deps: Bump Refit and Refit.Reflection

[dependabot]

Updated Refit from 15.2.0 to 16.0.0.

Release notes

Sourced from Refit's releases.

16.0.0

Summary

Refit 16.0.0 is a major version because the .NET 11 assemblies are built without runtime-async. The public API does not change.

Why runtime-async is off

• In .NET 10 and older, the C# compiler adds a state machine to each async method. The state machine stores the local variables and tracks where to resume after each await.
• .NET 11 adds a feature called runtime-async. The runtime does this work instead, so async code can run faster.
• Refit 12.0.0 to 15.2.0 built the .NET 11 assemblies with runtime-async on. We did not use it with older .NET 8-10 nor .NET framework assemblies.
• The feature needs a runtime that supports it. CoreCLR does, and Mono does not.
• Blazor WebAssembly runs on Mono unless you opt into CoreCLR. WASI, Android API levels 21 to 23, and apps that set UseMonoRuntime=true also run on Mono.
• Refit built with runtime-async can fail in every app that runs on Mono.
• Microsoft builds its framework assemblies twice, once for each runtime. ASP.NET Core turns the feature on only for libraries inside the shared framework, and leaves it off for libraries that also ship on NuGet.
• A NuGet package ships one build for every runtime, so Refit leaves the feature off. The feature is opt-in, so doing nothing is the correct setting.
• Apps that target .NET 10 or older are not affected, because only the .NET 11 assemblies used the feature. Apps on .NET 11 that run on CoreCLR do not get the speed gain inside Refit's own async code.
• You can turn on runtime-async in your own app if it runs only on CoreCLR.

Other changes

• Refit has a documentation website at https://reactiveui.net/documentation/refit/. It has guides for requests, results, clients, serialization and testing, and one page that lists the full API.
• The README is a short overview of the packages, the build requirements and the links to the website.
• src/examples/Documentation has a project for every website page, plus larger samples for topics such as multipart uploads, serializers and compression. Each project builds with Refit.slnx and checks its results against local replies, so none needs a live service.
• On older target frameworks, Refit checks the cancellation token before it buffers or reads HTTP content. A token that is already cancelled stops the operation before it starts.
• Doc comments were corrected to match how Refit works. They state that [Options] sends OPTIONS, that [Url] accepts an empty path or /, and that [PathPrefix] does not add a leading slash. The Refit.Testing docs state that VerifyAllCalled ignores reusable and fallback routes.
• The Blazor WebAssembly sample builds for .NET 10 and .NET 11. It uses a generated client and JSON source generation, and builds without trimmer warnings.
• Refit depends on ReactiveUI.Primitives 8.0.0. On .NET 11, Refit.HttpClientFactory depends on Microsoft.Extensions.Http 11.0.0-rc.1, and other targets depend on 10.0.12.
• SECURITY.md lists the supported versions and explains how to report a vulnerability through GitHub private reporting.
• CI workflows drop code scanning of fork pull requests and pass sourceRef to the shared release workflow. Renovate handles package updates per target framework, and the generator snapshot tests use a small in-repo helper instead of the Verify packages.

🗞️ What's Changed

✨ Features

• reactiveui/refit@​6f0507fa061f1844a8da6ea92e839b622dfc74ef feat: expand generated request support & docs (#​2329) @​glennawatson
• reactiveui/refit@​6445e423feb4a59b723f094829ecfca5e95473b4 feat: update nuget packages, update Renovate configuration, enhance generator tests, remove unused packages (#​2330) @​glennawatson
• reactiveui/refit@​1459f55c5c1bcf8b385753013d75422b716454a3 feature: Remove runtime-async feature from Directory.Build.props (#​2331) @​glennawatson

🧹 General Changes

• reactiveui/refit@​ba8f49211bdeb8273d506058e7098281e617a4ea ci: let the shared fork SonarCloud workflow resolve the pull request itself @​glennawatson
• reactiveui/refit@​1542153ba821547d1706915fdd202a9fe9f601aa ci: remove SonarCloud scanning of fork pull requests @​glennawatson
• reactiveui/refit@​7b1c3bedc3e811fcc9f1b42c29ac6b6d0929cf67 ci(lock): run the lock workflow at its own time of day @​glennawatson
• reactiveui/refit@​dd2a75f077c9505650821a02b7bffde8473972f6 ci: pass sourceRef to the shared release workflow @​glennawatson

📝 Documentation

• reactiveui/refit@​c2bd862967f163509f911e10cda564fa18e1df6d docs(readme): link combined API reference @​glennawatson
• reactiveui/refit@​dee79fcb62c42dbb2ff3d1260ee952cfc77f3166 docs: add security policy @​glennawatson

📦 Dependencies

• reactiveui/refit@​45fcc591e2a48d6c81de347baeb67d975f24e943 chore(deps): pin mcr.microsoft.com/dotnet/sdk docker tag to e622deb (#​2324) renovate[bot]
• reactiveui/refit@​8b71ed09ae2e61f8a3d255dc6aa7132cdb851459 chore(deps): update dependency minver to v8 (#​2320) renovate[bot]
• reactiveui/refit@​2d8976713c692c2b2f3f7f817886da4f4c8ab7e5 chore(deps): update dependency sonaranalyzer.csharp to 10.33.0.1635 (#​2316) renovate[bot]
  ... (truncated)

Commits viewable in compare view.

Updated Refit.Reflection from 15.2.0 to 16.0.0.

Release notes

Sourced from Refit.Reflection's releases.

16.0.0

Summary

Refit 16.0.0 is a major version because the .NET 11 assemblies are built without runtime-async. The public API does not change.

Why runtime-async is off

• In .NET 10 and older, the C# compiler adds a state machine to each async method. The state machine stores the local variables and tracks where to resume after each await.
• .NET 11 adds a feature called runtime-async. The runtime does this work instead, so async code can run faster.
• Refit 12.0.0 to 15.2.0 built the .NET 11 assemblies with runtime-async on. We did not use it with older .NET 8-10 nor .NET framework assemblies.
• The feature needs a runtime that supports it. CoreCLR does, and Mono does not.
• Blazor WebAssembly runs on Mono unless you opt into CoreCLR. WASI, Android API levels 21 to 23, and apps that set UseMonoRuntime=true also run on Mono.
• Refit built with runtime-async can fail in every app that runs on Mono.
• Microsoft builds its framework assemblies twice, once for each runtime. ASP.NET Core turns the feature on only for libraries inside the shared framework, and leaves it off for libraries that also ship on NuGet.
• A NuGet package ships one build for every runtime, so Refit leaves the feature off. The feature is opt-in, so doing nothing is the correct setting.
• Apps that target .NET 10 or older are not affected, because only the .NET 11 assemblies used the feature. Apps on .NET 11 that run on CoreCLR do not get the speed gain inside Refit's own async code.
• You can turn on runtime-async in your own app if it runs only on CoreCLR.

Other changes

• Refit has a documentation website at https://reactiveui.net/documentation/refit/. It has guides for requests, results, clients, serialization and testing, and one page that lists the full API.
• The README is a short overview of the packages, the build requirements and the links to the website.
• src/examples/Documentation has a project for every website page, plus larger samples for topics such as multipart uploads, serializers and compression. Each project builds with Refit.slnx and checks its results against local replies, so none needs a live service.
• On older target frameworks, Refit checks the cancellation token before it buffers or reads HTTP content. A token that is already cancelled stops the operation before it starts.
• Doc comments were corrected to match how Refit works. They state that [Options] sends OPTIONS, that [Url] accepts an empty path or /, and that [PathPrefix] does not add a leading slash. The Refit.Testing docs state that VerifyAllCalled ignores reusable and fallback routes.
• The Blazor WebAssembly sample builds for .NET 10 and .NET 11. It uses a generated client and JSON source generation, and builds without trimmer warnings.
• Refit depends on ReactiveUI.Primitives 8.0.0. On .NET 11, Refit.HttpClientFactory depends on Microsoft.Extensions.Http 11.0.0-rc.1, and other targets depend on 10.0.12.
• SECURITY.md lists the supported versions and explains how to report a vulnerability through GitHub private reporting.
• CI workflows drop code scanning of fork pull requests and pass sourceRef to the shared release workflow. Renovate handles package updates per target framework, and the generator snapshot tests use a small in-repo helper instead of the Verify packages.

🗞️ What's Changed

✨ Features

• reactiveui/refit@​6f0507fa061f1844a8da6ea92e839b622dfc74ef feat: expand generated request support & docs (#​2329) @​glennawatson
• reactiveui/refit@​6445e423feb4a59b723f094829ecfca5e95473b4 feat: update nuget packages, update Renovate configuration, enhance generator tests, remove unused packages (#​2330) @​glennawatson
• reactiveui/refit@​1459f55c5c1bcf8b385753013d75422b716454a3 feature: Remove runtime-async feature from Directory.Build.props (#​2331) @​glennawatson

🧹 General Changes

• reactiveui/refit@​ba8f49211bdeb8273d506058e7098281e617a4ea ci: let the shared fork SonarCloud workflow resolve the pull request itself @​glennawatson
• reactiveui/refit@​1542153ba821547d1706915fdd202a9fe9f601aa ci: remove SonarCloud scanning of fork pull requests @​glennawatson
• reactiveui/refit@​7b1c3bedc3e811fcc9f1b42c29ac6b6d0929cf67 ci(lock): run the lock workflow at its own time of day @​glennawatson
• reactiveui/refit@​dd2a75f077c9505650821a02b7bffde8473972f6 ci: pass sourceRef to the shared release workflow @​glennawatson

📝 Documentation

• reactiveui/refit@​c2bd862967f163509f911e10cda564fa18e1df6d docs(readme): link combined API reference @​glennawatson
• reactiveui/refit@​dee79fcb62c42dbb2ff3d1260ee952cfc77f3166 docs: add security policy @​glennawatson

📦 Dependencies

• reactiveui/refit@​45fcc591e2a48d6c81de347baeb67d975f24e943 chore(deps): pin mcr.microsoft.com/dotnet/sdk docker tag to e622deb (#​2324) renovate[bot]
• reactiveui/refit@​8b71ed09ae2e61f8a3d255dc6aa7132cdb851459 chore(deps): update dependency minver to v8 (#​2320) renovate[bot]
• reactiveui/refit@​2d8976713c692c2b2f3f7f817886da4f4c8ab7e5 chore(deps): update dependency sonaranalyzer.csharp to 10.33.0.1635 (#​2316) renovate[bot]
  ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 7ae18f52-1b07-4480-a7ad-7a7e5a019334

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.