chore(deps): consolidate dependency bumps (supersedes #37/#38/#39/#40/#41)

[WomB0ComB0]

All five open Dependabot PRs edit the same Directory.Packages.props, so they conflict with each other by construction — #38 was already DIRTY, the other four sat BEHIND, and merging any one re-breaks the rest. Folding them into a single change, following the precedent set by #34.

Package	From	To	From PR
MinVer	6.0.0	7.0.0	#37
Polly.Core	8.5.0	8.7.0	#38
Scalar.AspNetCore	2.0.5	2.16.20	#39
Microsoft.EntityFrameworkCore	9.0.0	9.0.19	#40
Microsoft.EntityFrameworkCore.Relational	9.0.0	9.0.19	#40
Microsoft.Extensions.Http.Resilience	9.0.0	9.10.0	#40
Microsoft.AspNetCore.Mvc.Testing	9.0.0	9.0.19	#40
Meziantou.Analyzer	3.0.157	3.0.159	#41

Everything stays inside the holds in dependabot.yml: the Microsoft.* moves are all within the 9.x line so the >=10.0.0 hold is respected, and FluentAssertions is untouched.

The two that needed more than a version check

MinVer 6 → 7 is a major carrying a [BREAKING] "switch to System.CommandLine". That changes minver-cli argument parsing — which we never invoke. Grep finds no minver-cli / dotnet minver anywhere. We consume the MSBuild task:

<PackageReference Include="MinVer" PrivateAssets="all" />
<MinVerTagPrefix>v</MinVerTagPrefix>

Neither the task path nor MinVerTagPrefix is touched by the rework. The Socket −32 supply-chain score raised on #37 is answered in full there — short version: Socket's blocking alert check passes, vulnerability/quality/maintenance/license all stay 100, provenance is identical (same author, same Apache-2.0, same adamralph/minver), and both versions declare zero NuGet dependencies, ruling out new transitive surface. PrivateAssets="all" also means it never reaches consumers of ResQ.BuildingBlocks.*.

Scalar.AspNetCore jumps 16 minors, but our entire surface is one Development-only MapScalarApiReference() call in OpenApiExtensions.cs.

Verification

Locally on .NET SDK 10.0.110:

• dotnet restore — clean
• dotnet build -c Release — succeeded, 0 warnings / 0 errors (worth noting given the analyzer bump could have added diagnostics)
• dotnet pack — exercises MinVer 7 end to end; derived a version and produced .nupkg + .snupkg

Each superseded PR was also independently green on CI before consolidation.

After merge

#37, #38, #39, #40, and #41 should be closed as superseded. Dependabot will not reopen them — these versions are now current.

Note

MinVer 8.0.0-rc.1 exists (2026-05-14) with its own breaking change ("Fail when default pre-release phase is provided"). Staying on 7.0.0 stable is deliberate; worth revisiting when 8.0.0 ships stable.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	minver@​6.0.0 ⏵ 7.0.0	-32
	scalar.aspnetcore@​2.16.20
	microsoft.extensions.http.resilience@​9.10.0
	microsoft.aspnetcore.mvc.testing@​9.0.19
	meziantou.analyzer@​3.0.157 ⏵ 3.0.159
	polly.core@​8.7.0	N/A	N/A	N/A	N/A	N/A

View full report

[github-actions]

Audit passed with minor recommendations. See full report below.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for #43 · age00 · 109 AIC · ⌖ 2.81 AIC · ⊞ 7.6K · ◷

[github-actions]

PR Audit Summary

I have audited the dependency consolidation in this PR. The changes are generally sound, but there are a few minor inconsistencies and maintenance items to address:

1. EF Core Version Alignment

The building block dependencies (Microsoft.EntityFrameworkCore, Relational, AspNetCore.Mvc.Testing) have been bumped to 9.0.19, but the provider packages used by samples in the root Directory.Packages.props were left behind:

• Microsoft.EntityFrameworkCore.Sqlite: stays at 9.0.0 (Inconsistent with the 9.0.19 used in the template).
• Npgsql.EntityFrameworkCore.PostgreSQL: stays at 9.0.2 (The template uses 9.0.4).

Recommendation: Align these provider versions in the root Directory.Packages.props with the latest 9.0.x patches (e.g., 9.0.19 for Sqlite) to ensure a coherent dependency graph for the samples.

2. Outdated Comments

The following project files contain XML comments that specifically refer to a "9.0.0 EF Core stack". These are now outdated and should be updated to reflect the new 9.0.19 baseline:

• samples/Widgets/src/Widgets.Api/Widgets.Api.csproj
• samples/Widgets/src/Widgets.Infrastructure/Widgets.Infrastructure.csproj

3. Notable Updates

• Scalar.AspNetCore (2.0.5 -> 2.16.20): This is a significant jump (16 minor versions). I verified that usage is limited to the standard app.MapScalarApiReference() call in OpenApiExtensions.cs, which minimizes risk, but the jump is worth noting.
• MinVer (6.0.0 -> 7.0.0): The major version bump is safe as the breaking changes in 7.0.0 affect the CLI argument parsing, which is not used here (consumed via MSBuild task).

4. Security

The transitive security pin for System.Text.Json (9.0.19) is correctly maintained, ensuring the fix for CVE-2024-43485 remains in place.

Overall, the consolidation is a good cleanup of the conflicting Dependabot PRs. Addressing the version alignment and comments will make it perfectly consistent.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for #43 · age00 · 109 AIC · ⌖ 2.81 AIC · ⊞ 7.6K · ◷