Bump MinVer from 6.0.0 to 7.0.0

[dependabot]

Updated MinVer from 6.0.0 to 7.0.0.

Release notes

Sourced from MinVer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	minver@​6.0.0 ⏵ 7.0.0	-32

View full report

[WomB0ComB0]

unsure because of lower supply chain security.

[WomB0ComB0]

unsure because of lower supply chain security

Dug into this. Recommend merging — the score drop is real but does not reflect a provenance or vulnerability signal, and the blast radius here is build-time only.

What Socket actually reported

Only the supply-chain sub-score moved: 63 (−32). Every other axis stayed perfect:

Axis	Score
Supply Chain	63 (−32)
Vulnerability	100
Quality	100
Maintenance	100
License	100

Critically, Socket Security: Pull Request Alerts passes on this PR, and the comment lists no alert rows. Socket raised zero blocking findings — this is an informational score delta, not a detection.

Provenance is unchanged

Pulled both versions from the NuGet registration API:

	6.0.0	7.0.0
authors	MinVer	MinVer
license	Apache-2.0	Apache-2.0
projectUrl	adamralph/minver	adamralph/minver
declared dependencies	none	none

No maintainer change, no license change, no new owner. And both versions declare zero NuGet dependencies — so the usual cause of a supply-chain drop (new transitive surface) is ruled out.

What most likely moved the number

The 7.0.0 changelog is short:

• [BREAKING] Switch to System.CommandLine (#325)
• Upgrade Microsoft.Build.Utilities.Core 17.0.1 → 17.8.43 (#1188)
• Run Git async (#1209)

System.CommandLine is bundled inside the package rather than declared as a dependency, so v7 ships materially different assembly contents. That is the plausible trigger for a contents-based heuristic shift while provenance stays clean.

Being straight about the limit here: Socket's dashboard needs org auth, so I could not read the specific factor behind the −32. That part is inference from the evidence above, not confirmation.

Why the BREAKING change does not apply to us

It affects minver-cli argument parsing. We do not use the CLI — grep across the repo returns no minver-cli / dotnet minver invocation. We consume MinVer purely through MSBuild:

<PackageReference Include="MinVer" PrivateAssets="all" />
<MinVerTagPrefix>v</MinVerTagPrefix>

Both the task path and MinVerTagPrefix are untouched by the System.CommandLine rework.

Blast radius

PrivateAssets="all" means MinVer never flows to consumers of ResQ.BuildingBlocks.*. It executes at build time on our own runners and ships in nothing. A degraded score on a build-time-only tool with clean provenance is a much smaller exposure than the same score on a runtime dependency.

Empirically, Build, Pack, and Test all pass here — and Pack is the job that actually exercises MinVer's version derivation.

One thing to note for later

8.0.0-rc.1 exists (2026-05-14) and carries its own breaking change ("Fail when default pre-release phase is provided"). Staying on 7.0.0 stable is the right call; worth a look when 8.0.0 goes stable.

[WomB0ComB0]

Superseded by #43, now merged.

All five open Dependabot PRs edited the same Directory.Packages.props and therefore conflicted with each other by construction — this one was BEHIND, and merging any single one re-broke the rest. #43 carries every bump from all five, verified together:

• dotnet restore clean
• dotnet build -c Release → 0 warnings / 0 errors
• dotnet pack exercised MinVer 7 end to end

The Socket −32 supply-chain question raised here is answered in detail above, and the analysis carried into #43: blocking alert check passes, vulnerability/quality/maintenance/license all 100, provenance identical, zero declared dependencies in both versions, and `PrivateAssets="all"` keeps it build-time only.
Dependabot will not reopen this — the version is now current on main.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.