Upgrade to DotNet 10, with CPM (Central Package Management) and NativeAoT Support - #1109
Open
ThaDaVos wants to merge 23 commits into
Open
Upgrade to DotNet 10, with CPM (Central Package Management) and NativeAoT Support#1109ThaDaVos wants to merge 23 commits into
ThaDaVos wants to merge 23 commits into
Conversation
…hierachy for the package versions so everything uses the same package versions
…o they are only mentioned once and on the corresponding level op props file
There was a problem hiding this comment.
Pull request overview
This PR is a WIP modernization pass across the Pulumi .NET repo to move projects toward .NET 10 while adopting NuGet Central Package Management (CPM) in multiple subtrees (sdk/, pulumi-language-dotnet/, integration_tests/, and testdata fixtures). The changes primarily standardize package versioning (via Directory.Packages.props) and update project target frameworks, with a few small test correctness tweaks.
Changes:
- Upgrade several SDK/test projects to
net10.0(or update target frameworks in affected SDK components). - Introduce CPM via new
Directory.Packages.propsfiles and remove per-projectPackageReference Version=...in many fixture/test.csprojfiles. - Minor test fix: normalize line endings on both expected and actual JSON strings in
OutputTests.
Reviewed changes
Copilot reviewed 193 out of 193 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| sdk/Pulumi.Tests/Pulumi.Tests.csproj | Move tests to net10.0 and rely on CPM for package versions. |
| sdk/Pulumi.Tests/Core/OutputTests.cs | Normalize line endings on both expected and actual strings to stabilize cross-platform assertions. |
| sdk/Pulumi.FSharp/Pulumi.FSharp.fsproj | Move Pulumi.FSharp package build to net10.0 and rely on CPM for SourceLink. |
| sdk/Pulumi.Automation.Tests/Pulumi.Automation.Tests.csproj | Move tests to net10.0 and rely on CPM for package versions. |
| sdk/Pulumi.Automation.Codegen/Pulumi.Automation.Codegen.csproj | Move codegen tool to net10.0 and rely on CPM for Roslyn package version. |
| sdk/Pulumi.Automation.Codegen.Tests/Pulumi.Automation.Codegen.Tests.csproj | Move codegen tests to net10.0 and rely on CPM for test package versions. |
| sdk/Directory.Packages.props | Add SDK-scoped CPM file defining core SDK/test package versions and importing repo-root CPM. |
| pulumi-language-dotnet/testdata/sdks/simple-27.0.0/Pulumi.Simple.csproj | Remove explicit SourceLink version in a fixture SDK project (now relies on CPM). |
| pulumi-language-dotnet/testdata/sdks/simple-26.0.0/Pulumi.Simple.csproj | Remove explicit SourceLink version in a fixture SDK project (now relies on CPM). |
| pulumi-language-dotnet/testdata/projects/l3-splat/l3-splat.csproj | Reformat and remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l3-resource-keyword-overlap/l3-resource-keyword-overlap.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l3-range-resource-output-traversal/l3-range-resource-output-traversal.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l3-range-parent-scope/l3-range-parent-scope.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l3-component-simple/l3-component-simple.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l3-component-provider/l3-component-provider.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-target-up-with-new-dependency/0/l2-target-up-with-new-dependency.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-simple/l2-resource-simple.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-primitive-defaults/l2-resource-primitive-defaults.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-parent-inheritance/l2-resource-parent-inheritance.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-order/l2-resource-order.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-version/l2-resource-option-version.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-version-sdk/l2-resource-option-version-sdk.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-retain-on-delete/l2-resource-option-retain-on-delete.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-replace-on-changes/0/l2-resource-option-replace-on-changes.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-protect/l2-resource-option-protect.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-plugin-download-url/l2-resource-option-plugin-download-url.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-import/l2-resource-option-import.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-ignore-changes/l2-resource-option-ignore-changes.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-hooks/l2-resource-option-hooks.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-env-var-mappings/l2-resource-option-env-var-mappings.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-depends-on/l2-resource-option-depends-on.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-deleted-with/l2-resource-option-deleted-with.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-delete-before-replace/0/l2-resource-option-delete-before-replace.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-option-additional-secret-outputs/l2-resource-option-additional-secret-outputs.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-keyword-overlap/l2-resource-keyword-overlap.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-invoke-dynamic-function/l2-resource-invoke-dynamic-function.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-hook-on-error/l2-resource-hook-on-error.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-hook-ignore-errors/l2-resource-hook-ignore-errors.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-hook-after-failure/l2-resource-hook-after-failure.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-const/l2-resource-const.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-resource-alpha/l2-resource-alpha.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-ref-ref/l2-ref-ref.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-provider-call/l2-provider-call.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-primitive-ref/l2-primitive-ref.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-plain-component/l2-plain-component.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-parameterized-resource/l2-parameterized-resource.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-parallel-resources/l2-parallel-resources.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-name-conflicts/l2-name-conflicts.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-logical-name/l2-logical-name.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-large-string/l2-large-string.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-keywords/l2-keywords.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-invoke-variants/l2-invoke-variants.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-invoke-simple/l2-invoke-simple.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-invoke-output-only/l2-invoke-output-only.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-invoke-options/l2-invoke-options.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-invoke-multi-argument/l2-invoke-multi-argument.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-invoke-dependencies/l2-invoke-dependencies.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-index-mod/l2-index-mod.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-failed-create/l2-failed-create.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-failed-create-continue-on-error/l2-failed-create-continue-on-error.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-external-enum/l2-external-enum.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-extension-parameterized-resource/l2-extension-parameterized-resource.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-extension-and-base-resource/l2-extension-and-base-resource.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-explicit-providers/l2-explicit-providers.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-explicit-provider/l2-explicit-provider.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-explicit-parameterized-provider/l2-explicit-parameterized-provider.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-enum/l2-enum.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-engine-update-options/l2-engine-update-options.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-discriminated-union/l2-discriminated-union.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-destroy/0/l2-destroy.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-component-program-resource-ref/l2-component-program-resource-ref.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-component-component-resource-ref/l2-component-component-resource-ref.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l2-component-call-simple/l2-component-call-simple.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-stack-reference/l1-stack-reference.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-output-string/l1-output-string.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-output-number/l1-output-number.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-output-null/l1-output-null.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-output-bool/l1-output-bool.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-main/subdir/l1-main.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-empty/l1-empty.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-config-types-primitive/l1-config-types-primitive.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-config-secret/l1-config-secret.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-string/l1-builtin-string.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-stash/0/l1-builtin-stash.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-sha1/l1-builtin-sha1.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-secret/l1-builtin-secret.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-require-pulumi-version/l1-builtin-require-pulumi-version.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-project-root/l1-builtin-project-root.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-project-root-main/subdir/l1-builtin-project-root-main.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-list/l1-builtin-list.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-info/l1-builtin-info.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-file/l1-builtin-file.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-cwd/l1-builtin-cwd.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/projects/l1-builtin-base64/l1-builtin-base64.csproj | Remove inline package versions to rely on CPM in fixture project. |
| pulumi-language-dotnet/testdata/overrides/l2-component-property-deps/l2-component-property-deps.csproj | Remove inline package versions to rely on CPM in override fixture. |
| pulumi-language-dotnet/testdata/Directory.Packages.props | Enable CPM for pulumi-language-dotnet/testdata subtree (imports parent CPM). |
| pulumi-language-dotnet/Directory.Packages.props | Enable CPM for pulumi-language-dotnet subtree (imports repo-root CPM). |
| pulumi-language-dotnet/codegen/testdata/using-shared-types-in-config/Pulumi.Credentials.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/urn-id-properties/Pulumi.Urnid.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/unions-inside-arrays/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/unions-inline/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/transpiled_examples/random-pp/random-pp.csproj | Remove inline package versions in transpiled example to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/transpiled_examples/kubernetes-pp/kubernetes-pp.csproj | Remove inline package versions in transpiled example to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/transpiled_examples/cue-random-pp/cue-random-pp.csproj | Remove inline package versions in transpiled example to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/simplified-invokes/Pulumi.Std.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/simple-yaml-schema/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/simple-resource-with-aliases/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/simple-resource-schema/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/simple-resource-schema-custom-pypackage-name/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/simple-plain-schema/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/simple-plain-schema-with-root-package/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/simple-methods-schema/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/simple-methods-schema-single-value-returns/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/simple-enum-schema/Pulumi.Plant.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/secrets/Pulumi.Mypkg.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/resource-property-overlap/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/resource-args-python/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/resource-args-python-case-insensitive/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/regress-node-8110/Pulumi.My8110.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/regress-8403/Pulumi.Mongodbatlas.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/provider-type-schema/Pulumi.ProviderType.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/provider-config-schema/Configstation.Pulumi.Configstation.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/plain-schema-gh6957/Pulumi.Xyz.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/plain-object-disable-defaults/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/plain-object-defaults/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/plain-and-default/Pulumi.FooBar.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/output-funcs-edgeorder/Pulumi.Myedgeorder.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/other-owned/Other.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/nested-module/Pulumi.Foo.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/nested-module-thirdparty/Pulumi.FooBar.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/naming-collisions/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/legacy-names/Pulumi.Legacy_names.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/kubernetes20/Pulumi.Kubernetes.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/hyphenated-symbols/Pulumi.Repro.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/functions-secrets/Pulumi.Mypkg.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/enum-reference/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/cyclic-types/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/config-variables/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/azure-native-nested-types/Pulumi.AzureNative.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/assets-and-archives/Pulumi.Example.csproj | Remove inline package versions in codegen fixture project to rely on CPM. |
| pulumi-language-dotnet/codegen/testdata/Directory.Packages.props | Add CPM file for codegen/testdata subtree defining versions for fixture-only packages. |
| pulumi-language-dotnet/codegen/Directory.Packages.props | Enable CPM for pulumi-language-dotnet/codegen subtree (imports parent CPM). |
| integration_tests/transformations_simple/Transformations.csproj | Remove inline package versions to rely on CPM in integration test project. |
| integration_tests/provider_construct/dotnet/ProviderConstruct.csproj | Normalize formatting and remove inline test package versions to rely on CPM. |
| integration_tests/provider_construct_dependencies/dotnet/ProviderConstructDependencies.csproj | Normalize formatting and remove inline test package versions to rely on CPM. |
| integration_tests/provider_call/dotnet/ProviderCall.csproj | Normalize formatting and remove inline test package versions to rely on CPM. |
| integration_tests/parameterized/tests/Parameterized.Tests.csproj | Remove inline MSTest package versions to rely on CPM. |
| integration_tests/get_resource/GetResource.csproj | Remove inline package versions to rely on CPM in integration test project. |
| integration_tests/Directory.Packages.props | Add CPM file for integration_tests subtree defining MSTest versions and importing parent CPM. |
| integration_tests/about/about-csharp.csproj | Remove inline provider package versions to rely on CPM in integration test project. |
| .mise.toml | Update mise-managed .NET toolchain version to a .NET 10 SDK build. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
ThaDaVos
changed the title
Author
|
All changes should be included now, sdk tests all run without errors |
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi) | `v3.255.0` → `v3.256.0` |  |  | require | minor | | [pulumi](https://redirect.github.com/pulumi/pulumi) | `v3.255.0` → `v3.256.0` |  |  | | minor | --- ### Release Notes <details> <summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary> ### [`v3.256.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.256.0) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.255.0...v3.256.0) ##### 3.256.0 (2026-08-04) ##### Features - \[cli] Add `--ignore-protect` flag to `pulumi up`, `pulumi preview` and `pulumi destroy` to allow deleting protected resources without unprotecting them in the state first [#​24053](https://redirect.github.com/pulumi/pulumi/pull/24053) - \[cli/env] Add an optional `--export-env-vars` flag to the `env provider {aws,azure,gcp}-login` commands to also set the standard SDK environment variables referencing the login outputs [#​24055](https://redirect.github.com/pulumi/pulumi/pull/24055) - \[cli] Add a `--server` flag to `pulumi package add`, `publish`, `get-schema`, `get-mapping`, `gen-sdk`, `info` and `pulumi schema check` that skips package resolution and uses the given URL as the plugin download URL [#​24107](https://redirect.github.com/pulumi/pulumi/pull/24107) ##### Bug Fixes - \[backend/service] Fix `pulumi login --insecure` not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates [#​24134](https://redirect.github.com/pulumi/pulumi/pull/24134) - \[cli] Scope current stack selection to the active backend so switching backends no longer surfaces stale stack errors [#​23974](https://redirect.github.com/pulumi/pulumi/pull/23974) - \[programgen/go] Parent an invoke written inside a component to that component, lower a component's outputs, and only import `fmt` when a component needs it [#​24019](https://redirect.github.com/pulumi/pulumi/pull/24019) - \[programgen/python] Parent an invoke written inside a component to that component, so it resolves the component's providers [#​24018](https://redirect.github.com/pulumi/pulumi/pull/24018) - \[sdk/nodejs] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine [#​24042](https://redirect.github.com/pulumi/pulumi/pull/24042) - \[engine] Gate invokes on the created-ness of their declared dependencies, including the children of remote components, resolving them as unknown during previews that still have to create them [#​24040](https://redirect.github.com/pulumi/pulumi/pull/24040) - \[sdk/go] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine [#​24044](https://redirect.github.com/pulumi/pulumi/pull/24044) - \[pcl] Declare invoke dependencies to the engine so invokes that depend on pending resources, including remote components, resolve as unknown during previews [#​24041](https://redirect.github.com/pulumi/pulumi/pull/24041) - \[sdk/python] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine [#​24043](https://redirect.github.com/pulumi/pulumi/pull/24043) - \[cli/env] `env provider` no longer writes a new environment revision when the resulting definition is unchanged [#​24055](https://redirect.github.com/pulumi/pulumi/pull/24055) - \[sdk/go] Output-form invokes now infer their resource dependencies from their arguments, so they are skipped during preview while a dependent resource is pending creation and their results carry those dependencies [#​24054](https://redirect.github.com/pulumi/pulumi/pull/24054) - \[sdkgen/go] Fixes nested optional output conversions [#​24096](https://redirect.github.com/pulumi/pulumi/pull/24096) - \[engine] Fix a plugin process leak in `NewPolicyAnalyzer` when `ConfigureStack` fails after the plugin has booted [#​24106](https://redirect.github.com/pulumi/pulumi/pull/24106) - \[programgen/go] Avoid redundant applies when projecting properties from generated Go object outputs [#​24112](https://redirect.github.com/pulumi/pulumi/pull/24112) - \[backend/diy] Fix 403 errors writing to third-party S3-compatible backends (e.g. IBM COS, MinIO) by defaulting request\_checksum\_calculation to when\_required when the s3:// backend URL sets a custom endpoint [#​24109](https://redirect.github.com/pulumi/pulumi/pull/24109) - \[programgen/nodejs] Avoid redundant applies when projecting properties from Node.js outputs [#​24119](https://redirect.github.com/pulumi/pulumi/pull/24119) - \[programgen/python] Avoid redundant applies when projecting properties from Python outputs [#​24120](https://redirect.github.com/pulumi/pulumi/pull/24120) - \[sdk] Fix apply erroring for skipped resources [#​24108](https://redirect.github.com/pulumi/pulumi/pull/24108) - \[cli] Retry rate-limited (HTTP 429) API requests when they are safe to retry, honoring the server's Retry-After header [#​24131](https://redirect.github.com/pulumi/pulumi/pull/24131) - \[cli] Exit non-zero from remote operations (`pulumi up --remote`, `pulumi deployment run`) when the deployment fails [#​24155](https://redirect.github.com/pulumi/pulumi/pull/24155) - \[cli/new] Resolve and install packages required by the program during `pulumi new`, as `pulumi install` does [#​24126](https://redirect.github.com/pulumi/pulumi/pull/24126) - \[cli] Make --remote not require a Pulumi.yaml file to be present [#​24128](https://redirect.github.com/pulumi/pulumi/pull/24128) - \[cli/import] Generate explicit providers in the import file `resources` [#​24135](https://redirect.github.com/pulumi/pulumi/pull/24135) - \[sdk/nodejs] Fix trustedDependencies parsing for bun [#​24145](https://redirect.github.com/pulumi/pulumi/pull/24145) - \[auto/go] ImportResources no longer leaks `--stack` into the converter's arguments when converter args are passed [#​24146](https://redirect.github.com/pulumi/pulumi/pull/24146) - \[auto/go] Fix `ImportResources` when `GenerateCode(false)` is set [#​24147](https://redirect.github.com/pulumi/pulumi/pull/24147) - \[sdk/go] Fix hooks and transforms causing panics with mocks [#​24161](https://redirect.github.com/pulumi/pulumi/pull/24161) - \[programgen/go] Fix plain invokes emitting nonexistent `...ArgsArgs` argument types [#​24172](https://redirect.github.com/pulumi/pulumi/pull/24172) ##### Improvements - \[cli/import] Error when running `pulumi import --from terraform` in a Pulumi HCL project [#​23744](https://redirect.github.com/pulumi/pulumi/pull/23744) - \[programgen] Add `ID` type to PCL [#​22702](https://redirect.github.com/pulumi/pulumi/pull/22702) - \[engine] Give the resource monitor's `Invoke` its own response message, separating it from the one a provider returns [#​24100](https://redirect.github.com/pulumi/pulumi/pull/24100) - \[cli/do] Allow stateful resources to register their own provider resources based on provider inputs on the command line [#​24098](https://redirect.github.com/pulumi/pulumi/pull/24098) - \[cli] Refresh the first-login welcome message to link your Pulumi Cloud console and the Pulumi changelog [#​24122](https://redirect.github.com/pulumi/pulumi/pull/24122) - \[cli/do] Add support for the `--provider` argument for stateful operations [#​24132](https://redirect.github.com/pulumi/pulumi/pull/24132) - \[programgen/go] Better typing for maps, using known types rather than `map[string]interface{}` [#​24142](https://redirect.github.com/pulumi/pulumi/pull/24142) - \[cli/import] Serve the package-resolver service to state converters via `resolver_target` on `ConvertStateRequest`, so converters can resolve package specifications the same way the CLI does [#​24174](https://redirect.github.com/pulumi/pulumi/pull/24174) ##### Miscellaneous - \[cli] Retire the Pulumi AI mode of `pulumi new` (interactive choice and `--ai`/`--language` flags). The backing service has been shut down; use `pulumi neo` instead. [#​24116](https://redirect.github.com/pulumi/pulumi/pull/24116) - \[sdk/dotnet] Upgrade dotnet to v3.110.0 [#​24175](https://redirect.github.com/pulumi/pulumi/pull/24175) - \[yaml] Upgrade yaml to v1.38.1 [#​24175](https://redirect.github.com/pulumi/pulumi/pull/24175) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - Monday through Friday (`* * * * 1-5`) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19--> --------- Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com> Co-authored-by: Julien Poissonnier <julien@caffeine.lu> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Automated release PR generated by `.github/workflows/attempt-release.yml`. See [CONTRIBUTING.md](./CONTRIBUTING.md) for the release process.
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://redirect.github.com/go-git/go-git) | `v5.19.1` → `v5.19.2` |  |  | | [github.com/go-git/go-git/v6](https://redirect.github.com/go-git/go-git) | `v6.0.0-alpha.4` → `v6.0.0-alpha.5` |  |  | --- ### go-git: Worktree operations may follow symlinks [CVE-2026-71556](https://nvd.nist.gov/vuln/detail/CVE-2026-71556) / [GHSA-hc8v-wwc9-vgxm](https://redirect.github.com/advisories/GHSA-hc8v-wwc9-vgxm) <details> <summary>More information</summary> #### Details ##### Impact A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path. The `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree. As a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if `s` is a symbolic link to `.git`, writing to `s/config` would modify `.git/config`. A symbolic link at the final path component could also be followed. For example, if `s` points directly to `.git/config`, opening `s` for writing with truncation could overwrite the repository configuration. Exploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path. Applications using `storage/memory` for their Storer, or `go-billy/memfs` for their `Worktree`, are not affected by this vulnerability. ##### Patches The issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary. Worktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component. Users of filesystem-backed worktrees should upgrade to a patched version. ##### Credits Thanks to @​kodareef5 for reporting this issue and working with the go-git security team toward its resolution. 🥇 We would also like to thank @​HughLewis20, who independently reported the same issue while a fix was already in progress. #### Severity - CVSS Score: 7.1 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm](https://redirect.github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm) - [https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab](https://redirect.github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab) - [https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac](https://redirect.github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac) - [https://github.com/go-git/go-git/releases/tag/v5.19.2](https://redirect.github.com/go-git/go-git/releases/tag/v5.19.2) - [https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5](https://redirect.github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5) - [https://github.com/advisories/GHSA-hc8v-wwc9-vgxm](https://redirect.github.com/advisories/GHSA-hc8v-wwc9-vgxm) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-hc8v-wwc9-vgxm) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### go-git: Malicious reference names may modify files outside the reference storage [CVE-2026-71557](https://nvd.nist.gov/vuln/detail/CVE-2026-71557) / [GHSA-qgq7-7hm3-q39j](https://redirect.github.com/advisories/GHSA-qgq7-7hm3-q39j) <details> <summary>More information</summary> #### Details ##### Impact A path traversal issue in `go-git` could allow malicious reference names to access files outside the repository's intended reference storage. Loose references are stored under `.git/<reference-name>`. The reference name was previously used as a path without verifying that the resolved path remained within the reference storage. A name such as `refs/heads/../../config` could therefore resolve to unrelated repository metadata such as `.git/config` or `.git/HEAD`. A malicious Git server could advertise such a reference name. The name may also survive refspec mapping; for example, it could be mapped to `refs/remotes/origin/../../config` during a clone or fetch operation. This vulnerability affects filesystem-backed repositories using the `storage/filesystem` package and its `dotgit` reference storage. Users relying exclusively on the in-memory storage implementation, `storage/memory`, are not affected, because reference names are not resolved as filesystem paths. Exploitation requires an application using `go-git` with filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names. ##### Patches The issue has been addressed by validating reference names at the `dotgit` storage entry points and rejecting names whose resolved paths could escape the reference storage. Users of filesystem-backed storage should upgrade to a patched version. ##### Workarounds Applications that exclusively use `storage/memory` are not affected and do not require a workaround for this vulnerability. For applications using filesystem-backed storage, avoid cloning from or fetching from untrusted Git servers until an upgrade is possible. Applications that directly construct or process reference names may also validate them before passing them to filesystem-backed `go-git` storage. Application-level validation should only be considered a temporary mitigation and does not replace upgrading to a patched version. ##### References - Fixes: - [https://github.com/go-git/go-git/pull/2247](https://redirect.github.com/go-git/go-git/pull/2247) - [https://github.com/go-git/go-git/pull/2254](https://redirect.github.com/go-git/go-git/pull/2254) ##### Credits Thanks to @​Saku0512 for reporting this issue and @​Sahana2524 for proposing the initial fix. 🙇 #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j](https://redirect.github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j) - [https://github.com/go-git/go-git/pull/2247](https://redirect.github.com/go-git/go-git/pull/2247) - [https://github.com/go-git/go-git/pull/2254](https://redirect.github.com/go-git/go-git/pull/2254) - [https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7](https://redirect.github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7) - [https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36](https://redirect.github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36) - [https://github.com/go-git/go-git/releases/tag/v5.19.2](https://redirect.github.com/go-git/go-git/releases/tag/v5.19.2) - [https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5](https://redirect.github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5) - [https://github.com/advisories/GHSA-qgq7-7hm3-q39j](https://redirect.github.com/advisories/GHSA-qgq7-7hm3-q39j) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-qgq7-7hm3-q39j) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.19.2`](https://redirect.github.com/go-git/go-git/releases/tag/v5.19.2) [Compare Source](https://redirect.github.com/go-git/go-git/compare/v5.19.1...v5.19.2) #### What's Changed - build: Update module golang.org/x/crypto to v0.52.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot] in [#​2150](https://redirect.github.com/go-git/go-git/pull/2150) - build: Update module github.com/go-git/go-git/v5 to v5.19.1 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot] in [#​2141](https://redirect.github.com/go-git/go-git/pull/2141) - build: Update module golang.org/x/net to v0.55.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot] in [#​2152](https://redirect.github.com/go-git/go-git/pull/2152) - git: Worktree: Add stores index entires with backslashes on Windows by [@​joshblum](https://redirect.github.com/joshblum) in [#​2262](https://redirect.github.com/go-git/go-git/pull/2262) - storage: dotgit, reject path traversal in reference names by [@​pjbgf](https://redirect.github.com/pjbgf) in [#​2254](https://redirect.github.com/go-git/go-git/pull/2254) - build: Update module golang.org/x/net to v0.56.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot] in [#​2267](https://redirect.github.com/go-git/go-git/pull/2267) - build: Update module golang.org/x/text to v0.39.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot] in [#​2268](https://redirect.github.com/go-git/go-git/pull/2268) - \[v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by [@​pjbgf](https://redirect.github.com/pjbgf) in [#​2277](https://redirect.github.com/go-git/go-git/pull/2277) **Full Changelog**: <go-git/go-git@v5.19.1...v5.19.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - Monday through Friday (`* * * * 1-5`) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19--> Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
After some bashing, I think I'm happy with this - we use mostly Renovate's own templating system to generate the CHANGELOGs. They're not the most verbose, but I think that's fine. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
We want the Automation API to update at the speed of engine releases, not at the speed of SDK releases. Engine also opens fresh PRs for these changes already, so we don't need to enforce this as part of unrelated work's CI processes. --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/cloudflare/circl](https://redirect.github.com/cloudflare/circl) | `v1.6.3` → `v1.6.5` |  |  | --- ### Release Notes <details> <summary>cloudflare/circl (github.com/cloudflare/circl)</summary> ### [`v1.6.5`](https://redirect.github.com/cloudflare/circl/releases/tag/v1.6.5): CIRCL v1.6.5 [Compare Source](https://redirect.github.com/cloudflare/circl/compare/v1.6.4...v1.6.5) ##### What's Changed - ascon: don't output plaintext if authentication fails by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​631](https://redirect.github.com/cloudflare/circl/pull/631) - Dilithium: don't accept signatures with trailing data by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​632](https://redirect.github.com/cloudflare/circl/pull/632) - Fix HPKE/KEM exact-length key unmarshaling by [@​drmikecrypto](https://redirect.github.com/drmikecrypto) in [#​627](https://redirect.github.com/cloudflare/circl/pull/627) - Bump x/crypto and golangci-lint by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​637](https://redirect.github.com/cloudflare/circl/pull/637) - ecc/bls12381: reject trailing data in G1/G2 SetBytes by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​636](https://redirect.github.com/cloudflare/circl/pull/636) - eddilithium: fail verification if signature is wrong length by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​633](https://redirect.github.com/cloudflare/circl/pull/633) - tss/rsa: fix length check to prevent runtime out-of-bounds panic by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​640](https://redirect.github.com/cloudflare/circl/pull/640) - dleq: verify: return false instead of panic()ing on nil parameters by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​641](https://redirect.github.com/cloudflare/circl/pull/641) - ed448: document verification behaviour by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​642](https://redirect.github.com/cloudflare/circl/pull/642) - ed448: reject non-canonical point encodings by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​635](https://redirect.github.com/cloudflare/circl/pull/635) - slhdsa: ensure full reads when rand source is provided by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​634](https://redirect.github.com/cloudflare/circl/pull/634) - ed{25519,448}: don't accept trailing data for keys by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​643](https://redirect.github.com/cloudflare/circl/pull/643) - frodo: pack: fix accidental zero buffer assumption by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​645](https://redirect.github.com/cloudflare/circl/pull/645) - secretsharing: check that share ID is not zero. by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​644](https://redirect.github.com/cloudflare/circl/pull/644) - kyber: document pk isn't checked like ML-KEM by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​648](https://redirect.github.com/cloudflare/circl/pull/648) - zk/dleq: Don't accept trailing data on proof by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​649](https://redirect.github.com/cloudflare/circl/pull/649) - slhdsa: don't panic if prehash-hash is out of range by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​647](https://redirect.github.com/cloudflare/circl/pull/647) - goldilocks: don't panic when unmarshalling invalid point by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​646](https://redirect.github.com/cloudflare/circl/pull/646) - hpke: don't panic when unmarshalling opener/sealer from empty buffer by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​656](https://redirect.github.com/cloudflare/circl/pull/656) - ot/simot: don't panic on mismatched ciphertext lengths by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​655](https://redirect.github.com/cloudflare/circl/pull/655) - fourq: document point decoding is lenient by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​654](https://redirect.github.com/cloudflare/circl/pull/654) - oprf: add note on multiple Point encodings by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​653](https://redirect.github.com/cloudflare/circl/pull/653) - tss/rsa: don't panic when combining empty list of shares by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​652](https://redirect.github.com/cloudflare/circl/pull/652) - ecc/p384: document that package is not fully constant time by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​651](https://redirect.github.com/cloudflare/circl/pull/651) - ristretto: reject non-canonical scalars by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​650](https://redirect.github.com/cloudflare/circl/pull/650) - Add more explicit constant time warnings by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​638](https://redirect.github.com/cloudflare/circl/pull/638) - mlsbset: make Encode() constant time by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​639](https://redirect.github.com/cloudflare/circl/pull/639) - mlsbset: fix stray index in Encode comment by [@​lukevalenta](https://redirect.github.com/lukevalenta) in [#​658](https://redirect.github.com/cloudflare/circl/pull/658) - removeLen32Prefixed: check for possible data overflow by [@​mdosch](https://redirect.github.com/mdosch) in [#​629](https://redirect.github.com/cloudflare/circl/pull/629) - expander: panic if requested output length overflows DST. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​664](https://redirect.github.com/cloudflare/circl/pull/664) - zk/dleq: add base point `a` to challenge derivation. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​663](https://redirect.github.com/cloudflare/circl/pull/663) - dh/sidh: document Import() side-effect for kem/sike. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​662](https://redirect.github.com/cloudflare/circl/pull/662) - ecc/fourq: improve constant-timeness of fpSgn, fqSqrt. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​666](https://redirect.github.com/cloudflare/circl/pull/666) - blinsign/blindrsa/partiallyblindrsa: reject malformed moduli. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​665](https://redirect.github.com/cloudflare/circl/pull/665) - blindsign/blindrsa: align PSSZERO behavior with RFC 9474. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​660](https://redirect.github.com/cloudflare/circl/pull/660) - ecc/fourq: fix fqSqr arithmetic error on amd64 by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​659](https://redirect.github.com/cloudflare/circl/pull/659) - README: warn that not all packages are constant time by [@​frangelbarrera](https://redirect.github.com/frangelbarrera) in [#​668](https://redirect.github.com/cloudflare/circl/pull/668) - internal/test: unify ACVP test vector parsing by [@​ihopenre-eng](https://redirect.github.com/ihopenre-eng) in [#​667](https://redirect.github.com/cloudflare/circl/pull/667) - blindrsa: fix interface documentation by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​672](https://redirect.github.com/cloudflare/circl/pull/672) - ecc/fourq: fix legacy (non-BMI2) GF(p^2) multiplication on amd64 by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​669](https://redirect.github.com/cloudflare/circl/pull/669) - p384: document assumed reductions by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​670](https://redirect.github.com/cloudflare/circl/pull/670) - [`ed25519`](https://redirect.github.com/cloudflare/circl/commit/ed25519): document another divergence with crypto/ed25519 by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​671](https://redirect.github.com/cloudflare/circl/pull/671) - prio3/histogram: don't panic on measurement equal to the bucket count by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​673](https://redirect.github.com/cloudflare/circl/pull/673) - zk/qndleq: document Qn membership precondition by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​675](https://redirect.github.com/cloudflare/circl/pull/675) - vdaf/prio3: require all prep shares by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​676](https://redirect.github.com/cloudflare/circl/pull/676) - vdaf/prio3: document prep sequencing requirement by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​677](https://redirect.github.com/cloudflare/circl/pull/677) - zk/dl: reject identity proof inputs by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​678](https://redirect.github.com/cloudflare/circl/pull/678) - tss/rsa: document trusted modulus requirement by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​680](https://redirect.github.com/cloudflare/circl/pull/680) - dh/csidh: harden key imports by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​689](https://redirect.github.com/cloudflare/circl/pull/689) - zk/dleq: validate batch shape by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​684](https://redirect.github.com/cloudflare/circl/pull/684) - ot/simot: make sender sessions one-shot by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​679](https://redirect.github.com/cloudflare/circl/pull/679) - vdaf/prio3/sum: reject unsafe measurement bounds by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​682](https://redirect.github.com/cloudflare/circl/pull/682) - tss/rsa: validate sign share protocol parameters by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​674](https://redirect.github.com/cloudflare/circl/pull/674) - vdaf/prio3/sum: reject aggregate field overflow by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​681](https://redirect.github.com/cloudflare/circl/pull/681) - vdaf/prio3: validate preparation inputs by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​683](https://redirect.github.com/cloudflare/circl/pull/683) - oprf: reject invalid deterministic blinds by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​688](https://redirect.github.com/cloudflare/circl/pull/688) - vdaf/prio3: reject degenerate parameters by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​685](https://redirect.github.com/cloudflare/circl/pull/685) - oprf: validate finalize state by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​687](https://redirect.github.com/cloudflare/circl/pull/687) ##### New Contributors - [@​drmikecrypto](https://redirect.github.com/drmikecrypto) made their first contribution in [#​627](https://redirect.github.com/cloudflare/circl/pull/627) - [@​lukevalenta](https://redirect.github.com/lukevalenta) made their first contribution in [#​658](https://redirect.github.com/cloudflare/circl/pull/658) - [@​mdosch](https://redirect.github.com/mdosch) made their first contribution in [#​629](https://redirect.github.com/cloudflare/circl/pull/629) - [@​frangelbarrera](https://redirect.github.com/frangelbarrera) made their first contribution in [#​668](https://redirect.github.com/cloudflare/circl/pull/668) - [@​ihopenre-eng](https://redirect.github.com/ihopenre-eng) made their first contribution in [#​667](https://redirect.github.com/cloudflare/circl/pull/667) **Full Changelog**: <cloudflare/circl@v1.6.4...v1.6.5> ### [`v1.6.4`](https://redirect.github.com/cloudflare/circl/releases/tag/v1.6.4): CIRCL v1.6.4 [Compare Source](https://redirect.github.com/cloudflare/circl/compare/v1.6.3...v1.6.4) ##### What's Changed - Fix typo: it's to its by [@​04cb](https://redirect.github.com/04cb) in [#​588](https://redirect.github.com/cloudflare/circl/pull/588) - ci: Bump Go version to 1.26 by [@​armfazh](https://redirect.github.com/armfazh) in [#​591](https://redirect.github.com/cloudflare/circl/pull/591) - tss/rsa: polynomial evaluation using Horner's method by [@​armfazh](https://redirect.github.com/armfazh) in [#​590](https://redirect.github.com/cloudflare/circl/pull/590) - zk/qndleq: Ensure large security parameter by [@​armfazh](https://redirect.github.com/armfazh) in [#​592](https://redirect.github.com/cloudflare/circl/pull/592) - sign/bls: rejects aggregated signatures built with duplicated messages. by [@​armfazh](https://redirect.github.com/armfazh) in [#​595](https://redirect.github.com/cloudflare/circl/pull/595) - Bump golang.org/x/crypto from 0.30.0 to 0.45.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​585](https://redirect.github.com/cloudflare/circl/pull/585) - tss/rsa: avoiding overflow in lambda calculation with big.Int by [@​armfazh](https://redirect.github.com/armfazh) in [#​598](https://redirect.github.com/cloudflare/circl/pull/598) - deps: Update CIRCL version in code generators. by [@​armfazh](https://redirect.github.com/armfazh) in [#​599](https://redirect.github.com/cloudflare/circl/pull/599) - ci: add Semgrep OSS scanning workflow by [@​hrushikeshdeshpande](https://redirect.github.com/hrushikeshdeshpande) in [#​601](https://redirect.github.com/cloudflare/circl/pull/601) - zk/qndleq: Fixes challenge calculation by [@​armfazh](https://redirect.github.com/armfazh) in [#​596](https://redirect.github.com/cloudflare/circl/pull/596) - sign/bls: Check that signature cannot be the identity point by [@​armfazh](https://redirect.github.com/armfazh) in [#​603](https://redirect.github.com/cloudflare/circl/pull/603) - ml-dsa: Don't use tr pointer by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​606](https://redirect.github.com/cloudflare/circl/pull/606) - ecc/bls12381: affinize must handle identity elements. by [@​armfazh](https://redirect.github.com/armfazh) in [#​604](https://redirect.github.com/cloudflare/circl/pull/604) - pki: check pem.Decode returned nil block. by [@​z9z](https://redirect.github.com/z9z) in [#​607](https://redirect.github.com/cloudflare/circl/pull/607) - abe/cpabe/tkn20: fix AND-gate secret sharing. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​610](https://redirect.github.com/cloudflare/circl/pull/610) - hpke: fix verifyPSKInputs() to match spec. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​612](https://redirect.github.com/cloudflare/circl/pull/612) - hpke: Warn about nonce misuse during marshaling by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​613](https://redirect.github.com/cloudflare/circl/pull/613) - hpke: don't panic when parsing on hybrid keys/ciphertexts. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​614](https://redirect.github.com/cloudflare/circl/pull/614) - blindsign/blindrsa: reject non-canonical signatures. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​615](https://redirect.github.com/cloudflare/circl/pull/615) - blindsign/blindrsa: reject message unless co-prime with modulus by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​616](https://redirect.github.com/cloudflare/circl/pull/616) - oprf: reject identity element as public key. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​619](https://redirect.github.com/cloudflare/circl/pull/619) - Add AGENTS.md and REVIEW\.md for contributor and AI agent guidance by [@​dotjs](https://redirect.github.com/dotjs) in [#​620](https://redirect.github.com/cloudflare/circl/pull/620) - ecc/bls12381: check input length for infinity encoding in SetBytes. by [@​bwesterb](https://redirect.github.com/bwesterb) in [#​618](https://redirect.github.com/cloudflare/circl/pull/618) - abe/cpabe/tkn20: bound recursion depth when parsing policies. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​622](https://redirect.github.com/cloudflare/circl/pull/622) - abe/cpabe/tkn20: reject ciphertexts with trailing data. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​621](https://redirect.github.com/cloudflare/circl/pull/621) - abe/cpabe/tkn20: handle short ciphertexts as errors. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​611](https://redirect.github.com/cloudflare/circl/pull/611) - abe/cpabe/tkn20: enforce wire count matches policy. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​624](https://redirect.github.com/cloudflare/circl/pull/624) - abe/cpabe/tkn20: handle malformed ciphertext header. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​623](https://redirect.github.com/cloudflare/circl/pull/623) - abe/cpabe/tkn20: reject circuits with invalid topologies. by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​625](https://redirect.github.com/cloudflare/circl/pull/625) - Release CIRCL v1.6.4 by [@​cjpatton](https://redirect.github.com/cjpatton) in [#​626](https://redirect.github.com/cloudflare/circl/pull/626) ##### New Contributors - [@​04cb](https://redirect.github.com/04cb) made their first contribution in [#​588](https://redirect.github.com/cloudflare/circl/pull/588) - [@​z9z](https://redirect.github.com/z9z) made their first contribution in [#​607](https://redirect.github.com/cloudflare/circl/pull/607) - [@​dotjs](https://redirect.github.com/dotjs) made their first contribution in [#​620](https://redirect.github.com/cloudflare/circl/pull/620) **Full Changelog**: <cloudflare/circl@v1.6.3...v1.6.4> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - Monday through Friday (`* * * * 1-5`) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19--> Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
This was referenced Aug 11, 2026
Closed
) While trying to update pulumi-dotnet in pulumi/pulumi, a smoke test failed pulumi/pulumi#24249 ``` Error: D:\a\_temp\test-env3863622462\out\Rc.cs(29,25): error CS0029: Cannot implicitly convert type 'Pulumi.Output<string>' to 'Pulumi.Output<dynamic>' [D:\a\_temp\test-env3863622462\out\test-env3863622462.csproj] ``` We need to properly handle the IDType in codegen that was introduced in 3.256.0. Getting `l2-id-type` passing required dealing with primitive conversions, so that solved a couple other tests along with it. Int to number conversions now always emit a double literal (`1.0`) when it's a literal, or a `(double)` cast otherwise, because C#'s implicitly-typed arrays infer int[] from bare int elements, but that doesn't convert to `InputList<double>`. Codegen can't tell scalar from array-element context, so this is always applied, not just in arrays. I also ran into the issue that we can't have a class called `Invoke` with a method named `Invoke`. That's now disambiguate with a `Function` suffix (they are static methods on a static class).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a redo of my other PR (#745) in relation to NativeAoT support, this time aimed at DotNet 10 and including Nuget Central Package Management to ease future upgrades - used DotNet Upgrade Assistant to setup the CPM, but the upgrade itself was done manually (https://learn.microsoft.com/en-us/dotnet/core/porting/)