Pin FluentValidation.DependencyInjectionExtensions to 12.1.1

[gunndabad]

Context

Builds from Rider have been failing since the last pull from main with NU1102 across Api, AuthorizeAccess, SupportUi, WebCommon and the test projects that reference them:

error NU1102: Unable to find package Microsoft.Extensions.Dependencyinjection.Abstractions with version (>= 2.1.0)
  - Found 172 version(s) in nuget.org [ Nearest version: 2.1.0 ]

Note the lowercase i in Dependencyinjection. That id is a typo in the nuspec of FluentValidation.DependencyInjectionExtensions 11.11.0, which FluentValidation.AspNetCore 11.3.1 pulls in transitively:

FluentValidation.AspNetCore 11.3.1
  └─ FluentValidation.DependencyInjectionExtensions 11.11.0   ← typo'd nuspec
       └─ Microsoft.Extensions.Dependencyinjection.Abstractions >= 2.1.0

Under .NET 10 package pruning that package is dropped from the graph entirely (the shared framework provides it), so the typo'd id never has to be resolved — which is why dotnet build from the command line is unaffected, and why no packages.lock.json on main contains an entry for it. Any restore that doesn't prune has to resolve the id and fails. Rider's in-process NuGet restore is one such restore; it writes the error into project.assets.json, and ResolvePackageAssets then replays it as a build error until something re-restores. That's why Rider builds alternate between clean and failing depending on whether a CLI build ran in between.

This is not caused by the SDK pin in #3720 — Rider resolves 10.0.301 both before and after it, and restore is clean under 10.0.102, 10.0.301 and 10.0.303 alike.

Changes proposed in this pull request

Add a direct FluentValidation.DependencyInjectionExtensions 12.1.1 reference so it wins over the transitive 11.11.0. Version 12.1.1 spells the dependency correctly:

<!-- 11.11.0 --> <dependency id="Microsoft.Extensions.Dependencyinjection.Abstractions" version="2.1.0" />
<!-- 12.1.1  --> <dependency id="Microsoft.Extensions.DependencyInjection.Abstractions" version="2.1.0" />

No behaviour changes — validation is untouched.

Guidance to review

Why pin rather than drop FluentValidation.AspNetCore. Dropping it was considered and rejected as too large for this fix. Three of its APIs are load-bearing: AddFluentValidationAutoValidation (validates every API request model), IValidatorInterceptor (PreferModelBindingErrorsValidationInterceptor), and ValidationResult.AddToModelState. Removing it means reimplementing MVC auto-validation and changing the 400-response path for the whole public API. Worth doing separately.

Upgrading FluentValidation.AspNetCore is not an option. It is discontinued — 133 versions published, the last being the 11.3.1 we're on. There is no 12.x and no newer prerelease; the maintainer retired it when auto-validation was dropped in FluentValidation 12.

This is consistent with what we already do. FluentValidation.AspNetCore 11.3.1 also asks for FluentValidation 11.11.0, and our direct FluentValidation 12.1.1 already overrides it. The two packages are versioned in lockstep upstream, so leaving DI.Extensions at 11.11.0 while FluentValidation sits at 12.1.1 was the anomaly.

Lock file churn is mechanical — 11 packages.lock.json files now resolve DI.Extensions to 12.1.1.

Verification

• just build — 0 errors, 0 warnings.
• just restore (--locked-mode, as CI runs it) — clean.
• just format-changed — no changes.
• Restored with -p:RestoreEnablePackagePruning=false to simulate a non-pruning restore like Rider's: the typo'd id no longer appears in the resolved graph at all (was present before this change). This is the direct evidence the Rider failure is fixed.
• just test-changed was not run. It aborts before running anything: the script derives a TeachingRecordSystem.WebCommon.Tests project from the changed WebCommon project, and no such project exists, so it crashes trying to cd into it. Pre-existing limitation in scripts/Utils.cs, unrelated to this change, but it means the affected tests are unverified locally and are relying on CI.

Checklist

• Attach to Trello card
• Rebased master
• Cleaned commit history
• Tested by running locally

🤖 Generated with Claude Code