Bump FluentAssertions and 25 others

src/Directory.Packages.props

@@ -8,39 +8,40 @@
     <PackageVersion Include="CommandLineParser" Version="2.9.1" />
     <PackageVersion Include="coverlet.collector" Version="3.2.0" />
     <PackageVersion Include="CsvHelper" Version="33.1.0" />
-    <PackageVersion Include="FluentAssertions" Version="6.12.0" />
-    <PackageVersion Include="JsonSchema.Net" Version="9.2.1" />
-    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.2" />
+    <PackageVersion Include="FluentAssertions" Version="6.12.2" />
+    <PackageVersion Include="JsonSchema.Net" Version="9.2.2" />
+    <PackageVersion Include="Microsoft.Bcl.HashCode" Version="6.0.0" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.3" />
     <PackageVersion Include="Microsoft.Diagnostics.Tracing.EventRegister" Version="1.1.28" />
-    <PackageVersion Include="Microsoft.Diagnostics.Tracing.TraceEvent" Version="3.1.3" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="3.1.2" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="3.1.2" />
-    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="3.1.9" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="3.1.2" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.ApplicationInsights" Version="2.20.0" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="3.1.2" />
-    <PackageVersion Include="Microsoft.Json.Pointer" Version="2.1.0" />
-    <PackageVersion Include="Microsoft.Json.Schema" Version="2.1.0" />
-    <PackageVersion Include="Microsoft.Json.Schema.Validation" Version="2.1.0" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.4.1" />
+    <PackageVersion Include="Microsoft.Diagnostics.Tracing.TraceEvent" Version="3.2.4" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="3.1.32" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="3.1.32" />
+    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="3.1.32" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="3.1.32" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.ApplicationInsights" Version="2.23.0" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="3.1.32" />
+    <PackageVersion Include="Microsoft.Json.Pointer" Version="2.3.0" />
+    <PackageVersion Include="Microsoft.Json.Schema" Version="2.3.0" />
+    <PackageVersion Include="Microsoft.Json.Schema.Validation" Version="2.3.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="1.1.1" />
-    <PackageVersion Include="Microsoft.TeamFoundationServer.Client" Version="16.170.0" />
-    <PackageVersion Include="Moq" Version="4.18.4" />
-    <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageVersion Include="System.Collections.Immutable" Version="5.0.0" />
-    <PackageVersion Include="System.Composition" Version="5.0.0" />
-    <PackageVersion Include="System.Data.SqlClient" Version="4.8.6" />
+    <PackageVersion Include="Microsoft.TeamFoundationServer.Client" Version="16.205.3" />
+    <PackageVersion Include="Moq" Version="4.20.72" />
+    <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
+    <PackageVersion Include="System.Collections.Immutable" Version="9.0.8" />
+    <PackageVersion Include="System.Composition" Version="5.0.1" />
+    <PackageVersion Include="System.Data.SqlClient" Version="4.9.1" />
     <PackageVersion Include="System.Diagnostics.Debug" Version="4.3.0" />
     <PackageVersion Include="System.IO.Compression" Version="4.3.0" />
     <PackageVersion Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
     <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
-    <PackageVersion Include="System.Text.Encoding.CodePages" Version="4.3.0" />
+    <PackageVersion Include="System.Text.Encoding.CodePages" Version="6.0.1" />
     <PackageVersion Include="System.Text.Encoding.Extensions" Version="4.3.0" />
-    <PackageVersion Include="System.Text.Encodings.Web" Version="6.0.0" />
+    <PackageVersion Include="System.Text.Encodings.Web" Version="6.0.1" />
     <PackageVersion Include="System.Threading.Channels" Version="5.0.0" />
-    <PackageVersion Include="xunit" Version="2.4.2" />
-    <PackageVersion Include="xunit.runner.console" Version="2.4.2" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="2.4.5" />
-    <PackageVersion Include="YamlDotNet" Version="11.2.0" />
+    <PackageVersion Include="xunit" Version="2.9.3" />
+    <PackageVersion Include="xunit.runner.console" Version="2.9.3" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageVersion Include="YamlDotNet" Version="11.2.1" />
   </ItemGroup>
 </Project>

src/Test.UnitTests.Sarif.Converters/CppCheckErrorTests.cs

@@ -86,7 +86,7 @@ public void CppCheckError_ErrorWithMultipleLocationsFillsOutCodeFlow()
                     }
                 }, Location.ValueComparer).Should().BeTrue();
 
-            Assert.Equal(1, result.CodeFlows.Count);
+            Assert.Single(result.CodeFlows);
             result.CodeFlows.First().ThreadFlows.First().Locations.SequenceEqual(new[]
                 {
                     new ThreadFlowLocation {

src/Test.UnitTests.Sarif.Converters/FortifyConverterTests.cs

@@ -196,7 +196,7 @@ public void FortifyConverter_Convert_UsesPrimaryAsMainLocation()
             Builder builder = FortifyConverterTests.GetBasicBuilder();
             builder.Source = FortifyConverterTests.s_dummyPathSourceElement;
             Result result = FortifyConverter.ConvertFortifyIssueToSarifIssue(builder.ToImmutable());
-            Assert.Equal(1, result.Locations.Count);
+            Assert.Single(result.Locations);
             Assert.Equal("filePath", result.Locations.First().PhysicalLocation.ArtifactLocation.Uri.ToString());
             Assert.True(result.Locations.First().PhysicalLocation.Region.ValueEquals(new Region { StartLine = 1729 }));
         }
@@ -214,7 +214,7 @@ public void FortifyConverter_Convert_FillsInCodeFlowWhenSourceIsPresent()
             Builder builder = FortifyConverterTests.GetBasicBuilder();
             builder.Source = FortifyConverterTests.s_dummyPathSourceElement;
             Result result = FortifyConverter.ConvertFortifyIssueToSarifIssue(builder.ToImmutable());
-            Assert.Equal(1, result.CodeFlows.Count);
+            Assert.Single(result.CodeFlows);
             IList<ThreadFlowLocation> flowLocations = result.CodeFlows.First().ThreadFlows.First().Locations;
             Assert.Equal("sourceFilePath", flowLocations[0].Location.PhysicalLocation.ArtifactLocation.Uri.ToString());
             Assert.True(flowLocations[0].Location.PhysicalLocation.Region.ValueEquals(new Region { StartLine = 42 }));

src/Test.UnitTests.Sarif.Multitool.Library/GenericCommandTests.cs

@@ -45,7 +45,7 @@ private void CheckTypeForDuplicateArgumentNames(Type type)
                         {
                             if (parameters.ContainsKey(result.ShortName))
                             {
-                                Assert.True(false, $"{type.Name} has a conflict for {result.ShortName} between {result.LongName} and {parameters[result.ShortName].LongName}.");
+                                Assert.Fail($"{type.Name} has a conflict for {result.ShortName} between {result.LongName} and {parameters[result.ShortName].LongName}.");
                             }
 
                             parameters[result.ShortName] = result;

src/Test.UnitTests.Sarif/Core/SarifLogTests.cs

@@ -413,7 +413,7 @@ await SarifLog.Post(postUri,
             }
             catch (Exception ex)
             {
-                Assert.True(false, $"Unhandled exception: {ex}");
+                Assert.Fail($"Unhandled exception: {ex}");
             }
         }
 
@@ -444,7 +444,7 @@ await SarifLog.Post(postUri,
             }
             catch (Exception ex)
             {
-                Assert.True(false, $"Unhandled exception: {ex}");
+                Assert.Fail($"Unhandled exception: {ex}");
             }
             httpMock.Clear();
         }

src/Test.UnitTests.Sarif/HashUtilitiesTests.cs

@@ -47,7 +47,7 @@ public void HashUtilities_ShouldRespectQuietFlag()
                     if (File.Exists(filePath)) { File.Delete(filePath); }
                 }
 
-                Assert.True(false, e.Message);
+                Assert.Fail(e.Message);
             }
 
             //  An custom textwriter.S
@@ -67,7 +67,7 @@ public void HashUtilities_ShouldRespectQuietFlag()
                 }
                 Console.SetOut(defaultOut);
 
-                Assert.True(false, "Exception was expected but not thrown");
+                Assert.Fail("Exception was expected but not thrown");
             }
             catch (InvalidOperationException)
             {
@@ -81,7 +81,7 @@ public void HashUtilities_ShouldRespectQuietFlag()
             }
             catch
             {
-                Assert.True(false, "Unexpected exception.");
+                Assert.Fail("Unexpected exception.");
             }
             finally
             {

src/Test.UnitTests.Sarif/Writers/SarifConsolidatorTests.cs

@@ -191,7 +191,7 @@ public void SarifConsolidator_Locations()
             };
 
             IList<Location> result = consolidator.Trim(locations);
-            Assert.Equal(1, result.Count);
+            Assert.Single(result);
             Assert.Null(result[0].PhysicalLocation.ArtifactLocation.UriBaseId);
             Assert.Equal(-1, result[0].PhysicalLocation.Region.CharOffset);
         }
@@ -209,7 +209,7 @@ public void SarifConsolidator_LogicalLocations()
             };
 
             IList<LogicalLocation> result = consolidator.Trim(locations);
-            Assert.Equal(1, result.Count);
+            Assert.Single(result);
             Assert.Null(result[0].Name);
         }
 

src/Test.UnitTests.Sarif/Writers/SarifLoggerTests.cs

@@ -166,7 +166,7 @@ public void SarifLogger_RedactedCommandLine()
                 }
                 else
                 {
-                    Assert.False(true, pathToExe + " " + commandLine);
+                    Assert.Fail(pathToExe + " " + commandLine);
                 }
 
                 using (_ = new SarifLogger(textWriter,
@@ -1052,7 +1052,7 @@ private void TestForLoggingOption(FilePersistenceOptions loggingOption)
             }
             catch (Exception e)
             {
-                Assert.True(false, e.ToString());
+                Assert.Fail(e.ToString());
             }
             finally
             {
@@ -1452,7 +1452,7 @@ public void SarifLogger_AnalyzingTarget_PersistsMultipleTargets()
         // 'InvalidOperationException: Collection was modified' inside
         // JsonSerializerInternalWriter.SerializeDictionary on .NET Framework.
         [Fact]
-        public void SarifLogger_DisposeIsThreadSafeWhenSarifRewritingVisitorRunsConcurrently()
+        public async Task SarifLogger_DisposeIsThreadSafeWhenSarifRewritingVisitorRunsConcurrently()
         {
             const int iterations = 50;
             const int ruleCount = 64;
@@ -1534,7 +1534,7 @@ public void SarifLogger_DisposeIsThreadSafeWhenSarifRewritingVisitorRunsConcurre
                 }
 
                 stop.Cancel();
-                Task.WaitAll(mutatorTasks);
+                await Task.WhenAll(mutatorTasks);
                 yieldingWriter.Dispose();
 
                 if (caughtExceptions.Count > 0) { break; }

src/Test.UnitTests.WorkItems/Test.UnitTests.WorkItems.csproj

@@ -17,9 +17,11 @@
 
   <ItemGroup>
     <PackageReference Include="FluentAssertions" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="Moq" />
     <PackageReference Include="System.Composition" />
+    <PackageReference Include="System.Text.Encodings.Web" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.console" PrivateAssets="All" />
     <PackageReference Include="xunit.runner.visualstudio" PrivateAssets="All" />

src/WorkItems/ServiceProviderFactory.cs

@@ -50,7 +50,10 @@ public static void Initialize(ILogger customLogger)
                     {
                         if (!string.IsNullOrEmpty(config[LoggingApplicationInsightsInstrumentationKey]))
                         {
-                            builder.AddApplicationInsights(config[LoggingApplicationInsightsInstrumentationKey], options => options.FlushOnDispose = true);
+                            string instrumentationKey = config[LoggingApplicationInsightsInstrumentationKey];
+                            builder.AddApplicationInsights(
+                                telemetry => telemetry.ConnectionString = $"InstrumentationKey={instrumentationKey}",
+                                options => options.FlushOnDispose = true);
                         }
                     }
 

src/WorkItems/WorkItems.csproj

@@ -22,6 +22,9 @@
     <TargetFrameworks>netstandard2.0</TargetFrameworks>
     <!-- We require 461 as a minimal framework due to dependency such as Microsoft.Extensions.Logging.Console -->
     <TargetFrameworks Condition="$(OS) == 'Windows_NT'">$(TargetFrameworks);net461</TargetFrameworks>
+    <!-- System.Data.SqlClient ships only as a transitive security pin here (no direct use); its
+         newer releases drop net461 from their support matrix but still run on it. -->
+    <SuppressTfmSupportBuildWarnings>true</SuppressTfmSupportBuildWarnings>
   </PropertyGroup>
 
   <ItemGroup>
@@ -37,7 +40,9 @@
     <PackageReference Include="Microsoft.Json.Schema.Validation" />
     <PackageReference Include="Microsoft.TeamFoundationServer.Client" />
     <PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="All" />
+    <PackageReference Include="System.Collections.Immutable" VersionOverride="1.7.1" />
     <PackageReference Include="System.Data.SqlClient" />
+    <PackageReference Include="System.Text.Encoding.CodePages" />
     <PackageReference Include="System.Text.Encodings.Web" />
     <PackageReference Include="Newtonsoft.Json" />
   </ItemGroup>

src/build.props

@@ -104,6 +104,14 @@
     <Compile Include="$(MsBuildThisFileDirectory)Shared\CommonAssemblyInfo.cs" />
   </ItemGroup>
 
+  <!-- On .NET Framework a transitive dependency declares a Microsoft.Bcl.HashCode >= 6.0.0
+       requirement that NuGet resolves down to 1.1.1, leaving an unresolvable 6.0.0.0 reference
+       identity that surfaces as MSB3277 (fatal under warnings-as-errors). An explicit reference
+       pins a single, unambiguous version across the closure. -->
+  <ItemGroup Condition=" '$(TargetFrameworkIdentifier)' == '.NETFramework' ">
+    <PackageReference Include="Microsoft.Bcl.HashCode" />
+  </ItemGroup>
+
   <PropertyGroup Condition=" '$(Configuration)' == 'Release' ">
     <ContinuousIntegrationBuild>true</ContinuousIntegrationBuild>
     <Deterministic>true</Deterministic>