Dependencies: Update NuGet packages to latest minor and patch versions (v17)

[AndyButland]

Prerequisites

• I have added steps to test this contribution in the description below

Description

Routine dependency maintenance for the 17.7 release line. Updates all NuGet packages that were behind to their latest available minor or patch version, as reported by dotnet-outdated. No major-version updates are included.

Production packages (Directory.Packages.props)

Package	From	To
Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation	10.0.10	10.0.11
Microsoft.Data.Sqlite	10.0.10	10.0.11
Microsoft.EntityFrameworkCore.Sqlite	10.0.10	10.0.11
Microsoft.EntityFrameworkCore.SqlServer	10.0.10	10.0.11
Microsoft.Extensions.Caching.Abstractions	10.0.10	10.0.11
Microsoft.Extensions.Caching.Memory	10.0.10	10.0.11
Microsoft.Extensions.Configuration.Abstractions	10.0.10	10.0.11
Microsoft.Extensions.Configuration.Json	10.0.10	10.0.11
Microsoft.Extensions.DependencyInjection	10.0.10	10.0.11
Microsoft.Extensions.FileProviders.Embedded	10.0.10	10.0.11
Microsoft.Extensions.FileProviders.Physical	10.0.10	10.0.11
Microsoft.Extensions.Hosting.Abstractions	10.0.10	10.0.11
Microsoft.Extensions.Http	10.0.10	10.0.11
Microsoft.Extensions.Identity.Core	10.0.10	10.0.11
Microsoft.Extensions.Identity.Stores	10.0.10	10.0.11
Microsoft.Extensions.Logging	10.0.10	10.0.11
Microsoft.Extensions.Options	10.0.10	10.0.11
Microsoft.Extensions.Options.ConfigurationExtensions	10.0.10	10.0.11
Microsoft.Extensions.Options.DataAnnotations	10.0.10	10.0.11
Microsoft.Extensions.Caching.Hybrid	10.8.0	10.9.0

Test packages (tests/Directory.Packages.props)

Package	From	To
Microsoft.AspNetCore.Mvc.Testing	10.0.10	10.0.11
Microsoft.Extensions.Logging.Debug	10.0.10	10.0.11
Microsoft.Extensions.TimeProvider.Testing	10.8.0	10.9.0
Microsoft.NET.Test.Sdk	18.8.1	18.9.0
System.Data.Odbc	10.0.10	10.0.11
System.Data.OleDb	10.0.10	10.0.11

Inline / template versions

• src/Umbraco.Web.UI/Umbraco.Web.UI.csproj: Microsoft.EntityFrameworkCore.Design 10.0.10 → 10.0.11; SQLitePCLRaw.lib.e_sqlite3 security pin raised 2.1.12 → 2.1.13 (patch release of the forward pin, GHSA-2m69-gcr7-jv3q).
• templates/UmbracoExtension: no change needed — the only versioned package there (Swashbuckle.AspNetCore) was not bumped in the root file.

Deliberately left unchanged

• Any package where only a major update is available (out of scope for this PR).
• Microsoft.OpenApi, held at 2.9.0 per the HOLD comment in Directory.Packages.props (2.10.0+ regresses OpenAPI 3.0 nullability serialization).

How to test

CI build and unit test suite should pass. Locally: dotnet build umbraco.sln -c Release -p:UmbracoBuild=true and dotnet test tests/Umbraco.Tests.UnitTests/Umbraco.Tests.UnitTests.csproj -c Release -p:UmbracoBuild=true --no-build both succeeded (6209 passed, 0 failed). dotnet list umbraco.sln package --vulnerable --include-transitive reports no vulnerable packages.

---

Generated by Claude Code

[claude]

Claude finished @AndyButland's task in 2m 26s —— View job

---

PR Review

Target: origin/v17/dev · Based on commit: 15b6719d · Classified as: Config-only

Routine minor/patch dependency bump for the 17.7 release line — 26 NuGet packages updated, Microsoft.OpenApi correctly held at 2.9.0 per the existing HOLD comment, and the SQLitePCLRaw.lib.e_sqlite3 security pin updated in Umbraco.Web.UI.csproj.

• Breaking changes: None — minor/patch version bumps to packages already in use.

---

Suggestions

• Directory.Packages.props:118: Central SQLitePCLRaw.lib.e_sqlite3 pin remains at 2.1.12 while Umbraco.Web.UI.csproj was bumped to 2.1.13 in this same PR. The comment below the pin still reads "patched 2.1.12". Since Umbraco.Web.UI opts out of central package management and controls its pin independently, the security floor for other projects is still 2.1.12; 2.1.12 was already the CVE-patched version for GHSA-2m69-gcr7-jv3q so there is no security regression. However, bumping the central pin to 2.1.13 (and updating the comment) would keep both locations in sync and avoid the impression that the two are diverging.

• Directory.Packages.props:97: System.Security.Cryptography.Xml is at 10.0.10 while every other Microsoft.10.0.x package in this file moved to 10.0.11. This is a transitive security pin (GHSA-37gx-xxp4-5rgx, GHSA-w3x6-4m5h-cxqf) — 10.0.10 was already the patched version so there is no security exposure, but leaving it one step behind the rest of the Microsoft packages may cause confusion the next time the file is reviewed. Worth bumping to 10.0.11 if dotnet-outdated is re-run.

---

Approved with Suggestions for improvement

Good to go, but please carefully consider the importance of the suggestions.

[Copilot]

Pull request overview

Updates centrally-managed NuGet package versions (and a couple of project-level pins) for the Umbraco CMS v17.7 maintenance line to the latest available minor/patch releases.

Changes:

• Bumped .NET 10 patch versions for several Microsoft.* packages in the root Directory.Packages.props.
• Updated test package versions in tests/Directory.Packages.props.
• Updated Umbraco.Web.UI project-level package references for EF Core design-time tooling and a SQLite native library forward-pin.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
Directory.Packages.props	Updates centrally managed Microsoft package versions (incl. HybridCache) for production projects.
tests/Directory.Packages.props	Updates centrally managed package versions used by test projects.
src/Umbraco.Web.UI/Umbraco.Web.UI.csproj	Updates project-level package references (EF Core design-time + SQLite native forward pin) for the Web UI project.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[claude]

Review Summary

This is a clean, well-scoped routine dependency maintenance PR. Everything looks correct.

What was checked:

• All 20 production packages bumped from 10.0.10 → 10.0.11 (patch only). ✅
• Microsoft.Extensions.Caching.Hybrid and related test packages (Microsoft.Extensions.TimeProvider.Testing) bumped 10.8.0 → 10.9.0 (minor within the same major). ✅
• Microsoft.NET.Test.Sdk 18.8.1 → 18.9.0 (minor). ✅
• SQLitePCLRaw.lib.e_sqlite3 2.1.12 → 2.1.13 — correctly forward-pinned security fix for GHSA-2m69-gcr7-jv3q. ✅
• Microsoft.EntityFrameworkCore.Design inline version in .csproj updated to match (justified because it carries PrivateAssets="all" and is a build-time-only reference). ✅
• Microsoft.OpenApi correctly left at 2.9.0 per the existing HOLD comment. ✅
• No major-version updates included. ✅
• PR description confirms zero vulnerable packages remaining after the update. ✅

No issues found. This is ready to merge.

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud