[github-actions]

Caution

Protected files were modified in this change.
This pull request is in request_review mode and requires explicit human scrutiny before merge.

Protected files: Directory.Packages.props

Routine dependency update. All version pins live in Directory.Packages.props (central package management); no .csproj files were touched.

Minor updates

• Microsoft.Extensions.DependencyInjection: 10.0.12 -> 10.0.14
• Microsoft.Extensions.DependencyInjection.AutoActivation: 10.8.0 -> 10.11.0
• Microsoft.Extensions.Logging.Debug: 10.0.12 -> 10.0.14
• System.Threading.RateLimiting: 10.0.12 -> 10.0.14
• FluentValidation: 12.1.1 -> 12.2.0
• Microsoft.Maui.Controls: 10.0.110 -> 10.0.120
• Microsoft.AspNetCore.Components.WebView.Maui: 10.0.110 -> 10.0.120
• CommunityToolkit.Maui: 15.0.0 -> 15.0.1
• Avalonia / Avalonia.Desktop / Avalonia.Fonts.Inter / Avalonia.Themes.Fluent: 12.1.1 -> 12.1.4
• Microsoft.AspNetCore.Components.WebAssembly / .DevServer: 10.0.10 -> 10.0.14
• Microsoft.WindowsAppSDK: 2.3.1 -> 2.5.1
• Uno.WinUI: 6.6.184 -> 6.7.135
• Microsoft.CodeAnalysis.NetAnalyzers: 10.0.302 -> 10.0.403 (SDK-band versioned analyzer package, distinct from the Roslyn compiler packages that are held back)
• Microsoft.NET.Test.Sdk: 18.8.1 -> 18.11.0
• coverlet.collector: 10.0.1 -> 10.1.0

Major update

• Roslynator.Analyzers: 4.15.0 -> 5.0.1 (this is an analyzer-only package, not the Roslyn compiler itself; restore and build both succeed with no conflicts)

Deliberately left unchanged

• ReactiveUI. (.Reactive family), ReactiveUI.SourceGenerators* — held on the 24.x / 3.x lines per project policy. dotnet list --outdated --highest-minor confirms 24.3.0 is already the newest release within the 24.x line, so there is nothing to take there. A move to ReactiveUI 25/26 is available upstream but is a breaking change (binding source-generator migration, loss of ICreatesCustomizedCommandRebinding) and is intentionally left for a dedicated migration, not a routine dependency bump.
• Microsoft.CodeAnalysis.CSharp — stays at 5.0.0. Raising it risks silently disabling Stellar.SourceGenerators for consumers on SDK feature bands below 10.0.3xx, per the pinned compatibility-floor policy.
• CommunityToolkit.Maui.Markup (8.0.0), CommunityToolkit.Mvvm (8.4.2), Mopups (1.3.4) — already at the newest stable release.
• xunit — stays on the 2.9.3 line; xunit.v3 is a different package/hosting model, not an upgrade path taken here.
• xunit.runner.visualstudio — stays at 3.1.5. The newest release (4.0.1) is a major-version jump that tracks the xunit.v3 runner/hosting model; since xunit itself stays on 2.x, bumping the runner independently risked an incompatible pairing, so it was left alone.
• Roslynator.Analyzers / Microsoft.CodeAnalysis.NetAnalyzers / stylecop.analyzers inside Directory.Build.props-applied analyzers — stylecop.analyzers stays on its only available 1.2.0-beta.556 line (no stable release exists).

Nothing was dropped from the batch due to failed verification — everything listed above built and tested cleanly together.

Verification

Ran against Stellar.slnf (the MAUI-workload-free subset; MAUI projects and sample apps are verified by CI on this PR, not locally):

dotnet restore Stellar.slnf
dotnet build Stellar.slnf --configuration Release --no-restore
dotnet test Stellar.UnitTests/Stellar.UnitTests.csproj --configuration Release --no-build

All three passed: build succeeded with 0 errors (5 pre-existing warnings, unrelated to this change), and all 259 unit tests passed.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

• avbuildtelapiv1.avaloniaui.net
• ccsca2021.crl.certum.pl
• ccsca2021.ocspcertum.com
• crl.certum.pl
• crl.godaddy.com
• ocsp.godaddy.com
• subca.crl.certum.pl
• subca.ocspcertum.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "avbuildtelapiv1.avaloniaui.net"
    - "ccsca2021.crl.certum.pl"
    - "ccsca2021.ocspcertum.com"
    - "crl.certum.pl"
    - "crl.godaddy.com"
    - "ocsp.godaddy.com"
    - "subca.crl.certum.pl"
    - "subca.ocspcertum.com"

See Network Configuration for more information.

Generated by Dependency update · sonnet50 286.7K · ◷

[github-actions]

Protected files were modified in this pull request and require manual scrutiny before merge.

Please verify that each protected-file change is intentional, policy-compliant, and safe:

• Protected files: Directory.Packages.props