Enable NuGet package validation

[oschwald]

What

Enable NuGet package validation for MaxMind.MinFraud by adding <EnablePackageValidation>true</EnablePackageValidation> to the project, matching what MaxMind.GeoIP2 and MaxMind.Db already do.

Why

With this enabled, dotnet pack runs Microsoft.DotNet.PackageValidation, which fails the build if the package's public API is binary- or source-incompatible with the latest published release. This catches accidental breaking API changes at pack time (the release workflow already runs dotnet pack on every pull request), keeping the library consistent with the validation the other MaxMind .NET packages already have.

Summary by CodeRabbit

• Chores
  • Enabled NuGet package validation in the project to strengthen release quality checks.
  • Added automated updating of the package validation baseline to the newly released version during the release process, ensuring validation stays aligned with each release.

[coderabbitai]

📝 Walkthrough

Walkthrough

This change enables NuGet package validation with a 6.1.0 baseline and updates the release script to set, commit, and push the baseline version after creating a release tag.

Changes

Package validation release flow

Layer / File(s)	Summary
Configure package validation MaxMind.MinFraud/MaxMind.MinFraud.csproj	Enables package validation and sets PackageValidationBaselineVersion to 6.1.0.
Update release baseline dev-bin/release.sh	Sets the baseline to the released version, commits the project-file update, and pushes it after release creation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A baseline hops into the file,
Release scripts march another mile.
Commit, then push, the tags align,
NuGet checks each package line.
Squeak! 🐇📦

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: enabling NuGet package validation for MaxMind.MinFraud.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch enable-package-validation

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

MaxMind.MinFraud/MaxMind.MinFraud.csproj

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request enables package validation in the project file. The reviewer pointed out that to validate against the latest published release, a baseline version must be specified using the PackageValidationBaselineVersion property, and a compatibility suppression file should be generated to handle intentional breaking changes in version 6.0.0.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

While setting <EnablePackageValidation>true</EnablePackageValidation> enables the compatible framework and compatible runtime validators, it does not validate the package against a previously published release unless a baseline version is specified.\n\nTo achieve the goal mentioned in the PR description ("fails the build if the package's public API is binary- or source-incompatible with the latest published release"), you need to specify the <PackageValidationBaselineVersion> property.\n\nNote that since 6.0.0 introduces several intentional breaking changes (as documented in releasenotes.md), enabling baseline validation will cause the build to fail unless you also generate a compatibility suppression file. You can generate this file by running:\n\nbash\ndotnet pack /p:GenerateCompatibilitySuppressionFile=true\n\n\nThis will create a CompatibilitySuppressions.xml file in your project directory, which should be committed to source control to document and allow these intentional breaking changes.

    <EnablePackageValidation>true</EnablePackageValidation>\n    <PackageValidationBaselineVersion>5.3.1</PackageValidationBaselineVersion>

[oschwald]

Good catch on the distinction between the compatible-framework/runtime validators and a baseline comparison against a previously published version. That's correct: this change intentionally enables only the former, matching how MaxMind.GeoIP2 is configured (it also sets EnablePackageValidation without a PackageValidationBaselineVersion).

I'm keeping this PR minimal and not adding baseline validation here, mainly because 6.0.0 (with its intentional breaking changes) hasn't been published yet, so there's no meaningful prior baseline to validate against until after that release ships. Adding PackageValidationBaselineVersion (pointed at 6.0.0 once released) plus a CompatibilitySuppressions.xml for any further intentional breaks would be a reasonable follow-up once we're validating against a real baseline.

For this PR specifically, the CI dotnet pack job (including the Windows job, where these validators run) passed, so the framework/runtime compatibility checks enabled here are already exercised and green.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@dev-bin/release.sh`:
- Around line 112-114: Update the release flow around the baseline replacement
and commit command: verify that the `sed` operation in `dev-bin/release.sh`
successfully changed `PackageValidationBaselineVersion` to `$version`, then
stage and commit only the intended `MaxMind.MinFraud/MaxMind.MinFraud.csproj`
update instead of using `git commit -a`. Abort without committing when the
replacement did not occur.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f55e71d6-efb2-4c5d-9bbb-3cc4a6d5d522

📥 Commits

Reviewing files that changed from the base of the PR and between 056767d and d097fe8.

📒 Files selected for processing (2)

• MaxMind.MinFraud/MaxMind.MinFraud.csproj
• dev-bin/release.sh

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Commit only the verified baseline update.

git commit -a stages every modified tracked file, so unrelated release-time changes can be included in this commit. Also verify that sed actually replaced the baseline before committing; otherwise an unrelated change could produce a successful commit with a stale baseline.

Proposed fix

 sed -i "s|<PackageValidationBaselineVersion>[^<]*</PackageValidationBaselineVersion>|<PackageValidationBaselineVersion>$version</PackageValidationBaselineVersion>|" MaxMind.MinFraud/MaxMind.MinFraud.csproj
+grep -q "<PackageValidationBaselineVersion>$version</PackageValidationBaselineVersion>" MaxMind.MinFraud/MaxMind.MinFraud.csproj || exit 1
+git add -- MaxMind.MinFraud/MaxMind.MinFraud.csproj
-git commit -m "Set package validation baseline to $version" -a
+git commit -m "Set package validation baseline to $version" -- MaxMind.MinFraud/MaxMind.MinFraud.csproj

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	sed -i "s|<PackageValidationBaselineVersion>[^<]*</PackageValidationBaselineVersion>|<PackageValidationBaselineVersion>$version</PackageValidationBaselineVersion>|" MaxMind.MinFraud/MaxMind.MinFraud.csproj
	git commit -m "Set package validation baseline to $version" -a
	sed -i "s|<PackageValidationBaselineVersion>[^<]*</PackageValidationBaselineVersion>|<PackageValidationBaselineVersion>$version</PackageValidationBaselineVersion>|" MaxMind.MinFraud/MaxMind.MinFraud.csproj
	grep -q "<PackageValidationBaselineVersion>$version</PackageValidationBaselineVersion>" MaxMind.MinFraud/MaxMind.MinFraud.csproj || exit 1
	git add -- MaxMind.MinFraud/MaxMind.MinFraud.csproj
	git commit -m "Set package validation baseline to $version" -- MaxMind.MinFraud/MaxMind.MinFraud.csproj

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@dev-bin/release.sh` around lines 112 - 114, Update the release flow around
the baseline replacement and commit command: verify that the `sed` operation in
`dev-bin/release.sh` successfully changed `PackageValidationBaselineVersion` to
`$version`, then stage and commit only the intended
`MaxMind.MinFraud/MaxMind.MinFraud.csproj` update instead of using `git commit
-a`. Abort without committing when the replacement did not occur.