From b8c997db0576f2713fded0c6ab738fac43149259 Mon Sep 17 00:00:00 2001 From: Stuart Meeks Date: Mon, 21 Sep 2026 12:46:43 +0000 Subject: [PATCH] docs: correct the 2.1.0 range-resolution note MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 2.1.0 entry claimed the provider packages "need no re-cut: their [2.0.0, 3.0.0) dependency range resolves against 2.1.0 unchanged." That is wrong. NuGet resolves a version range to its floor (lowest-applicable-version), so the 2.x providers' [2.0.0, 3.0.0) dependency resolves to core 2.0.0, not 2.1.0. Downstream consumers of the providers therefore did not pick up the 2.1.0 keystore data-loss fix at all. Correct the note to say the fix reaches downstream consumers only once the provider packages raise their floor to [2.1.0, 3.0.0) and re-cut, so other consumers of this package are not misled into thinking a core minor reaches them on its own. Keep the note free of any specific downstream provider version — that is the providers' repo to record, and coupling it here would go stale. --- CHANGELOG.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ab17771..2caed44 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,8 +26,12 @@ boundary (the identity was discoverable); the real boundary remains the filesyst permissions on the credentials directory, and `AdditionalEntropy` — or the DPAPI / platform keychain backends — is the way to bind a store to a secret. See the README's Security model. -No provider-facing interface changed, so this is a minor and the provider packages need no -re-cut: their `[2.0.0, 3.0.0)` dependency range resolves against 2.1.0 unchanged. +No provider-facing interface changed, so this is an API-compatible minor and existing +provider assemblies keep working against it. It does **not**, however, reach provider +_consumers_ on its own: a NuGet version range resolves to its **floor**, so the 2.x +providers' `[2.0.0, 3.0.0)` dependency resolves to core **2.0.0**, not 2.1.0. A downstream +consumer keeps getting the old core until the provider packages raise their floor to +`[2.1.0, 3.0.0)` and re-cut. ### Changed