Update 1 NuGet dependencies

[nfbot]

Bumps Nerdbank.GitVersioning from 3.8.118 to 3.9.50

[version update]

⚠️ This is an automated update. ⚠️

Summary by CodeRabbit

• Chores
  • Updated project dependencies to improve compatibility and stability.

[coderabbitai]

Walkthrough

This pull request updates the Nerdbank.GitVersioning dependency in the nanoFramework.System.Threading project from version 3.8.118 to 3.9.50, including an update to its content hash in the packages lock file.

Changes

Cohort / File(s)	Change Summary
Dependency Version Bump nanoFramework.System.Threading/packages.lock.json	Updated Nerdbank.GitVersioning from version 3.8.118 to 3.9.50 with corresponding content hash update

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• Update 1 NuGet dependencies #113: Both PRs update the Nerdbank.GitVersioning dependency version and content hash in the same lock file.
• Update 1 NuGet dependencies #124: Sequential dependency version updates in the same file, representing part of a dependency upgrade chain.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Update 1 NuGet dependencies' directly describes the main change—updating a NuGet dependency (Nerdbank.GitVersioning) in the packages.lock.json file.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch nfbot/update-dependencies/f2e0375e-c04e-43e7-9923-4260a12f3d4d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1228d48 and 8f47e5e.

⛔ Files ignored due to path filters (2)

• nanoFramework.System.Threading/nanoFramework.System.Threading.nfproj is excluded by none and included by none
• nanoFramework.System.Threading/packages.config is excluded by none and included by none

📒 Files selected for processing (1)

• nanoFramework.System.Threading/packages.lock.json (1 hunks)

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Verify package version and check for security advisories.

The dependency is being updated from 3.8.118 to 3.9.50 (a minor version bump). Please verify that:

1. Nerdbank.GitVersioning 3.9.50 is a stable, official release
2. There are no known security vulnerabilities in this version or between the old and new versions
3. The contentHash aligns with the official package from NuGet

---

🌐 Web query:

What are the latest versions and any security advisories for Nerdbank.GitVersioning package?

💡 Result:

As of November 7, 2025:

• Latest stable NuGet release: Nerdbank.GitVersioning 3.8.118 (published on nuget.org). [1]
• Latest prerelease(s): 3.9.37-alpha (prerelease) appears on the package feed/profile; other 3.9.x alpha builds are on the project release list. [2][3]

Security advisories:

• There are no public CVEs or repository security advisories specific to Nerdbank.GitVersioning found in public databases. Snyk reports no direct vulnerabilities for the package and ProGet/feeds show no known vulnerabilities. (No Nerdbank.GitVersioning-specific advisories located.) [4][5][3]

Sources:

1. nuget.org package page for Nerdbank.GitVersioning 3.8.118. [turn0search3]
2. Nerdbank profile / package listing showing prerelease 3.9.37-alpha. [turn0search0]
3. dotnet/Nerdbank.GitVersioning GitHub (releases and repo). [turn2search2][turn0search7]
4. Snyk package page (no direct vulnerabilities). [turn1search0]
5. NuGet/ProGet vulnerability view (no known vulnerabilities). [turn1search3]

If you want, I can (a) check the exact publish dates for those specific versions, or (b) monitor for any new advisories and notify you. Which would you prefer?

---

Version 3.9.50 appears to not exist on the official NuGet feed—critical issue.

The latest stable NuGet release is Nerdbank.GitVersioning 3.8.118, and the latest prerelease is 3.9.37-alpha. The PR is updating to version 3.9.50, which does not appear in the search results as either a stable or prerelease version on nuget.org.

Required actions:

• Verify the correct version number—this may be a typo (e.g., 3.9.37 or 3.8.118)
• Confirm the package source; 3.9.50 may not be available on the official NuGet feed
• If 3.9.50 is intentional, verify it's from an authorized source and that the contentHash matches the actual package

No security vulnerabilities are reported for this package, but the version validity must be resolved first.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud