From a88e465fcd62d6a956ddae68ac27921e3c0270fe Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 04:21:54 +0000
Subject: [PATCH] Bump Aspire.Hosting.AppHost and 38 others

Bumps Aspire.Hosting.AppHost from 13.5.3 to 13.6.4
Bumps Aspire.Hosting.SqlServer from 13.5.3 to 13.6.4
Bumps Aspire.Microsoft.EntityFrameworkCore.SqlServer from 13.5.3 to 13.6.4
Bumps AWSSDK.S3 from 4.0.102.4 to 4.0.104.6
Bumps HotChocolate.AspNetCore from 16.6.2 to 16.7.1
Bumps HotChocolate.AspNetCore.CommandLine from 16.6.2 to 16.7.1
Bumps HotChocolate.Diagnostics from 16.6.2 to 16.7.1
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.11 to 10.0.14
Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.11 to 10.0.14
Bumps Microsoft.AspNetCore.SignalR.Client from 10.0.11 to 10.0.14
Bumps Microsoft.AspNetCore.SignalR.Protocols.MessagePack from 10.0.11 to 10.0.14
Bumps Microsoft.Data.SqlClient to 7.1.1
Bumps Microsoft.EntityFrameworkCore from 10.0.11 to 10.0.14
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.11 to 10.0.14
Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.11 to 10.0.14
Bumps Microsoft.EntityFrameworkCore.SqlServer from 10.0.11 to 10.0.14
Bumps Microsoft.Extensions.AI.Abstractions to 10.11.0
Bumps Microsoft.Extensions.AI.OpenAI from 10.9.0 to 10.11.0
Bumps Microsoft.Extensions.Configuration from 10.0.11 to 10.0.14
Bumps Microsoft.Extensions.Configuration.Binder from 10.0.11 to 10.0.14
Bumps Microsoft.Extensions.DependencyInjection from 10.0.11 to 10.0.14
Bumps Microsoft.Extensions.Diagnostics.Testing from 10.9.0 to 10.11.0
Bumps Microsoft.Extensions.Http.Resilience from 10.9.0 to 10.11.0
Bumps Microsoft.Extensions.Options from 10.0.11 to 10.0.14
Bumps Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.11 to 10.0.14
Bumps Microsoft.Extensions.Options.DataAnnotations from 10.0.11 to 10.0.14
Bumps Microsoft.Extensions.ServiceDiscovery from 10.9.0 to 10.11.0
Bumps Microsoft.Extensions.TimeProvider.Testing from 10.9.0 to 10.11.0
Bumps Microsoft.FeatureManagement.AspNetCore from 4.7.0 to 4.8.0
Bumps Microsoft.NET.Test.Sdk from 18.9.0 to 18.11.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.18.0 to 1.20.1
Bumps OpenTelemetry.Extensions.Hosting from 1.18.0 to 1.20.1
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.18.0 to 1.20.1
Bumps OpenTelemetry.Instrumentation.Http from 1.18.0 to 1.20.1
Bumps OpenTelemetry.Instrumentation.Runtime from 1.18.0 to 1.20.1
Bumps SixLabors.ImageSharp from 3.1.12 to 3.2.0
Bumps System.Security.Cryptography.Xml from 10.0.11 to 10.0.14
Bumps Testcontainers.MsSql from 4.14.0 to 4.16.0
Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1

---
updated-dependencies:
- dependency-name: Aspire.Hosting.AppHost
  dependency-version: 13.6.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Aspire.Hosting.SqlServer
  dependency-version: 13.6.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Aspire.Microsoft.EntityFrameworkCore.SqlServer
  dependency-version: 13.6.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: AWSSDK.S3
  dependency-version: 4.0.104.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: HotChocolate.AspNetCore
  dependency-version: 16.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: HotChocolate.AspNetCore.CommandLine
  dependency-version: 16.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: HotChocolate.Diagnostics
  dependency-version: 16.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.SignalR.Client
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.AspNetCore.SignalR.Protocols.MessagePack
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Data.SqlClient
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Data.SqlClient
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.EntityFrameworkCore
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.EntityFrameworkCore.Design
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.EntityFrameworkCore.SqlServer
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.AI.Abstractions
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.AI.Abstractions
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.AI.OpenAI
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Configuration
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Configuration
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Configuration
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Configuration.Binder
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Configuration.Binder
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Configuration.Binder
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.DependencyInjection
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.DependencyInjection
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Diagnostics.Testing
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Options
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Options
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Options
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Options.ConfigurationExtensions
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Options.ConfigurationExtensions
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.Options.DataAnnotations
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.ServiceDiscovery
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.Extensions.TimeProvider.Testing
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.FeatureManagement.AspNetCore
  dependency-version: 4.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: SixLabors.ImageSharp
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: System.Security.Cryptography.Xml
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
- dependency-name: Testcontainers.MsSql
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Directory.Packages.props                      | 78 +++++++++----------
 .../RocketWiki.AppHost.csproj                 |  7 ++
 .../RocketWiki.Storage.csproj                 |  3 +
 .../RocketWiki.Core.Tests.csproj              |  5 ++
 4 files changed, 54 insertions(+), 39 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 58d740e..c5f5ed1 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -34,20 +34,20 @@
        inside this family is what produces the NU1605 downgrade errors that stopped
        RocketWiki.Storage.Tests building at 10.0.0. -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Protocols.MessagePack" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Protocols.MessagePack" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.14" />
+    <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.14" />
   </ItemGroup>
 
   <!-- Security bumps over transitively-resolved versions. Both are direct references
@@ -63,18 +63,18 @@
     <!-- Microsoft.Data.SqlClient (via EFCore.SqlServer) pulls in a transitive
          System.Security.Cryptography.Xml 9.0.0, which NU1903 flags for several known
          high-severity advisories. Pinned to a patched version. -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.11" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.14" />
   </ItemGroup>
 
   <!-- Aspire. The AppHost's SDK version (Aspire.AppHost.Sdk in its Sdk attribute) is
        NOT a package reference and is not managed here — keep the two in step by hand
        when upgrading. -->
   <ItemGroup>
-    <PackageVersion Include="Aspire.Hosting.AppHost" Version="13.5.3" />
-    <PackageVersion Include="Aspire.Hosting.SqlServer" Version="13.5.3" />
-    <PackageVersion Include="Aspire.Microsoft.EntityFrameworkCore.SqlServer" Version="13.5.3" />
-    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.9.0" />
-    <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.9.0" />
+    <PackageVersion Include="Aspire.Hosting.AppHost" Version="13.6.4" />
+    <PackageVersion Include="Aspire.Hosting.SqlServer" Version="13.6.4" />
+    <PackageVersion Include="Aspire.Microsoft.EntityFrameworkCore.SqlServer" Version="13.6.4" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.11.0" />
+    <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.11.0" />
     <!-- No official Aspire hosting integration exists for Keycloak; this is the
          leading community package (NikiforovAll). See AppHost.cs. -->
     <PackageVersion Include="Keycloak.AuthServices.Aspire.Hosting" Version="0.3.0" />
@@ -82,26 +82,26 @@
 
   <!-- GraphQL (design.md §8). -->
   <ItemGroup>
-    <PackageVersion Include="HotChocolate.AspNetCore" Version="16.6.2" />
-    <PackageVersion Include="HotChocolate.AspNetCore.CommandLine" Version="16.6.2" />
-    <PackageVersion Include="HotChocolate.Diagnostics" Version="16.6.2" />
+    <PackageVersion Include="HotChocolate.AspNetCore" Version="16.7.1" />
+    <PackageVersion Include="HotChocolate.AspNetCore.CommandLine" Version="16.7.1" />
+    <PackageVersion Include="HotChocolate.Diagnostics" Version="16.7.1" />
   </ItemGroup>
 
   <!-- OpenTelemetry (design.md §15). design.md §15's finding about
        CompositeProcessor.OnEnd being unconditional was established on 1.15.3 and
        re-confirmed on 1.18.0. -->
   <ItemGroup>
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.20.1" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.20.1" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.20.1" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.20.1" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.20.1" />
   </ItemGroup>
 
   <!-- AI: embeddings, "ask the wiki", and MCP (design.md §9, §8). -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="10.9.0" />
-    <PackageVersion Include="Microsoft.Extensions.AI.OpenAI" Version="10.9.0" />
+    <PackageVersion Include="Microsoft.Extensions.AI.Abstractions" Version="10.11.0" />
+    <PackageVersion Include="Microsoft.Extensions.AI.OpenAI" Version="10.11.0" />
     <!-- The official MCP C# SDK's ASP.NET Core host; brings ModelContextProtocol +
          ModelContextProtocol.Core transitively. -->
     <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
@@ -115,12 +115,12 @@
        its own known flags to ON when the section says nothing - see
        Features/RocketWikiFeatureDefinitionProvider. -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.7.0" />
+    <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.8.0" />
   </ItemGroup>
 
   <!-- Storage and image processing (design.md §10, §19). -->
   <ItemGroup>
-    <PackageVersion Include="AWSSDK.S3" Version="4.0.102.4" />
+    <PackageVersion Include="AWSSDK.S3" Version="4.0.104.6" />
     <!-- Referenced directly by RocketWiki.Storage's SqlServerFileStorage, but this
          version governs the whole solution: it is ahead of the 6.1.x floor
          Microsoft.EntityFrameworkCore.SqlServer asks for, so NuGet unification lifts
@@ -132,7 +132,7 @@
          column, and SqlServerFileStorage's streaming reads and chunked writes) and
          all 37 pass. If odd ADO.NET behaviour ever shows up, dropping back to 6.1.1
          is a one-line revert here. -->
-    <PackageVersion Include="Microsoft.Data.SqlClient" Version="7.0.2" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="7.1.1" />
     <!-- Pinned to the newest 3.x deliberately, NOT 4.x. Re-checked against 4.1.1 on
          2026-08-28 rather than taken on trust: the build fails outright with
          "No Six Labors license found. Set $(SixLaborsLicenseKey), set
@@ -143,22 +143,22 @@
          (.github/dependabot.yml) so the pin is not re-proposed weekly. Licence either
          way: Six Labors Split License — Apache-2.0 terms for open-source /
          small-organization use, commercial otherwise. -->
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.2.0" />
   </ItemGroup>
 
   <!-- Test infrastructure (design.md §14). On any Test SDK or runner major bump,
        check the per-project test COUNTS are unchanged rather than just that the run
        is green — a runner that silently stops discovering a tier is still "green". -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.0" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.1" />
     <!-- MetricCollector<T> and FakeLogger, for asserting instruments actually emit. -->
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.Testing" Version="10.9.0" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.Testing" Version="10.11.0" />
     <!-- FakeTimeProvider, for the edit-session registry's deterministic sweep tests. -->
-    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.9.0" />
+    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.11.0" />
     <!-- design.md §14 tier 3: real SQL Server per run. -->
-    <PackageVersion Include="Testcontainers.MsSql" Version="4.14.0" />
+    <PackageVersion Include="Testcontainers.MsSql" Version="4.16.0" />
   </ItemGroup>
 
 </Project>
diff --git a/src/RocketWiki.AppHost/RocketWiki.AppHost.csproj b/src/RocketWiki.AppHost/RocketWiki.AppHost.csproj
index ce04a10..7ac3d2c 100644
--- a/src/RocketWiki.AppHost/RocketWiki.AppHost.csproj
+++ b/src/RocketWiki.AppHost/RocketWiki.AppHost.csproj
@@ -18,6 +18,13 @@
          is what design.md §15 itself uses. See AppHost.cs for the exact deviations
          from the design.md snippet (method names / API shape only, not intent). -->
     <PackageReference Include="Keycloak.AuthServices.Aspire.Hosting" />
+    <PackageReference Include="Microsoft.Data.SqlClient" />
+    <PackageReference Include="Microsoft.Extensions.AI.Abstractions" />
+    <PackageReference Include="Microsoft.Extensions.Configuration" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.Binder" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
+    <PackageReference Include="Microsoft.Extensions.Options" />
+    <PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" />
     <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" />
     <PackageReference Include="OpenTelemetry.Extensions.Hosting" />
   </ItemGroup>
diff --git a/src/RocketWiki.Storage/RocketWiki.Storage.csproj b/src/RocketWiki.Storage/RocketWiki.Storage.csproj
index 8cc5bdd..ab69d8f 100644
--- a/src/RocketWiki.Storage/RocketWiki.Storage.csproj
+++ b/src/RocketWiki.Storage/RocketWiki.Storage.csproj
@@ -14,6 +14,9 @@
          table would otherwise have to join the migration chain every deployment
          applies. -->
     <PackageReference Include="Microsoft.Data.SqlClient" />
+    <PackageReference Include="Microsoft.Extensions.Configuration" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.Binder" />
+    <PackageReference Include="Microsoft.Extensions.Options" />
     <PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" />
     <!-- ValidateDataAnnotations() for FileStorageOptions. The API host gets this
          assembly free from the ASP.NET Core shared framework; this class library
diff --git a/tests/RocketWiki.Core.Tests/RocketWiki.Core.Tests.csproj b/tests/RocketWiki.Core.Tests/RocketWiki.Core.Tests.csproj
index 6cf588f..daede0a 100644
--- a/tests/RocketWiki.Core.Tests/RocketWiki.Core.Tests.csproj
+++ b/tests/RocketWiki.Core.Tests/RocketWiki.Core.Tests.csproj
@@ -10,7 +10,12 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.Configuration" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.Binder" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
     <PackageReference Include="Microsoft.Extensions.Diagnostics.Testing" />
+    <PackageReference Include="Microsoft.Extensions.Options" />
+    <PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio">