Skip to content

Bump AsyncKeyedLock and 10 others#229

Closed
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/nuget/src/DNTCommon.Web.Core/tests-9117e0b67c
Closed

Bump AsyncKeyedLock and 10 others#229
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/nuget/src/DNTCommon.Web.Core/tests-9117e0b67c

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 9, 2026

Updated AsyncKeyedLock from 8.0.1 to 8.0.2.

Release notes

Sourced from AsyncKeyedLock's releases.

8.0.2

DotNet.ReproducibleBuilds update.

Commits viewable in compare view.

Updated DependencyInjection.Lifetime.Analyzers from 2.1.1 to 2.4.6.

Release notes

Sourced from DependencyInjection.Lifetime.Analyzers's releases.

2.4.6

DependencyInjection.Lifetime.Analyzers 2.4.6

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • Code Fix Inventory Guardrails: Added parity tests that compare the README rule index against the reflected code-fix provider inventory, ensuring documented fixable rules stay aligned with shipped FixableDiagnosticIds and that providers only advertise public diagnostics.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.4.6

What changed

Changed

  • Code Fix Inventory Guardrails: Added parity tests that compare the README rule index against the reflected code-fix provider inventory, ensuring documented fixable rules stay aligned with shipped FixableDiagnosticIds and that providers only advertise public diagnostics.

Learn more

2.4.5

DependencyInjection.Lifetime.Analyzers 2.4.5

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI012 Ignored TryAdd Code Fix: Added a narrow, real code fix for the TryAddIgnored variant of DI012 that removes redundant ignored TryAdd* registrations when they appear as standalone statements, including wrapper-method cases, while leaving duplicate-registration scenarios diagnostic-only.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.4.5

What changed

Changed

  • DI012 Ignored TryAdd Code Fix: Added a narrow, real code fix for the TryAddIgnored variant of DI012 that removes redundant ignored TryAdd* registrations when they appear as standalone statements, including wrapper-method cases, while leaving duplicate-registration scenarios diagnostic-only.

Learn more

2.4.4

DependencyInjection.Lifetime.Analyzers 2.4.4

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • Analyzer Health Guardrails: Added full diagnostic inventory parity coverage for public IDs, severities, descriptors, and shipped/unshipped release tracking so new diagnostics cannot drift silently from test and release metadata.
  • CI/Release Provenance Hardening: CI now validates release tags against the project version, updates the coverage badge on the repository default branch, and publishes release-tag artifacts that the release workflow promotes directly to NuGet and GitHub Releases instead of rebuilding.
  • Compatibility Smoke Coverage: Added a focused DI-version smoke matrix around DI016, DI017, and DI018 plus reusable reference-assembly sets in the verifier so representative analyzer scenarios stay covered across supported package combinations.
  • Code Fix Policy Cleanup: DI016 remains diagnostic-only, and DI002 now offers only explicit pragma suppression instead of acknowledgement/TODO-style actions.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.4.4

What changed

Changed

  • Analyzer Health Guardrails: Added full diagnostic inventory parity coverage for public IDs, severities, descriptors, and shipped/unshipped release tracking so new diagnostics cannot drift silently from test and release metadata.
  • CI/Release Provenance Hardening: CI now validates release tags against the project version, updates the coverage badge on the repository default branch, and publishes release-tag artifacts that the release workflow promotes directly to NuGet and GitHub Releases instead of rebuilding.
  • Compatibility Smoke Coverage: Added a focused DI-version smoke matrix around DI016, DI017, and DI018 plus reusable reference-assembly sets in the verifier so representative analyzer scenarios stay covered across supported package combinations.
  • Code Fix Policy Cleanup: DI016 remains diagnostic-only, and DI002 now offers only explicit pragma suppression instead of acknowledgement/TODO-style actions.

Learn more

2.4.3

DependencyInjection.Lifetime.Analyzers 2.4.3

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI016 Builder-Flow Hardening: BuildServiceProvider misuse detection now recognizes assignable IServiceCollection abstractions, same-boundary alias reassignment, and helper methods that forward builder-style .Services flows, while still staying quiet for provider-factory methods and standalone top-level ServiceCollection usage.
  • DI009 Constructor and Collection Precision: Open-generic captive-dependency analysis now treats optional/default constructor parameters as activatable during likely-constructor selection, suppresses diagnostics on ambiguous equally-greedy constructors, and reports IEnumerable<T> captures against the element service lifetime.
  • DI012 Flow and Opaque-Barrier Accuracy: Conditional-registration analysis now follows same-collection local aliases plus source-defined helper/local-function wrappers more reliably, isolates distinct object-created collection flows, and treats source-declared but bodyless registration helpers as opaque ordering barriers instead of speculating across them.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.4.3

What changed

Changed

  • DI016 Builder-Flow Hardening: BuildServiceProvider misuse detection now recognizes assignable IServiceCollection abstractions, same-boundary alias reassignment, and helper methods that forward builder-style .Services flows, while still staying quiet for provider-factory methods and standalone top-level ServiceCollection usage.
  • DI009 Constructor and Collection Precision: Open-generic captive-dependency analysis now treats optional/default constructor parameters as activatable during likely-constructor selection, suppresses diagnostics on ambiguous equally-greedy constructors, and reports IEnumerable<T> captures against the element service lifetime.
  • DI012 Flow and Opaque-Barrier Accuracy: Conditional-registration analysis now follows same-collection local aliases plus source-defined helper/local-function wrappers more reliably, isolates distinct object-created collection flows, and treats source-declared but bodyless registration helpers as opaque ordering barriers instead of speculating across them.

Learn more

2.4.2

DependencyInjection.Lifetime.Analyzers 2.4.2

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI002 Executable-Root Coverage: Scoped-service escape analysis now runs across constructors, accessors, local functions, lambdas, and anonymous methods instead of only ordinary methods, while still keeping escape tracking local to the current executable boundary.
  • DI004 Executable-Root Coverage: Use-after-dispose analysis now follows the same broader executable-root set, including constructor and accessor bodies plus local and anonymous functions, without speculating across nested executable boundaries.
  • DI002/DI004 Regression Guardrails: Added direct should-report and should-not-report coverage for constructor, property-getter, local-function, anonymous-method, and nested-boundary cases so the widened entry surface stays conservative.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.4.2

What changed

Changed

  • DI002 Executable-Root Coverage: Scoped-service escape analysis now runs across constructors, accessors, local functions, lambdas, and anonymous methods instead of only ordinary methods, while still keeping escape tracking local to the current executable boundary.
  • DI004 Executable-Root Coverage: Use-after-dispose analysis now follows the same broader executable-root set, including constructor and accessor bodies plus local and anonymous functions, without speculating across nested executable boundaries.
  • DI002/DI004 Regression Guardrails: Added direct should-report and should-not-report coverage for constructor, property-getter, local-function, anonymous-method, and nested-boundary cases so the widened entry surface stays conservative.

Learn more

2.4.1

DependencyInjection.Lifetime.Analyzers 2.4.1

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI010 Runtime-Faithful Constructor Selection: Constructor over-injection now analyzes the constructor set the container could actually activate instead of every accessible constructor, reducing false positives on multi-constructor services where only a shorter constructor is resolvable.
  • DI010 Conservative Factory Coverage: The analyzer now covers straightforward factory registrations that directly construct the service and ActivatorUtilities.CreateInstance<T>(sp) factory paths, while staying quiet for more dynamic factory bodies it cannot classify confidently.
  • DI010 Symbol-Accurate Exclusions and Config: Logging, options, configuration, and provider-plumbing exclusions now use exact symbols instead of simple names, optional/default-value parameters are ignored, and the dependency threshold is configurable through .editorconfig with dotnet_code_quality.DI010.max_dependencies.
  • DI010 Regression Coverage and Health: Added direct tests for constructor selection, factory registrations, namespace-accurate exclusions, optional parameters, and threshold overrides, and refreshed the analyzer health snapshot to reflect the stronger rule quality.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.4.1

What changed

Changed

  • DI010 Runtime-Faithful Constructor Selection: Constructor over-injection now analyzes the constructor set the container could actually activate instead of every accessible constructor, reducing false positives on multi-constructor services where only a shorter constructor is resolvable.
  • DI010 Conservative Factory Coverage: The analyzer now covers straightforward factory registrations that directly construct the service and ActivatorUtilities.CreateInstance<T>(sp) factory paths, while staying quiet for more dynamic factory bodies it cannot classify confidently.
  • DI010 Symbol-Accurate Exclusions and Config: Logging, options, configuration, and provider-plumbing exclusions now use exact symbols instead of simple names, optional/default-value parameters are ignored, and the dependency threshold is configurable through .editorconfig with dotnet_code_quality.DI010.max_dependencies.
  • DI010 Regression Coverage and Health: Added direct tests for constructor selection, factory registrations, namespace-accurate exclusions, optional parameters, and threshold overrides, and refreshed the analyzer health snapshot to reflect the stronger rule quality.

Learn more

2.4.0

DependencyInjection.Lifetime.Analyzers 2.4.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI002 Scope/Alias Tracking: Scoped-service escape analysis now follows scopes created before a using (scope) statement, recognizes provider aliases, and stays quiet after safe alias overwrites instead of keeping stale escape state alive.
  • DI004 Scope/Alias Disposal Coverage: Use-after-dispose analysis now recognizes services resolved from predeclared scopes and provider aliases, and it clears stale tracked aliases after safe overwrites to avoid new false positives.
  • DI009 Registration-Shape Coverage: Open-generic captive-dependency coverage now has direct tests for TryAddSingleton(...), ServiceDescriptor.Singleton(...), and keyed open-generic singleton registrations, plus no-diagnostic guardrails for mismatched keys and ineffective TryAddSingleton(...).
  • Analyzer Health Snapshot: Refreshed the rule-health scoring after the DI002/DI004/DI009 hardening pass and rolled the direct-test counts forward to the current suite.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.4.0

What changed

Changed

  • DI002 Scope/Alias Tracking: Scoped-service escape analysis now follows scopes created before a using (scope) statement, recognizes provider aliases, and stays quiet after safe alias overwrites instead of keeping stale escape state alive.
  • DI004 Scope/Alias Disposal Coverage: Use-after-dispose analysis now recognizes services resolved from predeclared scopes and provider aliases, and it clears stale tracked aliases after safe overwrites to avoid new false positives.
  • DI009 Registration-Shape Coverage: Open-generic captive-dependency coverage now has direct tests for TryAddSingleton(...), ServiceDescriptor.Singleton(...), and keyed open-generic singleton registrations, plus no-diagnostic guardrails for mismatched keys and ineffective TryAddSingleton(...).
  • Analyzer Health Snapshot: Refreshed the rule-health scoring after the DI002/DI004/DI009 hardening pass and rolled the direct-test counts forward to the current suite.

Learn more

2.3.9

DependencyInjection.Lifetime.Analyzers 2.3.9

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI016 Minimal-Hosting Coverage: BuildServiceProvider misuse detection now recognizes top-level registration code that flows from a builder-style .Services property, closing the missed-diagnostic gap for minimal-hosting registration composition without expanding the rule to every top-level IServiceCollection usage.
  • DI016 Diagnostic Precision: DI016 now reports on the BuildServiceProvider member name instead of highlighting the full invocation, producing tighter squiggles in the IDE and test output.
  • DI016 Regression Coverage: Added tests for IServiceCollection variable indirection, top-level .Services aliases, and a top-level standalone new ServiceCollection() no-diagnostic guardrail so the rule stays conservative.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.9

What changed

Changed

  • DI016 Minimal-Hosting Coverage: BuildServiceProvider misuse detection now recognizes top-level registration code that flows from a builder-style .Services property, closing the missed-diagnostic gap for minimal-hosting registration composition without expanding the rule to every top-level IServiceCollection usage.
  • DI016 Diagnostic Precision: DI016 now reports on the BuildServiceProvider member name instead of highlighting the full invocation, producing tighter squiggles in the IDE and test output.
  • DI016 Regression Coverage: Added tests for IServiceCollection variable indirection, top-level .Services aliases, and a top-level standalone new ServiceCollection() no-diagnostic guardrail so the rule stays conservative.

Learn more

2.3.8

DependencyInjection.Lifetime.Analyzers 2.3.8

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI018 Open-Generic Activatability: Non-instantiable implementation detection now checks unbound generic registrations against the generic type definition, so open generic implementations with only private, internal, or protected constructors are reported instead of slipping through to runtime activation failures.
  • DI018 Registration-Shape Coverage: Added direct guardrails for keyed registrations, TryAddSingleton(...), ServiceDescriptor.Singleton(...), ServiceDescriptor.Describe(...), typeof(...) registrations, and factory/implementation-instance silence so DI018 stays aligned with the collector paths the analyzers actually support.
  • DI018 Sample and Docs Parity: Expanded the DI018 sample, contract, and rule docs to include constructor-accessibility failures in addition to abstract implementations, and refreshed the analyzer health snapshot to reflect the stronger coverage.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.8

What changed

Changed

  • DI018 Open-Generic Activatability: Non-instantiable implementation detection now checks unbound generic registrations against the generic type definition, so open generic implementations with only private, internal, or protected constructors are reported instead of slipping through to runtime activation failures.
  • DI018 Registration-Shape Coverage: Added direct guardrails for keyed registrations, TryAddSingleton(...), ServiceDescriptor.Singleton(...), ServiceDescriptor.Describe(...), typeof(...) registrations, and factory/implementation-instance silence so DI018 stays aligned with the collector paths the analyzers actually support.
  • DI018 Sample and Docs Parity: Expanded the DI018 sample, contract, and rule docs to include constructor-accessibility failures in addition to abstract implementations, and refreshed the analyzer health snapshot to reflect the stronger coverage.

Learn more

2.3.7

DependencyInjection.Lifetime.Analyzers 2.3.7

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • Instance-Backed Registration Fidelity: Shared registration metadata now tracks pre-built implementation instances explicitly so constructor-driven analyzers and dependency resolution stay aligned with runtime behavior instead of treating existing objects like activatable implementation types.
  • False-Positive Reduction Across Rules: DI003, DI010, DI011, DI015, DI017, and DI018 now stay silent for valid implementation-instance registrations, including ServiceDescriptor instance forms and generic implementationInstance: overloads.
  • DI017 Determinism Hardening: Circular-dependency analysis now builds its effective registration set from stable source order, preventing duplicate or mixed instance-plus-constructed registrations from changing results due to concurrent discovery order.
  • Regression Coverage Expansion: Added direct tests for generic and named implementation-instance collection, ServiceDescriptor instance shapes, mixed instance-plus-constructed DI017 graphs, and the cross-rule fallout cases that motivated this pass.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.7

What changed

Changed

  • Instance-Backed Registration Fidelity: Shared registration metadata now tracks pre-built implementation instances explicitly so constructor-driven analyzers and dependency resolution stay aligned with runtime behavior instead of treating existing objects like activatable implementation types.
  • False-Positive Reduction Across Rules: DI003, DI010, DI011, DI015, DI017, and DI018 now stay silent for valid implementation-instance registrations, including ServiceDescriptor instance forms and generic implementationInstance: overloads.
  • DI017 Determinism Hardening: Circular-dependency analysis now builds its effective registration set from stable source order, preventing duplicate or mixed instance-plus-constructed registrations from changing results due to concurrent discovery order.
  • Regression Coverage Expansion: Added direct tests for generic and named implementation-instance collection, ServiceDescriptor instance shapes, mixed instance-plus-constructed DI017 graphs, and the cross-rule fallout cases that motivated this pass.

Learn more

2.3.6

DependencyInjection.Lifetime.Analyzers 2.3.6

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI013 Open-Generic Compatibility Hardening: Implementation-type mismatch analysis now rejects open-service registrations backed by closed generic implementations and validates open-generic projection ordering and arity more precisely across interface and base-type mappings.
  • DI013 Registration-Shape Coverage: Added direct guardrails for ServiceDescriptor.Singleton(...), ServiceDescriptor.Describe(...), keyed registrations, TryAddSingleton(...), implementation-instance registrations, and other collector-fed registration shapes so compatibility checks stay aligned with the registrations the analyzers actually understand.
  • Analyzer Health Snapshot: Added docs/ANALYZER_HEALTH.md with per-rule scoring, pass recommendations, and current verification status to make future hardening priorities explicit.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.6

What changed

Changed

  • DI013 Open-Generic Compatibility Hardening: Implementation-type mismatch analysis now rejects open-service registrations backed by closed generic implementations and validates open-generic projection ordering and arity more precisely across interface and base-type mappings.
  • DI013 Registration-Shape Coverage: Added direct guardrails for ServiceDescriptor.Singleton(...), ServiceDescriptor.Describe(...), keyed registrations, TryAddSingleton(...), implementation-instance registrations, and other collector-fed registration shapes so compatibility checks stay aligned with the registrations the analyzers actually understand.
  • Analyzer Health Snapshot: Added docs/ANALYZER_HEALTH.md with per-rule scoring, pass recommendations, and current verification status to make future hardening priorities explicit.

Learn more

2.3.5

DependencyInjection.Lifetime.Analyzers 2.3.5

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI005 Extension-Method Coverage: Added analyzer and code-fix coverage for IServiceProvider.CreateScope() in async and sync contexts, including both using var and block-form using (...) fixer rewrites to CreateAsyncScope().
  • DI005 Ownership and Boundary Guardrails: Locked expected behavior for CreateScope() passed into helper methods, returned from async methods, synchronously disposed inside async methods, and used inside async anonymous methods.
  • DI005 Async-Context Precision: Added no-diagnostic guardrails for synchronous lambdas and synchronous local functions nested inside async methods so future DI005 changes preserve correct executable-boundary behavior.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.5

What changed

Changed

  • DI005 Extension-Method Coverage: Added analyzer and code-fix coverage for IServiceProvider.CreateScope() in async and sync contexts, including both using var and block-form using (...) fixer rewrites to CreateAsyncScope().
  • DI005 Ownership and Boundary Guardrails: Locked expected behavior for CreateScope() passed into helper methods, returned from async methods, synchronously disposed inside async methods, and used inside async anonymous methods.
  • DI005 Async-Context Precision: Added no-diagnostic guardrails for synchronous lambdas and synchronous local functions nested inside async methods so future DI005 changes preserve correct executable-boundary behavior.

Learn more

2.3.4

DependencyInjection.Lifetime.Analyzers 2.3.4

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI001 Explicit Disposal Accuracy: Scope-disposal analysis now recognizes scope?.Dispose() and reassignment-to-local disposal patterns, reducing false positives for valid explicit disposal code.
  • DI001 Reassignment Leak Detection: Explicit disposal tracking now rejects dispose proofs when the local is reassigned before disposal, including non-scope reassignments, while respecting executable boundaries so lambda-only reassignments do not create noise.
  • DI001 Regression Coverage: Added guardrail tests for conditional disposal, reassignment-to-local, intervening reassignments, expression-based using (CreateScope()), and IServiceProvider.CreateScope() report/no-report behavior.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.4

What changed

Changed

  • DI001 Explicit Disposal Accuracy: Scope-disposal analysis now recognizes scope?.Dispose() and reassignment-to-local disposal patterns, reducing false positives for valid explicit disposal code.
  • DI001 Reassignment Leak Detection: Explicit disposal tracking now rejects dispose proofs when the local is reassigned before disposal, including non-scope reassignments, while respecting executable boundaries so lambda-only reassignments do not create noise.
  • DI001 Regression Coverage: Added guardrail tests for conditional disposal, reassignment-to-local, intervening reassignments, expression-based using (CreateScope()), and IServiceProvider.CreateScope() report/no-report behavior.

Learn more

2.3.3

DependencyInjection.Lifetime.Analyzers 2.3.3

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI003 Deduplication: Captive-dependency reporting now emits one diagnostic per unique captured dependency per registration, reducing duplicate reports when the same scoped/transient service is resolved multiple times inside one singleton factory.
  • Shared Key and Constant Helpers: Extracted keyed-parameter parsing and constant-value extraction into shared infrastructure so DI003, DI015, and registration/factory analysis stay aligned on keyed-service semantics.
  • DI003 Regression Coverage: Added guardrail tests for TryAddSingleton captive dependencies, open-generic constructor no-diagnostic behavior, repeated factory resolutions of the same scoped dependency, and keyed factory resolutions with a null key.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.3

What changed

Changed

  • DI003 Deduplication: Captive-dependency reporting now emits one diagnostic per unique captured dependency per registration, reducing duplicate reports when the same scoped/transient service is resolved multiple times inside one singleton factory.
  • Shared Key and Constant Helpers: Extracted keyed-parameter parsing and constant-value extraction into shared infrastructure so DI003, DI015, and registration/factory analysis stay aligned on keyed-service semantics.
  • DI003 Regression Coverage: Added guardrail tests for TryAddSingleton captive dependencies, open-generic constructor no-diagnostic behavior, repeated factory resolutions of the same scoped dependency, and keyed factory resolutions with a null key.

Learn more

2.3.2

DependencyInjection.Lifetime.Analyzers 2.3.2

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI008 Keyed Registration Fixes: AddKeyedTransient(...) is now fully supported by the DI008 code fix provider, including keyed lifetime rewrites to AddKeyedScoped / AddKeyedSingleton and keyed factory rewrites that preserve the original key argument and generate the correct two-parameter factory lambda shape.
  • DI008 Factory Detection Hardening: Disposable-transient analysis now exercises both delegate-variable and method-group factory registrations for keyed and non-keyed DI paths, keeping DI008 conservative when registrations already use caller-owned factory delegates.
  • DI008 Regression Coverage: Added DI 8 keyed-service analyzer/code-fix tests, guardrails for no-fix typeof(...) factory conversions, and named-key preservation checks so the highest-risk keyed paths are locked by executable coverage instead of code inspection alone.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.2

What changed

Changed

  • DI008 Keyed Registration Fixes: AddKeyedTransient(...) is now fully supported by the DI008 code fix provider, including keyed lifetime rewrites to AddKeyedScoped / AddKeyedSingleton and keyed factory rewrites that preserve the original key argument and generate the correct two-parameter factory lambda shape.
  • DI008 Factory Detection Hardening: Disposable-transient analysis now exercises both delegate-variable and method-group factory registrations for keyed and non-keyed DI paths, keeping DI008 conservative when registrations already use caller-owned factory delegates.
  • DI008 Regression Coverage: Added DI 8 keyed-service analyzer/code-fix tests, guardrails for no-fix typeof(...) factory conversions, and named-key preservation checks so the highest-risk keyed paths are locked by executable coverage instead of code inspection alone.

Learn more

2.3.1

DependencyInjection.Lifetime.Analyzers 2.3.1

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI006 Inherited-Type Coverage: Static provider cache analysis now catches custom interfaces that inherit from IServiceProvider, IServiceScopeFactory, or IKeyedServiceProvider, closing a real false-negative path for wrapper abstractions.
  • DI006 Fixer Safety: The remove-static code fix now stays conservative by refusing fixes for static classes, non-private members, partial types, static local-function usage, and other cases where rewriting could silently break references or produce invalid code.
  • DI006 Regression Coverage: Added targeted should-fix and should-not-fix tests for inherited interface detection, public member no-fix behavior, implicitly private members, static local functions, static classes, multi-variable fields, and partial-type guardrails.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.1

What changed

Changed

  • DI006 Inherited-Type Coverage: Static provider cache analysis now catches custom interfaces that inherit from IServiceProvider, IServiceScopeFactory, or IKeyedServiceProvider, closing a real false-negative path for wrapper abstractions.
  • DI006 Fixer Safety: The remove-static code fix now stays conservative by refusing fixes for static classes, non-private members, partial types, static local-function usage, and other cases where rewriting could silently break references or produce invalid code.
  • DI006 Regression Coverage: Added targeted should-fix and should-not-fix tests for inherited interface detection, public member no-fix behavior, implicitly private members, static local functions, static classes, multi-variable fields, and partial-type guardrails.

Learn more

2.3.0

DependencyInjection.Lifetime.Analyzers 2.3.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI017 Circular Dependency Detection: New diagnostic that detects direct, transitive, and self-referential circular dependencies in constructor injection chains. Uses keyed-service-aware resolution with memoized graph traversal for performance. Conservative by design — skips factory registrations, optional parameters, and IEnumerable<T> dependencies to avoid false positives. Reports deterministically on the lexicographically smallest service type in each cycle.
  • DI018 Non-Instantiable Implementation Detection: New diagnostic that catches implementation types the DI container cannot construct — abstract classes, interfaces, static classes, and types with no public constructors. Skips factory registrations where the factory handles construction. Catches registration mistakes that would otherwise surface as runtime InvalidOperationException.
  • Sample Parity Enforcement: New contract tests that enforce every public diagnostic ID has sample coverage with concrete claim anchors, all contract folder claims reference existing sample directories, and all claimed diagnostic IDs exist in the public inventory.
  • Cross-Rule Interaction Tests: New test suite validating expected multi-rule behavior — DI007+DI011, DI003+DI015, DI008+DI012b, and DI010+DI011 interactions on shared source.
  • Performance Regression Gate: Deterministic stress tests with 200-service registration sets, diamond dependency patterns, and large-scale cycle detection. Memoized cycle detection prevents exponential blowup on acyclic graphs.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.3.0

What changed

Added

  • DI017 Circular Dependency Detection: New diagnostic that detects direct, transitive, and self-referential circular dependencies in constructor injection chains. Uses keyed-service-aware resolution with memoized graph traversal for performance. Conservative by design — skips factory registrations, optional parameters, and IEnumerable<T> dependencies to avoid false positives. Reports deterministically on the lexicographically smallest service type in each cycle.
  • DI018 Non-Instantiable Implementation Detection: New diagnostic that catches implementation types the DI container cannot construct — abstract classes, interfaces, static classes, and types with no public constructors. Skips factory registrations where the factory handles construction. Catches registration mistakes that would otherwise surface as runtime InvalidOperationException.
  • Sample Parity Enforcement: New contract tests that enforce every public diagnostic ID has sample coverage with concrete claim anchors, all contract folder claims reference existing sample directories, and all claimed diagnostic IDs exist in the public inventory.
  • Cross-Rule Interaction Tests: New test suite validating expected multi-rule behavior — DI007+DI011, DI003+DI015, DI008+DI012b, and DI010+DI011 interactions on shared source.
  • Performance Regression Gate: Deterministic stress tests with 200-service registration sets, diamond dependency patterns, and large-scale cycle detection. Memoized cycle detection prevents exponential blowup on acyclic graphs.

Changed

  • DI012 Accuracy: Wrapper flow ordering restored for invoked helper methods so TryAdd-after-Add detection correctly follows service collection parameters across method boundaries.
  • DI011 Precision: Provider heuristics narrowed to honor selected constructors and reduce service-locator escape hatches, keeping diagnostics focused on real DI misuse.
  • DI012 Flow Scoping: Duplicate registration analysis scoped to service-collection flows to prevent cross-wrapper false positives.
  • Sample Verification Hardening: SARIF-based contract verification tightened with approved secondary diagnostic allowlisting, public diagnostic parity checks, and sample/docs freshness gate integration.

Learn more

2.2.2

DependencyInjection.Lifetime.Analyzers 2.2.2

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI015 Wrapper Reachability: DI015 now expands source-visible IServiceCollection wrapper extensions from real invocation sites instead of treating registrations inside uncalled wrappers as globally available.
  • DI015 Opaque Wrapper Suppression: Earlier opaque or external wrappers on the same IServiceCollection flow now suppress DI015 when registration state is uncertain, reducing false positives in layered registration modules.
  • DI015 Ordering and Flow Isolation: Wrapper-aware resolution now respects call order and per-collection flow, so wrappers invoked on a different IServiceCollection instance or after a registration do not hide genuine missing-dependency diagnostics.
  • DI015 Regression Coverage: Added should-report and should-not-report guardrails for invoked vs uninvoked wrappers, nested wrapper chains, cyclic wrappers, keyed mismatches, opaque external wrappers, same-method flow isolation, and registration ordering.
  • Release Metadata Sync: Backfilled the missing 2.2.1 changelog entry and resynced package metadata so the tagged release train and project version history are aligned again.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.2.2

What changed

Changed

  • DI015 Wrapper Reachability: DI015 now expands source-visible IServiceCollection wrapper extensions from real invocation sites instead of treating registrations inside uncalled wrappers as globally available.
  • DI015 Opaque Wrapper Suppression: Earlier opaque or external wrappers on the same IServiceCollection flow now suppress DI015 when registration state is uncertain, reducing false positives in layered registration modules.
  • DI015 Ordering and Flow Isolation: Wrapper-aware resolution now respects call order and per-collection flow, so wrappers invoked on a different IServiceCollection instance or after a registration do not hide genuine missing-dependency diagnostics.
  • DI015 Regression Coverage: Added should-report and should-not-report guardrails for invoked vs uninvoked wrappers, nested wrapper chains, cyclic wrappers, keyed mismatches, opaque external wrappers, same-method flow isolation, and registration ordering.
  • Release Metadata Sync: Backfilled the missing 2.2.1 changelog entry and resynced package metadata so the tagged release train and project version history are aligned again.

Learn more

2.2.1

DependencyInjection.Lifetime.Analyzers 2.2.1

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI013 Compatibility Hardening: Expanded implementation-type validation beyond simple typeof(service), typeof(implementation) assignability checks so DI013 now also reports deterministic-invalid self-registrations, abstract/interface implementations, private-constructor implementations, and invalid implementation instances when their exact runtime type is known.
  • DI013 Open Generic Precision: Reworked open-generic validation to require exact generic-parameter projection compatibility, rejecting arity mismatches, reordered parameters, transformed generic arguments, and other registrations that compile but cannot be activated by the built-in container.
  • Collector and Engine Support: Extended registration collection to recognize non-factory implementation-instance overloads, keyed registrations, and equivalent ServiceDescriptor forms while keeping factory registrations out of DI013 scope and preventing constructor-based analyzers from treating pre-built instances like activatable implementation types.
  • Regression Coverage and Docs: Expanded DI013 tests across valid/invalid closed, open-generic, keyed, TryAdd*, ServiceDescriptor, and implementation-instance scenarios, and updated README.md, docs/RULES.md, the sample app, and descriptor wording to match the hardened behavior.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.2.1

What changed

Changed

  • DI013 Compatibility Hardening: Expanded implementation-type validation beyond simple typeof(service), typeof(implementation) assignability checks so DI013 now also reports deterministic-invalid self-registrations, abstract/interface implementations, private-constructor implementations, and invalid implementation instances when their exact runtime type is known.
  • DI013 Open Generic Precision: Reworked open-generic validation to require exact generic-parameter projection compatibility, rejecting arity mismatches, reordered parameters, transformed generic arguments, and other registrations that compile but cannot be activated by the built-in container.
  • Collector and Engine Support: Extended registration collection to recognize non-factory implementation-instance overloads, keyed registrations, and equivalent ServiceDescriptor forms while keeping factory registrations out of DI013 scope and preventing constructor-based analyzers from treating pre-built instances like activatable implementation types.
  • Regression Coverage and Docs: Expanded DI013 tests across valid/invalid closed, open-generic, keyed, TryAdd*, ServiceDescriptor, and implementation-instance scenarios, and updated README.md, docs/RULES.md, the sample app, and descriptor wording to match the hardened behavior.

Learn more

2.2.0

DependencyInjection.Lifetime.Analyzers 2.2.0

Compile-time DI diagnostics for Microsoft.Extensions.DependencyInjection projects that want earlier feedback on lifetime bugs, scope leaks, service locator drift, and unresolvable registrations.

Why install or upgrade

  • DI015 Precision Refactor: Moved unresolved-dependency analysis onto a shared resolution engine with explicit confidence/provenance tracking, so constructor, factory, keyed, open-generic, and strict-mode paths share the same conservative resolution rules.
  • DI015 TryAdd/Descriptor Coverage: Effective TryAdd* registrations now participate in DI015 analysis, while shadowed TryAdd* registrations stay silent to match runtime behaviour; coverage also now includes ServiceDescriptor registration forms and direct IKeyedServiceProvider resolutions.
  • DI015 Code Fix: Added a narrow safe fix that inserts a self-binding registration for one direct concrete constructor dependency when the registration site is local and unambiguous; factory-rooted, keyed, abstract, multi-missing, and transitive-only cases intentionally remain no-fix.
  • DI015 Guardrails: Expanded DI015 regression coverage with paired should-report / should-not-report scenarios for TryAdd*, ServiceDescriptor, framework-provided dependencies, opaque duplicate registrations, and fixer/no-fixer boundaries.
  • Packaging Metadata: Expanded NuGet description, package tags, and release notes so search and package landing pages better describe DI lifetime, scope, and registration coverage.

Install

dotnet add package DependencyInjection.Lifetime.Analyzers --version 2.2.0

What changed

Changed

  • DI015 Precision Refactor: Moved unresolved-dependency analysis onto a shared resolution engine with explicit confidence/provenance tracking, so constructor, factory, keyed, open-generic, and strict-mode paths share the same conservative resolution rules.
  • DI015 TryAdd/Descriptor Coverage: Effective TryAdd* registrations now participate in DI015 analysis, while shadowed TryAdd* registrations stay silent to match runtime behaviour; coverage also now includes ServiceDescriptor registration forms and direct IKeyedServiceProvider resolutions.
  • DI015 Code Fix: Added a narrow safe fix that inserts a self-binding registration for one direct concrete constructor dependency when the registration site is local and unambiguous; factory-rooted, keyed, abstract, multi-missing, and transitive-only cases intentionally remain no-fix.
  • DI015 Guardrails: Expanded DI015 regression coverage with paired should-report / should-not-report scenarios for TryAdd*, ServiceDescriptor, framework-provided dependencies, opaque duplicate registrations, and fixer/no-fixer boundaries.
  • Packaging Metadata: Expanded NuGet description, package tags, and release notes so search and package landing pages better describe DI lifetime, scope, and registration coverage.
  • Adoption Docs: Added docs/ADOPTION.md and linked it from README.md so teams evaluating the analyzer have a fast install and rollout path.
  • Repository Intake: Added GitHub issue-template routing to point users toward setup guidance and the full rule reference before they file issues.
  • Growth Automation: Added tools/generate-growth-assets.mjs to generate a searchable static docs site, problem-intent landing pages, version-synced README install snippets, and curated release notes from the repo source material.
  • GitHub Pages: Added automated Pages publishing plus CI verification for the generated docs site, sitemap, robots.txt, and search index.
  • Release Surfaces: Updated release automation to generate GitHub Release body content and package release-note input from CHANGELOG.md instead of relying on generic auto-generated notes.

Learn more

2.1.4

What's Changed

Full Changelog: georgepwall1991/DependencyInjection.Lifetime.Analyzers@v2.1.3...v2.1.4

2.1.3

What's Changed

Full Changelog: georgepwall1991/DependencyInjection.Lifetime.Analyzers@v2.1.2...v2.1.3

2.1.2

Full Changelog: georgepwall1991/DependencyInjection.Lifetime.Analyzers@v2.1.1...v2.1.2

Commits viewable in compare view.

Updated MailKit from 4.14.1 to 4.15.1.

Release notes

Sourced from MailKit's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.14.

Release notes

Sourced from Microsoft.Extensions.Http.Polly's releases.

9.0.14

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.13...v9.0.14

9.0.13

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.12...v9.0.13)

9.0.12

Release

What's Changed

Full Changelog: dotnet/aspnetcore@v9.0.11...v9.0.12

9.0.11

Release

What's Changed

Description has been truncated

@dependabot
Bump AsyncKeyedLock and 10 others
1677fde 
Bumps AsyncKeyedLock from 8.0.1 to 8.0.2
Bumps DependencyInjection.Lifetime.Analyzers from 2.1.1 to 2.4.6
Bumps MailKit from 4.14.1 to 4.15.1
Bumps Microsoft.Extensions.Http.Polly from 9.0.0 to 9.0.14
Bumps Microsoft.SourceLink.GitHub from 10.0.102 to 10.0.201
Bumps SkiaSharp from 3.119.1 to 3.119.2
Bumps SkiaSharp.HarfBuzz from 3.119.1 to 3.119.2
Bumps SkiaSharp.NativeAssets.Linux from 3.119.1 to 3.119.2
Bumps SonarAnalyzer.CSharp from 10.19.0.132793 to 10.23.0.137933
Bumps System.IO.Hashing from 9.0.0 to 10.0.5
Bumps System.ServiceModel.Syndication from 9.0.0 to 9.0.14

---
updated-dependencies:
- dependency-name: AsyncKeyedLock
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: DependencyInjection.Lifetime.Analyzers
  dependency-version: 2.4.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: MailKit
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: Microsoft.Extensions.Http.Polly
  dependency-version: 9.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: Microsoft.SourceLink.GitHub
  dependency-version: 10.0.201
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: System.IO.Hashing
  dependency-version: 10.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: tests
- dependency-name: SkiaSharp
  dependency-version: 3.119.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: SkiaSharp.HarfBuzz
  dependency-version: 3.119.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: SkiaSharp.NativeAssets.Linux
  dependency-version: 3.119.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.23.0.137933
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: tests
- dependency-name: System.ServiceModel.Syndication
  dependency-version: 9.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: tests
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Apr 9, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 9, 2026

Superseded by #230.

@dependabot dependabot bot closed this Apr 9, 2026
@dependabot dependabot bot deleted the dependabot/nuget/src/DNTCommon.Web.Core/tests-9117e0b67c branch April 9, 2026 19:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

⚡