Chore: Bump 15 dependencies from 3 dependabot PRs

.config/dotnet-tools.json

@@ -3,18 +3,18 @@
   "isRoot": true,
   "tools": {
     "dotnet-reportgenerator-globaltool": {
-      "version": "5.3.11",
+      "version": "5.5.11",
       "commands": [
         "reportgenerator"
       ],
       "rollForward": false
     },
     "dotnet-coverage": {
-      "version": "18.7.0",
+      "version": "18.9.0",
       "commands": [
         "dotnet-coverage"
       ],
       "rollForward": false
     }
   }
-}
+}

.github/dependabot.yml

@@ -32,6 +32,9 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+      # Pinned at 9.0.16 due to TypeInitializationException on Icu.NativeMethods
+      # in the net48 test host (PR #1000). Retest procedure: Directory.Packages.props.
+      - dependency-name: "Microsoft.Extensions.DependencyModel"
     groups:
       nuget-minor:
         patterns:

.github/workflows/base-installer-cd.yml

@@ -134,7 +134,7 @@ jobs:
           }
 
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: | 
             3.1.x
@@ -284,7 +284,7 @@ jobs:
 
       - name: Tag, Create Release, and Upload artifacts
         if: ${{ inputs.make_release == 'true' }}
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228
         with:
             target_commitish: ${{ github.event.inputs.fw_ref || github.ref }}
             tag_name: build-${{ env.FW_BUILD_NUMBER }}

.github/workflows/link-check.yml

@@ -11,7 +11,7 @@ jobs:
             - name: Checkout
               uses: actions/checkout@v7
             - name: Link check with lychee (non-blocking)
-              uses: lycheeverse/lychee-action@v2.8.0
+              uses: lycheeverse/lychee-action@v2.9.0
               with:
                   # Limit concurrency and accept 429 (rate-limited) as non-fatal
                   args: >-

.github/workflows/patch-installer-cd.yml

@@ -149,7 +149,7 @@ jobs:
           }
 
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: |
             3.1.x

Build/SilVersions.props

@@ -12,8 +12,8 @@
 		=============================================================
 	-->
 	<PropertyGroup Label="SIL Ecosystem Versions">
-		<SilLcmVersion>11.0.0-beta0173</SilLcmVersion>
-		<SilLibPalasoVersion>18.0.0-beta0027</SilLibPalasoVersion>
+		<SilLcmVersion>11.0.0-beta0176</SilLcmVersion>
+		<SilLibPalasoVersion>18.0.0-beta0030</SilLibPalasoVersion>
 		<SilLibPalasoL10nsVersion>18.0.0-beta0012</SilLibPalasoL10nsVersion>
 		<SilChorusVersion>6.0.0-beta0065</SilChorusVersion>
 		<SilChorusL10nsVersion>3.0.1</SilChorusL10nsVersion>

Build/Src/Directory.Packages.props

@@ -17,7 +17,10 @@
 
 	<!-- Use Update for root-pinned packages and Include for build-only packages absent from the root CPM file. -->
 	<ItemGroup Label="Build Tool Package Versions">
-		<PackageVersion Include="Microsoft.Build.Utilities.Core" Version="18.7.1" />
+		<PackageVersion Include="Microsoft.Build.Utilities.Core" Version="18.8.2" />
+		<!-- Microsoft.Build.Utilities.Core's System.Text.Json chain requires >= 10.0.4;
+			 the root pins 9.0.16 for the copy internalized into the Paratext plugin. -->
+		<PackageVersion Update="Microsoft.Bcl.AsyncInterfaces" Version="10.0.4" />
 		<PackageVersion Update="Microsoft.Extensions.DependencyModel" Version="2.1.0" />
 		<PackageVersion Update="NUnit3TestAdapter" Version="5.2.0" />
 		<PackageVersion Include="SIL.BuildTasks" Version="3.2.0" />

Directory.Packages.props

@@ -2,11 +2,9 @@
 	<PropertyGroup>
 		<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
 		<!--
-			Transitive Pinning: When a package is declared here but only consumed
-			transitively (not directly referenced by a project), NuGet still pins it
-			to the version below. This prevents the "last writer wins" problem in our
-			shared Output/ directory, which is the root cause of assembly-version
-			mismatch crashes like System.Drawing.Common 9.0 vs 6.0 (LT-22382 class).
+			Transitive pinning forces one version of a transitively-consumed package
+			across every project sharing Output/, preventing last-writer-wins
+			assembly-version crashes (LT-22382 class).
 		-->
 		<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
 	</PropertyGroup>
@@ -15,42 +13,39 @@
 	<Import Project="Build/SilVersions.props" />
 
 	<!--
-		=============================================================
 		TRANSITIVE PINS
 		Packages not directly referenced by any project, but whose
 		transitive versions must be forced to a single value across
 		all projects sharing Output/{Configuration}/.
-		=============================================================
 	-->
 	<ItemGroup Label="Transitive Pins">
-		<!-- Current-line refresh in this block: System.Drawing.Common,
-			 System.Resources.Extensions, and System.Security.Permissions move to 9.0.17.
-			 Microsoft.Extensions.DependencyModel intentionally stays at 9.0.16 because
-			 9.0.17 breaks ICU initialization in the .NET Framework test host. -->
-		<!-- System.Drawing.Common: SIL.LCModel.Core pulls 6.0.0 transitively,
-			 but ParatextData 9.5.x requires >= 9.0.9. Pin to 9.0.17. -->
-		<PackageVersion Include="System.Drawing.Common" Version="9.0.17" />
-		<PackageVersion Include="System.Reflection.Metadata" Version="10.0.9" />
+		<!-- System.Drawing.Common: ParatextData requires >= 9.0.9; SIL.LCModel.Core
+			 pulls 6.0.0 transitively. -->
+		<PackageVersion Include="System.Drawing.Common" Version="9.0.18" />
+		<PackageVersion Include="System.Reflection.Metadata" Version="10.0.10" />
 		<!-- System.Resources.Extensions: required for non-string resources (images, icons)
 			 in .NET Framework SDK-style projects. -->
-		<PackageVersion Include="System.Resources.Extensions" Version="9.0.17" />
-		<!-- DependencyModel: other current-line pins in this block move to 9.0.17,
-			 but this stays at 9.0.16. icu.net and SIL.LCModel.Core (liblcm) both float
-			 a 2.0.4 floor, ParatextData wants >= 9.0.9, and 9.0.17 throws
-			 TypeInitializationException on Icu.NativeMethods in the .NET Framework
-			 test host (reproduced and investigated in PR #1000). To retest: bump, run
-			 a full test.ps1, and grep the .trx for "Icu.NativeMethods" - zero hits
-			 means safe. -->
+		<PackageVersion Include="System.Resources.Extensions" Version="9.0.18" />
+		<!-- Held at 9.0.16: 9.0.17 throws TypeInitializationException on
+			 Icu.NativeMethods in the net48 test host (PR #1000). Retest: bump, full
+			 test.ps1, grep .trx for "Icu.NativeMethods" - zero hits is safe. -->
 		<PackageVersion Include="Microsoft.Extensions.DependencyModel" Version="9.0.16" />
-		<!-- System.Memory: ParatextData requires 4.6.3; other packages want 4.5.0–4.6.0. -->
+		<!-- SIL.LCModel's IoC container, ILRepack-internalized into
+			 FwParatextLexiconPlugin.dll which Paratext loads without our binding
+			 redirects. Keep in step with SIL.LCModel. -->
+		<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
+		<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.2" />
+		<PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="9.0.16" />
+		<!-- System.Memory: ParatextData requires >= 4.6.3; other packages want
+			 4.5.0–4.6.0. -->
 		<PackageVersion Include="System.Memory" Version="4.6.3" />
 		<!-- Microsoft.Bcl.HashCode: System.Resources.Extensions requires HashCode. -->
 		<PackageVersion Include="Microsoft.Bcl.HashCode" Version="6.0.0" />
-		<!-- System.Security.Permissions (LT-22394): ProDotNetZip needs >= 8.0.0,
-			 System.Security.AccessControl needs >= 6.0.0. Pin to 9.0.17. -->
-		<PackageVersion Include="System.Security.Permissions" Version="9.0.17" />
-		<!-- System.Text.Encoding.CodePages: SIL.Machine requires 10.0.x,
-			 other chains resolve to 9.0.9. Pin to 10.0.3 to match the plugin project. -->
+		<!-- System.Security.Permissions (LT-22394): ProDotNetZip requires >= 8.0.0,
+			 System.Security.AccessControl >= 6.0.0. -->
+		<PackageVersion Include="System.Security.Permissions" Version="9.0.18" />
+		<!-- System.Text.Encoding.CodePages: SIL.Machine requires >= 10.0.3,
+			 ProDotNetZip >= 8.0.0; must match the plugin project. -->
 		<PackageVersion Include="System.Text.Encoding.CodePages" Version="10.0.3" />
 	</ItemGroup>
 
@@ -100,10 +95,9 @@
 	-->
 	<ItemGroup Label="SIL Localization">
 		<PackageVersion Include="L10NSharp" Version="$(L10NSharpVersion)" />
-		<!-- L10NSharp v10 split the WinForms-specific types (LocalizationManagerWinforms) into a
-		     separate package. No project references it directly (it flows transitively from the
-		     Palaso stack); with CentralPackageTransitivePinningEnabled this pin keeps the
-		     transitive version aligned with the shared L10NSharp version. -->
+		<!-- L10NSharp v10 split the WinForms types into this package. Referenced only
+			 transitively via Palaso; pinned to keep it aligned with the shared
+			 L10NSharp version. -->
 		<PackageVersion Include="L10NSharp.Windows.Forms" Version="$(L10NSharpVersion)" />
 		<PackageVersion Include="SIL.Chorus.L10ns" Version="3.0.1" />
 		<PackageVersion Include="SIL.LibPalaso.L10ns" Version="$(SilLibPalasoL10nsVersion)" />
@@ -173,9 +167,9 @@
 		-->
 		<PackageVersion Include="HarfBuzzSharp" Version="8.3.1.1" />
 		<PackageVersion Include="HarfBuzzSharp.NativeAssets.Win32" Version="8.3.1.1" />
-		<!-- Pinned because multiple test projects copy this into the shared Output folder; without a
-		     single version the last-built project's copy breaks the others' binding redirects
-		     (observed: FwAvaloniaTests redirecting to 8.0.0.1 vs a 9.x dll from another graph). -->
+		<!-- Multiple test projects copy this into shared Output; without one version the
+			 last build breaks the others' binding redirects (seen: FwAvaloniaTests
+			 8.0.0.1 vs a 9.x dll). -->
 		<PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="9.0.2" />
 		<PackageVersion Include="Moq" Version="4.20.70" />
 		<PackageVersion Include="NUnit" Version="3.14.0" />
@@ -207,10 +201,9 @@
 	-->
 	<ItemGroup Label="Avalonia">
 		<PackageVersion Include="Avalonia" Version="11.3.17" />
-		<!-- Transitive analyzer carrier (Avalonia -> Avalonia.BuildServices). Pinned so xWorks can
-		     reference it with IncludeAssets="none": its AVA* analyzers must not run over the large
-		     legacy xWorks codebase where warnings are errors (the compile-only Avalonia reference
-		     there exists only for the ISlicePlugin contract). -->
+		<!-- Analyzer carrier for Avalonia. Pinned so xWorks can reference it with
+			 IncludeAssets="none": its AVA* analyzers must not run over legacy xWorks,
+			 where warnings are errors. -->
 		<PackageVersion Include="Avalonia.BuildServices" Version="11.3.2" />
 		<PackageVersion Include="Avalonia.Desktop" Version="11.3.17" />
 		<PackageVersion Include="Avalonia.Themes.Fluent" Version="11.3.17" />
@@ -220,9 +213,9 @@
 		<!-- Skia-enabled headless rendering for visual parity frame capture.
 		     The HarfBuzzSharp 8.3.1.1 pin above was aligned for exactly this package. -->
 		<PackageVersion Include="Avalonia.Skia" Version="11.3.17" />
-		<!-- MVVM for hand-authored Avalonia dialogs. 8.x ships
-		     netstandard2.0 source generators, so it works on net48; used only by the dedicated
-		     XAML-enabled FwAvaloniaDialogs project, not the pure-C# FwAvalonia foundation. -->
+		<!-- MVVM for hand-authored Avalonia dialogs. 8.x ships netstandard2.0 source
+			 generators so it works on net48; used only by FwAvaloniaDialogs, not
+			 FwAvalonia. -->
 		<PackageVersion Include="CommunityToolkit.Mvvm" Version="8.2.2" />
 	</ItemGroup>
 </Project>

Src/FwParatextLexiconPlugin/ILRepack.targets

@@ -25,6 +25,19 @@ This software is licensed under the LGPL, version 2.1 or later
 		<RepackAssemblies Include="$(OutputPath)/SIL.Lexicon.dll"/>
 		<RepackAssemblies Include="$(OutputPath)/ParserCore.dll"/>
 		<RepackAssemblies Include="$(OutputPath)/FwUtils.dll"/>
+		<!-- SIL.LCModel's IoC container (liblcm #393 replaced StructureMap with these in
+			 11.0.0-beta0176). Internalized because Paratext ships no copy and provides no
+			 binding redirects, so as external references they would have to resolve from
+			 the FieldWorks directory at their exact recorded versions - any version drift
+			 broke the plugin only inside Paratext. liblcm exposes no DI type on its public
+			 API and bootstraps the container without reflection-by-name, so internalizing
+			 is type-safe. Merging an assembly promotes ITS references to new externals of
+			 the plugin; check the merged output's AssemblyRefs after changing this list. -->
+		<RepackAssemblies Include="$(OutputPath)/Microsoft.Extensions.DependencyInjection.dll"/>
+		<RepackAssemblies Include="$(OutputPath)/Microsoft.Extensions.DependencyInjection.Abstractions.dll"/>
+		<!-- Dependency of the internalized DI assemblies. Left external it would reference
+			 8.0.0.0 while FieldWorks ships 9.x, a gap nothing bridges inside Paratext. -->
+		<RepackAssemblies Include="$(OutputPath)/Microsoft.Bcl.AsyncInterfaces.dll"/>
 	</ItemGroup>
 	<ItemGroup>
 		<LibDirs Include="$(OutputPath)"/>