From da4f886d5b990d725317a80cd3c483a20e0e9b0c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 8 Jun 2026 02:46:35 +0000
Subject: [PATCH 1/2] Bump the nuget-deps group with 1 update (#157)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Updated [csharpier](https://github.com/belav/csharpier) from 1.2.6 to
1.3.0.
Release notes
_Sourced from [csharpier's
releases](https://github.com/belav/csharpier/releases)._
## 1.3.0
# 1.3.0
## Breaking Changes
### Change xml formatting to return error when it runs into syntax error
so it is consistent with c#
[#1854](https://github.com/belav/csharpier/pull/1854)
Previously CSharpier treated an invalid xml file as a warning instead of
an error. This was inconsistent with how it treated c# files.
Invalid c# or xml files are not treated as errors.
The `--compilation-errors-as-warnings` argument has been renamed to
`--syntax-errors-as-warnings` and can be used to return warnings instead
of errors when encountering invalid files.
## What's Changed
### Feature: Configurable whitespace handling for xml
[#1790](https://github.com/belav/csharpier/issues/1790)
CSharpier now supports two types of xml whitespace formatting strict or
ignore.
By default all xml except `xaml` or `axaml` is treated as strict
whitespace. See
[details](https://csharpier.com/docs/Configuration#xml-whitespace-sensitivity)
### Feature: Move closing bracket for xml elements to the same line.
[#1598](https://github.com/belav/csharpier/issues/1598)
With strict xml whitespace handling, csharpier now keeps the closing
bracket for an element on the same line instead of breaking it to a new
line.
```xml
TextValue
TextValue
```
### Feature: Support for csharpier-ignore with XML formatter
[#1788](https://github.com/belav/csharpier/issues/1788)
CSharpier now supports `csharpier-ignore` in xml files. See
[details](https://csharpier.com/docs/Ignore#xml)
### Feature: Add MSBuild transitive and multi-target support
[#1833](https://github.com/belav/csharpier/issues/1833)
CSharpier.MSBuild can now work as a transitive dependency.
### Feature: allow checking formatting with cache
[#1830](https://github.com/belav/csharpier/pull/1830)
The `csharpier check` command now supports a `--use-cache` option.
### Feature: remove dependency on Microsoft.AspNetCore.App
[#1508](https://github.com/belav/csharpier/issues/1508)
Previously CSharpier required that Microsoft.AspNetCore.App be
installed. CSharpier has been modified to use an HttpListener when it is
run using `server` to remove the need for this dependency.
### Fix: csharpier-ignore comment removes linespaces before block
[#1867](https://github.com/belav/csharpier/issues/1867)
CSharpier was removing blank lines before csharpier-ignore comments in
some cases
```c#
// input and expected output
var x = 1;
// csharpier-ignore
var y=1;
/// 1.2.6
var x = 1;
// csharpier-ignore
var y=1;
... (truncated)
Commits viewable in [compare view](https://github.com/belav/csharpier/compare/1.2.6...1.3.0).
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.config/dotnet-tools.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
index c657430..efeff64 100644
--- a/.config/dotnet-tools.json
+++ b/.config/dotnet-tools.json
@@ -3,7 +3,7 @@
"isRoot": true,
"tools": {
"csharpier": {
- "version": "1.2.6",
+ "version": "1.3.0",
"commands": [
"csharpier"
],
From ea7e9d14bffdf071b014d19849d8a6cabd6e5751 Mon Sep 17 00:00:00 2001
From: Pieter Viljoen
Date: Mon, 8 Jun 2026 08:28:12 -0700
Subject: [PATCH 2/2] Migrate deprecated app-id to client-id for GitHub App
token (#159)
`actions/create-github-app-token` deprecated the numeric `app-id` input
in v3.0.0, and the scheduled/codegen runs log `Input 'app-id' has been
deprecated`. This switches all four call sites to `client-id`:
- `.github/workflows/merge-bot-pull-request.yml` - 3 jobs
(merge-dependabot, merge-codegen, disable-auto-merge-on-maintainer-push)
- `.github/workflows/run-codegen-pull-request-task.yml` - 1 job
(codegen)
The `CODEGEN_APP_CLIENT_ID` secret already holds the App's Client ID (it
was already wired to these steps), so **no secrets change is required**
- this is a parameter rename only.
Ports the fix already applied upstream in the ProjectTemplate
(`ptr727/ProjectTemplate` issue #88).
---
.github/workflows/merge-bot-pull-request.yml | 6 +++---
.github/workflows/run-codegen-pull-request-task.yml | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/merge-bot-pull-request.yml b/.github/workflows/merge-bot-pull-request.yml
index d31883e..4508d5c 100644
--- a/.github/workflows/merge-bot-pull-request.yml
+++ b/.github/workflows/merge-bot-pull-request.yml
@@ -88,7 +88,7 @@ jobs:
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
- app-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
+ client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
- name: Get dependabot metadata step
@@ -151,7 +151,7 @@ jobs:
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
- app-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
+ client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
- name: Merge pull request step
@@ -204,7 +204,7 @@ jobs:
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
- app-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
+ client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
- name: Disable auto-merge step
diff --git a/.github/workflows/run-codegen-pull-request-task.yml b/.github/workflows/run-codegen-pull-request-task.yml
index d70a93c..8732c56 100644
--- a/.github/workflows/run-codegen-pull-request-task.yml
+++ b/.github/workflows/run-codegen-pull-request-task.yml
@@ -46,7 +46,7 @@ jobs:
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
- app-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
+ client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
- name: Setup .NET SDK step