⭐ Package Versions

Every one of ~50 central package pins in Directory.Packages.props was checked against its actual current-latest version — a web search, not an assumption — rather than copied from source. The notable deviations, not routine patch bumps:

• Duende.IdentityServer* bumped 7.x → 8.x, a deliberate major-version call with real breaking-change risk deferred to verification once Identity.API is actually added. The source's own DuendeVersion variable was unused (every package was hardcoded to 7.3.2 instead of referencing it) — wired up properly as part of the same pass.
• IdentityModel → Duende.IdentityModel, 7.0.0 → 8.1.0. Upstream IdentityModel is archived; Duende.IdentityModel is the maintained successor (still Apache-2.0). Any using IdentityModel; in code added later will need a namespace update.
• MediatR pinned to 12.5.0, a deliberate user decision — MediatR v13+ moved to a dual RPL-1.5/commercial license (LuckyPenny Software, July 2025). 12.5.0 is the last MIT/Apache-2.0 release. Flagged for verification once Ordering.API lands, since it's pinned below the source's original version.
• Asp.Versioning.Http.Client split onto its own 8.1.0 — it diverged from the rest of the Asp.Versioning.* family's shared version variable; pinning it to that variable would have been wrong.
• Microsoft.VisualStudio.Web.CodeGeneration.Design: was stuck on a .NET-8-RC-era prerelease (8.0.0-rc.1.23461.3); a real stable 10.0.2 release exists now.

See Architecture Overview for which projects these packages actually gate.