CPMigrate 3.51.0

This package has no dependencies.

Docs and packaging: the README is rebuilt around a conversion funnel — Remotion-rendered hero video (poster-linked, because NuGet strips video tags), terminal recordings re-recorded at 3.28.x replacing GIFs that showed v3.5.0, a new FAQ, and 40% fewer lines with every documented contract preserved. The docs site gains FAQ and Video structured data and proper 1200x630 social cards. The nupkg no longer bundles assets/video — the **\* pack glob swept 3.4MB of media NuGet cannot render; it now ships the README and the three product-flow SVGs. Previously: URGENT FIX for a regression in 3.26.0, 3.27.0 and 3.28.0: those versions silently dropped projects from --analyze. The restore isolation they introduced was passed as environment variables, which apply to every project in the MSBuild graph rather than the one being queried, so any project with a ProjectReference told its references to write to the same intermediate directory. They collided, the query returned no frameworks, and the scan counted that as success with zero packages — so the project vanished with scanFailures: 0 and no warning. Measured on Serilog: three of six projects lost, non-deterministically. Upgrade from any of those three versions. Previously: closes a security-relevant race in --audit, --outdated and --deprecated that has been present since 3.15.0. Those queries shell out to `dotnet package list`, which restores — so two projects sharing a project.assets.json corrupt each other's results. Demonstrated with two projects in one directory, one pinned to a Newtonsoft.Json version with a known high-severity advisory and one to a clean version: queried concurrently, the clean project was reported carrying the vulnerable version. It runs the other way just as easily, which is a genuinely vulnerable project reported clean, with nothing in the output to say so. Each deep scan now reuses the isolated directory its project's resolved scan proved usable, and where that scan escaped, it runs under the exclusive restore lock instead. Previously in 3.27.0: Every dependency is now current — MSBuild 18.8.2, Buildalyzer 9, Spectre.Console 0.57.2, SonarAnalyzer 10.31, coverlet 10 — with nothing outdated left. This also corrects the record: 3.24.0 reported that Microsoft.Build 18.8.2 broke 20 tests. It does not, and it did not. That run took 14 minutes against a normal 2 and the machine ran out of disk shortly afterwards; the bisect that produced the claim never tested the MSBuild packages on their own. Verified now on both this code and the pre-3.26.0 code: clean either way. Previously in 3.26.0: Analysis is about four times faster on a large solution: 60 projects went from 200s to 50s, with byte-identical findings. Resolving packages shells out to `dotnet package list` once per project — a separate process that spends most of its time waiting — and those now run concurrently. The reason it could not before is that `dotnet package list` restores, and two projects sharing an assets file cannot be queried at once: the loser reports the other project's packages, so two projects with different versions report the same one and the inconsistency disappears with a clean exit code. Each invocation now gets its own MSBuild intermediate directory, which makes that collision impossible rather than something to detect — the detection is not possible here, because where the assets file goes depends on MSBuild evaluation that this phase must not perform. Reading project files stays serial, deliberately: MSBuild's object model is not thread-safe. Previously in 3.25.1: Refreshes the dependencies bundled into the tool — Serilog 4.4.0, NuGet.Versioning 7.6.0, Microsoft.Extensions.Logging 10.0.10 — which were updated on main after 3.25.0 was tagged. No behaviour change: this is a PackAsTool package, so those assemblies ship inside it rather than being restored by consumers, and 3.25.0 was still carrying the older ones. Previously in 3.25.0: Holds the documentation to the tool. A flag that exists and is undocumented is invisible; one that is documented and no longer exists is worse, because it gets written into a CI script and discovered from an exit code. Neither shows up in a build, a test run, or a review of the code that changed — the docs are a different file and nothing was checking them. DocumentationDriftTests now asserts, by reflection, that every option appears in the README reference and every documented option still exists, that every exit code is in the table under its own name, and that every analysis rule has a published page. One option had already slipped (--gitignore-dir), which is the argument for asserting it rather than remembering. Previously in 3.24.0: Adds ScanWorkTests: the properties any change to the analysis scan's scheduling has to hold, rather than a duration — findings independent of --max-parallelism, shared-directory and redirected-output layouts still reporting their findings, and the same solution producing the same report twice. Also fixes a --fix regression from 3.23.0 where a framework-conditional pin read as an ordinary one and every other project was unified to it. A concurrent package-resolution change measured at two to four times faster was written and deliberately not shipped: whether two projects share a project.assets.json depends on full MSBuild evaluation, which that phase cannot do, and eight review rounds each found another route to a shared file. A scan that silently reports fewer findings is worse than a slow one. Previously in 3.23.0: Fixes --fix reporting "No changes were needed" when it could not change anything. Both fixers that edit project XML swallowed every exception and returned null, which the caller could only read as "nothing to change" — so on a read-only, locked, or malformed project file the run printed that reassuring line directly above "1 issue(s) could not be fixed automatically", two statements contradicting each other, and threw away the actual cause. The exit code was already right, because the post-fix rescan gates on the surviving finding; everything a human reads was wrong. Failures now carry their reason and name the file, one unreadable file still does not stop the others, and "No changes were needed" is printed only when that is true. Previously in 3.22.0: Closes the last four exemptions in the end-to-end rule guard, so every analysis rule is now proven against real data rather than taken on trust. The vulnerability, outdated, deprecated, and transitive rules were exempted as needing a live NuGet feed — true of the query, but not of the parsing and reporting after it, which is exactly where the 3.20.0 defect lived. They are now driven from JSON captured from real `dotnet package list` runs, which immediately found that a --transitive scan invented a duplicate-reference finding for any package present both directly and transitively. Previously in 3.21.0: Fixes RedundantReference, which could not fire, and its fixer, which could not fix. The rule reads package references from `dotnet package list` — the *resolved* graph — and resolution collapses two PackageReference items with the same Include into one, so by the time a duplicate reached the analyzer there was only ever one of it. Rules about what a project file says now read the references as declared. The fixer separately resolved projects by file name while findings have identified them by path since 3.10.0, so it matched nothing and returned "no fix needed": the run printed "No changes were needed" over an unrepaired finding. Conditional declarations are now respected by every rule and fixer: declaring a package once per target framework behind a Condition is how multi-targeting is written, and treating it as a duplicate or an inconsistency had --fix delete or overwrite the pin another framework depended on. The rule also now fires under central package management, where references carry no version at all. All found by a new end-to-end guard that drives the real CLI against real files and asserts every rule can actually fire — because the analyzer unit tests all passed throughout, proving the logic while nothing checked that the pipeline in front of it delivers the shape the logic expects. Previously in 3.20.0: Fixes the RedundantDirectReference analyzer, which had never reported anything. It reads the resolved dependency graph out of project.assets.json, but composed its lookup key from the version in project.frameworks.<tf>.dependencies — which NuGet writes as a range, "[7.0.0, )" — while the targets section is keyed by the resolved version, "Serilog/7.0.0". The key matched nothing on any real project, so the traversal found no dependencies and the analyzer reported a clean result instead of a broken lookup. Its tests passed because their fixtures used a bare version that restore never writes. Lookup is now by package name against the resolved graph, since restore settles on one version per package per framework and no version needs reconstructing. Two further conditions the corrected traversal needed, both found in cross-review: a reference that pins *higher* than anything else requires is not redundant, because removing it downgrades the package — the contract always said "at the same or higher version" and a reachability-only check dropped that; and a reference redundant under only some target frameworks is not reported, since removing it breaks the framework where it was independently required. Previously in 3.19.0: Directory.Packages.props keeps its shape across runs. A merge used to write new pins as <PackageVersion Include="X"><Version>1.0.0</Version></PackageVersion> while every entry around them used Version="1.0.0" — one file, two styles, and a three-line diff for a one-line addition. It also inserted new entries between a comment and the pin that comment documents, silently reattaching a team's "pinned because 2.x drops netstandard2.0" note to a different package, which is worse than losing it because the file still reads as correct. New pins now match whichever style the file already uses, a file that was ordered stays ordered, one that was not is left as its author arranged it, and where a comment occupies the sorted position the new entry goes one slot later rather than taking the explanation with it. Ordering is also no longer culture-sensitive. Previously in 3.18.0: Fixes the interactive wizard silently answering its own questions. Every prompt used to work out what an answer meant by reading its label back — StartsWith("Yes"), an exact match against the display string, or slicing an emoji prefix off a directory name — and every one of them had a quiet wrong answer behind it: an answer that matched nothing fell through to a default, so a reworded option flipped to its opposite and an unrecognised mission started a migration nobody asked for. Answers now carry their values, and an answer that was not offered is an error. Also fixes a real gap this was hiding: a repository with Directory.Packages.props at the top and projects under src/ — the ordinary shape of a migrated solution, and exactly what --analyze is pointed at — could not be selected in the browser at all. Previously in 3.17.1: Internal: CommandRouter dispatch is now an ordered table rather than an if/else chain. Behaviour-preserving, but it makes precedence explicit — which mode wins when several flags are present was previously decided by the order statements happened to appear in, and is now a readable list with tests asserting it. Previously in 3.17.0: publishes a JSON Schema for the --output Json payload at schemas/cpmigrate-output.schema.json. The contract has been versioned since 1.0.0 but never described, so consumers had to infer the shape from examples — and infer it wrong at the edges, which is where the fields that matter live: success: true does not mean "no findings" when they were below the --fail-on threshold or accepted by a baseline, and an absent summary counter means the command did not produce it rather than producing zero. Guarded against drift by reflection rather than a new dependency, so a field added without updating the schema fails the build. Previously in 3.16.0: adds --explain <RuleId>: rule documentation from the same terminal that produced the finding. A rule ID in a build log is the moment someone needs to know what it means and the moment they are least likely to go looking for a docs site. The same IDs appear as issueCode in JSON and ruleId in SARIF, so a report can be pasted straight back. --explain all lists every rule; a near miss suggests the real one; an unrecognised ID exits non-zero so a CI typo is visible. Previously in 3.15.0: --audit, --outdated, and --deprecated now query projects concurrently. Each shells out to 'dotnet package list' per project and waits on the network, so the scan scaled linearly with solution size for no reason: 10 projects with --outdated went from 12s to 6s. Bounded by --max-parallelism (default: processor count, capped at 8). Reading package references stays serial on purpose — that pass goes through MSBuild's object model, whose static caches are not thread-safe, and running it concurrently made projects report each other's versions and silently erased version-inconsistency findings. Results merge in project order, so a report is identical run to run. Previously in 3.14.0: fixes a failed NuGet version lookup being reported as "up to date". The lookup returned null both for "this package is current" and "the request failed", so one 503 or timeout during --update-packages silently dropped that package and the run still finished with "Everything up to date!" — on a slow connection a large solution could skip most of its updates and say nothing. Transient failures are now retried with exponential backoff and jitter, honouring Retry-After up to a cap; 404 and malformed bodies are treated as definitive; and whatever still fails is named rather than being counted as current. Lookups are also cached per run, so a package referenced from thirty projects costs one request instead of thirty. Previously in 3.13.0: adds --completions for bash, zsh, fish, and PowerShell. With 45 options, remembering which take a value — and that it is Sarif rather than SARIF — is not a reasonable expectation. Generated from the option metadata rather than hand-written, because a stale completion list is worse than none: it suggests flags that no longer exist. Enum options complete their values, path options complete filenames, and zsh shows help text inline. Previously in 3.12.0: adds four rules that catch a solution drifting back off central package management. Migrating is a one-off event; staying migrated is not — someone adds a package with an inline Version and the solution is quietly half-centralized, with NuGet saying nothing because the inline version simply wins. InlineVersionUnderCpm (an inline pin overriding the central one), MissingPackageVersion (no version anywhere; restore fails), OrphanedPackageVersion (a central pin nothing references), and CpmNotEnabled (a props file with central management switched off, so every entry is inert). Gated on data rather than a flag: nothing is reported unless the solution has a Directory.Packages.props. Previously in 3.11.0: adds --output Markdown: a report for a CI job summary or PR comment, because neither existing format reaches a human when they need it — JSON is for parsers and SARIF only surfaces findings that map to a line in the diff, which a solution-wide dependency problem never does. Leads with the verdict (did anything reach the --fail-on threshold), then scan totals, a severity breakdown, and a findings table linking each rule to its docs. Incomplete scans get a prominent warning, baselined findings are marked, long lists collapse, and table cells are escaped. Previously in 3.10.0: findings identify projects by their path relative to the scan root (src/App/App.csproj) rather than by file name. A file name is not an identifier — two projects can share one — which meant a baseline entry accepting debt in one project could silently suppress a new finding in another, and SARIF had to guess which same-named file to annotate. Action required: regenerate baselines, the fingerprint scheme is now v2 and a v1 file is rejected with an explicit instruction. JSON schema 1.3.0: analysisIssues[].affectedProjects holds relative paths. Previously in 3.9.0: adds --baseline and --write-baseline: adopt a CI gate on a codebase that already has debt. Record the current findings once, commit the file, and every run after that fails only on findings the baseline does not contain. Baselined findings stay in every report — terminal, JSON (suppressed: true), and SARIF (as a suppressions entry) — so the debt stays visible without blocking. A finding is identified by its rule, package, and affected projects rather than by the versions in its description, so version drift does not unsuppress accepted debt while spreading to a new project does. Stale entries are reported so a baseline cannot grow forever. Previously in 3.8.0: --fail-on <severity>: gate CI on the findings that matter instead of on all of them. Every finding used to fail the build, which makes the gate unusable for a repository with existing debt. --fail-on High narrows the gate without narrowing the report — findings below the threshold still appear in terminal, JSON, and SARIF output, and only the exit code changes. Accepts Info (default), Low, Moderate, High, Critical, and Never for report-without-gating; settable team-wide as "failOn" in .cpmigrate.json. Cannot suppress exit 8 (IncompleteAnalysis). JSON schema 1.2.0 adds summary.failOnSeverity, issuesAtOrAboveThreshold, highestSeverity, scanFailures, and deepScanFailures (all additive). Also fixes the published config schema, which was missing Sarif from outputFormat. Previously in 3.7.0: --output Sarif: cpmigrate --analyze now emits a SARIF 2.1.0 log for GitHub code scanning, so dependency findings annotate the pull request diff. Results point at the exact PackageReference line, carry full rule metadata with links to the new docs/rules.md reference, and include stable fingerprints so findings are tracked across runs rather than reopened. Tool failures emit an unsuccessful SARIF invocation, so an upload step never breaks on a malformed file. --output-file now accepts Sarif as well as Json. No analyzer severity changes.