From a35f0ff28980a2e3e1bcf504d3efbf8ba1372d32 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 24 Sep 2026 09:15:49 +0000 Subject: [PATCH 1/2] Bump the avalonia group with 2 updates Bumps Avalonia.Desktop from 12.1.2 to 12.1.3 Bumps Avalonia.Themes.Fluent from 12.1.2 to 12.1.3 --- updated-dependencies: - dependency-name: Avalonia.Desktop dependency-version: 12.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: avalonia - dependency-name: Avalonia.Themes.Fluent dependency-version: 12.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: avalonia ... Signed-off-by: dependabot[bot] --- Directory.Packages.props | 4 +- src/ArcForges.ArcNotes/packages.lock.json | 114 +++++++++++----------- 2 files changed, 59 insertions(+), 59 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 4a77128..8e01efb 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -7,8 +7,8 @@ - - + + diff --git a/src/ArcForges.ArcNotes/packages.lock.json b/src/ArcForges.ArcNotes/packages.lock.json index db549d0..f602020 100644 --- a/src/ArcForges.ArcNotes/packages.lock.json +++ b/src/ArcForges.ArcNotes/packages.lock.json @@ -20,25 +20,25 @@ }, "Avalonia.Desktop": { "type": "Direct", - "requested": "[12.1.2, )", - "resolved": "12.1.2", - "contentHash": "ghG7UVnLVhCyWm/74xh24gAkXgEZ41oJTUr7c0VI9BiVSqhpukvU5vm8l8ZY35BZX8VPx1YtXUI1+VbhDTOLMw==", + "requested": "[12.1.3, )", + "resolved": "12.1.3", + "contentHash": "kjCpRlBIK5OZDnQ01Hd43CF0Mq4eQ9ndABiDCJAGtLD7lbzX6KxJ08vIK4N1VAiY4/enAUz8oT8q4O6bSybrBQ==", "dependencies": { - "Avalonia": "12.1.2", - "Avalonia.HarfBuzz": "12.1.2", - "Avalonia.Native": "12.1.2", - "Avalonia.Skia": "12.1.2", - "Avalonia.Win32": "12.1.2", - "Avalonia.X11": "12.1.2" + "Avalonia": "12.1.3", + "Avalonia.HarfBuzz": "12.1.3", + "Avalonia.Native": "12.1.3", + "Avalonia.Skia": "12.1.3", + "Avalonia.Win32": "12.1.3", + "Avalonia.X11": "12.1.3" } }, "Avalonia.Themes.Fluent": { "type": "Direct", - "requested": "[12.1.2, )", - "resolved": "12.1.2", - "contentHash": "EKw1PzlIfqB8n0+yGuHThR9cUEiqZYj0EHYp89jrTwSuudu8pji6I4SGe1UmdwJWdgWf+kuss8T7KT+0wsUyow==", + "requested": "[12.1.3, )", + "resolved": "12.1.3", + "contentHash": "ens/GHfXXk0W1ZScHZ2XG6DFiVyUVKR+0O8QK6zkviMNAPQCNwkftXlRVSFSQGtBYxXoJHZMsKYvCLEtVyzkug==", "dependencies": { - "Avalonia": "12.1.2" + "Avalonia": "12.1.3" } }, "Microsoft.DotNet.ILCompiler": { @@ -85,11 +85,11 @@ }, "Avalonia": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "GHSe4qxjbqqxB570xuB4KtoD+Qhk3uKXJUXbelGYhGz/ti8xEoL7e5DGun8hcsXHondszPPBEdcC68szw7vUKg==", + "resolved": "12.1.3", + "contentHash": "l0VGyGn1OwqFrhmIhIHivvrQP0DtBD4Vn2F1vLYgGA2X2qHg0DMVRAln/6xOTLBUYoTopiVAujN0jtH8MpVSeA==", "dependencies": { "Avalonia.BuildServices": "11.3.2", - "Avalonia.Remote.Protocol": "12.1.2", + "Avalonia.Remote.Protocol": "12.1.3", "MicroCom.Runtime": "0.11.6" } }, @@ -105,27 +105,27 @@ }, "Avalonia.FreeDesktop": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "RJqKF7djK/lyDBdj24+HKELGe+7I/86NIA57aeiod5k340svbcb9hs1RYkIF8Nga4Xa2Jd/Pzxpkmvdjb1ASiw==", + "resolved": "12.1.3", + "contentHash": "yEvk7qm0QPzgQwFZZTAIUXt31sQOSSeOSVTDrcm/Pk+5klNN+8C08kIJs9ZD8RY9esHVk2g6VHPab6DceJYRCw==", "dependencies": { - "Avalonia": "12.1.2", + "Avalonia": "12.1.3", "Tmds.DBus.Protocol": "0.94.1" } }, "Avalonia.FreeDesktop.AtSpi": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "632PfHnqe7OkzStmDOW2ghXfCcTapGhT46HZGMMOIZFr+I0biyxUk7felBQwNzEk5LJ54y4VfIoiWKTgZK8FnA==", + "resolved": "12.1.3", + "contentHash": "t9dP6VQAKGlXtftNuj7QzFtE54AI1qH1dwFmDEJlvI5gweCLNR8ebgRCLlO/bSLWzzV8dZtb6mB/glZ8soisDw==", "dependencies": { - "Avalonia": "12.1.2" + "Avalonia": "12.1.3" } }, "Avalonia.HarfBuzz": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "CqYTMnOLuAXjGldTEMdEf5/ozMY1z5ZshpE4YF0i2s2o4ycsYq855BD/eQS0iBt5PbjtlJgk8njILrBwW0HteQ==", + "resolved": "12.1.3", + "contentHash": "XcO9BBsmZHMIK+e+yy1TGsytlhqa7o4ih2Y7B0Q7OKh91GEEerbEc6v/X2kRmluKxyYNSmkwH5Uzj53FtjJngA==", "dependencies": { - "Avalonia": "12.1.2", + "Avalonia": "12.1.3", "HarfBuzzSharp": "8.3.1.3", "HarfBuzzSharp.NativeAssets.Linux": "8.3.1.3", "HarfBuzzSharp.NativeAssets.WebAssembly": "8.3.1.3" @@ -133,23 +133,23 @@ }, "Avalonia.Native": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "Co60A3FhDiCR022en90e/nUJqn2GtYal353cSUB0lWAd0qb/AuVRdScz9i0QCyglYw+PBfUXSP+9OfI2XvnfCg==", + "resolved": "12.1.3", + "contentHash": "TP6G8mF8vPufxycwe/dfLTsNhqQOGBt2Os5MtJshUGfVQ8zlYUG8K8JckPE+dweuDraAKq305aHXseReD7UgXQ==", "dependencies": { - "Avalonia": "12.1.2" + "Avalonia": "12.1.3" } }, "Avalonia.Remote.Protocol": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "DdLTe9xKXxxfRcXmUw1trXZpBpz1YiZYWXx0DfMVPFAnkCszKsHLi67kaZfGJqtfQq2EySKd2qgRYX2QYkSxcg==" + "resolved": "12.1.3", + "contentHash": "HcF69DKyihgg5coLOSp7GTqxQvWAy58LMKauwcHA28uSBJVwu0h5+gTNdJA8Sn/nqJVTRDU98zYsk6i1QSwDVQ==" }, "Avalonia.Skia": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "x0TDDdZgNepbxRd6gSQyv3A/hHoVJk3kYqjRa1baI43XPGPuO87lArf4DRKAERgWUxUp1ad28aTvVsE3x0JM0g==", + "resolved": "12.1.3", + "contentHash": "fYfSecJ6vQT3zB9vWl2DOoBK6JM4Mzxpz7KbUPxJePjY/yUl2OyhjKCyUcGZF2DV5mpAYfCOT4rdKEk8hP/lCA==", "dependencies": { - "Avalonia": "12.1.2", + "Avalonia": "12.1.3", "HarfBuzzSharp": "8.3.1.3", "HarfBuzzSharp.NativeAssets.Linux": "8.3.1.3", "HarfBuzzSharp.NativeAssets.WebAssembly": "8.3.1.3", @@ -160,22 +160,22 @@ }, "Avalonia.Win32": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "MjHc5aKNs7Hp/fiX13wTQ3pg+kG9lh+NfqSQGx6/SkfvdO1Hbmribk7Bt0pwFTxcJ6HGlzwGKp1Ur3Ib/tv0ew==", + "resolved": "12.1.3", + "contentHash": "RXSOmQGV5uKS9orIeE8a5oGz9QukzBnQTP3dtT9uJUhIIuZracy3ItoW8gtlZGBs3lzhEFTZlOk1Fn/Zxj/iAg==", "dependencies": { - "Avalonia": "12.1.2", + "Avalonia": "12.1.3", "Avalonia.Angle.Windows.Natives": "2.1.27548.20260419" } }, "Avalonia.X11": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "wtCAY9k90yrvhzKmesDGGFxYHsgejmLaR7HY36A4VYJ+E1R8AguNZc3hFaVKywnQLpf/eLhAwQWUxoNVFu9h/w==", + "resolved": "12.1.3", + "contentHash": "NWkfAGgERPlYRKpiB18t5auSFA/Ffd++uZsUEtHPc/maitjydNJVDmtY21pUqR2QvAeTCl1nRAagi+j9bKVyKw==", "dependencies": { - "Avalonia": "12.1.2", - "Avalonia.FreeDesktop": "12.1.2", - "Avalonia.FreeDesktop.AtSpi": "12.1.2", - "Avalonia.Skia": "12.1.2" + "Avalonia": "12.1.3", + "Avalonia.FreeDesktop": "12.1.3", + "Avalonia.FreeDesktop.AtSpi": "12.1.3", + "Avalonia.Skia": "12.1.3" } }, "Google.Protobuf": { @@ -561,10 +561,10 @@ }, "Avalonia.Native": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "Co60A3FhDiCR022en90e/nUJqn2GtYal353cSUB0lWAd0qb/AuVRdScz9i0QCyglYw+PBfUXSP+9OfI2XvnfCg==", + "resolved": "12.1.3", + "contentHash": "TP6G8mF8vPufxycwe/dfLTsNhqQOGBt2Os5MtJshUGfVQ8zlYUG8K8JckPE+dweuDraAKq305aHXseReD7UgXQ==", "dependencies": { - "Avalonia": "12.1.2" + "Avalonia": "12.1.3" } }, "HarfBuzzSharp.NativeAssets.Linux": { @@ -625,10 +625,10 @@ }, "Avalonia.Native": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "Co60A3FhDiCR022en90e/nUJqn2GtYal353cSUB0lWAd0qb/AuVRdScz9i0QCyglYw+PBfUXSP+9OfI2XvnfCg==", + "resolved": "12.1.3", + "contentHash": "TP6G8mF8vPufxycwe/dfLTsNhqQOGBt2Os5MtJshUGfVQ8zlYUG8K8JckPE+dweuDraAKq305aHXseReD7UgXQ==", "dependencies": { - "Avalonia": "12.1.2" + "Avalonia": "12.1.3" } }, "HarfBuzzSharp.NativeAssets.Linux": { @@ -689,10 +689,10 @@ }, "Avalonia.Native": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "Co60A3FhDiCR022en90e/nUJqn2GtYal353cSUB0lWAd0qb/AuVRdScz9i0QCyglYw+PBfUXSP+9OfI2XvnfCg==", + "resolved": "12.1.3", + "contentHash": "TP6G8mF8vPufxycwe/dfLTsNhqQOGBt2Os5MtJshUGfVQ8zlYUG8K8JckPE+dweuDraAKq305aHXseReD7UgXQ==", "dependencies": { - "Avalonia": "12.1.2" + "Avalonia": "12.1.3" } }, "HarfBuzzSharp.NativeAssets.Linux": { @@ -753,10 +753,10 @@ }, "Avalonia.Native": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "Co60A3FhDiCR022en90e/nUJqn2GtYal353cSUB0lWAd0qb/AuVRdScz9i0QCyglYw+PBfUXSP+9OfI2XvnfCg==", + "resolved": "12.1.3", + "contentHash": "TP6G8mF8vPufxycwe/dfLTsNhqQOGBt2Os5MtJshUGfVQ8zlYUG8K8JckPE+dweuDraAKq305aHXseReD7UgXQ==", "dependencies": { - "Avalonia": "12.1.2" + "Avalonia": "12.1.3" } }, "HarfBuzzSharp.NativeAssets.Linux": { @@ -817,10 +817,10 @@ }, "Avalonia.Native": { "type": "Transitive", - "resolved": "12.1.2", - "contentHash": "Co60A3FhDiCR022en90e/nUJqn2GtYal353cSUB0lWAd0qb/AuVRdScz9i0QCyglYw+PBfUXSP+9OfI2XvnfCg==", + "resolved": "12.1.3", + "contentHash": "TP6G8mF8vPufxycwe/dfLTsNhqQOGBt2Os5MtJshUGfVQ8zlYUG8K8JckPE+dweuDraAKq305aHXseReD7UgXQ==", "dependencies": { - "Avalonia": "12.1.2" + "Avalonia": "12.1.3" } }, "HarfBuzzSharp.NativeAssets.Linux": { From 9f1fea84f5defbb16e38916f4e525c322ae6993f Mon Sep 17 00:00:00 2001 From: sammiller Date: Sat, 26 Sep 2026 12:43:48 +0800 Subject: [PATCH 2/2] Admit the reviewed Avalonia 12.1.3 update Admit the eleven Avalonia 12.1.3 packages from their published nuspecs (MIT, exact nuspec SHA-256 and upstream source commit), retire the 12.1.2 coordinates and reseal eng/policy/dependency-review.json. SkiaSharp, HarfBuzzSharp and ANGLE keep their admitted versions. Co-Authored-By: Claude Opus 5.5 --- eng/policy/dependency-policy.json | 110 +++++++++++++++--------------- eng/policy/dependency-review.json | 22 +++--- 2 files changed, 66 insertions(+), 66 deletions(-) diff --git a/eng/policy/dependency-policy.json b/eng/policy/dependency-policy.json index 82414bf..bcc6459 100644 --- a/eng/policy/dependency-policy.json +++ b/eng/policy/dependency-policy.json @@ -35,15 +35,15 @@ }, { "id": "Avalonia", - "version": "12.1.2", - "contentHash": "GHSe4qxjbqqxB570xuB4KtoD+Qhk3uKXJUXbelGYhGz/ti8xEoL7e5DGun8hcsXHondszPPBEdcC68szw7vUKg==", + "version": "12.1.3", + "contentHash": "l0VGyGn1OwqFrhmIhIHivvrQP0DtBD4Vn2F1vLYgGA2X2qHg0DMVRAln/6xOTLBUYoTopiVAujN0jtH8MpVSeA==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "6812a63a8b193752c1338e300f7f258a96e2f981d4a56dc8d032b907cd3954d0", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "8fd64a84c229548a71e61390f4a310219f50529af0ee53162ffd39e7874ff4dc", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { @@ -74,132 +74,132 @@ }, { "id": "Avalonia.Desktop", - "version": "12.1.2", - "contentHash": "ghG7UVnLVhCyWm/74xh24gAkXgEZ41oJTUr7c0VI9BiVSqhpukvU5vm8l8ZY35BZX8VPx1YtXUI1+VbhDTOLMw==", + "version": "12.1.3", + "contentHash": "kjCpRlBIK5OZDnQ01Hd43CF0Mq4eQ9ndABiDCJAGtLD7lbzX6KxJ08vIK4N1VAiY4/enAUz8oT8q4O6bSybrBQ==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "aaf4a3b219f24950eb844a6f1af8c6defd1d5359775eca4ae8071ddfc30917e9", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "cb0d6a62291e467cb9e3cbc01180c1d061f62a4d9dfff460d5a359faded8d848", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { "id": "Avalonia.FreeDesktop", - "version": "12.1.2", - "contentHash": "RJqKF7djK/lyDBdj24+HKELGe+7I/86NIA57aeiod5k340svbcb9hs1RYkIF8Nga4Xa2Jd/Pzxpkmvdjb1ASiw==", + "version": "12.1.3", + "contentHash": "yEvk7qm0QPzgQwFZZTAIUXt31sQOSSeOSVTDrcm/Pk+5klNN+8C08kIJs9ZD8RY9esHVk2g6VHPab6DceJYRCw==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "eb6b999f0aab66ce9420d1ac0a1bcfe254e74c7612563be34d2b1284e28923c3", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "6e04dff25c4ce83814f9e84cb606c7f44ad49bc24bee2d3a5e520128fb15a809", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { "id": "Avalonia.FreeDesktop.AtSpi", - "version": "12.1.2", - "contentHash": "632PfHnqe7OkzStmDOW2ghXfCcTapGhT46HZGMMOIZFr+I0biyxUk7felBQwNzEk5LJ54y4VfIoiWKTgZK8FnA==", + "version": "12.1.3", + "contentHash": "t9dP6VQAKGlXtftNuj7QzFtE54AI1qH1dwFmDEJlvI5gweCLNR8ebgRCLlO/bSLWzzV8dZtb6mB/glZ8soisDw==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "eb0db053476369b31bdd40d1af8c8ad5cffbd700ba7193a04221a1bab313b76e", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "5ec9ea9bed3e1280c988b2e06938b7f81ddc92fb52b0711536d8a4053ac7b066", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { "id": "Avalonia.HarfBuzz", - "version": "12.1.2", - "contentHash": "CqYTMnOLuAXjGldTEMdEf5/ozMY1z5ZshpE4YF0i2s2o4ycsYq855BD/eQS0iBt5PbjtlJgk8njILrBwW0HteQ==", + "version": "12.1.3", + "contentHash": "XcO9BBsmZHMIK+e+yy1TGsytlhqa7o4ih2Y7B0Q7OKh91GEEerbEc6v/X2kRmluKxyYNSmkwH5Uzj53FtjJngA==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "6c8ce1c41f280d4c6ce7c1c8b286c3c7b2f830015a46b67ece380b6d32d58745", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "15ff9247f7c41fe827fa825ad680560a0983bb6fedee0a3a0a4e9030a0bca549", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { "id": "Avalonia.Native", - "version": "12.1.2", - "contentHash": "Co60A3FhDiCR022en90e/nUJqn2GtYal353cSUB0lWAd0qb/AuVRdScz9i0QCyglYw+PBfUXSP+9OfI2XvnfCg==", + "version": "12.1.3", + "contentHash": "TP6G8mF8vPufxycwe/dfLTsNhqQOGBt2Os5MtJshUGfVQ8zlYUG8K8JckPE+dweuDraAKq305aHXseReD7UgXQ==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "c737958465ffa29a92104ae13d883055a8c9924826b84a5afae30a39e3dfe062", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "99183e0571ecb1a42532e415002723e9a3236b8f96b02e528a526ce16f6d83a1", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { "id": "Avalonia.Remote.Protocol", - "version": "12.1.2", - "contentHash": "DdLTe9xKXxxfRcXmUw1trXZpBpz1YiZYWXx0DfMVPFAnkCszKsHLi67kaZfGJqtfQq2EySKd2qgRYX2QYkSxcg==", + "version": "12.1.3", + "contentHash": "HcF69DKyihgg5coLOSp7GTqxQvWAy58LMKauwcHA28uSBJVwu0h5+gTNdJA8Sn/nqJVTRDU98zYsk6i1QSwDVQ==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "85c04ad13fb6d2993780af8df2b23ad4eb29fa628eaf05899d825f5c6f0a2ece", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "4c0cd5ec137d2a376bab20e62bb2cbbdc9b71ffcb044acf41adeaf25cf5025b1", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { "id": "Avalonia.Skia", - "version": "12.1.2", - "contentHash": "x0TDDdZgNepbxRd6gSQyv3A/hHoVJk3kYqjRa1baI43XPGPuO87lArf4DRKAERgWUxUp1ad28aTvVsE3x0JM0g==", + "version": "12.1.3", + "contentHash": "fYfSecJ6vQT3zB9vWl2DOoBK6JM4Mzxpz7KbUPxJePjY/yUl2OyhjKCyUcGZF2DV5mpAYfCOT4rdKEk8hP/lCA==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "4bc8127688e28c01d82bca0edaa6fc9ecddbc92d7041548a11a375e3964821a7", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "460e60e81c3f8e8655f27dff29d1b485d1398f275244cbd9a0172371e4ce0d61", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { "id": "Avalonia.Themes.Fluent", - "version": "12.1.2", - "contentHash": "EKw1PzlIfqB8n0+yGuHThR9cUEiqZYj0EHYp89jrTwSuudu8pji6I4SGe1UmdwJWdgWf+kuss8T7KT+0wsUyow==", + "version": "12.1.3", + "contentHash": "ens/GHfXXk0W1ZScHZ2XG6DFiVyUVKR+0O8QK6zkviMNAPQCNwkftXlRVSFSQGtBYxXoJHZMsKYvCLEtVyzkug==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "190589f97e9cffb968fba3b78d1a81aae4911601c2da0034aacbc69073c5e79d", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "05815e6cca72f3aee5e5570e62665925886ade322c625b7c4ce3c88beb3893bb", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { "id": "Avalonia.Win32", - "version": "12.1.2", - "contentHash": "MjHc5aKNs7Hp/fiX13wTQ3pg+kG9lh+NfqSQGx6/SkfvdO1Hbmribk7Bt0pwFTxcJ6HGlzwGKp1Ur3Ib/tv0ew==", + "version": "12.1.3", + "contentHash": "RXSOmQGV5uKS9orIeE8a5oGz9QukzBnQTP3dtT9uJUhIIuZracy3ItoW8gtlZGBs3lzhEFTZlOk1Fn/Zxj/iAg==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "2b639f3aabe320e0c0de49fc274157910a670cf0a8eab5690099d91c360ce48b", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "3506aa7312736322a7cc74204cccdcd884fd5b2ded2a6b51b5dbe1091897ed34", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { "id": "Avalonia.X11", - "version": "12.1.2", - "contentHash": "wtCAY9k90yrvhzKmesDGGFxYHsgejmLaR7HY36A4VYJ+E1R8AguNZc3hFaVKywnQLpf/eLhAwQWUxoNVFu9h/w==", + "version": "12.1.3", + "contentHash": "NWkfAGgERPlYRKpiB18t5auSFA/Ffd++uZsUEtHPc/maitjydNJVDmtY21pUqR2QvAeTCl1nRAagi+j9bKVyKw==", "licence": "MIT", "licenceEvidence": "Published package nuspec declares SPDX expression MIT; existing packaged upstream notices remain authoritative for bundled material.", "sourceRepository": "https://github.com/AvaloniaUI/Avalonia/", - "sourceCommit": "d3c867a9e2de379249b03dbeb3495bd7f076a81a", - "nuspecSha256": "94be6f461cde50fa16914d0eec02aa76e4ac405ad135bc72e778a513245d5166", + "sourceCommit": "8eeda4f6f546165b3f72e63c9f42247abb306905", + "nuspecSha256": "acb9d9ba146314e262fc9e0208574fff5b13be9bf63ec9150846566f31879463", "dependencyClass": "framework", - "maintenanceAssessment": "Retain the already admitted pinned release and upstream source identity; no new dependency or current upstream support/freshness claim. Existing dependency-review/security gates review changes; the product owner must assess replacement or vulnerabilities before an upgrade.", + "maintenanceAssessment": "Reviewed Dependabot avalonia group update from 12.1.2: same package identity and publisher, exact immutable upstream source commit and published nuspec recorded; dependency-review, CodeQL and security gates remain required. No current upstream support or vulnerability-absence claim.", "previewAdmission": "none" }, { diff --git a/eng/policy/dependency-review.json b/eng/policy/dependency-review.json index 28ab167..5ae845d 100644 --- a/eng/policy/dependency-review.json +++ b/eng/policy/dependency-review.json @@ -11,32 +11,32 @@ "frameworkMajorUpgrade": false, "runtimePostureAssessment": "No framework version changes: existing desktop Native AOT and trim posture retained.", "checks": { - "compilation": "Workflow-only update: github/codeql-action init/analyze 4.38.0 -> 4.38.1 (Dependabot actions group). Required Windows/Linux compilation runs unchanged in CI.", - "aot": "No project, package or publish input changed; existing Windows x64/ARM64 and Linux x64 AOT publication jobs are unchanged.", - "compatibility": "Patch release within CodeQL action v4 with the same inputs and outputs; no package versions, APIs or generated contracts changed.", - "licence": "GitHub-owned action pinned to the immutable commit 1c5b675653bb5c22dbe9b12b556ec555138e09fd of annotated tag v4.38.1; no distributed closure or notice changed.", - "security": "Immutable SHA pin retained; CodeQL and dependency-review gates stay required; no vulnerability-absence claim.", - "sbom": "No restore closure change; the portable dependencies.json SBOM is unaffected.", - "localRuntime": "Not run: CI-only workflow action update; no application runtime behavior changed.", - "performance": "Not applicable: no runtime dependency, executable behavior or performance-sensitive algorithm changed.", + "compilation": "Avalonia.Desktop and Avalonia.Themes.Fluent 12.1.2 -> 12.1.3 (Dependabot avalonia group) with the matching Avalonia 12.1.3 transitive set; required Windows/Linux compilation runs in CI.", + "aot": "Windows x64/ARM64 and Linux x64 Native AOT publication stays required in CI for this patch release within Avalonia 12.1.", + "compatibility": "Patch release within Avalonia 12.1; no framework-major change. SkiaSharp, HarfBuzzSharp and ANGLE native packages keep their admitted versions, so the existing native admission is unchanged.", + "licence": "Every new Avalonia 12.1.3 package declares SPDX MIT in its published nuspec; exact nuspec SHA-256 and upstream source commit are recorded; notices unchanged.", + "security": "Dependency-review, CodeQL and secret-scan gates stay required on the pull request head; no vulnerability-absence claim.", + "sbom": "The portable dependencies.json SBOM is generated in CI from actual restore assets; only the Avalonia versions change.", + "localRuntime": "Not run: desktop GUI/runtime checks are local opt-in and outside this dependency update; CI covers compilation and AOT publication only.", + "performance": "Not measured: Avalonia patch release; no performance-sensitive code or configuration changed in this repository.", "migration": "Not applicable: no persistence format or storage dependency changed." }, "inputs": { ".github/workflows/ci.yml": "a7a84aabb9441717b25c2f88328168ce3d6b8772f3249f2f22cf96df08307f2c", "Directory.Build.props": "90a5954ec7685904894ef8d19fea650f9bcebabbde98b0b94058f8b7c68fb5a4", "Directory.Build.targets": "21da49619dc407ca9de526c9aa75cb9a0e67ca6314bddd4770dd165975405bd4", - "Directory.Packages.props": "ef826d5a6865882ae44e02c03a21e2d94e3146a2027a22bdbc6a558aac260321", + "Directory.Packages.props": "a3be569aa978aa50a56fff07fc4da3d762886ecdc2bff96fae05bec688e67366", "NuGet.Config": "4b8c02e4d50d3cc41197afc609f592e5a1889c049fe39147564e2811c5d8e261", "eng/ArcForges.Repository/ArcForges.Repository.csproj": "b80fff54a4c877998e66b035a159e790bce4c771244d1d239fa8d58c8dd589a6", "eng/ArcForges.Repository/packages.lock.json": "c89665a55992ffd3e4e1c3ba0ae067c104a48ac9b4d40561147e3208d7acc931", - "eng/policy/dependency-policy.json": "ebde30ed1fd96baa1aaa2063ac03dad3336504e64508381008f191f79a380c55", + "eng/policy/dependency-policy.json": "50129c4537a26dc352cb4f40f968ca82c545aa1b410b4c9b795c404f2ec62bf5", "eng/policy/licence-boundary.json": "b47394287794368d8b997161afe66ecdb03b632ce56d72f26df59e686200b478", "eng/policy/reuse-policy.json": "07ce0656c89f0d7173f0e81fc94ab88eb5deed45ad30e1aff987f1e3c373e015", "global.json": "d533441ee720f55065ffdda4273cd815f53f534612cd5899bd4b9b41d0e3a630", "src/ArcForges.ArcNotes.Core/ArcForges.ArcNotes.Core.csproj": "2338d20f00790d79a717e3ed74cfd79de26204d428eda618247558d84f776f3d", "src/ArcForges.ArcNotes.Core/packages.lock.json": "2d4085d38648181c42333b905a7d57bff5b5faee5a35e777c05f16cf2b3c6142", "src/ArcForges.ArcNotes/ArcForges.ArcNotes.csproj": "4a4bb4fb53401da31b2f2aafd96f5c733a78f08c60632f717eeb8b8e1eaabdba", - "src/ArcForges.ArcNotes/packages.lock.json": "2db0cecbda58e2a4bae5b55ddcea422a74b359f65643f46a74c10718281feec7", + "src/ArcForges.ArcNotes/packages.lock.json": "6b7ca43db3316b52015ea192837b0105d3b3dfd98ef8372187613418e2892fe7", "tests/ArcForges.ArcNotes.Tests/ArcForges.ArcNotes.Tests.csproj": "850e1ce3bbc3cbe8e4d96d4ed2db6522ea32c80c4cb724ee2ee4716b74950897", "tests/ArcForges.ArcNotes.Tests/packages.lock.json": "432eab7f4ebd9e2ba494394ac92b702908afafdbbcfdf745eb3655cad86d65c0", "third-party/sources.json": "106696f712f9574d0e5521337c954bdb936ee3e30901a7aab1f2d569bed548f6"