Release Healthie.NET 4.1.3

.github/dependabot.yml

@@ -18,6 +18,16 @@ updates:
         update-types:
           - "minor"
           - "patch"
+    # Quartz 4 no longer provides net8.0 assets and changes the Quartz types exposed by
+    # Healthie.NET.Quartz. Keep Healthie 4.x on the supported Quartz 3 line; migrating the public
+    # surface belongs in a future Healthie major release.
+    ignore:
+      - dependency-name: "Quartz.Extensions.DependencyInjection"
+        update-types:
+          - "version-update:semver-major"
+      - dependency-name: "Quartz.Extensions.Hosting"
+        update-types:
+          - "version-update:semver-major"
 
   - package-ecosystem: "github-actions"
     directory: "/"

.github/workflows/scorecard.yml

@@ -52,6 +52,6 @@ jobs:
           retention-days: 90
 
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: results.sarif

CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [4.1.3] - 2026-09-29
+
+### Fixed
+
+- Compatible runtime and test dependencies now track their current releases, including the latest
+  Quartz 3 line for the existing `net8.0` and `net10.0` provider. Dependabot now leaves the
+  incompatible Quartz 4 migration for a future Healthie.NET major release.
+- The test projects now run on xUnit 4 through Microsoft Testing Platform, so .NET 10 executes the
+  unit and browser suites instead of rejecting their legacy VSTest target.
+- The Aspire sample now uses the matching 13.5.4 AppHost SDK and its recommended CLI bundle, and the
+  redundant direct SSH.NET test pin was removed after Testcontainers adopted the patched release.
+- The Scorecard upload action is pinned to the current immutable CodeQL Action 4.38.2 commit.
+
 ## [4.1.2] - 2026-09-12
 
 ### Fixed

Directory.Packages.props

@@ -9,28 +9,28 @@
     onto .NET 10 assemblies by referencing this library.
   -->
   <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.10" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.10" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="10.0.10" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.12" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' != 'net10.0'">
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.2" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="8.0.29" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="8.0.29" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="8.0.31" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="8.0.31" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="8.0.1" />
     <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.1" />
   </ItemGroup>
 
   <!-- Library dependencies -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.Azure.Cosmos" Version="3.63.0" />
+    <PackageVersion Include="Microsoft.Azure.Cosmos" Version="3.63.1" />
     <!-- Provider-agnostic AI abstractions: the host brings its own IChatClient. -->
-    <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="10.10.0" />
+    <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="10.10.1" />
     <!-- 2.0 is in preview and tracks a release-candidate protocol revision; stay on stable. -->
     <PackageVersion Include="ModelContextProtocol" Version="2.2.0" />
     <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
@@ -39,7 +39,7 @@
     <PackageVersion Include="Cronos" Version="0.13.0" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.12" />
     <PackageVersion Include="Hangfire.Core" Version="1.8.25" />
-    <PackageVersion Include="Microsoft.Data.SqlClient" Version="7.0.3" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="7.1.0" />
     <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.12" />
     <PackageVersion Include="Npgsql" Version="10.0.3" />
     <!--
@@ -49,10 +49,10 @@
       break this repository's deliberate float of 8.0.x against 10.0.x.
     -->
     <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.13" />
-    <PackageVersion Include="Temporalio" Version="1.19.0" />
-    <PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.22.0" />
-    <PackageVersion Include="Quartz.Extensions.Hosting" Version="3.22.0" />
-    <PackageVersion Include="StackExchange.Redis" Version="3.2.1" />
+    <PackageVersion Include="Temporalio" Version="1.20.0" />
+    <PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="3.22.3" />
+    <PackageVersion Include="Quartz.Extensions.Hosting" Version="3.22.3" />
+    <PackageVersion Include="StackExchange.Redis" Version="3.3.1" />
   </ItemGroup>
 
   <!-- Sample-only dependencies -->
@@ -65,26 +65,14 @@
   <!-- Test dependencies -->
   <ItemGroup>
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
-    <PackageVersion Include="Microsoft.Playwright" Version="1.62.0" />
-    <PackageVersion Include="xunit.v3" Version="3.2.2" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
+    <PackageVersion Include="Microsoft.Playwright" Version="1.63.0" />
+    <PackageVersion Include="xunit.v3" Version="4.0.1" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.0" />
     <PackageVersion Include="bunit" Version="2.11.3" />
     <PackageVersion Include="Testcontainers.Redis" Version="4.15.0" />
     <PackageVersion Include="Testcontainers.PostgreSql" Version="4.15.0" />
     <PackageVersion Include="Testcontainers.MsSql" Version="4.15.0" />
     <PackageVersion Include="Testcontainers.CosmosDb" Version="4.15.0" />
-    <!--
-      Referenced directly by Healthie.Tests.Unit purely to raise it. Testcontainers 4.13.0 resolves
-      SSH.NET 2025.1.0, which is GHSA-q939-rpr3-3284 (high): ScpClient's recursive download writes
-      wherever a malicious server's filenames point. Patched in 2026.0.0, and 4.13.0 is
-      Testcontainers' own latest, so there is nothing upstream to wait for.
-
-      A direct reference rather than CentralPackageTransitivePinningEnabled: that switch forces one
-      version of every transitive package across the whole solution, which collides head-on with the
-      per-target-framework Microsoft.Extensions.* versions above and fails restore with NU1109.
-      Drop this when Testcontainers resolves 2026.0.0 itself.
-    -->
-    <PackageVersion Include="SSH.NET" Version="2026.0.0" />
   </ItemGroup>
 
 </Project>

global.json

@@ -1,7 +1,10 @@
 {
   "sdk": {
-    "version": "10.0.303",
+    "version": "10.0.401",
     "rollForward": "latestPatch",
     "allowPrerelease": false
+  },
+  "test": {
+    "runner": "Microsoft.Testing.Platform"
   }
 }

samples/Healthie.AppHost/Healthie.AppHost.csproj

@@ -1,12 +1,13 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
-  <Sdk Name="Aspire.AppHost.Sdk" Version="13.4.6" />
+  <Sdk Name="Aspire.AppHost.Sdk" Version="13.5.4" />
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
     <!-- The Aspire host targets the current LTS; the samples it orchestrates target net8.0. -->
     <TargetFramework>net10.0</TargetFramework>
     <IsAspireHost>true</IsAspireHost>
+    <AspireUseCliBundle>true</AspireUseCliBundle>
     <UserSecretsId>healthie-apphost</UserSecretsId>
     <!--
       RunAsPreviewEmulator and WithDataExplorer are still marked experimental. They select the Linux

samples/Healthie.Sample.BlazorUI/packages.lock.json

@@ -139,8 +139,8 @@
       },
       "Quartz": {
         "type": "Transitive",
-        "resolved": "3.22.0",
-        "contentHash": "Bq7XJNnFC1l54jpELSPi5xZ8QbA9wFpJOeMJ1MsS1LSS+yUFa/5dvAm5YGIaiq41szwCmRisZL+iwrhBUvIBPA==",
+        "resolved": "3.22.3",
+        "contentHash": "2IG8/IGRqSmobcQ/bvvCOE98vd7pv1cgbQSzV4fg3A3GB8Y+pgVOUJSEPCnds5BIt/I6oNsePLqfc/EphPwytw==",
         "dependencies": {
           "Microsoft.Extensions.Logging.Abstractions": "2.1.1"
         }
@@ -280,7 +280,7 @@
         "type": "Project",
         "dependencies": {
           "Healthie.NET.Abstractions": "[1.0.0, )",
-          "Microsoft.Azure.Cosmos": "[3.63.0, )"
+          "Microsoft.Azure.Cosmos": "[3.63.1, )"
         }
       },
       "Healthie.NET.Dashboard": {
@@ -294,7 +294,7 @@
         "dependencies": {
           "Cronos": "[0.13.0, )",
           "Healthie.NET.Abstractions": "[1.0.0, )",
-          "Microsoft.Extensions.Diagnostics.HealthChecks": "[8.0.29, )"
+          "Microsoft.Extensions.Diagnostics.HealthChecks": "[8.0.31, )"
         }
       },
       "Healthie.NET.LeaderElection": {
@@ -308,8 +308,8 @@
         "dependencies": {
           "Healthie.NET.Abstractions": "[1.0.0, )",
           "Microsoft.Extensions.DependencyInjection.Abstractions": "[8.0.2, )",
-          "Quartz.Extensions.DependencyInjection": "[3.22.0, )",
-          "Quartz.Extensions.Hosting": "[3.22.0, )"
+          "Quartz.Extensions.DependencyInjection": "[3.22.3, )",
+          "Quartz.Extensions.Hosting": "[3.22.3, )"
         }
       },
       "Healthie.NET.Uptime": {
@@ -326,9 +326,9 @@
       },
       "Microsoft.Azure.Cosmos": {
         "type": "CentralTransitive",
-        "requested": "[3.63.0, )",
-        "resolved": "3.63.0",
-        "contentHash": "FyEhmsAohHiKRMM+66dQriRWgJjkL/99NTFRXW4np6GlIa15pXY1F1lp5z35KNhyWV5oTIInjwdZVyzHD/eKeQ==",
+        "requested": "[3.63.1, )",
+        "resolved": "3.63.1",
+        "contentHash": "ocxXpxJkhyQv0OH6pTBoKKuz+VzR1zb2x6E7r3D6Kdmjb6zmFyrDTyaxQ3i/BD+V3sztCfNjXUQFREAo9mdyLg==",
         "dependencies": {
           "Azure.Core": "1.44.1",
           "Microsoft.Bcl.AsyncInterfaces": "6.0.0",
@@ -361,21 +361,21 @@
       },
       "Microsoft.Extensions.Diagnostics.HealthChecks": {
         "type": "CentralTransitive",
-        "requested": "[8.0.29, )",
-        "resolved": "8.0.29",
-        "contentHash": "CKaXBomiwjwo+HQv8WhCPVW8LwNP8pVu6nKzRxh23qgOMVNJeerPgxfHaBniFJsFnBzsq9ntu6nXk77CbYvkHA==",
+        "requested": "[8.0.31, )",
+        "resolved": "8.0.31",
+        "contentHash": "9zVhlLRTka8pNcyrlm0B1al+AlT0gPXuELs1FL9fIry5eWoTOtlyIjVOVqmk/+LYMjIuIuLfOxToZE1acxVxUA==",
         "dependencies": {
-          "Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions": "8.0.29",
+          "Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions": "8.0.31",
           "Microsoft.Extensions.Hosting.Abstractions": "8.0.1",
           "Microsoft.Extensions.Logging.Abstractions": "8.0.3",
           "Microsoft.Extensions.Options": "8.0.2"
         }
       },
       "Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions": {
         "type": "CentralTransitive",
-        "requested": "[8.0.29, )",
-        "resolved": "8.0.29",
-        "contentHash": "HSabrcvae+5j1CYW4MJa8CC9Wd4ZX1l9ImldPjiDeTmcdgfi6XvEuWFLncj/xB2FiVuOVlMAssMWiICPxZnEJA=="
+        "requested": "[8.0.31, )",
+        "resolved": "8.0.31",
+        "contentHash": "MYsLt506vFROmfST9D6SQx8wXsXcdiKEMhpNNL4E2e8fie5jJ+nTCBVXwtoTnB6uqIboRbJ4VtSvMcIDunyp4Q=="
       },
       "Microsoft.Extensions.Hosting.Abstractions": {
         "type": "CentralTransitive",
@@ -406,23 +406,23 @@
       },
       "Quartz.Extensions.DependencyInjection": {
         "type": "CentralTransitive",
-        "requested": "[3.22.0, )",
-        "resolved": "3.22.0",
-        "contentHash": "xfr8PRBtQDFwiUdbmIi56QX1vpMdBVKTsu0dHakUqRwc5lpe6IgzOIseQzq1tPlnlTCZleplJfH6InSj5E3lQw==",
+        "requested": "[3.22.3, )",
+        "resolved": "3.22.3",
+        "contentHash": "57O6cM8zcgZbl8swQquQbwUj5MNCR5ZiEd8snmiw7/UD4NRmJDWw5bjYKe2u6FeCajL9zuvcGtQdVXCQCpFjnQ==",
         "dependencies": {
           "Microsoft.Extensions.Configuration.Abstractions": "8.0.0",
           "Microsoft.Extensions.Options": "8.0.0",
-          "Quartz": "3.22.0"
+          "Quartz": "3.22.3"
         }
       },
       "Quartz.Extensions.Hosting": {
         "type": "CentralTransitive",
-        "requested": "[3.22.0, )",
-        "resolved": "3.22.0",
-        "contentHash": "zVDs4nHELhjabZ8WEfP7j/wcG6DKKtYvULoQL8Oix4vyisvBD9kCMiQVFSQ5PnmWW0O8PH/JuahBLp0e6JxIYQ==",
+        "requested": "[3.22.3, )",
+        "resolved": "3.22.3",
+        "contentHash": "mISGoTfqYigwDak0UEf9SsOzOurAqYTfWDOQggKkyVKe3ukR4zzK9W3U1gdkxz0/3mWo62uL50rnvaXLD51Yzw==",
         "dependencies": {
           "Microsoft.Extensions.Hosting.Abstractions": "8.0.0",
-          "Quartz.Extensions.DependencyInjection": "3.22.0"
+          "Quartz.Extensions.DependencyInjection": "3.22.3"
         }
       }
     }