Dependencies: Update NuGet packages to latest minor and patch versions (18)

[AndyButland]

Description

Routine dependency maintenance for the 18.1 release. Updates all NuGet packages that were behind to their latest available minor or patch version, as reported by dotnet-outdated. No major-version updates are included.

It also raises two transitive security pins to close known advisories (see Security below).

Production packages (Directory.Packages.props)

Package	From	To
Microsoft.Extensions.* (Caching.Abstractions, Caching.Memory, Configuration.Abstractions, Configuration.Json, DependencyInjection, FileProviders.Embedded, FileProviders.Physical, Hosting.Abstractions, Http, Identity.Core, Identity.Stores, Logging, Options, Options.ConfigurationExtensions, Options.DataAnnotations)	10.0.9	10.0.10
Microsoft.AspNetCore.OpenApi	10.0.9	10.0.10
Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation	10.0.9	10.0.10
Microsoft.Data.Sqlite	10.0.9	10.0.10
Microsoft.EntityFrameworkCore.Sqlite	10.0.9	10.0.10
Microsoft.EntityFrameworkCore.SqlServer	10.0.9	10.0.10
Microsoft.CodeAnalysis.CSharp	5.3.0	5.6.0
Microsoft.CodeAnalysis.CSharp.Workspaces	5.3.0	5.6.0
Microsoft.Extensions.Caching.Hybrid	10.7.0	10.8.0
MessagePack	3.1.7	3.1.8
OpenIddict.Abstractions / OpenIddict.AspNetCore / OpenIddict.EntityFrameworkCore	7.5.0	7.6.0
Serilog	4.3.1	4.4.0
Microsoft.OpenApi (security pin)	2.9.0	2.11.0
Nerdbank.GitVersioning (GlobalPackageReference)	3.10.85	3.10.91

Microsoft.CodeAnalysis.CSharp.Workspaces was raised to 5.6.0 alongside Microsoft.CodeAnalysis.CSharp — dotnet-outdated only bumped the latter, which produced an NU1107 conflict on Microsoft.CodeAnalysis.Common until the two were realigned.

Test packages (tests/Directory.Packages.props)

Package	From	To
Microsoft.AspNetCore.Mvc.Testing	10.0.9	10.0.10
Microsoft.Extensions.Logging.Debug	10.0.9	10.0.10
System.Data.Odbc / System.Data.OleDb	10.0.9	10.0.10
Microsoft.Extensions.TimeProvider.Testing	10.7.0	10.8.0
Microsoft.NET.Test.Sdk	18.7.0	18.8.1

Inline / template versions

• src/Umbraco.Web.UI/Umbraco.Web.UI.csproj: Microsoft.EntityFrameworkCore.Design 10.0.9 → 10.0.10, Microsoft.CodeAnalysis.CSharp.Workspaces / Microsoft.CodeAnalysis.Workspaces.MSBuild 5.3.0 → 5.6.0, Microsoft.OpenApi 2.9.0 → 2.11.0.
• templates/UmbracoExtension: Microsoft.AspNetCore.OpenApi 10.0.9 → 10.0.10 (kept in sync with the root file; this project is not part of umbraco.sln).

The central Microsoft.OpenApi pin was also aligned to 2.11.0 so CPM projects resolve the same floor as the inline Umbraco.Web.UI reference (both were already patched for CVE-2026-49451; this is consistency, not a fix).

Security

• System.Security.Cryptography.Xml transitive pin 10.0.9 → 10.0.10 (patched advisory).
• SQLitePCLRaw.lib.e_sqlite3 — the central pin to 2.1.12 (for GHSA-2m69-gcr7-jv3q, High severity) did not reach Umbraco.Web.UI, which opts out of central package management and resolved the vulnerable 2.1.11 transitively. Added an inline PackageReference to 2.1.12, mirroring the existing Microsoft.OpenApi inline pin. dotnet list package --vulnerable --include-transitive is now clean across the whole solution.

Deliberately left unchanged

• Any package where only a major update is available (out of scope for this PR).
• Intentionally-held packages carrying a HOLD/do not bump comment (e.g. Umbraco.Code).

Testing

Solution should build and CI checks pass.

[claude]

Claude finished @AndyButland's task in 2m 39s —— View job

---

PR Review

Target: origin/release/18.1 · Based on commit: 2045389c · Classified as: Config-only

Routine dependency maintenance updating NuGet packages to their latest minor/patch versions for 18.1, plus two targeted security pins for SQLitePCLRaw.lib.e_sqlite3 (GHSA-2m69-gcr7-jv3q) and System.Security.Cryptography.Xml.

---

Suggestions

• Directory.Packages.props:106: The Microsoft.OpenApi transitive security pin stays at 2.9.0 while Umbraco.Web.UI.csproj was bumped to 2.11.0. Both versions are patched for CVE-2026-49451/GHSA-v5pm-xwqc-g5wc, so there's no security gap, but CPM-managed projects and the opt-out project now resolve different versions of this library. Consider bumping the central pin to 2.11.0 for version consistency across the full solution.

---

Approved with Suggestions for improvement

Good to go, but please carefully consider the importance of the suggestions.

The security handling is solid — the SQLitePCLRaw pin in Umbraco.Web.UI.csproj correctly compensates for that project opting out of CPM, the Microsoft.CodeAnalysis.* realignment prevents the NU1107 conflict, and the explanatory comments on each security pin are clear and traceable. The comment reminder to update the template csproj was also followed correctly.

[Copilot]

Pull request overview

Routine dependency maintenance for the 18.1 release: bumps NuGet packages to latest minor/patch versions and updates a couple of transitive security pins, keeping versions aligned across centrally-managed packages, tests, and relevant non-CPM projects/templates.

Changes:

• Updated centrally-managed package versions (Microsoft.* patch rollups, Roslyn 5.6.0 alignment, OpenIddict 7.6.0, Serilog 4.4.0, MessagePack 3.1.8, Nerdbank.GitVersioning 3.10.91).
• Updated test-only package versions (Microsoft.AspNetCore.Mvc.Testing, test SDK, ODBC/OleDb, TimeProvider.Testing).
• Updated non-CPM and template pinning where needed (Umbraco.Web.UI inline pins; UmbracoExtension template OpenApi version sync).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Directory.Packages.props	Bumps centrally-managed production package versions and updates security pins.
tests/Directory.Packages.props	Bumps centrally-managed test package versions.
src/Umbraco.Web.UI/Umbraco.Web.UI.csproj	Updates inline package references for the non-CPM web project (EF design-time + Roslyn alignment, Microsoft.OpenApi bump, SQLitePCLRaw security pin).
templates/UmbracoExtension/Directory.Packages.props	Keeps template CPM package versions aligned with the repo (OpenApi patch bump).
templates/UmbracoExtension/Umbraco.Extension.csproj	Keeps the template’s explicit OpenApi reference aligned with the updated patch version.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud