timothyandClaude Opus 5.5
f30a54172b
security.imagesharp-3x-tiff-decoder-disabled now says the bounds are
enforced by ImageSharpSurfaceTests rather than by its own prose. The
"Load pass is masked" claim is dropped from the record and from the two
code comments that repeated it: with the architecture pin, reverting the
Load pass's options alone now reddens
Only_ImageSharpDecoding_constructs_DecoderOptions (witnessed
2026-10-27), so the claim had become false. The residual it cannot see,
an extension-dispatched Save(path), is named.
Renovate: a packageRule holds SixLabors.ImageSharp on 3.1.x. The
existing "range pins are respected" sentence in ci-cd.md and the EF
group's description were wrong: Dependency Dashboard #22 offers EF Core
v10 and MediatR 14.2.0 over their range pins, so a range does not hold
Renovate. Whether the rule holds the OSV security PR (#923) cannot be
measured before merge, and the record says so.
guard-inventory.md's hand-written C# guard list gains the new fixture
and its two Architecture.Tests siblings, and stops quoting a count.
This branch also edits the rationale prose of
ffmpeg.remote-image-fetcher-bounded (commit 73045865f: the MaxFrames
measurement is dated to 3.1.12 and TIFF is no longer in play), which
the decisions lifecycle check requires this trailer for.
Decisions-Edit: yes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1
92 lines
3.2 KiB
JSON
92 lines
3.2 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"config:recommended"
|
|
],
|
|
"timezone": "Europe/Brussels",
|
|
"semanticCommits": "enabled",
|
|
"dependencyDashboard": true,
|
|
"labels": ["dependencies"],
|
|
"enabledManagers": ["nuget", "github-actions", "dockerfile"],
|
|
"osvVulnerabilityAlerts": true,
|
|
"vulnerabilityAlerts": {
|
|
"labels": ["dependencies", "security"]
|
|
},
|
|
"prConcurrentLimit": 5,
|
|
"packageRules": [
|
|
{
|
|
"description": "Only manage the built amd64 docker/Dockerfile; ignore the vestigial upstream arm/ffmpeg-tests Dockerfiles (this fork ships amd64-only)",
|
|
"matchManagers": ["dockerfile"],
|
|
"matchFileNames": [
|
|
"docker/arm32v7/Dockerfile",
|
|
"docker/arm64/Dockerfile",
|
|
"docker/ffmpeg-tests/Dockerfile"
|
|
],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"description": "Group the .NET base images (mcr.microsoft.com/dotnet/*) into one PR",
|
|
"matchManagers": ["dockerfile"],
|
|
"matchPackageNames": ["/^mcr\\.microsoft\\.com\\/dotnet\\//"],
|
|
"groupName": ".NET base images"
|
|
},
|
|
{
|
|
"description": "Group the Microsoft.Extensions.* family into one PR",
|
|
"matchPackageNames": ["/^Microsoft\\.Extensions\\./"],
|
|
"groupName": "Microsoft.Extensions"
|
|
},
|
|
{
|
|
"description": "Group the Microsoft.AspNetCore.* family into one PR",
|
|
"matchPackageNames": ["/^Microsoft\\.AspNetCore\\./"],
|
|
"groupName": "Microsoft.AspNetCore"
|
|
},
|
|
{
|
|
"description": "Group Entity Framework Core + providers. The range pins in Directory.Packages.props hold the build to v9 but do not stop Renovate proposing v10 (docs/ci-cd.md, Renovate)",
|
|
"matchPackageNames": [
|
|
"/^Microsoft\\.EntityFrameworkCore/",
|
|
"/^EFCore\\.BulkExtensions/",
|
|
"/^Pomelo\\.EntityFrameworkCore/"
|
|
],
|
|
"groupName": "Entity Framework Core"
|
|
},
|
|
{
|
|
"description": "Hold SixLabors.ImageSharp on 3.1.x: every patched release fails a Release build without a Six Labors license key. Delete this rule when the key is provisioned (security.imagesharp-3x-tiff-decoder-disabled, ersatztv#929)",
|
|
"matchPackageNames": ["SixLabors.ImageSharp"],
|
|
"allowedVersions": "/^3\\.1\\./"
|
|
},
|
|
{
|
|
"description": "Group the Serilog family into one PR",
|
|
"matchPackageNames": ["/^Serilog/"],
|
|
"groupName": "Serilog"
|
|
},
|
|
{
|
|
"description": "Group the Refit family into one PR",
|
|
"matchPackageNames": ["/^Refit/"],
|
|
"groupName": "Refit"
|
|
},
|
|
{
|
|
"description": "Group the Lucene.Net family into one PR",
|
|
"matchPackageNames": ["/^Lucene\\.Net/"],
|
|
"groupName": "Lucene.Net"
|
|
},
|
|
{
|
|
"description": "Auto-merge patch bumps to test/dev-only packages once the build+test check passes; everything else stays manual (ersatztv is prod-bearing). server-management#484",
|
|
"matchPackageNames": [
|
|
"NUnit",
|
|
"NUnit.Analyzers",
|
|
"NUnit3TestAdapter",
|
|
"NSubstitute",
|
|
"Shouldly",
|
|
"coverlet.collector",
|
|
"Microsoft.NET.Test.Sdk",
|
|
"Testably.Abstractions",
|
|
"Testably.Abstractions.Testing",
|
|
"Microsoft.VisualStudio.Threading.Analyzers"
|
|
],
|
|
"matchUpdateTypes": ["patch"],
|
|
"automerge": true,
|
|
"platformAutomerge": true
|
|
}
|
|
]
|
|
}
|