chore(deps): sweep all centrally managed NuGet packages

[NiklasArbin]

What this changes

Brings every dependency in Directory.Packages.props to its current release in one pass, instead of the trickle of near-identical grouped Dependabot PRs. Aspire.AppHost.Sdk is pinned in the AspireHost csproj rather than centrally, so it does not move on its own and is bumped here alongside Aspire.Hosting.Azure.ServiceBus.

Twelve packages hold a direct reference to something that moved, so their published dependency floor changes and they get a minor bump: KnightBus.Core 18.4.0, KnightBus.Host 18.3.0, KnightBus.Azure.ServiceBus 24.2.0, KnightBus.Azure.Storage 18.3.0, KnightBus.Redis 17.2.0, KnightBus.SqlServer 17.2.0, KnightBus.PostgreSql 4.3.0, KnightBus.PostgreSql.Management 4.2.0, KnightBus.PostgreSql.Extensions.Azure 2.1.0, KnightBus.Schedule 15.3.0, KnightBus.NewRelic 13.2.0, KnightBus.OpenTelemetry 1.0.0-alpha4.

The other fourteen are unchanged and not republished — KnightBus.ApplicationInsights, KnightBus.Nats and KnightBus.Newtonsoft were already current on everything they reference, and the satellites have no package references of their own.

This clears twelve NuGet Audit advisories. MessagePack 2.5.192 (two high, nine moderate) reached the build through Microsoft.NET.Test.Sdk, and SSH.NET 2024.2.0 (one high) through Testcontainers. master builds with 60 NU1902/NU1903 warnings; this branch builds with none. Both were confined to the test suites and the Aspire sample, all IsPackable=false, so no published package ever carried them.

Notes for the reviewer

Three versions are held back deliberately, and each carries a comment in Directory.Packages.props so the next Dependabot PR does not quietly undo it:

• StackExchange.Redis stays on 2.x (2.13.17 — latest 2.x). 3.x is compile-compatible on paper, and the code uses the new RedisChannel(name, PatternMode.Literal) constructor rather than the conversion operators obsoleted in 2.6.116. But 3.x defaults to RESP3 and raises the floor in the published KnightBus.Redis, forcing every consumer off 2.x. That belongs in its own major release. Worth a second opinion if you disagree.
• Microsoft.Data.SqlClient stays on the 6.1 LTS line (6.1.6, supported to 2028-08-14) rather than 7.0.2, which is STS and loses support three months after the next release ships.
• FluentAssertions keeps its [7.2.0,8.0.0) range — the v8 licence guard. 8.10.0 exists and must not be picked up.

KnightBus.PostgreSql goes to 4.3.0, not 4.2.0. #227 already published 4.2.0 with the previous Npgsql floor. CI pushes with --skip-duplicate, so reusing that version would have packed the new floor and then silently discarded it on publish — no failure, no moved floor. This is the one thing here worth double-checking.

Five call sites needed real changes for new obsoletions:

• PostgresAzureConfiguration.TokenCredential now defaults to new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned). Azure.Identity 1.21.0 obsoleted the constructor the old parameterless call resolved to. Same system-assigned identity, spelled explicitly — this one is in a shipped package.
• The four Testcontainers setups pass their image to the builder constructor, since the parameterless overload is obsolete. Redis and Postgres already called .WithImage(...), so those just moved. Azurite and MsSql relied on the module defaults, so those tags are now explicit — verified byte-identical between 4.3.0 and 4.14.0, so no behaviour change.

Verification beyond the checklist. NUnit3TestAdapter 5 → 6 is a major bump of the runner, where a mismatch shows up as tests silently not being discovered rather than as a build error. Test counts are identical per suite against a master baseline build, so nothing was dropped. I also inspected the packed nuspecs to confirm the floors moved as intended, including the per-TFM split — KnightBus.Core declares 9.0.19 for net9.0 and 10.0.11 for net10.0.

Two judgment calls, easy to reverse:

• The Aspire 13.5 SDK emits a new ASPIRE010 advisory about the missing CLI bundle. I suppressed it in the sample AppHost with NoWarn rather than pulling the bundle into CI. Say the word and I'll set AspireUseCliBundle=true instead.
• csharpier stays at 1.2.1 in .config/dotnet-tools.json; 1.3.0 is out, but a formatter bump can reflow files repo-wide and does not belong in this diff.

Out of scope: the 5 open Dependabot alerts are all pip packages in docs/requirements.txt (pymdown-extensions, urllib3, requests) — unrelated to this sweep, and that file is hash-pinned so it needs hashes regenerated rather than a version line edited. NU1510 (System.Text.Json in KnightBus.Core now likely redundant) is pre-existing and unchanged.

Checklist

• dotnet build KnightBus.slnx and dotnet test pass — 308/308 across 10 suites, build clean apart from pre-existing NU1510
• dotnet csharpier check . passes
• Tests cover the change — no new tests; this is a version sweep, and the existing suites are the coverage
• Documentation under docs/ is updated, if the change is user-visible — N/A, no doc references a dependency version
• <Version> is bumped in the affected .csproj and CHANGELOG.md has an entry — twelve packages, plus entries in the three per-package changelogs (KnightBus.Core, KnightBus.Azure.ServiceBus, KnightBus.PostgreSql)

🤖 Generated with Claude Code

https://claude.ai/code/session_0176nyGkxqpWKrvJAEpwYtnx

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud