deps: staleness sweep — every pin to latest published

global.json

@@ -5,7 +5,7 @@
     "allowPrerelease": true
   },
   "msbuild-sdks": {
-    "ANcpLua.NET.Sdk.Test": "3.4.44"
+    "ANcpLua.NET.Sdk.Test": "3.4.46"
   },
   "test": {
     "runner": "Microsoft.Testing.Platform"

src/Build/Common/Version.props

@@ -9,7 +9,7 @@
   </PropertyGroup>
 
   <PropertyGroup Label=".NET SDK">
-    <DotNetSdkVersion>10.0.301</DotNetSdkVersion>
+    <DotNetSdkVersion>10.0.400</DotNetSdkVersion>
     <DotNetSdkRollForward>latestMinor</DotNetSdkRollForward>
   </PropertyGroup>
 
@@ -19,54 +19,55 @@
   </PropertyGroup>
 
   <PropertyGroup Label="Reference Assemblies">
-    <BasicReferenceAssembliesVersion>1.8.9</BasicReferenceAssembliesVersion>
+    <BasicReferenceAssembliesVersion>1.8.11</BasicReferenceAssembliesVersion>
   </PropertyGroup>
 
   <PropertyGroup Label="Meziantou">
-    <MeziantouFrameworkVersion>6.0.1</MeziantouFrameworkVersion>
-    <MeziantouFullPathVersion>3.0.1</MeziantouFullPathVersion>
-    <MeziantouProcessWrapperVersion>2.0.1</MeziantouProcessWrapperVersion>
-    <MeziantouTemporaryDirectoryVersion>3.0.1</MeziantouTemporaryDirectoryVersion>
+    <MeziantouFrameworkVersion>6.0.4</MeziantouFrameworkVersion>
+    <MeziantouFullPathVersion>3.0.4</MeziantouFullPathVersion>
+    <MeziantouProcessWrapperVersion>2.0.4</MeziantouProcessWrapperVersion>
+    <MeziantouTemporaryDirectoryVersion>3.0.4</MeziantouTemporaryDirectoryVersion>
   </PropertyGroup>
 
   <PropertyGroup Label="Testing">
-    <XunitV3Version>3.2.2</XunitV3Version>
-    <AwesomeAssertionsVersion>9.4.0</AwesomeAssertionsVersion>
+    <XunitV3Version>4.0.0</XunitV3Version>
+    <AwesomeAssertionsVersion>9.6.0</AwesomeAssertionsVersion>
     <AwesomeAssertionsAnalyzersVersion>9.0.8</AwesomeAssertionsAnalyzersVersion>
   </PropertyGroup>
 
   <PropertyGroup Label="MTP Extensions">
-    <MTPExtensionsVersion>2.3.2</MTPExtensionsVersion>
-    <CodeCoverageVersion>18.9.0</CodeCoverageVersion>
-    <GitHubActionsLoggerMTPVersion>3.0.4</GitHubActionsLoggerMTPVersion>
+    <MTPExtensionsVersion>2.4.0</MTPExtensionsVersion>
+    <CodeCoverageVersion>18.11.0</CodeCoverageVersion>
+    <GitHubActionsLoggerMTPVersion>3.0.5</GitHubActionsLoggerMTPVersion>
   </PropertyGroup>
 
   <PropertyGroup Label="Analyzers">
-    <!-- 2.1.0: adds AL1506 (ExcludeFromCodeCoverage on branching code without a Justification),
-         on top of 2.0.2's gating of the AL1200-band "use ANcpLua.Roslyn.Utilities helper" rules
-         (AL1204-AL1220) to projects that reference the package. 2.1.0 is indexed on nuget.org —
-         pointing SDK truth at an unpublished version fails restore with NU1102.
+    <!-- 2.1.2: makes <AlAnalysisMode> actually work — the three profiles shipped as sectioned
+         analyzer configs, whose globs Roslyn resolves relative to the package folder, so they
+         matched nothing; they are now emitted with is_global = true. Carries the 90th
+         diagnostic on top of 2.1.1's 89. 2.1.2 is indexed on nuget.org — pointing SDK truth
+         at an unpublished version fails restore with NU1102.
          Bundled per-rule editorconfig in src/Config/Analyzer.ANcpLua.Analyzers.editorconfig
          is regenerated from the published DLL's HelpLinkUri by ConfigFilesGenerator. -->
-    <ANcpLuaAnalyzersVersion>2.1.1</ANcpLuaAnalyzersVersion>
+    <ANcpLuaAnalyzersVersion>2.1.2</ANcpLuaAnalyzersVersion>
     <NetAnalyzersVersion Condition="'$(NetAnalyzersVersion)' == ''">$(DotNetSdkVersion)</NetAnalyzersVersion>
     <SbomTargetsVersion>4.1.5</SbomTargetsVersion>
     <BannedApiAnalyzersVersion>5.6.0</BannedApiAnalyzersVersion>
   </PropertyGroup>
 
   <PropertyGroup Label="Microsoft.Extensions">
-    <MicrosoftExtensionsVersion>10.8.0</MicrosoftExtensionsVersion>
-    <AspNetCoreVersion>10.0.10</AspNetCoreVersion>
-    <MicrosoftBclAsyncInterfacesVersion>10.0.10</MicrosoftBclAsyncInterfacesVersion>
+    <MicrosoftExtensionsVersion>10.9.0</MicrosoftExtensionsVersion>
+    <AspNetCoreVersion>10.0.11</AspNetCoreVersion>
+    <MicrosoftBclAsyncInterfacesVersion>10.0.11</MicrosoftBclAsyncInterfacesVersion>
   </PropertyGroup>
 
   <PropertyGroup Label="Build Tools">
-    <NuGetVersion>7.6.0</NuGetVersion>
-    <MSBuildStructuredLoggerVersion>2.3.213</MSBuildStructuredLoggerVersion>
+    <NuGetVersion>7.9.0</NuGetVersion>
+    <MSBuildStructuredLoggerVersion>2.3.246</MSBuildStructuredLoggerVersion>
   </PropertyGroup>
 
   <!--
-    Microsoft.Agents.AI (MAF 1.13.0). Numeric base ships in lockstep from upstream;
+    Microsoft.Agents.AI (MAF 1.20.0). Numeric base ships in lockstep from upstream;
     family spans mixed release tracks — highest experimental track per package:
       stable     : core, Abstractions, Workflows, OpenAI, Workflows.Declarative
       -preview.* : Hosting, Hosting.AGUI.AspNetCore, Anthropic, DevUI
@@ -75,15 +76,15 @@
     the suffix variance.
   -->
   <PropertyGroup Label="Microsoft.Agents">
-    <MicrosoftAgentsAIVersion Condition="'$(MicrosoftAgentsAIVersion)' == ''">1.13.0</MicrosoftAgentsAIVersion>
-    <MicrosoftAgentsAIAbstractionsVersion Condition="'$(MicrosoftAgentsAIAbstractionsVersion)' == ''">1.13.0</MicrosoftAgentsAIAbstractionsVersion>
-    <MicrosoftAgentsAIWorkflowsVersion Condition="'$(MicrosoftAgentsAIWorkflowsVersion)' == ''">1.13.0</MicrosoftAgentsAIWorkflowsVersion>
-    <MicrosoftAgentsAIOpenAIVersion Condition="'$(MicrosoftAgentsAIOpenAIVersion)' == ''">1.13.0</MicrosoftAgentsAIOpenAIVersion>
-    <MicrosoftAgentsAIHostingVersion Condition="'$(MicrosoftAgentsAIHostingVersion)' == ''">1.13.0-preview.260703.1</MicrosoftAgentsAIHostingVersion>
-    <MicrosoftAgentsAIHostingAGUIAspNetCoreVersion Condition="'$(MicrosoftAgentsAIHostingAGUIAspNetCoreVersion)' == ''">1.13.0-preview.260703.1</MicrosoftAgentsAIHostingAGUIAspNetCoreVersion>
-    <MicrosoftAgentsAIAnthropicVersion Condition="'$(MicrosoftAgentsAIAnthropicVersion)' == ''">1.13.0-preview.260703.1</MicrosoftAgentsAIAnthropicVersion>
-    <MicrosoftAgentsAIDevUIVersion Condition="'$(MicrosoftAgentsAIDevUIVersion)' == ''">1.13.0-preview.260703.1</MicrosoftAgentsAIDevUIVersion>
-    <MicrosoftAgentsAIWorkflowsDeclarativeVersion Condition="'$(MicrosoftAgentsAIWorkflowsDeclarativeVersion)' == ''">1.13.0</MicrosoftAgentsAIWorkflowsDeclarativeVersion>
+    <MicrosoftAgentsAIVersion Condition="'$(MicrosoftAgentsAIVersion)' == ''">1.20.0</MicrosoftAgentsAIVersion>
+    <MicrosoftAgentsAIAbstractionsVersion Condition="'$(MicrosoftAgentsAIAbstractionsVersion)' == ''">1.20.0</MicrosoftAgentsAIAbstractionsVersion>
+    <MicrosoftAgentsAIWorkflowsVersion Condition="'$(MicrosoftAgentsAIWorkflowsVersion)' == ''">1.20.0</MicrosoftAgentsAIWorkflowsVersion>
+    <MicrosoftAgentsAIOpenAIVersion Condition="'$(MicrosoftAgentsAIOpenAIVersion)' == ''">1.20.0</MicrosoftAgentsAIOpenAIVersion>
+    <MicrosoftAgentsAIHostingVersion Condition="'$(MicrosoftAgentsAIHostingVersion)' == ''">1.20.0-preview.260831.1</MicrosoftAgentsAIHostingVersion>
+    <MicrosoftAgentsAIHostingAGUIAspNetCoreVersion Condition="'$(MicrosoftAgentsAIHostingAGUIAspNetCoreVersion)' == ''">1.20.0-preview.260831.1</MicrosoftAgentsAIHostingAGUIAspNetCoreVersion>
+    <MicrosoftAgentsAIAnthropicVersion Condition="'$(MicrosoftAgentsAIAnthropicVersion)' == ''">1.20.0-preview.260831.1</MicrosoftAgentsAIAnthropicVersion>
+    <MicrosoftAgentsAIDevUIVersion Condition="'$(MicrosoftAgentsAIDevUIVersion)' == ''">1.20.0-preview.260831.1</MicrosoftAgentsAIDevUIVersion>
+    <MicrosoftAgentsAIWorkflowsDeclarativeVersion Condition="'$(MicrosoftAgentsAIWorkflowsDeclarativeVersion)' == ''">1.20.0</MicrosoftAgentsAIWorkflowsDeclarativeVersion>
   </PropertyGroup>
 
   <PropertyGroup Label="Aliases">

src/Config/Analyzer.xunit.analyzers.editorconfig

@@ -273,6 +273,86 @@ dotnet_diagnostic.xUnit1052.severity = warning
 # Enabled: True, Severity: warning
 dotnet_diagnostic.xUnit1053.severity = warning
 
+# xUnit1054: Properties used for conditional skipping must be public, static, and return bool
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1054
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1054.severity = error
+
+# xUnit1055: Conditional skipping cannot set both SkipUnless and SkipWhen
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1055
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1055.severity = error
+
+# xUnit1056: Type must have a single public non-static constructor
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1056
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1056.severity = error
+
+# xUnit1057: Type must be public or internal
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1057
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1057.severity = error
+
+# xUnit1058: Generic collection definitions are not supported in Native AOT
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1058
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1058.severity = error
+
+# xUnit1059: Test classes may not be decorated with ICollectionFixture<>
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1059
+# Enabled: True, Severity: warning
+dotnet_diagnostic.xUnit1059.severity = warning
+
+# xUnit1060: Cultured test methods must have at least one culture
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1060
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1060.severity = error
+
+# xUnit1061: Fact methods cannot be generic
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1061
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1061.severity = error
+
+# xUnit1062: Theory methods cannot be generic in Native AOT
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1062
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1062.severity = error
+
+# xUnit1063: Test classes cannot be an open generic type
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1063
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1063.severity = error
+
+# xUnit1064: Theory parameter cannot use params modifier in Native AOT
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1064
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1064.severity = error
+
+# xUnit1065: MemberData method is ambiguous
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1065
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1065.severity = error
+
+# xUnit1066: MemberData parameter cannot use params modifier in Native AOT
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1066
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1066.severity = error
+
+# xUnit1067: There is no matching MemberData method argument
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1067
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1067.severity = error
+
+# xUnit1068: MemberData cannot point to an open generic type
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1068
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit1068.severity = error
+
+# xUnit1069: Test methods with a Timeout should reference TestContext.Current.CancellationToken
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit1069
+# Enabled: True, Severity: warning
+dotnet_diagnostic.xUnit1069.severity = warning
+
 # xUnit2000: Constants and literals should be the expected argument
 # Help link: https://xunit.net/xunit.analyzers/rules/xUnit2000
 # Enabled: True, Severity: warning
@@ -433,6 +513,11 @@ dotnet_diagnostic.xUnit2031.severity = warning
 # Enabled: True, Severity: suggestion
 dotnet_diagnostic.xUnit2032.severity = suggestion
 
+# xUnit2033: Use the assertion return value instead of re-deriving it
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit2033
+# Enabled: True, Severity: suggestion
+dotnet_diagnostic.xUnit2033.severity = suggestion
+
 # xUnit3000: Classes which cross AppDomain boundaries must derive directly or indirectly from LongLivedMarshalByRefObject
 # Help link: https://xunit.net/xunit.analyzers/rules/xUnit3000
 # Enabled: True, Severity: error
@@ -452,3 +537,23 @@ dotnet_diagnostic.xUnit3002.severity = warning
 # Help link: https://xunit.net/xunit.analyzers/rules/xUnit3003
 # Enabled: True, Severity: warning
 dotnet_diagnostic.xUnit3003.severity = warning
+
+# xUnit3004: The given type is missing a required interface implementation
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit3004
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit3004.severity = error
+
+# xUnit3005: Type must have an appropriate non-obsolete public constructor
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit3005
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit3005.severity = error
+
+# xUnit3006: Test case implementation must be serializable
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit3006
+# Enabled: True, Severity: error
+dotnet_diagnostic.xUnit3006.severity = error
+
+# xUnit3007: Test case implementation might not be serializable
+# Help link: https://xunit.net/xunit.analyzers/rules/xUnit3007
+# Enabled: True, Severity: warning
+dotnet_diagnostic.xUnit3007.severity = warning

tests/ANcpLua.Sdk.Tests/SdkTests.cs

@@ -258,7 +258,14 @@ public async Task Build_WhenEditorConfigFileExists_IncludedInBinlog()
 
         var files = result.GetBinLogFiles();
         Assert.Contains(files, static f => f.EndsWith(".editorconfig", StringComparison.Ordinal));
-        Assert.Contains(files, f => f == localFile || f == "/private" + localFile);
+
+        // macOS resolves the /var symlink behind the temp folder, so the binlog records the
+        // /private-prefixed realpath. Compare as FullPath so the platform's path comparer
+        // decides, not an ordinal string compare (MFFP0015).
+        FullPath[] expected = OperatingSystem.IsMacOS()
+            ? [localFile, FullPath.FromPath("/private" + localFile)]
+            : [localFile];
+        Assert.Contains(files, f => expected.Contains(FullPath.FromPath(f)));
     }
 
     [Fact]

tools/ConfigFilesGenerator/Program.cs

@@ -458,7 +458,9 @@ async Task GenerateBanSymbolsForNewtonsoftJson()
 
     var package = await DownloadNuGetPackage("Newtonsoft.Json", null, NullLogger.Instance, CancellationToken.None)
         .ConfigureAwait(false);
-    var libItems = await package.PackageReader.GetLibItemsAsync(CancellationToken.None).ConfigureAwait(false);
+    var packageReader = package.PackageReader
+                        ?? throw new InvalidOperationException("Downloaded package 'Newtonsoft.Json' has no reader.");
+    var libItems = await packageReader.GetLibItemsAsync(CancellationToken.None).ConfigureAwait(false);
 
     var compatibleFrameworks = libItems.Where(item =>
         DefaultCompatibilityProvider.Instance.IsCompatible(NuGetFramework.Parse("net10.0"), item.TargetFramework));
@@ -468,7 +470,7 @@ async Task GenerateBanSymbolsForNewtonsoftJson()
         if (!string.Equals(Path.GetExtension(item), ".dll", StringComparison.OrdinalIgnoreCase))
             continue;
 
-        await using var stream = package.PackageReader.GetStream(item);
+        await using var stream = packageReader.GetStream(item);
         var metadataRef = MetadataReference.CreateFromStream(stream);
         var allRefs = Net100.References.All.Add(metadataRef);
 
@@ -657,7 +659,8 @@ static string NormalizeCondition(string condition) =>
 
     using var cache = new SourceCacheContext();
     var repository = Repository.Factory.GetCoreV3("https://api.nuget.org/v3/index.json");
-    var resource = await repository.GetResourceAsync<PackageMetadataResource>().ConfigureAwait(false);
+    var resource = await repository.GetResourceAsync<PackageMetadataResource>().ConfigureAwait(false)
+                   ?? throw new InvalidOperationException("nuget.org does not expose a PackageMetadataResource.");
 
     foreach (var package in GetReferencedNuGetPackages())
     {
@@ -735,7 +738,9 @@ static async Task ListAllPackageDependencies(
         foreach (var repository in sourceRepositories)
         {
             var dependencyInfoResource =
-                await repository.GetResourceAsync<DependencyInfoResource>().ConfigureAwait(false);
+                await repository.GetResourceAsync<DependencyInfoResource>().ConfigureAwait(false)
+                ?? throw new InvalidOperationException(
+                    $"Source '{repository.PackageSource.Source}' does not expose a DependencyInfoResource.");
             var dependencyInfo =
                 await dependencyInfoResource.ResolvePackage(package, framework, cache, logger, cancellationToken)
                     .ConfigureAwait(false);
@@ -862,8 +867,10 @@ static async Task<Assembly[]> GetAnalyzerReferences(string packageId, NuGetVersi
     var cancellationToken = CancellationToken.None;
 
     var package = await DownloadNuGetPackage(packageId, version, logger, cancellationToken).ConfigureAwait(false);
+    var packageReader = package.PackageReader
+                        ?? throw new InvalidOperationException($"Downloaded package '{packageId}' has no reader.");
     var result = new List<Assembly>();
-    var files = package.PackageReader.GetFiles("analyzers");
+    var files = packageReader.GetFiles("analyzers");
     var filesGroupedByFolder = files.GroupBy(Path.GetDirectoryName).ToArray();
     foreach (var group in filesGroupedByFolder)
     {
@@ -884,7 +891,7 @@ static async Task<Assembly[]> GetAnalyzerReferences(string packageId, NuGetVersi
                     string.Equals(Path.GetFileName(f), assemblyFileName, StringComparison.OrdinalIgnoreCase));
                 if (assemblyPath != null)
                 {
-                    using var stream = package.PackageReader.GetStream(assemblyPath);
+                    using var stream = packageReader.GetStream(assemblyPath);
                     return context.LoadFromStream(stream);
                 }
             }
@@ -910,7 +917,7 @@ IEnumerable<string> GetProbeFolders()
 
             try
             {
-                await using var stream = package.PackageReader.GetStream(file);
+                await using var stream = packageReader.GetStream(file);
                 result.Add(context.LoadFromStream(stream));
             }
             catch (Exception ex)
@@ -1007,11 +1014,14 @@ static async Task<DownloadResourceResult> DownloadNuGetPackage(string packageId,
 
     using var cache = new SourceCacheContext();
     var repository = Repository.Factory.GetCoreV3(Source);
-    var resource = await repository.GetResourceAsync<FindPackageByIdResource>().ConfigureAwait(false);
+    var resource = await repository.GetResourceAsync<FindPackageByIdResource>().ConfigureAwait(false)
+                   ?? throw new InvalidOperationException($"Source '{Source}' does not expose a FindPackageByIdResource.");
 
     if (version is null)
     {
-        var metadataResource = await repository.GetResourceAsync<PackageMetadataResource>().ConfigureAwait(false);
+        var metadataResource = await repository.GetResourceAsync<PackageMetadataResource>().ConfigureAwait(false)
+                               ?? throw new InvalidOperationException(
+                                   $"Source '{Source}' does not expose a PackageMetadataResource.");
         var metadata = await metadataResource.GetMetadataAsync(packageId, true, false, cache, NullLogger.Instance,
             CancellationToken.None).ConfigureAwait(false);
         var latestPackage = metadata.MaxBy(static m => m.Identity.Version)