From adc3ad97c50cb0f8d56075b0e864fef384955c71 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 11 Oct 2026 21:02:23 +0000
Subject: [PATCH] Bump coverlet.collector and 25 others

Bumps coverlet.collector from 10.0.1 to 10.1.0
Bumps docfx from 2.78.5 to 2.81.0
Bumps Jint from 4.15.3 to 4.17.0
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.11 to 10.0.12
Bumps Microsoft.AspNetCore.DataProtection.EntityFrameworkCore from 10.0.11 to 10.0.12
Bumps Microsoft.AspNetCore.OpenApi from 10.0.11 to 10.0.12
Bumps Microsoft.AspNetCore.TestHost from 10.0.11 to 10.0.12
Bumps Microsoft.CodeAnalysis.Analyzers to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp to 5.9.0
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.Relational from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.Http.Resilience from 10.9.0 to 10.10.0
Bumps Microsoft.Extensions.TimeProvider.Testing from 10.9.0 to 10.10.0
Bumps Microsoft.NET.Test.Sdk from 18.8.1 to 18.10.1
Bumps Microsoft.OpenApi from 2.10.0 to 3.10.2
Bumps MinVer from 7.0.0 to 8.0.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.17.0 to 1.19.1
Bumps OpenTelemetry.Extensions.Hosting from 1.17.0 to 1.19.1
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.17.0 to 1.19.0
Bumps OpenTelemetry.Instrumentation.Http from 1.17.0 to 1.19.0
Bumps Scalar.AspNetCore from 2.16.19 to 2.17.14
Bumps System.IdentityModel.Tokens.Jwt to 8.23.0
Bumps Testcontainers.PostgreSql from 4.13.0 to 4.16.0
Bumps xunit.runner.visualstudio from 3.1.5 to 4.0.1
Bumps Xunit.SkippableFact from 1.5.61 to 1.5.85

---
updated-dependencies:
- dependency-name: coverlet.collector
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: docfx
  dependency-version: 2.81.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Jint
  dependency-version: 4.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.AspNetCore.DataProtection.EntityFrameworkCore
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.AspNetCore.TestHost
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.EntityFrameworkCore.Design
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.EntityFrameworkCore.Relational
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.Extensions.TimeProvider.Testing
  dependency-version: 10.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Microsoft.OpenApi
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: MinVer
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Scalar.AspNetCore
  dependency-version: 2.17.14
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: Testcontainers.PostgreSql
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-all
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-all
- dependency-name: Xunit.SkippableFact
  dependency-version: 1.5.85
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-all
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .config/dotnet-tools.json                     |  2 +-
 Directory.Packages.props                      | 52 +++++++++----------
 src/Core/Callora.Core.csproj                  |  3 ++
 .../Callora.Analyzers.Tests.csproj            |  1 +
 4 files changed, 31 insertions(+), 27 deletions(-)

diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
index 12ab7ac1..18264e64 100644
--- a/.config/dotnet-tools.json
+++ b/.config/dotnet-tools.json
@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "docfx": {
-      "version": "2.78.5",
+      "version": "2.81.0",
       "commands": [
         "docfx"
       ],
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 12088ceb..3ce7f8ec 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -6,8 +6,8 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageVersion Include="CalloraVoipSdk" Version="4.10.0" />
-    <PackageVersion Include="coverlet.collector" Version="10.0.1" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.11" />
+    <PackageVersion Include="coverlet.collector" Version="10.1.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
     <!-- Mindestens 10.0.10: zieht System.Security.Cryptography.Xml transitiv auf den
          Patch, der die HIGH-Advisory (NU1903, GHSA-mmjf-rqrv-855v u.a.) schließt. Wer diese
          Zeile senkt, holt sie zurück — die Untergrenze ist der Punkt, nicht die genaue Zahl.
@@ -17,8 +17,8 @@
          das gegen das veröffentlichte Callora.Core baut, bekam wieder 10.0.9 samt Advisory.
          Aufgefallen ist das erst, als ein Plugin AUSSERHALB des Repositories gegen die
          Pakete gebaut wurde; im Repo ist der Fehler unsichtbar. -->
-    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.12" />
     <!-- Roslyn analyzer authoring (Callora.Analyzers, REV2 §7). 4.8.0 targets a broadly
          compatible Roslyn; analyzers bind to the host compiler, not this version.
          NICHT anheben, ohne die Compiler-Version des ÄLTESTEN unterstützten SDK zu kennen:
@@ -30,51 +30,51 @@
     <!-- Surface-Template-Engine (ADR-015 rev.): sandboxbarer .NET-JS-Interpreter,
          führt das gebündelte Nunjucks (native Twig-Block-Vererbung) im gehärteten
          Modus aus (kein CLR-Interop, Timeout/Memory/Recursion-Limits). -->
-    <PackageVersion Include="Jint" Version="4.15.3" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.6.0" />
+    <PackageVersion Include="Jint" Version="4.17.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" />
     <!-- Public-API baseline tracking (REV2 §7.3, WP-G2): any change to the public
          surface of a framework assembly must show up as a reviewable diff. -->
     <PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="5.6.0" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12" />
     <!-- Nur für Tests: eine Verdrahtungsprüfung, die eine echte Schreiboperation braucht,
          soll dafür weder Docker noch Postgres verlangen. -->
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.12" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.11" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.9.0" />
-    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.9.0" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
-    <PackageVersion Include="MinVer" Version="7.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.10.0" />
+    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.10.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
+    <PackageVersion Include="MinVer" Version="8.0.0" />
     <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.19.1" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.19.1" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.19.0" />
     <PackageVersion Include="OpenTelemetry.Instrumentation.EntityFrameworkCore" Version="1.17.0-beta.1" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.11" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.19.0" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
     <!-- Pin transitive Microsoft.OpenApi above the vulnerable 2.0.0 (GHSA-v5pm-xwqc-g5wc).
          Bleibt auf 2.x, und das ist keine Vorsicht, sondern eine Schranke: Microsoft.AspNetCore.OpenApi
          10.0.11 fordert `>= 2.7.5 && < 3.0.0`. Mit 3.x bricht der Restore an NU1608 — hier als Fehler
          geschaltet — in JEDEM Projekt der Solution. Der Sprung wird erst möglich, wenn ASP.NET Core
          eine Fassung liefert, die 3.x zulässt; Dependabot sieht diese Schranke nicht und wird ihn
          weiter vorschlagen. -->
-    <PackageVersion Include="Microsoft.OpenApi" Version="2.10.0" />
+    <PackageVersion Include="Microsoft.OpenApi" Version="3.10.2" />
     <!-- Offizielles MCP-SDK (ASP.NET-Host): agenten-native Tool-Fläche über /mcp (Streamable HTTP). -->
     <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
-    <PackageVersion Include="Scalar.AspNetCore" Version="2.16.19" />
+    <PackageVersion Include="Scalar.AspNetCore" Version="2.17.14" />
     <!-- SemVer parsing/ordering for the plugin dependency install gate (npm-style
          ranges). Correct prerelease ordering out of the box — no in-house parser. -->
     <PackageVersion Include="Semver" Version="3.0.0" />
     <!-- Nur wegen der Advisory hier: transitive Abhängigkeit von Testcontainers, siehe die
          Begründung am PackageReference in Callora.Core.Tests.csproj. -->
     <PackageVersion Include="SSH.NET" Version="2026.0.0" />
-    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.22.0" />
-    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.13.0" />
+    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.23.0" />
+    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.16.0" />
     <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
-    <PackageVersion Include="Xunit.SkippableFact" Version="1.5.61" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.1" />
+    <PackageVersion Include="Xunit.SkippableFact" Version="1.5.85" />
   </ItemGroup>
 </Project>
diff --git a/src/Core/Callora.Core.csproj b/src/Core/Callora.Core.csproj
index 1617de9d..21f7825c 100644
--- a/src/Core/Callora.Core.csproj
+++ b/src/Core/Callora.Core.csproj
@@ -59,6 +59,8 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -82,6 +84,7 @@
     <PackageReference Include="ModelContextProtocol.AspNetCore" />
     <!-- Plugin dependency install gate: npm-range SemVer enforcement. -->
     <PackageReference Include="Semver" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" VersionOverride="8.23.0" />
   </ItemGroup>
 
 </Project>
diff --git a/tests/Callora.Analyzers.Tests/Callora.Analyzers.Tests.csproj b/tests/Callora.Analyzers.Tests/Callora.Analyzers.Tests.csproj
index 9c9ff5bb..04c1641c 100644
--- a/tests/Callora.Analyzers.Tests/Callora.Analyzers.Tests.csproj
+++ b/tests/Callora.Analyzers.Tests/Callora.Analyzers.Tests.csproj
@@ -14,6 +14,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio" />