Skip to content

Bump AsyncKeyedLock and 10 others#222

Closed
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/nuget/src/DNTCommon.Web.Core/tests-21c69d80e5
Closed

Bump AsyncKeyedLock and 10 others#222
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/nuget/src/DNTCommon.Web.Core/tests-21c69d80e5

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 31, 2026

Updated AsyncKeyedLock from 8.0.1 to 8.0.2.

Release notes

Sourced from AsyncKeyedLock's releases.

8.0.2

DotNet.ReproducibleBuilds update.

Commits viewable in compare view.

Updated DependencyInjection.Lifetime.Analyzers from 2.1.1 to 2.4.0.

Release notes

Sourced from DependencyInjection.Lifetime.Analyzers's releases.

2.4.0

DependencyInjection.Lifetime.Analyzers 2.4.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI002 Scope/Alias Tracking: Scoped-service escape analysis now follows scopes created before a using (scope) statement, recognizes provider aliases, and stays quiet after safe alias overwrites instead of keeping stale escape state alive.
  • DI004 Scope/Alias Disposal Coverage: Use-after-dispose analysis now recognizes services resolved from predeclared scopes and provider aliases, and it clears stale tracked aliases after safe overwrites to avoid new false positives.
  • DI009 Registration-Shape Coverage: Open-generic captive-dependency coverage now has direct tests for TryAddSingleton(...), ServiceDescriptor.Singleton(...), and keyed open-generic singleton registrations, plus no-diagnostic guardrails for mismatched keys and ineffective TryAddSingleton(...).
  • Analyzer Health Snapshot: Refreshed the rule-health scoring after the DI002/DI004/DI009 hardening pass and rolled the direct-test counts forward to the current suite.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.4.0

What changed

Changed

  • DI002 Scope/Alias Tracking: Scoped-service escape analysis now follows scopes created before a using (scope) statement, recognizes provider aliases, and stays quiet after safe alias overwrites instead of keeping stale escape state alive.
  • DI004 Scope/Alias Disposal Coverage: Use-after-dispose analysis now recognizes services resolved from predeclared scopes and provider aliases, and it clears stale tracked aliases after safe overwrites to avoid new false positives.
  • DI009 Registration-Shape Coverage: Open-generic captive-dependency coverage now has direct tests for TryAddSingleton(...), ServiceDescriptor.Singleton(...), and keyed open-generic singleton registrations, plus no-diagnostic guardrails for mismatched keys and ineffective TryAddSingleton(...).
  • Analyzer Health Snapshot: Refreshed the rule-health scoring after the DI002/DI004/DI009 hardening pass and rolled the direct-test counts forward to the current suite.

Learn more

2.3.9

DependencyInjection.Lifetime.Analyzers 2.3.9

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI016 Minimal-Hosting Coverage: BuildServiceProvider misuse detection now recognizes top-level registration code that flows from a builder-style .Services property, closing the missed-diagnostic gap for minimal-hosting registration composition without expanding the rule to every top-level IServiceCollection usage.
  • DI016 Diagnostic Precision: DI016 now reports on the BuildServiceProvider member name instead of highlighting the full invocation, producing tighter squiggles in the IDE and test output.
  • DI016 Regression Coverage: Added tests for IServiceCollection variable indirection, top-level .Services aliases, and a top-level standalone new ServiceCollection() no-diagnostic guardrail so the rule stays conservative.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.9

What changed

Changed

  • DI016 Minimal-Hosting Coverage: BuildServiceProvider misuse detection now recognizes top-level registration code that flows from a builder-style .Services property, closing the missed-diagnostic gap for minimal-hosting registration composition without expanding the rule to every top-level IServiceCollection usage.
  • DI016 Diagnostic Precision: DI016 now reports on the BuildServiceProvider member name instead of highlighting the full invocation, producing tighter squiggles in the IDE and test output.
  • DI016 Regression Coverage: Added tests for IServiceCollection variable indirection, top-level .Services aliases, and a top-level standalone new ServiceCollection() no-diagnostic guardrail so the rule stays conservative.

Learn more

2.3.8

DependencyInjection.Lifetime.Analyzers 2.3.8

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI018 Open-Generic Activatability: Non-instantiable implementation detection now checks unbound generic registrations against the generic type definition, so open generic implementations with only private, internal, or protected constructors are reported instead of slipping through to runtime activation failures.
  • DI018 Registration-Shape Coverage: Added direct guardrails for keyed registrations, TryAddSingleton(...), ServiceDescriptor.Singleton(...), ServiceDescriptor.Describe(...), typeof(...) registrations, and factory/implementation-instance silence so DI018 stays aligned with the collector paths the analyzers actually support.
  • DI018 Sample and Docs Parity: Expanded the DI018 sample, contract, and rule docs to include constructor-accessibility failures in addition to abstract implementations, and refreshed the analyzer health snapshot to reflect the stronger coverage.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.8

What changed

Changed

  • DI018 Open-Generic Activatability: Non-instantiable implementation detection now checks unbound generic registrations against the generic type definition, so open generic implementations with only private, internal, or protected constructors are reported instead of slipping through to runtime activation failures.
  • DI018 Registration-Shape Coverage: Added direct guardrails for keyed registrations, TryAddSingleton(...), ServiceDescriptor.Singleton(...), ServiceDescriptor.Describe(...), typeof(...) registrations, and factory/implementation-instance silence so DI018 stays aligned with the collector paths the analyzers actually support.
  • DI018 Sample and Docs Parity: Expanded the DI018 sample, contract, and rule docs to include constructor-accessibility failures in addition to abstract implementations, and refreshed the analyzer health snapshot to reflect the stronger coverage.

Learn more

2.3.7

DependencyInjection.Lifetime.Analyzers 2.3.7

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • Instance-Backed Registration Fidelity: Shared registration metadata now tracks pre-built implementation instances explicitly so constructor-driven analyzers and dependency resolution stay aligned with runtime behavior instead of treating existing objects like activatable implementation types.
  • False-Positive Reduction Across Rules: DI003, DI010, DI011, DI015, DI017, and DI018 now stay silent for valid implementation-instance registrations, including ServiceDescriptor instance forms and generic implementationInstance: overloads.
  • DI017 Determinism Hardening: Circular-dependency analysis now builds its effective registration set from stable source order, preventing duplicate or mixed instance-plus-constructed registrations from changing results due to concurrent discovery order.
  • Regression Coverage Expansion: Added direct tests for generic and named implementation-instance collection, ServiceDescriptor instance shapes, mixed instance-plus-constructed DI017 graphs, and the cross-rule fallout cases that motivated this pass.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.7

What changed

Changed

  • Instance-Backed Registration Fidelity: Shared registration metadata now tracks pre-built implementation instances explicitly so constructor-driven analyzers and dependency resolution stay aligned with runtime behavior instead of treating existing objects like activatable implementation types.
  • False-Positive Reduction Across Rules: DI003, DI010, DI011, DI015, DI017, and DI018 now stay silent for valid implementation-instance registrations, including ServiceDescriptor instance forms and generic implementationInstance: overloads.
  • DI017 Determinism Hardening: Circular-dependency analysis now builds its effective registration set from stable source order, preventing duplicate or mixed instance-plus-constructed registrations from changing results due to concurrent discovery order.
  • Regression Coverage Expansion: Added direct tests for generic and named implementation-instance collection, ServiceDescriptor instance shapes, mixed instance-plus-constructed DI017 graphs, and the cross-rule fallout cases that motivated this pass.

Learn more

2.3.6

DependencyInjection.Lifetime.Analyzers 2.3.6

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI013 Open-Generic Compatibility Hardening: Implementation-type mismatch analysis now rejects open-service registrations backed by closed generic implementations and validates open-generic projection ordering and arity more precisely across interface and base-type mappings.
  • DI013 Registration-Shape Coverage: Added direct guardrails for ServiceDescriptor.Singleton(...), ServiceDescriptor.Describe(...), keyed registrations, TryAddSingleton(...), implementation-instance registrations, and other collector-fed registration shapes so compatibility checks stay aligned with the registrations the analyzers actually understand.
  • Analyzer Health Snapshot: Added docs/ANALYZER_HEALTH.md with per-rule scoring, pass recommendations, and current verification status to make future hardening priorities explicit.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.6

What changed

Changed

  • DI013 Open-Generic Compatibility Hardening: Implementation-type mismatch analysis now rejects open-service registrations backed by closed generic implementations and validates open-generic projection ordering and arity more precisely across interface and base-type mappings.
  • DI013 Registration-Shape Coverage: Added direct guardrails for ServiceDescriptor.Singleton(...), ServiceDescriptor.Describe(...), keyed registrations, TryAddSingleton(...), implementation-instance registrations, and other collector-fed registration shapes so compatibility checks stay aligned with the registrations the analyzers actually understand.
  • Analyzer Health Snapshot: Added docs/ANALYZER_HEALTH.md with per-rule scoring, pass recommendations, and current verification status to make future hardening priorities explicit.

Learn more

2.3.5

DependencyInjection.Lifetime.Analyzers 2.3.5

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI005 Extension-Method Coverage: Added analyzer and code-fix coverage for IServiceProvider.CreateScope() in async and sync contexts, including both using var and block-form using (...) fixer rewrites to CreateAsyncScope().
  • DI005 Ownership and Boundary Guardrails: Locked expected behavior for CreateScope() passed into helper methods, returned from async methods, synchronously disposed inside async methods, and used inside async anonymous methods.
  • DI005 Async-Context Precision: Added no-diagnostic guardrails for synchronous lambdas and synchronous local functions nested inside async methods so future DI005 changes preserve correct executable-boundary behavior.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.5

What changed

Changed

  • DI005 Extension-Method Coverage: Added analyzer and code-fix coverage for IServiceProvider.CreateScope() in async and sync contexts, including both using var and block-form using (...) fixer rewrites to CreateAsyncScope().
  • DI005 Ownership and Boundary Guardrails: Locked expected behavior for CreateScope() passed into helper methods, returned from async methods, synchronously disposed inside async methods, and used inside async anonymous methods.
  • DI005 Async-Context Precision: Added no-diagnostic guardrails for synchronous lambdas and synchronous local functions nested inside async methods so future DI005 changes preserve correct executable-boundary behavior.

Learn more

2.3.4

DependencyInjection.Lifetime.Analyzers 2.3.4

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI001 Explicit Disposal Accuracy: Scope-disposal analysis now recognizes scope?.Dispose() and reassignment-to-local disposal patterns, reducing false positives for valid explicit disposal code.
  • DI001 Reassignment Leak Detection: Explicit disposal tracking now rejects dispose proofs when the local is reassigned before disposal, including non-scope reassignments, while respecting executable boundaries so lambda-only reassignments do not create noise.
  • DI001 Regression Coverage: Added guardrail tests for conditional disposal, reassignment-to-local, intervening reassignments, expression-based using (CreateScope()), and IServiceProvider.CreateScope() report/no-report behavior.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.4

What changed

Changed

  • DI001 Explicit Disposal Accuracy: Scope-disposal analysis now recognizes scope?.Dispose() and reassignment-to-local disposal patterns, reducing false positives for valid explicit disposal code.
  • DI001 Reassignment Leak Detection: Explicit disposal tracking now rejects dispose proofs when the local is reassigned before disposal, including non-scope reassignments, while respecting executable boundaries so lambda-only reassignments do not create noise.
  • DI001 Regression Coverage: Added guardrail tests for conditional disposal, reassignment-to-local, intervening reassignments, expression-based using (CreateScope()), and IServiceProvider.CreateScope() report/no-report behavior.

Learn more

2.3.3

DependencyInjection.Lifetime.Analyzers 2.3.3

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI003 Deduplication: Captive-dependency reporting now emits one diagnostic per unique captured dependency per registration, reducing duplicate reports when the same scoped/transient service is resolved multiple times inside one singleton factory.
  • Shared Key and Constant Helpers: Extracted keyed-parameter parsing and constant-value extraction into shared infrastructure so DI003, DI015, and registration/factory analysis stay aligned on keyed-service semantics.
  • DI003 Regression Coverage: Added guardrail tests for TryAddSingleton captive dependencies, open-generic constructor no-diagnostic behavior, repeated factory resolutions of the same scoped dependency, and keyed factory resolutions with a null key.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.3

What changed

Changed

  • DI003 Deduplication: Captive-dependency reporting now emits one diagnostic per unique captured dependency per registration, reducing duplicate reports when the same scoped/transient service is resolved multiple times inside one singleton factory.
  • Shared Key and Constant Helpers: Extracted keyed-parameter parsing and constant-value extraction into shared infrastructure so DI003, DI015, and registration/factory analysis stay aligned on keyed-service semantics.
  • DI003 Regression Coverage: Added guardrail tests for TryAddSingleton captive dependencies, open-generic constructor no-diagnostic behavior, repeated factory resolutions of the same scoped dependency, and keyed factory resolutions with a null key.

Learn more

2.3.2

DependencyInjection.Lifetime.Analyzers 2.3.2

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI008 Keyed Registration Fixes: AddKeyedTransient(...) is now fully supported by the DI008 code fix provider, including keyed lifetime rewrites to AddKeyedScoped / AddKeyedSingleton and keyed factory rewrites that preserve the original key argument and generate the correct two-parameter factory lambda shape.
  • DI008 Factory Detection Hardening: Disposable-transient analysis now exercises both delegate-variable and method-group factory registrations for keyed and non-keyed DI paths, keeping DI008 conservative when registrations already use caller-owned factory delegates.
  • DI008 Regression Coverage: Added DI 8 keyed-service analyzer/code-fix tests, guardrails for no-fix typeof(...) factory conversions, and named-key preservation checks so the highest-risk keyed paths are locked by executable coverage instead of code inspection alone.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.2

What changed

Changed

  • DI008 Keyed Registration Fixes: AddKeyedTransient(...) is now fully supported by the DI008 code fix provider, including keyed lifetime rewrites to AddKeyedScoped / AddKeyedSingleton and keyed factory rewrites that preserve the original key argument and generate the correct two-parameter factory lambda shape.
  • DI008 Factory Detection Hardening: Disposable-transient analysis now exercises both delegate-variable and method-group factory registrations for keyed and non-keyed DI paths, keeping DI008 conservative when registrations already use caller-owned factory delegates.
  • DI008 Regression Coverage: Added DI 8 keyed-service analyzer/code-fix tests, guardrails for no-fix typeof(...) factory conversions, and named-key preservation checks so the highest-risk keyed paths are locked by executable coverage instead of code inspection alone.

Learn more

2.3.1

DependencyInjection.Lifetime.Analyzers 2.3.1

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI006 Inherited-Type Coverage: Static provider cache analysis now catches custom interfaces that inherit from IServiceProvider, IServiceScopeFactory, or IKeyedServiceProvider, closing a real false-negative path for wrapper abstractions.
  • DI006 Fixer Safety: The remove-static code fix now stays conservative by refusing fixes for static classes, non-private members, partial types, static local-function usage, and other cases where rewriting could silently break references or produce invalid code.
  • DI006 Regression Coverage: Added targeted should-fix and should-not-fix tests for inherited interface detection, public member no-fix behavior, implicitly private members, static local functions, static classes, multi-variable fields, and partial-type guardrails.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.1

What changed

Changed

  • DI006 Inherited-Type Coverage: Static provider cache analysis now catches custom interfaces that inherit from IServiceProvider, IServiceScopeFactory, or IKeyedServiceProvider, closing a real false-negative path for wrapper abstractions.
  • DI006 Fixer Safety: The remove-static code fix now stays conservative by refusing fixes for static classes, non-private members, partial types, static local-function usage, and other cases where rewriting could silently break references or produce invalid code.
  • DI006 Regression Coverage: Added targeted should-fix and should-not-fix tests for inherited interface detection, public member no-fix behavior, implicitly private members, static local functions, static classes, multi-variable fields, and partial-type guardrails.

Learn more

2.3.0

DependencyInjection.Lifetime.Analyzers 2.3.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI017 Circular Dependency Detection: New diagnostic that detects direct, transitive, and self-referential circular dependencies in constructor injection chains. Uses keyed-service-aware resolution with memoized graph traversal for performance. Conservative by design — skips factory registrations, optional parameters, and IEnumerable<T> dependencies to avoid false positives. Reports deterministically on the lexicographically smallest service type in each cycle.
  • DI018 Non-Instantiable Implementation Detection: New diagnostic that catches implementation types the DI container cannot construct — abstract classes, interfaces, static classes, and types with no public constructors. Skips factory registrations where the factory handles construction. Catches registration mistakes that would otherwise surface as runtime InvalidOperationException.
  • Sample Parity Enforcement: New contract tests that enforce every public diagnostic ID has sample coverage with concrete claim anchors, all contract folder claims reference existing sample directories, and all claimed diagnostic IDs exist in the public inventory.
  • Cross-Rule Interaction Tests: New test suite validating expected multi-rule behavior — DI007+DI011, DI003+DI015, DI008+DI012b, and DI010+DI011 interactions on shared source.
  • Performance Regression Gate: Deterministic stress tests with 200-service registration sets, diamond dependency patterns, and large-scale cycle detection. Memoized cycle detection prevents exponential blowup on acyclic graphs.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.0

What changed

Added

  • DI017 Circular Dependency Detection: New diagnostic that detects direct, transitive, and self-referential circular dependencies in constructor injection chains. Uses keyed-service-aware resolution with memoized graph traversal for performance. Conservative by design — skips factory registrations, optional parameters, and IEnumerable<T> dependencies to avoid false positives. Reports deterministically on the lexicographically smallest service type in each cycle.
  • DI018 Non-Instantiable Implementation Detection: New diagnostic that catches implementation types the DI container cannot construct — abstract classes, interfaces, static classes, and types with no public constructors. Skips factory registrations where the factory handles construction. Catches registration mistakes that would otherwise surface as runtime InvalidOperationException.
  • Sample Parity Enforcement: New contract tests that enforce every public diagnostic ID has sample coverage with concrete claim anchors, all contract folder claims reference existing sample directories, and all claimed diagnostic IDs exist in the public inventory.
  • Cross-Rule Interaction Tests: New test suite validating expected multi-rule behavior — DI007+DI011, DI003+DI015, DI008+DI012b, and DI010+DI011 interactions on shared source.
  • Performance Regression Gate: Deterministic stress tests with 200-service registration sets, diamond dependency patterns, and large-scale cycle detection. Memoized cycle detection prevents exponential blowup on acyclic graphs.

Changed

  • DI012 Accuracy: Wrapper flow ordering restored for invoked helper methods so TryAdd-after-Add detection correctly follows service collection parameters across method boundaries.
  • DI011 Precision: Provider heuristics narrowed to honor selected constructors and reduce service-locator escape hatches, keeping diagnostics focused on real DI misuse.
  • DI012 Flow Scoping: Duplicate registration analysis scoped to service-collection flows to prevent cross-wrapper false positives.
  • Sample Verification Hardening: SARIF-based contract verification tightened with approved secondary diagnostic allowlisting, public diagnostic parity checks, and sample/docs freshness gate integration.

Learn more

2.2.2

DependencyInjection.Lifetime.Analyzers 2.2.2

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI015 Wrapper Reachability: DI015 now expands source-visible IServiceCollection wrapper extensions from real invocation sites instead of treating registrations inside uncalled wrappers as globally available.
  • DI015 Opaque Wrapper Suppression: Earlier opaque or external wrappers on the same IServiceCollection flow now suppress DI015 when registration state is uncertain, reducing false positives in layered registration modules.
  • DI015 Ordering and Flow Isolation: Wrapper-aware resolution now respects call order and per-collection flow, so wrappers invoked on a different IServiceCollection instance or after a registration do not hide genuine missing-dependency diagnostics.
  • DI015 Regression Coverage: Added should-report and should-not-report guardrails for invoked vs uninvoked wrappers, nested wrapper chains, cyclic wrappers, keyed mismatches, opaque external wrappers, same-method flow isolation, and registration ordering.
  • Release Metadata Sync: Backfilled the missing 2.2.1 changelog entry and resynced package metadata so the tagged release train and project version history are aligned again.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.2.2

What changed

Changed

  • DI015 Wrapper Reachability: DI015 now expands source-visible IServiceCollection wrapper extensions from real invocation sites instead of treating registrations inside uncalled wrappers as globally available.
  • DI015 Opaque Wrapper Suppression: Earlier opaque or external wrappers on the same IServiceCollection flow now suppress DI015 when registration state is uncertain, reducing false positives in layered registration modules.
  • DI015 Ordering and Flow Isolation: Wrapper-aware resolution now respects call order and per-collection flow, so wrappers invoked on a different IServiceCollection instance or after a registration do not hide genuine missing-dependency diagnostics.
  • DI015 Regression Coverage: Added should-report and should-not-report guardrails for invoked vs uninvoked wrappers, nested wrapper chains, cyclic wrappers, keyed mismatches, opaque external wrappers, same-method flow isolation, and registration ordering.
  • Release Metadata Sync: Backfilled the missing 2.2.1 changelog entry and resynced package metadata so the tagged release train and project version history are aligned again.

Learn more

2.2.1

DependencyInjection.Lifetime.Analyzers 2.2.1

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI013 Compatibility Hardening: Expanded implementation-type validation beyond simple typeof(service), typeof(implementation) assignability checks so DI013 now also reports deterministic-invalid self-registrations, abstract/interface implementations, private-constructor implementations, and invalid implementation instances when their exact runtime type is known.
  • DI013 Open Generic Precision: Reworked open-generic validation to require exact generic-parameter projection compatibility, rejecting arity mismatches, reordered parameters, transformed generic arguments, and other registrations that compile but cannot be activated by the built-in container.
  • Collector and Engine Support: Extended registration collection to recognize non-factory implementation-instance overloads, keyed registrations, and equivalent ServiceDescriptor forms while keeping factory registrations out of DI013 scope and preventing constructor-based analyzers from treating pre-built instances like activatable implementation types.
  • Regression Coverage and Docs: Expanded DI013 tests across valid/invalid closed, open-generic, keyed, TryAdd*, ServiceDescriptor, and implementation-instance scenarios, and updated README.md, docs/RULES.md, the sample app, and descriptor wording to match the hardened behavior.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.2.1

What changed

Changed

  • DI013 Compatibility Hardening: Expanded implementation-type validation beyond simple typeof(service), typeof(implementation) assignability checks so DI013 now also reports deterministic-invalid self-registrations, abstract/interface implementations, private-constructor implementations, and invalid implementation instances when their exact runtime type is known.
  • DI013 Open Generic Precision: Reworked open-generic validation to require exact generic-parameter projection compatibility, rejecting arity mismatches, reordered parameters, transformed generic arguments, and other registrations that compile but cannot be activated by the built-in container.
  • Collector and Engine Support: Extended registration collection to recognize non-factory implementation-instance overloads, keyed registrations, and equivalent ServiceDescriptor forms while keeping factory registrations out of DI013 scope and preventing constructor-based analyzers from treating pre-built instances like activatable implementation types.
  • Regression Coverage and Docs: Expanded DI013 tests across valid/invalid closed, open-generic, keyed, TryAdd*, ServiceDescriptor, and implementation-instance scenarios, and updated README.md, docs/RULES.md, the sample app, and descriptor wording to match the hardened behavior.

Learn more

2.2.0

DependencyInjection.Lifetime.Analyzers 2.2.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI015 Precision Refactor: Moved unresolved-dependency analysis onto a shared resolution engine with explicit confidence/provenance tracking, so constructor, factory, keyed, open-generic, and strict-mode paths share the same conservative resolution rules.
  • DI015 TryAdd/Descriptor Coverage: Effective TryAdd* registrations now participate in DI015 analysis, while shadowed TryAdd* registrations stay silent to match runtime behaviour; coverage also now includes ServiceDescriptor registration forms and direct IKeyedServiceProvider resolutions.
  • DI015 Code Fix: Added a narrow safe fix that inserts a self-binding registration for one direct concrete constructor dependency when the registration site is local and unambiguous; factory-rooted, keyed, abstract, multi-missing, and transitive-only cases intentionally remain no-fix.
  • DI015 Guardrails: Expanded DI015 regression coverage with paired should-report / should-not-report scenarios for TryAdd*, ServiceDescriptor, framework-provided dependencies, opaque duplicate registrations, and fixer/no-fixer boundaries.
  • Packaging Metadata: Expanded NuGet description, package tags, and release notes so search and package landing pages better describe DI lifetime, scope, and registration coverage.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.2.0

What changed

Changed

  • DI015 Precision Refactor: Moved unresolved-dependency analysis onto a shared resolution engine with explicit confidence/provenance tracking, so constructor, factory, keyed, open-generic, and strict-mode paths share the same conservative resolution rules.
  • DI015 TryAdd/Descriptor Coverage: Effective TryAdd* registrations now participate in DI015 analysis, while shadowed TryAdd* registrations stay silent to match runtime behaviour; coverage also now includes ServiceDescriptor registration forms and direct IKeyedServiceProvider resolutions.
  • DI015 Code Fix: Added a narrow safe fix that inserts a self-binding registration for one direct concrete constructor dependency when the registration site is local and unambiguous; factory-rooted, keyed, abstract, multi-missing, and transitive-only cases intentionally remain no-fix.
  • DI015 Guardrails: Expanded DI015 regression coverage with paired should-report / should-not-report scenarios for TryAdd*, ServiceDescriptor, framework-provided dependencies, opaque duplicate registrations, and fixer/no-fixer boundaries.
  • Packaging Metadata: Expanded NuGet description, package tags, and release notes so search and package landing pages better describe DI lifetime, scope, and registration coverage.
  • Adoption Docs: Added docs/ADOPTION.md and linked it from README.md so teams evaluating the analyzer have a fast install and rollout path.
  • Repository Intake: Added GitHub issue-template routing to point users toward setup guidance and the full rule reference before they file issues.
  • Growth Automation: Added tools/generate-growth-assets.mjs to generate a searchable static docs site, problem-intent landing pages, version-synced README install snippets, and curated release notes from the repo source material.
  • GitHub Pages: Added automated Pages publishing plus CI verification for the generated docs site, sitemap, robots.txt, and search index.
  • Release Surfaces: Updated release automation to generate GitHub Release body content and package release-note input from CHANGELOG.md instead of relying on generic auto-generated notes.

Learn more

2.1.4

What's Changed

Full Changelog: georgepwall1991/DependencyInjection.Lifetime.Analyzers@v2.1.3...v2.1.4

2.1.3

What's Changed

Full Changelog: georgepwall1991/DependencyInjection.Lifetime.Analyzers@v2.1.2...v2.1.3

2.1.2

Full Changelog: georgepwall1991/DependencyInjection.Lifetime.Analyzers@v2.1.1...v2.1.2

Commits viewable in compare view.

Updated MailKit from 4.14.1 to 4.15.1.

Release notes

Sourced from MailKit's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.14.

Release notes

Sourced from Microsoft.Extensions.Http.Polly's releases.

9.0.14

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.13...v9.0.14

9.0.13

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.12...v9.0.13)

9.0.12

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.11...v9.0.12

9.0.11

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.10...v9.0.11

9.0.10

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.9...v9.0.10

9.0.9

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.8...v9.0.9

9.0.7

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.6...v9.0.7

9.0.6

Bug Fixes

  • Forwarded Headers Middleware: Ignore X-Forwarded-Headers from Unknown Proxy (#​61622)
    The Forwarded Headers Middleware now ignores X-Forwarded-Headers sent from unknown proxies. This change improves security by ensuring that only trusted proxies can influence forwarded header values, preventing potential spoofing or misrouting issues.

Dependency Updates

  • Bump src/submodules/googletest from 52204f7 to 04ee1b4 (#​61762)
    Updates the GoogleTest submodule to a newer commit, bringing in the latest improvements and bug fixes from the upstream project.
  • Update dependencies from dotnet/arcade (#​61714)
    Updates internal build and infrastructure dependencies from the dotnet/arcade repository, ensuring compatibility and access to the latest build tools.
  • Update dependencies from dotnet/extensions (#​61571)
    Refreshes dependencies from the dotnet/extensions repository, incorporating the latest features and fixes from the extensions libraries.
  • Update dependencies from dotnet/extensions (#​61877)
    Further updates dependencies from dotnet/extensions, ensuring the project benefits from recent improvements and bug fixes.
  • Update dependencies from dotnet/arcade (#​61892)
    Additional updates to build and infrastructure dependencies from dotnet/arcade, maintaining up-to-date tooling and build processes.

Miscellaneous

  • Update branding to 9.0.6 (#​61831)
    Updates the project version and branding to 9.0.6, reflecting the new release and ensuring version consistency across the codebase.
  • Merging internal commits for release/9.0 (#​61925)
    Incorporates various internal commits into the release/9.0 branch, ensuring that all relevant changes are included in this release.

This summary is generated and may contain inaccuracies. For complete details, please review the linked pull requests.

Full Changelog: v9.0.5...v9.0.6

9.0.5

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.4...v9.0.5

9.0.4

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.3...v9.0.4

9.0.3

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.2...v9.0.3

9.0.2

Release

What's Changed

Description has been truncated

@dependabot
Bump AsyncKeyedLock and 10 others
eabd482 
Bumps AsyncKeyedLock from 8.0.1 to 8.0.2
Bumps DependencyInjection.Lifetime.Analyzers from 2.1.1 to 2.4.0
Bumps MailKit from 4.14.1 to 4.15.1
Bumps Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.14
Bumps Microsoft.SourceLink.GitHub from 10.0.102 to 10.0.201
Bumps SkiaSharp from 3.119.1 to 3.119.2
Bumps SkiaSharp.HarfBuzz from 3.119.1 to 3.119.2
Bumps SkiaSharp.NativeAssets.Linux from 3.119.1 to 3.119.2
Bumps SonarAnalyzer.CSharp from 10.19.0.132793 to 10.22.0.136894
Bumps System.IO.Hashing from 9.0.0 to 10.0.5
Bumps System.ServiceModel.Syndication from 9.0.0 to 9.0.14

---
updated-dependencies:
- dependency-name: AsyncKeyedLock
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: DependencyInjection.Lifetime.Analyzers
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: MailKit
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: Microsoft.Extensions.Http.Polly
  dependency-version: 9.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: Microsoft.SourceLink.GitHub
  dependency-version: 10.0.201
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: System.IO.Hashing
  dependency-version: 10.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: tests
- dependency-name: SkiaSharp
  dependency-version: 3.119.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: SkiaSharp.HarfBuzz
  dependency-version: 3.119.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: SkiaSharp.NativeAssets.Linux
  dependency-version: 3.119.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.22.0.136894
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: System.ServiceModel.Syndication
  dependency-version: 9.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Mar 31, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Mar 31, 2026

Superseded by #223.

@dependabot dependabot bot closed this Mar 31, 2026
@dependabot dependabot bot deleted the dependabot/nuget/src/DNTCommon.Web.Core/tests-21c69d80e5 branch March 31, 2026 19:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants