Merge branch 'release/1.4.18'

.github/dependabot.yml

@@ -41,6 +41,19 @@ updates:
       fakeiteasy:
         patterns:
           - "FakeItEasy*"
+      testable-io:
+        patterns:
+          - "TestableIO*"
+
+#  - package-ecosystem: "dotnet-sdk"
+#    directory: "/global.json"
+#    schedule:
+#      interval: "daily"
+
+#  - package-ecosystem: "dotnet-sdk"
+#    directory: "/templates/opinionated-solution/global.json"
+#    schedule:
+#      interval: "daily"
 
   - package-ecosystem: "npm"
     directory: "/templates/opinionated-solution/src/BASE_NAME.Frontend/"

.github/workflows/build.yml

@@ -100,7 +100,7 @@ jobs:
           global.json
         sparse-checkout-cone-mode: false
 
-    - name: Download artiifacts
+    - name: Download artifacts
       uses: actions/download-artifact@v4
       with:
         name: packages

.github/workflows/scorecard.yml

@@ -0,0 +1,73 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '23 8 * * 5'
+  push:
+    branches: [ "develop" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

Karls.Templates.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <PackageType>Template</PackageType>
-    <PackageVersion>1.4.17</PackageVersion>
+    <PackageVersion>1.4.18</PackageVersion>
     <PackageId>Karls.Templates</PackageId>
     <Title>Karls Templates</Title>
     <Authors>Karl-Johan Sjögren</Authors>

global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "8.0.401",
+    "version": "9.0.100",
     "rollForward": "latestFeature"
   }
 }

templates/opinionated-solution/.github/dependabot.yml

@@ -40,6 +40,9 @@ updates:
       fakeiteasy:
         patterns:
           - "FakeItEasy*"
+      testable-io:
+        patterns:
+          - "TestableIO*"
 
   - package-ecosystem: "github-actions"
     directory: "/"

templates/opinionated-solution/.github/workflows/build.yml

@@ -206,12 +206,12 @@ jobs:
         path: coverage-report
 
     - name: Upload to Codecov
-      uses: codecov/codecov-action@v4
+      uses: codecov/codecov-action@v5
       # To save on uploads, only upload coverage from the main branches and PRs
       if: env.PUBLISH_CODECOV
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
-        file: coverage-report/Cobertura.xml
+        files: coverage-report/Cobertura.xml
 
     - name: Upload coverage history
       uses: actions/upload-artifact@v4

templates/opinionated-solution/.vscode/settings.json

@@ -1,11 +1,10 @@
 {
-    "files.exclude": {
-      "**/.DS_Store": true,
-      "**/node_modules": true,
-      "**/bin": true,
-      "**/obj": true,
-      "**/tmp": true,
-      "**/.yarn/cache": true
-    }
+  "files.exclude": {
+    "**/.DS_Store": true,
+    "**/node_modules": true,
+    "**/bin": true,
+    "**/obj": true,
+    "**/tmp": true,
+    "**/.yarn/cache": true
   }
-  
+}

templates/opinionated-solution/Directory.Build.props

@@ -4,6 +4,7 @@
     <LangVersion>latest</LangVersion>
     <TargetFramework>net8.0</TargetFramework>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors> <!-- A package restored for your project has a known vulnerability. -->
     <Deterministic>true</Deterministic>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>

templates/opinionated-solution/Directory.Packages.props

@@ -1,10 +1,10 @@
 <Project>
 
-<ItemGroup>
+  <ItemGroup>
     <GlobalPackageReference Include="DotNet.ReproducibleBuilds" Version="1.2.25" />
     <GlobalPackageReference Include="Karls.Analyzers" Version="0.4.3" />
-    <GlobalPackageReference Include="Roslynator.Analyzers" Version="4.12.8" />
-    <GlobalPackageReference Include="Roslynator.Formatting.Analyzers" Version="4.12.8" />
+    <GlobalPackageReference Include="Roslynator.Analyzers" Version="4.12.9" />
+    <GlobalPackageReference Include="Roslynator.Formatting.Analyzers" Version="4.12.9" />
     <GlobalPackageReference Include="TestableIO.System.IO.Abstractions.Analyzers" Version="2022.0.0" />
   </ItemGroup>
 
@@ -13,13 +13,13 @@
     <PackageVersion Include="FakeItEasy.Analyzer.CSharp" Version="6.1.1" />
     <PackageVersion Include="FakeItEasy" Version="8.3.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="3.3.4" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.Testing" Version="8.10.0" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="8.10.0" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.Testing" Version="9.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="9.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="9.0.0" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
     <PackageVersion Include="Shouldly" Version="4.2.1" />
-    <PackageVersion Include="TestableIO.System.IO.Abstractions.TestingHelpers" Version="21.0.29" />
-    <PackageVersion Include="TestableIO.System.IO.Abstractions.Wrappers" Version="21.0.29" />
+    <PackageVersion Include="TestableIO.System.IO.Abstractions.TestingHelpers" Version="21.1.3" />
+    <PackageVersion Include="TestableIO.System.IO.Abstractions.Wrappers" Version="21.1.3" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
     <PackageVersion Include="xunit" Version="2.9.2" />
   </ItemGroup>

templates/opinionated-solution/global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "8.0.401",
+    "version": "9.0.100",
     "rollForward": "latestFeature"
   }
 }

templates/opinionated-solution/src/BASE_NAME.Frontend/package.json

@@ -17,36 +17,36 @@
     "test:ci": "vitest run --reporter=junit --coverage --outputFile=test-results/junit.xml"
   },
   "devDependencies": {
-    "@codecov/vite-plugin": "^1.2.0",
-    "@stylistic/eslint-plugin-js": "^2.9.0",
+    "@codecov/vite-plugin": "^1.2.1",
+    "@stylistic/eslint-plugin-js": "^2.10.1",
     "@stylistic/stylelint-plugin": "^3.1.1",
     "@testing-library/dom": "^10.4.0",
-    "@vitest/browser": "^2.1.2",
-    "@vitest/coverage-v8": "^2.1.2",
-    "@vitest/ui": "^2.1.2",
+    "@vitest/browser": "^2.1.5",
+    "@vitest/coverage-v8": "^2.1.5",
+    "@vitest/ui": "^2.1.5",
     "autoprefixer": "^10.4.20",
-    "browserslist": "^4.24.0",
+    "browserslist": "^4.24.2",
     "cssnano": "^7.0.6",
     "esbuild": "^0.24.0",
     "esbuild-plugin-browserslist": "^0.15.0",
-    "eslint": "^9.12.0",
+    "eslint": "^9.14.0",
     "eslint-plugin-compat": "^6.0.1",
-    "eslint-plugin-jsdoc": "^50.3.1",
-    "eslint-plugin-testing-library": "^6.3.0",
+    "eslint-plugin-jsdoc": "^50.5.0",
+    "eslint-plugin-testing-library": "^6.4.0",
     "eslint-plugin-vitest": "^0.5.4",
     "jsdom": "^25.0.1",
     "jsdom-testing-mocks": "^1.13.1",
-    "postcss": "^8.4.47",
+    "postcss": "^8.4.49",
     "postcss-scss": "^4.0.9",
     "rollup-plugin-copy": "^3.5.0",
     "rollup-plugin-visualizer": "^5.12.0",
-    "sass": "^1.79.5",
+    "sass": "^1.80.7",
     "stylelint": "^16.10.0",
     "stylelint-config-standard": "^36.0.1",
     "stylelint-config-standard-scss": "^13.1.0",
-    "vite": "^5.4.8",
+    "vite": "^5.4.11",
     "vite-plugin-mkcert": "^1.17.6",
-    "vitest": "^2.1.2",
-    "webdriverio": "^9.1.5"
+    "vitest": "^2.1.5",
+    "webdriverio": "^9.2.14"
   }
 }