[github-actions]

Caution

Protected files were modified in this change.
This pull request is in request_review mode and requires explicit human scrutiny before merge.

Protected files: Directory.Packages.props

Routine dependency update via Directory.Packages.props (central package management). No .csproj files were touched.

Patch

• Microsoft.Extensions.DependencyInjection: 10.0.12 -> 10.0.13
• Microsoft.Extensions.Logging.Debug: 10.0.12 -> 10.0.13 (kept in step with the other Microsoft.Extensions.* packages even though it's unreferenced in Stellar.slnf)
• System.Threading.RateLimiting: 10.0.12 -> 10.0.13
• Microsoft.AspNetCore.Components.WebAssembly: 10.0.10 -> 10.0.13
• Microsoft.AspNetCore.Components.WebAssembly.DevServer: 10.0.10 -> 10.0.13
• Avalonia / Avalonia.Desktop / Avalonia.Fonts.Inter / Avalonia.Themes.Fluent: 12.1.1 -> 12.1.4
• CommunityToolkit.Maui: 15.0.0 -> 15.0.1
• coverlet.collector: 10.0.1 -> 10.1.0

Minor

• Microsoft.Extensions.DependencyInjection.AutoActivation: 10.8.0 -> 10.11.0
• FluentValidation: 12.1.1 -> 12.2.0
• Microsoft.NET.Test.Sdk: 18.8.1 -> 18.11.0
• Microsoft.WindowsAppSDK: 2.3.1 -> 2.5.1
• Uno.WinUI: 6.6.184 -> 6.7.135

Deliberately left unchanged

• ReactiveUI.Reactive, ReactiveUI.Blazor.Reactive, ReactiveUI.Maui.Reactive, ReactiveUI.WPF.Reactive, ReactiveUI.WinUI.Reactive stay on 24.3.0. 26.0.1 is available but ReactiveUI 25+ moves binding onto a source generator that breaks Stellar's private-field Bind calls and removes the ICreatesCustomizedCommandRebinding extension point used by Stellar.Maui/MauiCommandRebinding.cs. Per the project rule, not touching this.
• ReactiveUI.SourceGenerators stays on 3.2.0 - already the newest version within the 3.x line (paired with ReactiveUI 24.x); 4.2.0 only pairs with ReactiveUI 25+.
• Microsoft.CodeAnalysis.CSharp stays on 5.0.0 (floor for the Roslyn source generator to load on SDK 10.0.1xx, per the project rule - not raising toward 5.9.0).
• xunit (2.9.3) and xunit.runner.visualstudio (3.1.5) are already the latest versions within their respective 2.x/3.x lines; not migrating to xunit.v3/4.x.
• Microsoft.Maui.Controls (10.0.110), Microsoft.AspNetCore.Components.WebView.Maui (10.0.110), CommunityToolkit.Maui.Markup (8.0.0), CommunityToolkit.Mvvm (8.4.2), Mopups (1.3.4) are already the latest stable versions published on nuget.org - verified individually since Stellar.slnf excludes the MAUI projects.
• stylecop.analyzers stays on its 1.2.0-beta.556 line (no stable release exists); Microsoft.CodeAnalysis.NetAnalyzers and Roslynator.Analyzers were not reported as outdated by dotnet list package --outdated for the projects in Stellar.slnf and were left untouched to stay within the scope of the automated check.

Nothing was dropped from the batch - every update below passed verification.

Verification

Ran from the repo root:

dotnet restore Stellar.slnf
dotnet build Stellar.slnf --configuration Release --no-restore
dotnet test Stellar.UnitTests/Stellar.UnitTests.csproj --configuration Release --no-build

Restore and build succeeded (0 errors), and all 259 unit tests passed. The MAUI projects and sample apps are not built here (no MAUI workload available) and will be validated by CI on this PR.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

• avbuildtelapiv1.avaloniaui.net
• ccsca2021.crl.certum.pl
• ccsca2021.ocspcertum.com
• crl.certum.pl
• crl.godaddy.com
• ocsp.godaddy.com
• subca.crl.certum.pl
• subca.ocspcertum.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "avbuildtelapiv1.avaloniaui.net"
    - "ccsca2021.crl.certum.pl"
    - "ccsca2021.ocspcertum.com"
    - "crl.certum.pl"
    - "crl.godaddy.com"
    - "ocsp.godaddy.com"
    - "subca.crl.certum.pl"
    - "subca.ocspcertum.com"

See Network Configuration for more information.

Generated by Dependency update · sonnet50 392.3K · ◷

[github-actions]

Protected files were modified in this pull request and require manual scrutiny before merge.

Please verify that each protected-file change is intentional, policy-compliant, and safe:

• Protected files: Directory.Packages.props