Dependencies: Update NuGet packages to latest minor and patch versions (17)

[AndyButland]

Description

Routine dependency maintenance for the 17.6 release. Updates all NuGet packages that were behind to their latest available minor or patch version, as reported by dotnet-outdated. No major-version updates are included.

It also raises two transitive security pins to close known advisories (see Security below).

Production packages (Directory.Packages.props)

Package	From	To
Microsoft.Extensions.* (Caching.Abstractions, Caching.Memory, Configuration.Abstractions, Configuration.Json, DependencyInjection, FileProviders.Embedded, FileProviders.Physical, Hosting.Abstractions, Http, Identity.Core, Identity.Stores, Logging, Options, Options.ConfigurationExtensions, Options.DataAnnotations)	10.0.9	10.0.10
Microsoft.Data.Sqlite	10.0.9	10.0.10
Microsoft.EntityFrameworkCore.Sqlite	10.0.9	10.0.10
Microsoft.EntityFrameworkCore.SqlServer	10.0.9	10.0.10
Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation	10.0.9	10.0.10
Microsoft.Extensions.Caching.Hybrid	10.7.0	10.8.0
MessagePack	3.1.7	3.1.8
OpenIddict.Abstractions / OpenIddict.AspNetCore / OpenIddict.EntityFrameworkCore	7.5.0	7.6.0
Serilog	4.3.1	4.4.0
Nerdbank.GitVersioning (GlobalPackageReference)	3.10.85	3.10.91

Test packages (tests/Directory.Packages.props)

Package	From	To
Microsoft.AspNetCore.Mvc.Testing	10.0.9	10.0.10
Microsoft.Extensions.Logging.Debug	10.0.9	10.0.10
System.Data.Odbc / System.Data.OleDb	10.0.9	10.0.10
Microsoft.Extensions.TimeProvider.Testing	10.7.0	10.8.0
Microsoft.NET.Test.Sdk	18.7.0	18.8.1

Inline versions

• src/Umbraco.Web.UI/Umbraco.Web.UI.csproj: Microsoft.EntityFrameworkCore.Design 10.0.9 → 10.0.10.

Security

• System.Security.Cryptography.Xml transitive pin 10.0.9 → 10.0.10 (patched advisory).
• SQLitePCLRaw.lib.e_sqlite3 — the central pin to 2.1.12 (for GHSA-2m69-gcr7-jv3q, High severity) did not reach Umbraco.Web.UI, which opts out of central package management and resolved the vulnerable 2.1.11 transitively. Added an inline PackageReference to 2.1.12, mirroring the existing Microsoft.OpenApi inline pin. dotnet list package --vulnerable --include-transitive is now clean across the whole solution.

Deliberately left unchanged

• Microsoft.OpenApi — held at 2.9.0 (2.11.0 update kept back), now with a documented HOLD comment. dotnet-outdated offered 2.9.0 → 2.11.0, but 2.10.0+ reworked how nullable schemas serialize in OpenAPI 3.0 mode — type-less nullable schemas emit "enum": [null] (constraining values to null) instead of "nullable": true, and nullable oneOf $refs (e.g. media focalPoint/coordinates) drop "nullable": true entirely. The Delivery API on this line generates OpenAPI 3.0 (via Swashbuckle), so this diverges from the committed contract (OpenApiContractTest) and misleads client generation. It's a deliberate upstream 3.0.3 spec-compliance change tracked at microsoft/OpenAPI.NET#2967, with no fixed 2.x release yet. 2.9.0 is itself already patched for CVE-2026-49451, so holding introduces no vulnerability. A HOLD/do-not-bump comment (referencing Add Multi Url Picker to core #2967) has been added to the pin in Directory.Packages.props and Umbraco.Web.UI.csproj so the routine update process skips it. (The 18.x line is unaffected: it generates OpenAPI 3.1 via Microsoft.AspNetCore.OpenApi, which doesn't exercise the changed 3.0 path.)
• Any package where only a major update is available (out of scope for this PR).
• Intentionally-held packages carrying a HOLD/do not bump comment (e.g. Umbraco.Code).

Testing

Solution should build and CI checks pass.

[claude]

Claude finished @AndyButland's task in 2m 21s —— View job

---

PR Review

Target: origin/release/17.6 · Based on commit: e857e93e · Classified as: Config-only

Routine minor/patch NuGet dependency maintenance for 17.6, including two transitive security pins (System.Security.Cryptography.Xml 10.0.9→10.0.10, SQLitePCLRaw.lib.e_sqlite3 2.1.11→2.1.12 inline for Umbraco.Web.UI) to clear known advisories.

---

Suggestions

• Directory.Packages.props:103: The Microsoft.OpenApi central pin remains at 2.9.0 while Umbraco.Web.UI.csproj was bumped inline to 2.11.0. There is no security gap — both are patched for CVE-2026-49451/GHSA-v5pm-xwqc-g5wc — but CPM projects will resolve a different (older) floor than Umbraco.Web.UI. Worth bumping the central pin to 2.11.0 for consistency. Fix this →

---

Approved with Suggestions for improvement

Good to go, but please carefully consider the importance of the suggestions.

[Copilot]

Pull request overview

Routine dependency maintenance for the 17.6 release: updates centrally-managed (and test) NuGet package versions to latest minor/patch levels, and adds/updates explicit pins to ensure vulnerable transitives are resolved to patched versions (including for Umbraco.Web.UI, which opts out of central package management).

Changes:

• Bump central package versions in Directory.Packages.props (Microsoft.Extensions.*, EF Core, OpenIddict, Serilog, MessagePack, Nerdbank.GitVersioning, etc.).
• Update test package versions in tests/Directory.Packages.props (Microsoft.AspNetCore.Mvc.Testing, Microsoft.NET.Test.Sdk, System.Data.*).
• Update Umbraco.Web.UI inline package references for security/patching (Microsoft.EntityFrameworkCore.Design, Microsoft.OpenApi, and add SQLitePCLRaw.lib.e_sqlite3).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
Directory.Packages.props	Central version bumps + security transitive pin update for System.Security.Cryptography.Xml (and other package minor/patch updates).
tests/Directory.Packages.props	Updates centrally-managed test dependency versions to align with the 10.0.10/10.8.0 wave and newer test SDK.
src/Umbraco.Web.UI/Umbraco.Web.UI.csproj	Updates inline package versions for the non-CPM project and adds an explicit SQLite native lib reference to ensure the patched version is used.

[AndyButland]

I see this one has triggered a failing integration test - will review to see if we either fix the test or rollback one of the upgrades (and bring it in again, with fixed tests, for the next minor).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud