Skip to content

fix(deps): land the eleven open Dependabot updates together - #236

Merged
AdCodicem merged 11 commits into
mainfrom
claude/quirky-dirac-stso3z
Oct 27, 2026
Merged

fix(deps): land the eleven open Dependabot updates together#236
AdCodicem merged 11 commits into
mainfrom
claude/quirky-dirac-stso3z

Conversation

@AdCodicem

@AdCodicem AdCodicem commented Oct 27, 2026

Copy link
Copy Markdown
Owner

What changed

The eleven open Dependabot pull requests, each one a commit of its own, cherry-picked onto main (-x names the original commit). They were all green, but stuck: they were behind main, waiting on a review, or in conflict. They land here in one Rebase and merge, with no squash, so each commit keeps its type for semantic-release:

Commit Replaces Type
Bump LateApexEarlySpeed.Json.Schema and 6 others (MessagePack 3.1.12, Microsoft.Extensions.AI.Abstractions 10.11.0, …) #221 fix(deps): these dependencies ship
Bump the hotchocolate group to 16.6.9 #235 fix(deps): HotChocolate.Types ships
Bump the actions group (create-github-app-token, scorecard-action, codeql-action) #203 ci(deps)
Bump undici (release tooling) #215 ci(deps)
docusaurus group (react, react-dom 19.3.1), qs, follow-redirects, launch-editor, body-parser, fast-uri, undici in /website #202, #234, #233, #219, #218, #217, #216 chore(deps)

Two changes go beyond Dependabot's diffs:

  • fix(deps): Bump the hotchocolate group with 2 updates #235 conflicted with ADR 0015, which removed the HotChocolate.Data pin. The resolution keeps main's version.
  • The HotChocolate family requires a single version, and Dependabot had left HotChocolate.AspNetCore at 16.6.8. It moves to 16.6.9 with HotChocolate.Types and HotChocolate.Types.Analyzers. 16.6.9 was published on 2026-10-19, so it is past the seven-day cooldown.

Labelled ci:heavy because MessagePack moves (native AOT). Once this merges, Dependabot closes its pull requests as superseded.

Checklist

  • The unit projects of the families changed pass locally: core (2,241), GraphQL (178), Observability (382), Serialization (1,073), Text (141). dotnet restore reports no NU1608 or NU1109, and the Release build has no warning. The generator suite was not run locally (no generator change); CI runs it.
  • Codecov: no code changes.
  • No change to the consumer surface.
  • No new diagnostic.
  • No benchmark claim affected.
  • 11 commits.

Generated by Claude Code

dependabot Bot and others added 11 commits October 27, 2026 22:04
@dependabot @claude
fix(deps): Bump LateApexEarlySpeed.Json.Schema and 6 others
ea1c96f 
Bumps LateApexEarlySpeed.Json.Schema from 4.2.0 to 4.2.2
Bumps MessagePack from 3.1.11 to 3.1.12
Bumps Microsoft.Agents.AI from 1.24.0 to 1.25.0
Bumps Microsoft.Extensions.AI.Abstractions from 10.10.1 to 10.11.0
Bumps Microsoft.Extensions.AI.OpenAI from 10.10.1 to 10.11.0
Bumps Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0
Bumps Microsoft.SourceLink.GitHub from 10.0.401 to 10.0.402

---
updated-dependencies:
- dependency-name: LateApexEarlySpeed.Json.Schema
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: MessagePack
  dependency-version: 3.1.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Agents.AI
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.AI.Abstractions
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.AI.OpenAI
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.SourceLink.GitHub
  dependency-version: 10.0.402
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit c867be8)
@dependabot @claude
fix(deps): Bump the hotchocolate group to 16.6.9
367cac4 
HotChocolate.AspNetCore moves to 16.6.9 with HotChocolate.Types and HotChocolate.Types.Analyzers: the
family requires one version, and Dependabot left it behind.

Bumps HotChocolate.Types from 16.6.8 to 16.6.9
Bumps HotChocolate.Types.Analyzers from 16.6.8 to 16.6.9

---
updated-dependencies:
- dependency-name: HotChocolate.Types
  dependency-version: 16.6.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: hotchocolate
- dependency-name: HotChocolate.Types.Analyzers
  dependency-version: 16.6.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: hotchocolate
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 7549ea8)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018bXdF2eLZjHdqq7DtzuFE7
@dependabot @claude
ci(deps): Bump the actions group across 1 directory with 3 updates
c38ac0c 
Bumps the actions group with 3 updates in the / directory: [actions/create-github-app-token](https://github.com/actions/create-github-app-token), [ossf/scorecard-action](https://github.com/ossf/scorecard-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).

Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@bcd2ba4...64ab729)

Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@2d11466...fa7117d)

Updates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@24c5418...6f2ac81)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: ossf/scorecard-action
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit a6595cd)
@dependabot @claude
ci(deps): Bump undici
04846c4 
Bumps  and [undici](https://github.com/nodejs/undici). These dependencies needed to be updated together.

Updates `undici` from 7.29.1 to 7.30.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.29.1...v7.30.1)

Updates `undici` from 6.28.1 to 6.29.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.29.1...v7.30.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.29.1
  dependency-type: indirect
- dependency-name: undici
  dependency-version: 7.30.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit e8ac875)
@dependabot @claude
chore(deps): Bump the docusaurus group across 1 directory with 2 updates
9bccc0a 
Bumps the docusaurus group with 2 updates in the /website directory: [react](https://github.com/react/react/tree/HEAD/packages/react) and [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom).

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

---
updated-dependencies:
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docusaurus
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docusaurus
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 6abf03a)
@dependabot @claude
chore(deps): Bump qs from 6.16.0 to 6.17.0 in /website
42d3db9 
Bumps [qs](https://github.com/ljharb/qs) from 6.16.0 to 6.17.0.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.16.0...v6.17.0)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.17.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 6733416)
@dependabot @claude
chore(deps): Bump follow-redirects from 1.16.0 to 1.16.2 in /website
594ba79 
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.16.0 to 1.16.2.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.2)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit af8e898)
@dependabot @claude
chore(deps): Bump launch-editor from 2.14.1 to 2.14.2 in /website
4d352d0 
Bumps [launch-editor](https://github.com/vitejs/launch-editor) from 2.14.1 to 2.14.2.
- [Commits](vitejs/launch-editor@v2.14.1...v2.14.2)

---
updated-dependencies:
- dependency-name: launch-editor
  dependency-version: 2.14.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 2dcb893)
@dependabot @claude
chore(deps): Bump body-parser from 1.20.8 to 1.20.9 in /website
f3e4cb9 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.8 to 1.20.9.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.9/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.8...1.20.9)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 1.20.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 69df60f)
@dependabot @claude
chore(deps): Bump fast-uri from 3.1.8 to 3.1.9 in /website
743f98e 
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.8 to 3.1.9.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 78123f7)
@dependabot @claude
chore(deps): Bump undici from 7.30.0 to 7.30.1 in /website
af1a1f6 
Bumps [undici](https://github.com/nodejs/undici) from 7.30.0 to 7.30.1.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.30.0...v7.30.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.30.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 6e4bd3c)
@AdCodicem AdCodicem added dependencies Pull requests that update a dependency file ci:heavy labels Oct 27, 2026 — with Claude
@codecov

codecov Bot commented Oct 27, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@AdCodicem
AdCodicem merged commit c6d0a35 into main Oct 27, 2026
41 checks passed
@AdCodicem
AdCodicem deleted the claude/quirky-dirac-stso3z branch October 27, 2026 22:28
This was referenced Oct 29, 2026
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ci:heavy dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AdCodicem