    return await _http.GetStringAsync(url);
}

// ✅
public async Task InvokeAsync(HttpContext context)
{
    return await _http.GetStringAsync(url, context.RequestAborted);
}

CC001 skips convention middleware Invoke / InvokeAsync(HttpContext). Adding a token parameter is not injected by the pipeline and can throw at runtime. Use RequestAborted instead. Closes the remaining half of #​1.

Code fixes emit member-access expressions (context.RequestAborted), not dotted identifiers. CC028's speculative bind uses the same expression so blocking file I/O in middleware is no longer silent.

1030 tests passing. Focused Stryker.NET on the walk at 96% mutation score. 36 diagnostics.

Commits viewable in compare view.

Updated HtmlAgilityPack from 1.12.4 to 1.13.0.

Release notes

Sourced from HtmlAgilityPack's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated iTextSharp.LGPLv2.Core from 3.8.4 to 3.8.5.

Release notes

Sourced from iTextSharp.LGPLv2.Core's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.19.

Release notes

Sourced from Microsoft.Extensions.Http.Polly's releases.

9.0.19

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.18...v9.0.19

9.0.18

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.17...v9.0.18

9.0.17

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.16...v9.0.17

9.0.16

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.15...v9.0.16

9.0.15

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.14...v9.0.15

9.0.14

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.13...v9.0.14

9.0.13

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.12...v9.0.13)

9.0.12

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.11...v9.0.12

9.0.11

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.10...v9.0.11

9.0.10

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.9...v9.0.10

9.0.9

Release

What's Changed

Description has been truncated

@dependabot
Bump the tests group with 8 updates
00673b6 
Bumps CancelCop.Analyzer from 1.38.0 to 1.52.51
Bumps HtmlAgilityPack from 1.12.4 to 1.13.0
Bumps iTextSharp.LGPLv2.Core from 3.8.4 to 3.8.5
Bumps Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.19
Bumps Microsoft.NET.Test.Sdk from 18.8.1 to 18.9.0
Bumps Roslynator.Analyzers from 4.16.0 to 4.16.1
Bumps SonarAnalyzer.CSharp from 10.32.0.713 to 10.33.0.1635
Bumps System.ServiceModel.Syndication from 9.0.0 to 9.0.19

---
updated-dependencies:
- dependency-name: CancelCop.Analyzer
  dependency-version: 1.52.51
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: HtmlAgilityPack
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: iTextSharp.LGPLv2.Core
  dependency-version: 3.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: Microsoft.Extensions.Http.Polly
  dependency-version: 9.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: Roslynator.Analyzers
  dependency-version: 4.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.33.0.1635
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: System.ServiceModel.Syndication
  dependency-version: 9.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Aug 26, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .net code labels Aug 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants