[dependabot]

Updated CHDSharp from 1.5.2 to 1.6.0.

Release notes

Sourced from CHDSharp's releases.

1.6.0

CHDSharp v1.6.0 - What's New

Released: 2026-10-29 - Full changelog - NuGet

CHDSharp v1.6.0 is a reliability and supply-chain release: read-ahead teardown no longer blocks on
in-flight I/O, truncated CD sources report exactly where the layout ran out, and the repository
gained a full CI gate with CodeQL, Dependency Review, OpenSSF Scorecard, Dependabot, NuGet audit,
SHA-pinned actions and provenance-attested release assets.

---

Download (CLI)

Platform	Bundle
Windows x64	CHDSharp_win-x64_v1.6.0.zip
Windows ARM64	CHDSharp_win-arm64_v1.6.0.zip
Linux x64	CHDSharp_linux-x64_v1.6.0.zip
Linux ARM64	CHDSharp_linux-arm64_v1.6.0.zip
macOS Intel	CHDSharp_osx-x64_v1.6.0.zip
macOS Apple Silicon	CHDSharp_osx-arm64_v1.6.0.zip

Every bundle contains a framework-dependent single-file CHDSharp / CHDSharp.exe
build (the .NET runtime is not embedded) plus LICENSE.txt, README.md, README.txt
and this document. The .NET 10 runtime
is required.

---

Fixed: read-ahead disposal no longer blocks or leaks permits

ChdFile.Dispose() and ConfigureReadAhead(0) used to wait for every in-flight read-ahead read.
A stream that ignored cancellation could stall teardown indefinitely. The manager now cancels,
returns immediately, and lets the last background task dispose its semaphore and token source.
In-flight hunks are deduplicated, so two tasks can no longer race to cache the same hunk and leak a
permit. Shutdown cancellation is no longer logged as a decompression failure (important because
Warning+ events are forwarded to the CLI bug-report sink).

Fixed: truncated CD sources are diagnosable

A short read while encoding a CD now reports the track, frame within the track, logical frame,
source offset (hex and decimal), sector size, bytes needed/read and the file length. Split-pregap
reads name the next track's file only when that file was actually used.

Full CI and security (new in v1.6.0)

• CI gate - three-OS build/test across .NET 8/9/10, InspectCode, NuGet packaging, merged
  coverage, a Jekyll docs build and a quick chdman parity battle.
• CodeQL for C# and GitHub Actions, Dependency Review on pull requests, and
  OpenSSF Scorecard results published to code scanning.
  ... (truncated)

Commits viewable in compare view.

Updated Meziantou.Analyzer from 3.0.317 to 3.0.320.

Release notes

Sourced from Meziantou.Analyzer's releases.

3.0.320

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.320

What's Changed

• Fuzz: do not report findings that only happen in a long-running libFuzzer worker by @​meziantou in Fuzz: do not report findings that only happen in a long-running libFuzzer worker meziantou/Meziantou.Analyzer#1771
• chore(deps): update all dependencies by @​renovate[bot] in chore(deps): update all dependencies meziantou/Meziantou.Analyzer#1639

Full Changelog: meziantou/Meziantou.Analyzer@3.0.319...3.0.320

3.0.319

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.319

What's Changed

• MA0019: Do not report EventArgs used as an attribute by @​meziantou in MA0019: Do not report EventArgs used as an attribute meziantou/Meziantou.Analyzer#1770

Full Changelog: meziantou/Meziantou.Analyzer@3.0.318...3.0.319

3.0.318

NuGet package: https://www.nuget.org/packages/Meziantou.Analyzer/3.0.318

What's Changed

• MA0244, MA0245: Report the conversions of floating-point values to decimal by @​meziantou in MA0244, MA0245: Report the conversions of floating-point values to decimal meziantou/Meziantou.Analyzer#1747

Full Changelog: meziantou/Meziantou.Analyzer@3.0.317...3.0.318

Commits viewable in compare view.

Updated PBPSharp from 1.1.5 to 1.1.7.

Release notes

Sourced from PBPSharp's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated System.Drawing.Common from 10.0.13 to 10.0.14.

Release notes

Sourced from System.Drawing.Common's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.