Repository navigation
Conversation
dotnet list package --vulnerable で High が検出されたため更新する。 - Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.10(GHSA-g27p-qf6j-c96c・GHSA-qjpx-jqm5-h2c4) ほか Microsoft.* の 10.0.10 をすべて 10.0.13 に揃える - System.Security.Cryptography.Pkcs 9.0.4(SqlClient 6.1.1 経由。GHSA-846f-f764-76mx ほか)は Infrastructure から 10.0.13 を直接参照して上書きする - AspNetCore.OpenApi 10.0.13 が要求する Microsoft.OpenApi 2.12.2 へ直接参照も上げる(NU1605 の解消) - dotnet-ef ツールを EF Core と同じ 10.0.13 に揃える Co-Authored-By: Claude Opus 5.5 <[email protected]>
単票API(POST api/maintenance-orders/{id}/record)と実績CSV maintenance-records が
全ロールに開いており、物流・品質の担当者でも在庫の引落し・保全指示の完了・
設備の稼働可能への復帰・治工具の寿命リセットができた。
Spec.md 7.4 の「異常・使用実績の記録は絞らない」は保全依頼(起票)までで、実績は含まない。
- API・CSVとも MesRoleGroups.MaintenanceManage で絞る
- 画面の実績登録フォームも同じ定数で隠す(取消ボタンと同じ範囲にまとめた)
- 作業者が単票・CSVのどちらでも登録できず、指示が完了しないことをテストで確認
- Spec.md 改訂144
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Dependabot(nuget・github-actions):毎週月曜 09:00(JST)に確認し、dev 向けの PR を作る。 担当者を自分に割り当て、GitHub の通知(Inbox)と Assigned の一覧に出す。 Microsoft.* / System.* は版ずれ(NU1605)を避けるため1つの PR にまとめる - Vulnerability ワークフロー:push・PR と週1回の定期実行で、推移的な依存も含めて 既知の脆弱性を一覧にし、見つかったら失敗させる。復元時の NuGet 監査は警告がエラー扱いで 一覧が出る前に落ちるため、復元では止めてこの手順で判定する Co-Authored-By: Claude Opus 5.5 <[email protected]>
- アクセストークンに SecurityStamp を載せ、検証のたびにDBの値・有効フラグと照合する(Api/AccessTokenValidation)。 これまではリフレッシュトークンだけを失効させていたため、無効化・ロール変更後も最大60分は操作できた - 無効化・ロール変更で UpdateSecurityStampAsync を呼ぶ(単票API・ユーザーCSVの両方) - Identity のトークンプロバイダが未登録で、管理者のパスワードリセット(API・ユーザーCSVの InitialPassword・ 初期管理者の再生成)が例外になっていたのを AddDefaultTokenProviders で直した - CSV出力で先頭が = @ タブ CR、または数値でない + - の値に ' を付ける。取込では外す(出力をそのまま取り込み直せる) - Spec.md 7.4・3.8、改訂145 Co-Authored-By: Claude Opus 5.5 <[email protected]>
Bumps the actions group with 8 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `7` | | [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4` | `6` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3` | `4` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` | | [docker/login-action](https://github.com/docker/login-action) | `3` | `4` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `5` | `6` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` | Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) Updates `actions/setup-dotnet` from 4 to 6 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@v4...v6) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) Updates `docker/setup-qemu-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@v3...v4) Updates `docker/setup-buildx-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v3...v4) Updates `docker/login-action` from 3 to 4 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v3...v4) Updates `docker/metadata-action` from 5 to 6 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@v5...v6) Updates `docker/build-push-action` from 6 to 7 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-dotnet dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-qemu-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/metadata-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Components.Authorization from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Components.WebAssembly from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Components.WebAssembly.DevServer from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Components.WebAssembly.Server from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Identity.EntityFrameworkCore from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.OpenApi from 10.0.13 to 10.0.14 Bumps Microsoft.EntityFrameworkCore.Design from 10.0.13 to 10.0.14 Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.13 to 10.0.14 Bumps Microsoft.EntityFrameworkCore.SqlServer from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Identity.Stores from 10.0.13 to 10.0.14 Bumps Microsoft.Extensions.Localization from 10.0.13 to 10.0.14 Bumps Microsoft.OpenApi from 2.12.2 to 2.13.0 Bumps Microsoft.Web.WebView2 from 1.0.4129.50 to 1.0.4314.35 Bumps System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.14 --- updated-dependencies: - dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.AspNetCore.Components.Authorization dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.AspNetCore.Components.WebAssembly dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.AspNetCore.Components.WebAssembly.DevServer dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.AspNetCore.Components.WebAssembly.Server dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.AspNetCore.Identity.EntityFrameworkCore dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.AspNetCore.Mvc.Testing dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.AspNetCore.OpenApi dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.EntityFrameworkCore.Sqlite dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.EntityFrameworkCore.SqlServer dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.Extensions.Identity.Stores dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.Extensions.Localization dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: Microsoft.OpenApi dependency-version: 2.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet - dependency-name: Microsoft.Web.WebView2 dependency-version: 1.0.4314.35 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet - dependency-name: System.Security.Cryptography.Pkcs dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps bunit from 2.9.0 to 2.13.3 Bumps SQLitePCLRaw.bundle_e_sqlite3 from 3.0.4 to 3.0.5 Bumps xunit.runner.visualstudio from 3.1.4 to 3.1.5 --- updated-dependencies: - dependency-name: bunit dependency-version: 2.13.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: others - dependency-name: SQLitePCLRaw.bundle_e_sqlite3 dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: others - dependency-name: xunit.runner.visualstudio dependency-version: 3.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: others - dependency-name: xunit.runner.visualstudio dependency-version: 3.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: others ... Signed-off-by: dependabot[bot] <[email protected]>
--- updated-dependencies: - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.11.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
…ions-4c5532e93e 依存更新 Bump the actions group with 8 updates
…ev/dotnet-8d4c0fb07b 依存更新 Bump the dotnet group with 16 updates
…structure/dev/others-ca0e169109 依存更新 Bump the others group with 3 updates
--- updated-dependencies: - dependency-name: coverlet.collector dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
….Tests/dev/coverlet.collector-10.1.0 依存更新 Bump coverlet.collector from 6.0.4 to 10.1.0
Co-Authored-By: Claude Opus 5.5 <[email protected]>
….Tests/dev/multi-45d74c8809 依存更新 Bump Microsoft.NET.Test.Sdk from 17.14.1 to 18.11.0
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
依存パッケージと GitHub Actions を更新し、取り込めない
Microsoft.OpenApi3.x を Dependabot の対象から外す。アプリのコードは変更していない。変更内容
dotnet-efを EF Core のパッケージと同じ 10.0.14 に揃えるMicrosoft.OpenApiのメジャー更新を Dependabot の対象から外す(依存更新 Bump Microsoft.OpenApi from 2.13.0 to 3.11.0 #38 は閉じた)Microsoft.OpenApi 3.x を除外する理由
Microsoft.AspNetCore.OpenApi10.x はMicrosoft.OpenApiを 3.0 未満に制限している(dotnet/aspnetcore#64317)。.NET 11 へ移行するときに除外を外す。Dependabot は既定ブランチの設定を読むので、この除外はマージ後に有効になる。コミット一覧について
#30〜#32 と同じ内容のコミットが別ハッシュで
devに残っているため一覧に出るが、内容はmainに入っており、差分には含まれない。確認
dev、SQLite)dotnet-ef更新を含む)/openapi/v1.jsonの表示(依存更新 Bump the actions group with 8 updates #33〜依存更新 Bump Microsoft.NET.Test.Sdk from 17.14.1 to 18.11.0 #37 の統合状態)release.ymlの実行(タグ push でのみ動くため未実行)🤖 Generated with Claude Code