Bump the nuget-patch-and-minor group with 7 updates

[dependabot]

Updated Microsoft.Extensions.Hosting from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.Extensions.Hosting's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Hosting.WindowsServices from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.Extensions.Hosting.WindowsServices's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Logging.Abstractions from 10.0.10 to 10.0.11.

Release notes

Sourced from Microsoft.Extensions.Logging.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.8.1 to 18.9.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.9.0

What's Changed

• Fix tilde/exclamation characters corrupted in TerminalLogger test output by @​nohwnd in [fix] Fix tilde/exclamation characters corrupted in TerminalLogger test output microsoft/vstest#16046
• Make TranslationLayer Native AOT-compatible by @​drewnoakes in Make TranslationLayer Native AOT-compatible microsoft/vstest#16045
• Guard GenerateProgramFile target against UseWinUI/UseUwpTools evaluation order by @​nohwnd in [fix] fix: guard GenerateProgramFile target against UseWinUI/UseUwpTools evaluation order microsoft/vstest#16072
• Add RequestingAssembly to AssemblyResolveEventArgs for binary compat by @​nohwnd in [fix] fix: add RequestingAssembly to AssemblyResolveEventArgs for binary compat microsoft/vstest#16076
• Remove stale Microsoft.Extensions.FileSystemGlobbing binding redirect from testhost.x86 and datacollector by @​Evangelink in Remove stale Microsoft.Extensions.FileSystemGlobbing binding redirect from testhost.x86 and datacollector microsoft/vstest#16082
• Fix TRX attachment paths when LogFileName contains a subdirectory by @​nohwnd in [fix] Fix TRX attachment paths when LogFileName contains a subdirectory microsoft/vstest#15791
• Fix missing dumps for .NET Framework child processes in NetClientHangDumper by @​nohwnd in [fix] Fix missing dumps for .NET Framework child processes in NetClientHangDumper microsoft/vstest#16098
• Fix data collection channels to use negotiated protocol version instead of V1 by @​nohwnd in [fix] Fix data collection channels to use negotiated protocol version instead of V1 microsoft/vstest#16096
• Fix race condition in BlameCollector: skip hang dump when testhost hasn't launched yet by @​nohwnd in [fix] Fix race condition in BlameCollector: skip hang dump when testhost hasn't launched yet microsoft/vstest#16065
• Replace TestSDKAutoGeneratedCode with ExcludeFromCodeCoverage in auto-generated Program files by @​nohwnd in [fix] Replace TestSDKAutoGeneratedCode with ExcludeFromCodeCoverage in auto-generated Program files microsoft/vstest#16101
• Include testhost process path in crash error messages by @​nohwnd in [fix] Include testhost process path in crash error messages microsoft/vstest#16108
• Fix DataDriven test results being double-counted in TRX logger totals by @​nohwnd in [fix] Fix DataDriven test results being double-counted in TRX logger totals microsoft/vstest#15766
• Fix datacollector crash visibility: replace Assert with throwable exceptions by @​nohwnd in [fix] Fix datacollector crash visibility: replace Assert with throwable exceptions microsoft/vstest#16048
• Add TreatErrorMessagesAsWarnings parameter to TRX logger by @​nohwnd in [fix] Add TreatErrorMessagesAsWarnings parameter to TRX logger microsoft/vstest#16106
• Wait for testhost stderr to drain before reading its crash output by @​nohwnd in Wait for testhost stderr to drain before reading its crash output microsoft/vstest#16128
• Handle runtimeconfig.dev.json without additionalProbingPaths by @​tmat in Handle runtimeconfig.dev.json without additionalProbingPaths microsoft/vstest#16166
• Suggest Microsoft.NET.Test.Sdk when a managed test project brings no testhost by @​nohwnd in Suggest Microsoft.NET.Test.Sdk when a managed test project brings no testhost microsoft/vstest#16169
• Fix x86 testhost loading mismatched x64 hostfxr (0x800700C1) when run via vstest.console.exe directly (#​16151) by @​azat-msft in Fix x86 testhost loading mismatched x64 hostfxr (0x800700C1) when run via vstest.console.exe directly (#16151) microsoft/vstest#16156
• Preserve the real exception (type + stack trace) when a test run aborts in BaseRunTests by @​nohwnd in [fix] Preserve the real exception (type + stack trace) when a test run aborts in BaseRunTests microsoft/vstest#16167

New Contributors

• @​drewnoakes made their first contribution in Make TranslationLayer Native AOT-compatible microsoft/vstest#16045

Full Changelog: microsoft/vstest@v18.8.0...v18.9.0

Commits viewable in compare view.

Updated ModelContextProtocol from 2.1.0 to 2.2.0.

Release notes

Sourced from ModelContextProtocol's releases.

2.2.0

This release adds hybrid stateful/stateless HTTP serving so clients using the 2025-11-25 and 2026-07-28 protocol revisions can share an endpoint, and fixes a malformed header-decoding edge case.

What's Changed

• Add HttpServerSessionMode for hybrid stateful/stateless HTTP serving #​1796 by @​saicharanpardhu (co-authored by @​Copilot @​jeffhandley)
• Fix McpHeaderEncoder.DecodeValue throwing on the degenerate base64 wrapper #​1805 by @​latent-9

Test Improvements

• Fix duplicated word in test comment #​1809 by @​latent-9

Repository Infrastructure Updates

• Enable package validation for the MCP extension packages #​1793 by @​jeffhandley (co-authored by @​Copilot)
• Add a release-manager agent that orchestrates the release skills #​1794 by @​jeffhandley (co-authored by @​Copilot)
• Bump Anthropic from 12.39.0 to 12.40.0 #​1808
• Bump @​hono/node-server from 1.19.14 to 2.1.0 in the npm_and_yarn group across 1 directory #​1812
• Fix dead relative link to versioning docs in bump-version skill #​1807 by @​latent-9

Acknowledgements

• @​latent-9 made their first contribution in #​1807
• @​saicharanpardhu made their first contribution in #​1796
• @​saicharanpardhu submitted issue #​1777 (resolved by #​1796)
• @​jeffhandley @​tarekgh @​halter73 reviewed pull requests

Full Changelog: modelcontextprotocol/csharp-sdk@v2.1.0...v2.2.0

[!NOTE]
These release notes were drafted with GitHub Copilot and reviewed before publishing.

Commits viewable in compare view.

Updated ModelContextProtocol.AspNetCore from 2.1.0 to 2.2.0.

Updated System.Security.Cryptography.ProtectedData from 10.0.10 to 10.0.11.

Release notes

Sourced from System.Security.Cryptography.ProtectedData's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[erikdarlingdata]

Summary

Dependabot group bump of 7 NuGet packages targeting dev (correct base). CI is red — build and Darling PostgreSQL tests both fail restore, and the failure is caused by this PR, not the base branch.

What the PR does

• Directory.Packages.props: bumps Microsoft.Extensions.Hosting / Hosting.WindowsServices / Logging.Abstractions / System.Security.Cryptography.ProtectedData from 10.0.10 → 10.0.11, Microsoft.NET.Test.Sdk 18.8.1 → 18.9.0, ModelContextProtocol[.AspNetCore] 2.1.0 → 2.2.0.
• Adds <PackageReference Include="ModelContextProtocol" /> and <PackageReference Include="System.Security.Cryptography.ProtectedData" VersionOverride="10.0.11" /> to Darling/PerformanceMonitor.Darling.Analysis.
• Adds <PackageReference Include="System.Security.Cryptography.ProtectedData" VersionOverride="10.0.11" /> to PerformanceMonitor.PlanAnalysis.
• Updates 8 packages.lock.json files.
• The .csproj diffs look huge only because a CRLF/LF whitespace re-render dominates them — repo policy is * text=auto eol=crlf (.gitattributes:1) and both sides remain CRLF (git ls-files --eol reports i/crlf w/crlf on both files), so the real changes are only the added <PackageReference> lines. Not something you have to touch, but flagging so you don't chase it.

Blockers (CI red — caused by this diff)

1. Version skew in Directory.Packages.props breaks restore in Lite and deprecated/Dashboard. Hosting 10.0.11 transitively requires Microsoft.Extensions.Configuration, Configuration.Json, and Logging at >= 10.0.11, but those three sit at 10.0.10 — NU1605 downgrade. See inline on lines 17-22.
2. Stale packages.lock.json CentralTransitive entries for ModelContextProtocol ([2.1.0, ) vs central 2.2.0) and Microsoft.Extensions.* (10.0.10 vs 10.0.11 in Installer.Core's lock) fail NU1004 across Lite.Tests, Darling.Tests, Darling.Viewer, Installer.Core, Installer.Tests, Dashboard.Tests. See inline on line 24. dotnet restore --force-evaluate across the affected projects, or ·@·d·ependabot r·ecreate, should regenerate them.

Non-blocking

• VersionOverride="10.0.11" in both Darling.Analysis.csproj and PlanAnalysis.csproj matches the central pin exactly — the override does nothing and just adds a divergence point for the next bump. Drop the VersionOverride and let CPM resolve, or drop the reference entirely if the package flowed transitively before. Inline on each.
• The <PackageReference Include="ModelContextProtocol" /> added to Darling.Analysis.csproj is a real semantic change (transitive → direct). It's not wrong — PgDrillDownCollector.Plans.cs:103,188 uses McpHelpers.Truncate — but it isn't something dependabot should be deciding on its own during a version bump. Confirm intent.

Repo review focus (per CLAUDE.md)

• PlanAnalyzer.cs sync: N/A — no changes to either copy.
• Schema upgrade path: N/A — no SQL changes.
• Lite-first ordering: N/A — dependency bump.
• Base branch: dev — correct.
• SignPath/build.yml: unchanged — still test-signing.
• SQL / C#/WPF/Avalonia hygiene / test coverage: N/A — no logic changed.

Nothing on the maintainer-review checklist is red; the only reason not to merge is the failed restore, which is a real regression caused by this diff and needs the version-skew fix plus a lock-file regen.

---

Generated by Claude Code

[erikdarlingdata]

Version skew across the Microsoft.Extensions.* family — this is the root cause of the NU1605 failures in the build job.

Microsoft.Extensions.Hosting and Hosting.WindowsServices are bumped to 10.0.11 (lines 19-20), and Logging.Abstractions to 10.0.11 (line 22), but three siblings were left at 10.0.10:

• L17 Microsoft.Extensions.Configuration = 10.0.10
• L18 Microsoft.Extensions.Configuration.Json = 10.0.10
• L21 Microsoft.Extensions.Logging = 10.0.10

Hosting 10.0.11 transitively requires each of those >= 10.0.11, so both Lite/PerformanceMonitorLite.csproj and deprecated/Dashboard/Dashboard.csproj fail restore:

error NU1605: Detected package downgrade: Microsoft.Extensions.Logging from 10.0.11 to 10.0.10
  PerformanceMonitorLite -> Microsoft.Extensions.Hosting 10.0.11 -> Microsoft.Extensions.Logging (>= 10.0.11)
  PerformanceMonitorLite -> Microsoft.Extensions.Logging (>= 10.0.10)

Bump these three to 10.0.11 to move the family atomically — which is exactly the invariant the file's header comment (every consumer moves atomically … the multi-project misalignment class dependabot shipped in #2100 cannot recur) exists to enforce.

---

Generated by Claude Code

[erikdarlingdata]

Bumping ModelContextProtocol (and .AspNetCore on L25) to 2.2.0 without regenerating every packages.lock.json breaks locked-mode restore. The lock files still record the CentralTransitive at [2.1.0, ), so every project that consumes MCP transitively fails NU1004:

error NU1004: Mistmatch between the requestedVersion of a lock file dependency
  marked as CentralTransitive and the the version specified in the central
  package management file. Lock file version [2.1.0, ), central package
  management version [2.2.0, ).

This hits Lite.Tests, Darling.Tests, PerformanceMonitor.Darling.Viewer, deprecated/Dashboard.Tests, deprecated/Installer.Core, deprecated/Installer.Tests in the build job.

Same failure mode for the Microsoft.Extensions.* 10.0.10 → 10.0.11 bumps in Installer.Core's lock file. After fixing the version skew above, regenerate all locks with dotnet restore --force-evaluate (or ask dependabot to ·@·d·ependabot r·ecreate) so the diff picks up the sibling lock files this run missed.

---

Generated by Claude Code

[erikdarlingdata]

Two references added by dependabot, both worth confirming before merge:

1. L20 — <PackageReference Include="ModelContextProtocol" /> promotes this project from a transitive MCP consumer to a direct one. The code does use it (PgDrillDownCollector.Plans.cs:103,188 — McpHelpers.Truncate), so it isn't wrong, but it's a semantic change dependabot shouldn't be making on its own during a version bump; nothing in Analysis uses an MCP surface that wouldn't already flow via PerformanceMonitor.Common. Confirm this is intentional or drop it.

2. L21 — VersionOverride="10.0.11" matches the central pin at Directory.Packages.props:29 exactly, so it's a no-op that just adds a divergence point for the next bump to forget about. If Analysis needs this package as a direct reference, drop the override and let CPM resolve it (<PackageReference Include="System.Security.Cryptography.ProtectedData" />); if not, drop the reference entirely — it flows in transitively from Storage/Notifications today.

Same pattern in PerformanceMonitor.PlanAnalysis/PerformanceMonitor.PlanAnalysis.csproj:25.

---

Generated by Claude Code

[erikdarlingdata]

Same story as Darling.Analysis.csproj:21 — VersionOverride="10.0.11" duplicates the central pin at Directory.Packages.props:29, so the override does nothing except invite drift the next time either side moves.

If PlanAnalysis needs this dependency directly, keep the reference without the override (<PackageReference Include="System.Security.Cryptography.ProtectedData" />); if not, drop the whole line — the transitive graph via Microsoft.Data.SqlClient already provides it.

---

Generated by Claude Code

[erikdarlingdata]

Pushed a fix commit. Two separate failures were hiding behind the one red check:

NU1004 — the bump edited Directory.Packages.props but left nine packages.lock.json files describing the old CentralTransitive versions, so CI's locked-mode restore refused. Regenerated with --force-evaluate.

NU1605 — the group bumped Microsoft.Extensions.Hosting to 10.0.11 while leaving Configuration, Configuration.Json and Logging at 10.0.10. Hosting 10.0.11 requires >= 10.0.11 of all three, so central pinning resolved them down and the downgrade is an error in this repo. Those four move as a family — aligned at 10.0.11 rather than pinning Hosting back, since Hosting.WindowsServices and Logging.Abstractions were already there.

Verified locally before pushing: --force-evaluate then --locked-mode both clean (locked mode is what CI runs and what was failing), and all seven projects build.

[claude]

VersionOverride="10.0.11" here is redundant — Directory.Packages.props (edited in this same PR) already centrally pins System.Security.Cryptography.ProtectedData to 10.0.11, so the override resolves to the exact same version as the central management would provide anyway.

It also contradicts the policy documented right at the top of Directory.Packages.props:

A project that must diverge pins with VersionOverride at its own reference (only tools/CompactionRepro does, to keep reproducing against its original DuckDB).

Darling/PerformanceMonitor.Darling.Service/PerformanceMonitor.Darling.Service.csproj already references this same package with plain <PackageReference Include="System.Security.Cryptography.ProtectedData" /> (no override) — this project should match that pattern rather than adding a second exception to the "only CompactionRepro overrides" rule.

[claude]

Same issue as the Darling.Analysis.csproj change in this PR: VersionOverride="10.0.11" is redundant since Directory.Packages.props now centrally pins this package to 10.0.11, and it contradicts that file's own stated policy that only tools/CompactionRepro should use VersionOverride. Darling.Service.csproj references the same package without an override — worth being consistent with that instead of introducing a third override site.

[claude]

Review summary

This PR is a pure dependency-version-bump (Dependabot-style): it only touches packages.lock.json files, Directory.Packages.props, and two .csproj files. No T-SQL (install/), Lite, or Darling application source changed, so the T-SQL style guide, Lite/Darling functional parity, and SQL-injection/input-handling checks from the review brief don't really apply here — noted for completeness rather than skipped.

One thing worth a second look (left as inline comments):

• Darling/PerformanceMonitor.Darling.Analysis/PerformanceMonitor.Darling.Analysis.csproj and PerformanceMonitor.PlanAnalysis/PerformanceMonitor.PlanAnalysis.csproj both add a new <PackageReference Include="System.Security.Cryptography.ProtectedData" VersionOverride="10.0.11" />. That override is redundant (it matches the central version this same PR sets in Directory.Packages.props) and contradicts the policy documented in that file's own header comment, which says only tools/CompactionRepro should use VersionOverride. Darling.Service.csproj already references the same package without an override — these two should probably follow that pattern instead.

Everything else (the packages.lock.json regenerations and the plain version-string bumps in Directory.Packages.props) looks like a normal, mechanical dependency update.