Bump test deps

[Evangelink]

No description provided.

[Copilot]

Pull request overview

Updates centrally-managed NuGet package versions in Directory.Packages.props, primarily for test/integration-test dependencies across the repo.

Changes:

• Bump NUnit from 4.5.0 to 4.6.0.
• Upgrade Moq and MSBuild.StructuredLogger to newer versions.
• Patch-bump Polly from 8.6.5 to 8.6.6.

Show a summary per file

File	Description
Directory.Packages.props	Updates central package versions for several test/infrastructure dependencies (NUnit, Moq, MSBuild.StructuredLogger, Polly).

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 1

[Evangelink]

Summary

Workflow: Expert Code Reviewer
Date: 2026-05-11
Repository: microsoft/testfx

Key Findings

• [Security / Minor] Directory.Packages.props line 78 retains <!-- Pinned to 4.18.4 for security --> while the Moq version is now 4.20.72. The original pin guarded against the SponsorLink data-collection feature introduced in Moq 4.20.0 — that feature was removed in a later 4.20.x release, so 4.20.72 is unaffected. The comment is now stale and should be removed or updated so future readers (and automated tooling) aren't misled.

Positive Observations

• All four bumps (NUnit 4.5→4.6, Moq 4.18.4→4.20.72, MSBuild.StructuredLogger 2.3.113→2.3.178, Polly 8.6.5→8.6.6) are test/build-time-only dependencies — none affect the shipped NuGet surface or runtime behavior of MTP/MSTest.
• No public API surface is touched.
• No cross-TFM or threading concerns introduced.

Recommendations

• Update or remove the stale security comment on the Moq entry (see inline comment).

---

Generated by Expert Code Reviewer

🧠 Reviewed by Expert Code Reviewer 🧠

[Evangelink]

Summary

Workflow: PR Nitpick Reviewer
Date: 2026-05-11
Repository: microsoft/testfx

Key Findings

1. Outdated comment (Directory.Packages.props, line 78): The comment <!-- Pinned to 4.18.4 for security --> was not removed when Moq was bumped from 4.18.4 to 4.20.72. This is the only meaningful nitpick in an otherwise clean, routine dependency bump.

Positive Highlights

• ✅ The missing end-of-file newline was fixed as part of this PR — good catch.
• ✅ All version bumps are incremental and look reasonable (NUnit, Moq, MSBuild.StructuredLogger, Polly).

Overall Assessment

Very small, low-risk PR. Only one minor issue found.

---

🔍 Meticulously inspected by PR Nitpick Reviewer

🔍 Meticulously inspected by PR Nitpick Reviewer 🔍

[Copilot]

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 1