[wasabii]

Bumps every outdated NuGet package, MSBuild SDK and .NET tool in the repository, except KubeOps — see below. No source changes were required.

Updated

Package	From	To
Auth0.ManagementApi	9.2.0	10.1.0
Auth0.AuthenticationApi	7.48.0	7.49.0
Microsoft.CodeAnalysis.CSharp	5.6.0	5.9.0
System.Reflection.MetadataLoadContext	10.0.10	10.0.11
System.Text.Json	10.0.10	10.0.11
System.Threading.RateLimiting	10.0.10	10.0.11
MSTest.Sdk (global.json)	4.3.3	4.4.0

Held back: KubeOps stays at 13.1.0

13.2.0 is available and this PR originally took it. It silently ships a chart with no CRDs. The CLI dies partway through generation and then exits 0:

Generate CRDs.
Unhandled exception: System.IO.FileNotFoundException: Could not find assembly
'Microsoft.CodeAnalysis, Version=5.9.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'

Nothing fails as a result. MSBuild sees a successful Exec, config/ is left empty, and the chart's RewriteCrds skips every CRD through its Condition="Exists(...)", so helm package produces a chart with templates and a ClusterRole but no CRDs. The build stays green and only the artifact size gives it away — the charts artifact fell from 109,942 bytes (PR #36, KubeOps 13.1.0) to 39,178 bytes on the first commit here.

KubeOps.Operator, KubeOps.Generator, KubeOps.Operator.Web and the KubeOps.Cli tool are therefore all reverted to 13.1.0, the version main already ships, with the reason recorded beside the reference so a future bump is checked against the chart contents rather than the exit code.

Already current — verified, not changed

IKVM.Core.MSBuild (0.1.108), Newtonsoft.Json (13.0.4), YamlDotNet (18.1.0), Microsoft.Build.NoTargets (3.7.134), GitVersion.Tool (6.8.2), and the workflow's GitHub Actions (checkout@v7, setup-dotnet@v6, upload-artifact@v7, download-artifact@v8) are all at their latest releases. global.json's SDK pin stays at 10.0.100 with rollForward: latestFeature, which already picks up newer patches.

Compatibility review

Auth0.ManagementApi 10.x is the only major bump. Its sole breaking change is date-valued properties on refresh-token, session and flow responses moving from T? to Optional<T?> — GetRefreshTokenResponseContent, SessionResponseContent, SessionAuthenticationSignal.Timestamp, FlowActionFlowMapValueParams.Fallback and friends. The operator drives Clients, Connections, ResourceServers, ClientGrants, Roles, Branding, CustomDomains, Tenants and Prompts, and touches none of those endpoints, so nothing needed adapting. The Optional<T> type itself was already in use in the connection mapping, so the pattern is unchanged.

The reflective lookup of the internal Auth0.ManagementApi.Core.JsonOptions (in V2alpha3ConnectionController, ConnectionConverter and ClientConverter) still resolves under 10.1.0 — the type and its JsonSerializerOptions field both survive the major bump. Because it is read from a static field initializer, the mapping tests would fail with a TypeInitializationException if it had not.

Verification

• Clean Release build: 0 errors, 0 new warnings (the two NU1510 "will not be pruned" notices for System.Text.Json and System.Threading.RateLimiting pre-date this change).
• Test suite green in both configurations: 445/445 passed, 0 failed, 0 skipped — run via the Microsoft.Testing.Platform executable, not dotnet test.
• CRD generation and Helm packaging cannot run in the sandbox this was prepared in (helm unavailable; the KubeOps CLI fails to resolve the project-referenced Alethic.Auth0.Operator.Core assembly under a distro-packaged SDK, on 13.1.0 and 13.2.0 alike). They are verified through CI instead, by checking the charts artifact is full size rather than trusting the job's exit code.