Dependency maintenance¶

Dependabot checks NuGet projects and GitHub Actions every Monday at 07:00 Europe/London. Version-update PRs are limited to three for NuGet, two for Actions and one for the .NET SDK. Related MSTest/test-runner, Windows-management and WiX dependencies are grouped to reduce mismatched versions. Actions patch/minor updates are grouped; major Actions changes remain separate. These groups do not imply compatibility or approval: major NuGet upgrades still need deliberate review.

No automatic merging is configured. Preserve the full test, package and installer checks. Review runtime changes with driver detection, controller reconnection and suspend/resume testing; review installer dependency changes with both app and installer helper builds. Review test-tool upgrades separately, preserving exact exception assertions, test discovery, coverage and explicit hardware skips.

Fork activation¶

A configuration file alone does not enable version updates in a fork. After merging this configuration, check Settings > Advanced Security > Dependabot version updates and enable it if disabled. Confirm the monitored ecosystems and update jobs under Insights > Dependency graph > Dependabot. Version updates and vulnerability-driven security updates have separate settings.

See GitHub's fork instructions.

Existing inherited branches¶

The four inherited June dependency proposals were superseded by reviewed fork-specific updates, and the obsolete branches were removed after review. They are not active update branches. Fresh proposals should start from current main through this fork's Dependabot configuration; do not resurrect an old proposal merely because its package name matches. Published release tags are separate from branch cleanup and remain preserved.

A removed direct NuGet reference can still appear transitively in the dependency graph. Confirm restored assets and published outputs before claiming a dependency was removed from the shipped application. Scan direct and transitive dependencies for advisories when reviewing updates; an outdated version is not by itself proof of a known vulnerability.

Coverage and review priorities¶

The NuGet configuration covers the application's packages, both test projects, the C# installer helpers and standalone C# tools. Individual packages do not need separate configuration entries. GitHub Actions are monitored independently. Dependabot proposes changes; passing CI does not automatically merge them.

The installer scan intentionally names the C# helper directories. Dependabot's current NuGet discovery implementation does not recognise standalone .wixproj entry points. Review WixToolset.Sdk and WixToolset.Util.wixext manually alongside any proposed WixToolset.BootstrapperApplicationApi update. Keep that installer family compatible and run the full installer lifecycle checks.

Recommended order after accepting the initial dependency refresh:

As of 12 October 2026, NuGet lists patch updates for WpfScreenHelper (2.1.0 to 2.1.1) and TraceEvent (3.2.6 to 3.2.8). Later versions also exist for the other packages in the table. These are review candidates, not an instruction to take the newest version without checking it. BouncyCastle.Cryptography, Concentus, MdXaml, Ookii.Dialogs.Wpf, YellowDogMan.RRNoise.NET and bloomtom.HttpProgress were already at their latest stable NuGet versions during this audit; continue monitoring them.

Keep Actions major-version updates separate from ordinary patch/minor batches, and verify their runtime requirements and the full workflow. Preserve workflow permissions, signing policy and secret handling unless a reviewed change needs them. The SDK is now selected through global.json; Dependabot's dotnet-sdk ecosystem proposes servicing updates weekly. Major/minor SDK migrations remain separate compatibility work. No npm, Python, Go or submodule manifests justify additional ecosystems.

SDK and dependency locks¶

Local builds and both workflows select the reviewed 10.0.402 SDK, with prereleases and automatic roll-forward disabled. SDK servicing updates therefore arrive as reviewable Dependabot PRs rather than silently changing the compiler and self-contained runtime inputs. See Microsoft's SDK selection guidance and GitHub's SDK update support.

Every application, test, installer and diagnostic-tool project has a committed packages.lock.json. Directory.Build.props enables lock generation locally and locked restore under GitHub Actions. A dependency-graph mismatch fails CI instead of updating the lock file silently. WiX SDK versions are still pinned in .wixproj declarations; their SDK-resolver packages are not ordinary PackageReference entries in the project lock graph.

When changing a package or SDK intentionally:

1. Install the SDK declared in global.json.
2. Restore affected projects locally with --force-evaluate, using -p:Platform=x64 -p:Configuration=Release. Restore projects referencing the changed project too. For an SDK update, refresh all 16 project lock files.
3. Review direct/transitive version changes and content hashes; commit the manifests and affected lock files together. Do not bypass locked CI restore.
4. Verify dotnet restore <project> --locked-mode and the normal full CI checks.

The application lock graph retains its declared x64/x86 runtime identifiers. Restore that graph without overriding it with -r; publish the selected x64 runtime afterward with --no-restore. Installer helpers already declare x64. Dependabot package proposals should update locks; if an SDK proposal leaves SDK-dependent lock entries stale, regenerate them on that PR before merging. See NuGet's lock-file contract.

Components requiring manual maintenance¶

Bundled VIIPER and DS4Updater executables, the usbip-win2 installer, HidHide, FakerInput and raw native DLLs are not ordinary NuGet version references. Update them through their documented source/build and packaging process, including provenance, hashes and compatibility checks. Coordinate VIIPER and USB/IP changes across their repositories rather than letting an unrelated package update replace driver binaries.

RRNoise is a useful exception: its NuGet reference is monitored, but the app copies a native DLL from that package. Review native architecture, shipped payload and audio behaviour even when Dependabot supplies the version bump.