Skip to content

Bump Microsoft.ComponentDetection.Contracts and 2 others#1468

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/nuget/multi-2de081190a
Closed

Bump Microsoft.ComponentDetection.Contracts and 2 others#1468
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/nuget/multi-2de081190a

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 9, 2026

Updated Microsoft.ComponentDetection.Contracts from 6.3.0 to 7.0.17.

Release notes

Sourced from Microsoft.ComponentDetection.Contracts's releases.

7.0.17

⚙️ Changes

  • Bump mvn cli detector timeout to 9 min by @​zhenghao104 (#​1771)

7.0.16

⚙️ Changes

  • Simplify PatternMatchingUtility by removing expression trees by @​JamieMagee (#​1766)
  • Replace DotNet.Glob with Microsoft.Extensions.FileSystemGlobbing by @​JamieMagee (#​1767)

7.0.15

⚙️ Changes

  • Reapply "Add OCI image support to Linux scanner (#​1708)" (#​1716) by @​jasonpaulos (#​1717)

7.0.14

⚙️ Changes

  • Promote MavenWithFallback detector replacing MvnCli by @​zhenghao104 (#​1756)

7.0.13

⚙️ Changes

  • Fix VcpkgComponent purl construction for names containing slashes by @​JamieMagee (#​1752)
  • Reapply "Update packageurl-dotnet to 2.0.0-rc.2 (#​1730)" (#​1751) by @​JamieMagee (#​1753)

7.0.12

⚙️ Changes

  • Revert: Bump packageurl-dotnet from 2.0.0-rc.2 to 1.0.0 by @​zhenghao104 (#​1751)
  • Fix Docker scan timeout cancellation not working by @​AMaini503 (#​1729)

7.0.11

⚙️ Changes

  • Bump packageurl-dotnet from 2.0.0-rc.2 to 2.0.0-rc.3 by @​JamieMagee (#​1737)
  • Only run smoketests in PRs targetting main repository by @​grvillic (#​1736)

7.0.10

⚙️ Changes

  • More maven parsing fix for experiment detector by @​zhenghao104 (#​1724)
  • Bump werkzeug from 3.1.5 to 3.1.6 in /test/Microsoft.ComponentDetection.VerificationTests/resources/uv by @dependabot[bot] (#​1682)

🧰 Maintenance

  • Bump release-drafter/release-drafter from 6.4.0 to 7.0.0 by @dependabot[bot] (#​1720)
  • Bump step-security/harden-runner from 2.15.1 to 2.16.0 by @dependabot[bot] (#​1725)
  • Bump shogo82148/actions-upload-release-asset from 1.9.2 to 1.10.0 by @dependabot[bot] (#​1726)
  • Bump github/codeql-action from 4.32.6 to 4.33.0 by @dependabot[bot] (#​1727)
  • Bump mshick/add-pr-comment from 2.8.2 to 3.9.0 by @dependabot[bot] (#​1728)

7.0.9

⚙️ Changes

  • Allow prerelease dependency in Contracts NuGet package by @​JamieMagee (#​1731)

7.0.8

⚙️ Changes

  • Update packageurl-dotnet to 2.0.0-rc.2 by @​JamieMagee (#​1730)
  • [WIP] Fix NPM detector to differentiate packages by namespace by @copilot-swe-agent[bot] (#​1713)

7.0.7

⚙️ Changes

  • Fix maven detector race conditions by @​zhenghao104 (#​1719)
  • Revert "Add OCI image support to Linux scanner (#​1708)" by @​jasonpaulos (#​1716)
  • Revert "Add Docker archive support to Linux scanner (#​1711)" by @​jasonpaulos (#​1715)

7.0.6

⚙️ Changes

  • Add Docker archive support to Linux scanner by @​jasonpaulos (#​1711)
  • Add OCI image support to Linux scanner by @​jasonpaulos (#​1708)

🧰 Maintenance

  • Bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by @dependabot[bot] (#​1706)

7.0.5

⚙️ Changes

  • Fix submodule bug in MavenFallbackDetector by @​zhenghao104 (#​1685)
  • Enable nullable types in Linux detector files by @​jasonpaulos (#​1709)

7.0.4

⚙️ Changes

  • Mark detectors as public by @​JamieMagee (#​1707)

7.0.3

⚙️ Changes

  • Revert some internal changes by @​JamieMagee (#​1705)

7.0.2

⚙️ Changes

  • chore(deps): update release-drafter/release-drafter digest to 6a93d82 by @renovate[bot] (#​1701)
  • Fix SwiftComponent.PackageUrl JSON property name collision on .NET 10 by @​JamieMagee (#​1704)
  • Detect self-contained projects in DotNetComponentDetector by @​ericstj (#​1689)
  • Run snapshot publish on a schedule by @​JamieMagee (#​1700)
  • refactor: make Orchestrator implementation details internal by @​JamieMagee (#​1696)
  • refactor: make Common implementation details internal by @​JamieMagee (#​1695)
  • refactor: make detector implementation details internal by @​JamieMagee (#​1694)
  • refactor: standardize InternalsVisibleTo in csproj files by @​JamieMagee (#​1690)
  • [MSTest.Sdk] Cleanup property by @​Evangelink (#​1697)

🧰 Maintenance

  • Bump release-drafter/release-drafter from 6.2.0 to 6.3.0 by @dependabot[bot] (#​1699)

7.0.1

⚙️ Changes

  • Add LicenseConcluded and Suppliers to ScannedComponent by @​pauld-msft (#​1684)
  • Use MSTest.Sdk and opt-in to MTP by @​Evangelink (#​1680)
  • Update dependency Polly to 8.6.6 by @renovate[bot] (#​1691)

🧰 Maintenance

  • Bump step-security/harden-runner from 2.14.2 to 2.15.1 by @dependabot[bot] (#​1688)
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] (#​1676)
  • Bump github/codeql-action from 4.32.3 to 4.32.6 by @dependabot[bot] (#​1686)
  • Bump actions/setup-dotnet from 5.1.0 to 5.2.0 by @dependabot[bot] (#​1687)

7.0.0

⚙️ Changes

  • Pauldorsch/public cd contract update by @​pauld-msft (#​1678)

6.5.0

⚙️ Changes

  • Update dependency yamldotnet to v16 by @renovate[bot] (#​1659)
  • Update vulnerable dependencies in verification test fixtures by @​JamieMagee (#​1670)
  • Bump express, typescript, re2, @​types/react in pnpm verification test resources by @​JamieMagee (#​1665)
  • Bump express, typescript, re2, @​types/react in yarn verification test resources by @​JamieMagee (#​1667)
  • Bump commons-text to 1.12.0 in maven verification test resources by @​JamieMagee (#​1661)
  • Bump Microsoft.Owin packages to 4.2.2 in nuget verification test resources by @​JamieMagee (#​1663)
  • Bump go directive to 1.22 in verification test resources by @​JamieMagee (#​1660)
  • Bump certifi, zipp, setuptools, azure-identity in pip verification test resources by @​JamieMagee (#​1664)
  • Bump black, ipython in poetry verification test resources by @​JamieMagee (#​1666)
  • Bump express, typescript, re2, @​types/react in npm verification test resources by @​JamieMagee (#​1662)
  • Add application-layer Syft factories for 6 new ecosystems by @​JamieMagee (#​1632)
  • Fix System.Text.Json MSB3277 version conflict by @​JamieMagee (#​1669)
  • Fix snapshot verify workflow on Windows by @​JamieMagee (#​1668)
  • Update dependency python to 3.14 by @renovate[bot] (#​1658)
  • Update dotnet monorepo by @renovate[bot] (#​1644)
  • Update dependency MinVer to v7 by @renovate[bot] (#​1656)
  • Fix zizmor workflow security findings by @​JamieMagee (#​1657)
  • Update dependency AwesomeAssertions to 9.4.0 by @renovate[bot] (#​1654)
  • Update dependency Tomlyn.Signed to 0.20.0 by @renovate[bot] (#​1655)
  • Update dependency Spectre.Console.Cli.Extensions.DependencyInjection to 0.23.0 by @renovate[bot] (#​1578)
  • Update dependency MinVer to 6.1.0 by @renovate[bot] (#​1653)
  • Bump urllib3 from 2.6.0 to 2.6.3 in /test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-2 by @dependabot[bot] (#​1652)
  • Bump urllib3 from 2.2.1 to 2.6.3 in /test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-4 by @dependabot[bot] (#​1651)
  • Bump requests from 2.28.1 to 2.32.4 in /test/Microsoft.ComponentDetection.Detectors.Tests/Mocks/InvalidJsonReport by @dependabot[bot] (#​1650)
  • Bump urllib3 from 2.4.0 to 2.6.3 in /test/Microsoft.ComponentDetection.VerificationTests/resources/uv by @dependabot[bot] (#​1622)
  • Bump urllib3 from 2.2.1 to 2.6.3 in /test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-3 by @dependabot[bot] (#​1649)
  • Update dependency Serilog to 4.3.1 by @renovate[bot] (#​1648)
  • Update release-drafter/release-drafter digest to 6db134d by @renovate[bot] (#​1647)
  • Bump azure-core from 1.34.0 to 1.38.0 in /test/Microsoft.ComponentDetection.VerificationTests/resources/uv by @dependabot[bot] (#​1625)
  • Update actions/setup-dotnet action to v5.1.0 by @renovate[bot] (#​1640)
  • Update nuget monorepo to 7.3.0 by @renovate[bot] (#​1646)
  • Update mstest monorepo to 4.1.0 by @renovate[bot] (#​1645)
  • Update step-security/harden-runner action to v2.14.2 by @renovate[bot] (#​1639)
  • Update zizmorcore/zizmor-action action to v0.5.0 by @renovate[bot] (#​1643)
  • Update actions/setup-python digest to a309ff8 by @renovate[bot] (#​1635)
  • Update github/codeql-action action to v4.32.3 by @renovate[bot] (#​1641)
  • Update codecov/codecov-action action to v5.5.2 by @renovate[bot] (#​1637)
  • Update stefanzweifel/git-auto-commit-action action to v7.1.0 by @renovate[bot] (#​1642)
  • Update actions/checkout action to v6.0.2 by @renovate[bot] (#​1636)
  • Update shogo82148/actions-upload-release-asset action to v1.9.2 by @renovate[bot] (#​1638)
  • Bump cryptography from 45.0.3 to 46.0.5 in /test/Microsoft.ComponentDetection.VerificationTests/resources/uv by @dependabot[bot] (#​1634)
  • Bump werkzeug from 3.1.3 to 3.1.5 in /test/Microsoft.ComponentDetection.VerificationTests/resources/uv by @dependabot[bot] (#​1623)
  • Bump github.com/sirupsen/logrus from 1.8.1 to 1.8.3 in /test/Microsoft.ComponentDetection.VerificationTests/resources/go by @dependabot[bot] (#​1585)
  • Bump requests from 2.31.0 to 2.32.4 in /test/Microsoft.ComponentDetection.VerificationTests/resources/pip/roots by @dependabot[bot] (#​1427)
  • Bump urllib3 from 2.2.1 to 2.6.3 in /test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-5 by @dependabot[bot] (#​1609)
  • Bump urllib3 from 2.2.1 to 2.6.3 in /test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-1 by @dependabot[bot] (#​1604)
  • Bump urllib3 from 2.2.1 to 2.6.0 in /test/Microsoft.ComponentDetection.VerificationTests/resources/pip/parallel/parallel-test-2 by @dependabot[bot] (#​1589)
  • Bump azure-core from 1.30.0 to 1.38.0 in /test/Microsoft.ComponentDetection.VerificationTests/resources/pip/roots by @dependabot[bot] (#​1611)
  • Bump requests from 2.28.1 to 2.32.4 in /test/Microsoft.ComponentDetection.Detectors.Tests/Mocks/EmptyReport by @dependabot[bot] (#​1608)
    ... (truncated)

6.4.0

⚙️ Changes

  • Maven combined detector experiment by @​zhenghao104 (#​1628)

Commits viewable in compare view.

Updated packageurl-dotnet from 1.1.0 to 2.0.0-rc.3.

Release notes

Sourced from packageurl-dotnet's releases.

2.0.0-rc.3

What's Changed

New Contributors

Full Changelog: package-url/packageurl-dotnet@2.0.0-rc.2...2.0.0-rc.3

2.0.0-rc.2

What's Changed

Full Changelog: package-url/packageurl-dotnet@2.0.0-rc.1...2.0.0-rc.2

2.0.0-rc.1

What's Changed

1.3.0

What's Changed

New Contributors

Full Changelog: package-url/packageurl-dotnet@1.2.1...1.3.0

1.2.1

What's Changed

New Contributors

Full Changelog: package-url/packageurl-dotnet@1.2.0...1.2.1

1.2.0

What's Changed

New Contributors

Full Changelog: package-url/packageurl-dotnet@1.1.1...1.2.0

1.1.1

What's Changed

New Contributors

Full Changelog: package-url/packageurl-dotnet@1.1.0...1.1.1

Commits viewable in compare view.

Updated System.Text.Json from 9.0.10 to 9.0.13.

Release notes

Sourced from System.Text.Json's releases.

9.0.13

Release

What's Changed

Full Changelog: dotnet/runtime@v9.0.12...v9.0.13

9.0.12

Release

9.0.11

Release

What's Changed

Full Changelog: dotnet/runtime@v9.0.10...v9.0.11

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps Microsoft.ComponentDetection.Contracts from 6.3.0 to 7.0.17
Bumps packageurl-dotnet from 1.1.0 to 2.0.0-rc.3
Bumps System.Text.Json from 9.0.10 to 9.0.13

---
updated-dependencies:
- dependency-name: Microsoft.ComponentDetection.Contracts
  dependency-version: 7.0.17
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: packageurl-dotnet
  dependency-version: 2.0.0-rc.3
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: System.Text.Json
  dependency-version: 9.0.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Apr 9, 2026
@dependabot dependabot bot requested a review from a team as a code owner April 9, 2026 04:35
@dependabot dependabot bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Apr 9, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 9, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Apr 9, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 9, 2026

Superseded by #1469.

@dependabot dependabot bot deleted the dependabot/nuget/multi-2de081190a branch April 9, 2026 21:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants