Skip to content

依存パッケージと GitHub Actions を更新し、Microsoft.OpenApi のメジャー更新を除外する - #41

Merged
msmsrep merged 18 commits into
mainfrom
dev
Nov 3, 2026
Merged

msmsrep merged 18 commits into
mainfrom
dev

Conversation

@msmsrep

@msmsrep msmsrep commented Nov 3, 2026

Copy link
Copy Markdown
Owner

概要

依存パッケージと GitHub Actions を更新し、取り込めない Microsoft.OpenApi 3.x を Dependabot の対象から外す。アプリのコードは変更していない。

変更内容

Microsoft.OpenApi 3.x を除外する理由

Microsoft.AspNetCore.OpenApi 10.x は Microsoft.OpenApi を 3.0 未満に制限している(dotnet/aspnetcore#64317)。.NET 11 へ移行するときに除外を外す。Dependabot は既定ブランチの設定を読むので、この除外はマージ後に有効になる。

コミット一覧について

#30〜#32 と同じ内容のコミットが別ハッシュで dev に残っているため一覧に出るが、内容は main に入っており、差分には含まれない。

確認

🤖 Generated with Claude Code

msmsrep and others added 18 commits October 23, 2026 07:09
dotnet list package --vulnerable で High が検出されたため更新する。
- Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.10(GHSA-g27p-qf6j-c96c・GHSA-qjpx-jqm5-h2c4)
  ほか Microsoft.* の 10.0.10 をすべて 10.0.13 に揃える
- System.Security.Cryptography.Pkcs 9.0.4(SqlClient 6.1.1 経由。GHSA-846f-f764-76mx ほか)は
  Infrastructure から 10.0.13 を直接参照して上書きする
- AspNetCore.OpenApi 10.0.13 が要求する Microsoft.OpenApi 2.12.2 へ直接参照も上げる(NU1605 の解消)
- dotnet-ef ツールを EF Core と同じ 10.0.13 に揃える

Co-Authored-By: Claude Opus 5.5 <[email protected]>
単票API(POST api/maintenance-orders/{id}/record)と実績CSV maintenance-records が
全ロールに開いており、物流・品質の担当者でも在庫の引落し・保全指示の完了・
設備の稼働可能への復帰・治工具の寿命リセットができた。
Spec.md 7.4 の「異常・使用実績の記録は絞らない」は保全依頼(起票)までで、実績は含まない。

- API・CSVとも MesRoleGroups.MaintenanceManage で絞る
- 画面の実績登録フォームも同じ定数で隠す(取消ボタンと同じ範囲にまとめた)
- 作業者が単票・CSVのどちらでも登録できず、指示が完了しないことをテストで確認
- Spec.md 改訂144

Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Dependabot(nuget・github-actions):毎週月曜 09:00(JST)に確認し、dev 向けの PR を作る。
  担当者を自分に割り当て、GitHub の通知(Inbox)と Assigned の一覧に出す。
  Microsoft.* / System.* は版ずれ(NU1605)を避けるため1つの PR にまとめる
- Vulnerability ワークフロー:push・PR と週1回の定期実行で、推移的な依存も含めて
  既知の脆弱性を一覧にし、見つかったら失敗させる。復元時の NuGet 監査は警告がエラー扱いで
  一覧が出る前に落ちるため、復元では止めてこの手順で判定する

Co-Authored-By: Claude Opus 5.5 <[email protected]>
- アクセストークンに SecurityStamp を載せ、検証のたびにDBの値・有効フラグと照合する(Api/AccessTokenValidation)。
  これまではリフレッシュトークンだけを失効させていたため、無効化・ロール変更後も最大60分は操作できた
- 無効化・ロール変更で UpdateSecurityStampAsync を呼ぶ(単票API・ユーザーCSVの両方)
- Identity のトークンプロバイダが未登録で、管理者のパスワードリセット(API・ユーザーCSVの InitialPassword・
  初期管理者の再生成)が例外になっていたのを AddDefaultTokenProviders で直した
- CSV出力で先頭が = @ タブ CR、または数値でない + - の値に ' を付ける。取込では外す(出力をそのまま取り込み直せる)
- Spec.md 7.4・3.8、改訂145

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Bumps the actions group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4` | `6` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3` | `4` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` |
| [docker/login-action](https://github.com/docker/login-action) | `3` | `4` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5` | `6` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` |


Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

Updates `actions/setup-dotnet` from 4 to 6
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@v4...v6)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `docker/setup-qemu-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@v3...v4)

Updates `docker/setup-buildx-action` from 3 to 4
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@v3...v4)

Updates `docker/login-action` from 3 to 4
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v3...v4)

Updates `docker/metadata-action` from 5 to 6
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@v5...v6)

Updates `docker/build-push-action` from 6 to 7
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-dotnet
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/setup-qemu-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/setup-buildx-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/login-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/metadata-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/build-push-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.13 to 10.0.14
Bumps Microsoft.AspNetCore.Components.Authorization from 10.0.13 to 10.0.14
Bumps Microsoft.AspNetCore.Components.WebAssembly from 10.0.13 to 10.0.14
Bumps Microsoft.AspNetCore.Components.WebAssembly.DevServer from 10.0.13 to 10.0.14
Bumps Microsoft.AspNetCore.Components.WebAssembly.Server from 10.0.13 to 10.0.14
Bumps Microsoft.AspNetCore.Identity.EntityFrameworkCore from 10.0.13 to 10.0.14
Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.13 to 10.0.14
Bumps Microsoft.AspNetCore.OpenApi from 10.0.13 to 10.0.14
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.13 to 10.0.14
Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.13 to 10.0.14
Bumps Microsoft.EntityFrameworkCore.SqlServer from 10.0.13 to 10.0.14
Bumps Microsoft.Extensions.Identity.Stores from 10.0.13 to 10.0.14
Bumps Microsoft.Extensions.Localization from 10.0.13 to 10.0.14
Bumps Microsoft.OpenApi from 2.12.2 to 2.13.0
Bumps Microsoft.Web.WebView2 from 1.0.4129.50 to 1.0.4314.35
Bumps System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.14

---
updated-dependencies:
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.Components.Authorization
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.Components.WebAssembly
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.Components.WebAssembly.DevServer
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.Components.WebAssembly.Server
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.Identity.EntityFrameworkCore
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.EntityFrameworkCore.Design
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.EntityFrameworkCore.SqlServer
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Identity.Stores
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Localization
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.OpenApi
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Web.WebView2
  dependency-version: 1.0.4314.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: System.Security.Cryptography.Pkcs
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps bunit from 2.9.0 to 2.13.3
Bumps SQLitePCLRaw.bundle_e_sqlite3 from 3.0.4 to 3.0.5
Bumps xunit.runner.visualstudio from 3.1.4 to 3.1.5

---
updated-dependencies:
- dependency-name: bunit
  dependency-version: 2.13.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: others
- dependency-name: SQLitePCLRaw.bundle_e_sqlite3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: others
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: others
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: others
...

Signed-off-by: dependabot[bot] <[email protected]>
---
updated-dependencies:
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
…ions-4c5532e93e

依存更新 Bump the actions group with 8 updates
…ev/dotnet-8d4c0fb07b

依存更新 Bump the dotnet group with 16 updates
…structure/dev/others-ca0e169109

依存更新 Bump the others group with 3 updates
---
updated-dependencies:
- dependency-name: coverlet.collector
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
….Tests/dev/coverlet.collector-10.1.0

依存更新 Bump coverlet.collector from 6.0.4 to 10.1.0
….Tests/dev/multi-45d74c8809

依存更新 Bump Microsoft.NET.Test.Sdk from 17.14.1 to 18.11.0
@msmsrep
msmsrep merged commit f9683e4 into main Nov 3, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant