Bump the nuget-minor-patch group with 6 updates

[dependabot]

Note (steward): after merging origin/main this pull request applies FIVE updates: Testcontainers 4.16.0 and the xUnit v3 family at 4.0.2 (including xunit.v3.assert) plus xunit.runner.visualstudio 4.0.1. SixLabors.ImageSharp is not updated: main replaced it with SkiaSharp (#6598), so it is no longer in the tree.

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Updated SixLabors.ImageSharp from 3.1.12 to 3.2.0.

Release notes

Sourced from SixLabors.ImageSharp's releases.

3.2.0

What's Changed

• [3.1] Use macos-26-intel on CI by @​antonfirsov in [3.1] Use macos-26-intel on CI SixLabors/ImageSharp#3087
• Backport: V3 - Throw explicit InvalidImageContentException when BMP BPP is invalid. by @​JimBobSquarePants in Backport: V3 - Throw explicit InvalidImageContentException when BMP BPP is invalid. SixLabors/ImageSharp#3068
• [3.1] Backport #​3075 - Add check, if Offset is greater then stream length when reading bitmap colorMapSize by @​antonfirsov in [3.1] Backport #3075 - Add check, if Offset is greater then stream length when reading bitmap colorMapSize SixLabors/ImageSharp#3091
• v3: Backport. Fix JPEG SIMD slicing and padding length handling by @​JimBobSquarePants in v3: Backport. Fix JPEG SIMD slicing and padding length handling SixLabors/ImageSharp#3106
• Backport v3 security fixes and license enforcement by @​JimBobSquarePants in Backport v3 security fixes and license enforcement SixLabors/ImageSharp#3208

Full Changelog: SixLabors/ImageSharp@v3.1.12...v3.2.0

Commits viewable in compare view.

Updated Testcontainers from 4.15.0 to 4.16.0.

Release notes

Sourced from Testcontainers's releases.

4.16.0

What's Changed

Huge thanks to everyone for your contributions and feedback 🧡.

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​54051351.

🚀 Features

• feat: Add common WithSsl builder API and support it in Azurite (#​1788) @​aleksandarMilev, @​HofmeisterAn
• feat: Add BuildKit support for image builds via sidecar container (#​1761) @​george-petrakis, @​HofmeisterAn
• feat(Elasticsearch): Add OTLP and certificate support (#​1774) @​HofmeisterAn

🐛 Bug Fixes

• fix(PostgreSql): Support SSL with Alpine images and non-root users (#​1790) @​HofmeisterAn
• fix: Do not pull base image with unresolved platform variable (#​1787) @​HofmeisterAn
• fix(Kafka): Default to KRaft for Confluent Platform 8.x images (#​1775) @​arnelirobles, @​HofmeisterAn
• fix(Kafka): Drop the trailing comma from advertised listeners (#​1772) @​arnelirobles, @​HofmeisterAn
• fix: Prevent Docker ignore patterns from matching path prefixes (#​1768) @​Benziza, @​HofmeisterAn

📖 Documentation

• docs: Complete builder API tables and align heading casing (#​1778) @​HofmeisterAn
• docs: Explain how builder configurations combine (#​1770) @​arnelirobles, @​HofmeisterAn

🧹 Housekeeping

• fix: Regenerate expired test certificates (#​1786) @​zcsizmadia
• chore: Resolve Sonar findings (#​1776) @​HofmeisterAn
• chore: Remove Minio module (#​1769) @​HofmeisterAn
• chore: Publish NuGet packages with Trusted Publishing (OIDC) (#​1763) @​HofmeisterAn
• feat: Prepare next release cycle (4.16.0) (#​1762) @​HofmeisterAn

📦 Dependency Updates

• chore(deps): Bump the actions group with 5 updates (#​1781) @​dependabot[bot]

Commits viewable in compare view.

Updated xunit.runner.visualstudio from 4.0.0 to 4.0.1.

Release notes

Sourced from xunit.runner.visualstudio's releases.

4.0.1

Release notes: https://xunit.net/releases/visualstudio/4.0.1

Commits viewable in compare view.

Updated xunit.v3 from 4.0.1 to 4.0.2.

Release notes

Sourced from xunit.v3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated xunit.v3.extensibility.core from 4.0.1 to 4.0.2.

Release notes

Sourced from xunit.v3.extensibility.core's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated xunit.v3.runner.console from 4.0.1 to 4.0.2.

Release notes

Sourced from xunit.v3.runner.console's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Test Results

    25 files  ±0      25 suites  ±0   57m 14s ⏱️ -30s
12 299 tests ±0  12 106 ✅ ±0  193 💤 ±0  0 ❌ ±0 
12 313 runs  ±0  12 120 ✅ ±0  193 💤 ±0  0 ❌ ±0 

Results for commit 5e34994. ± Comparison against base commit f632b88.

This pull request removes 40 and adds 16 tests. Note that renamed tests count towards both.

   --- End of inner exception stack trace ---
   --- End of inner exception stack trace ---, expected: True)
   --- End of inner exception stack trace ---, isDenial: True)
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
 ---> (Inner Exception #1) MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432<---
 ---> (Inner Exception #1) System.ArgumentException: Value does not fall within the expected range.<---
 ---> (Inner Exception #1) System.InvalidOperationException: boom<---
 ---> (Inner Exception #1) System.InvalidOperationException: source B is misconfigured<---
 ---> (Inner Exception #1) System.Net.Sockets.SocketException (0xFFFDFFFF): Name or service not known<---
…

Memex.Portal.Shared.Test.InstanceIdRulesMatchTheRegistryTest ‑ TheSetupHostAgreesWithTheRegistry(candidate: "b77ead23-999b-449f-9325-427c47099935")
Memex.Portal.Shared.Test.SessionDenialIsAnAnswerTest ‑ OnlyAVerdictReadsAsADenial(shape: "the same verdict nested, as a late denial dispatch"···, failure: System.InvalidOperationException: write failed
 ---> System.UnauthorizedAccessException: Access denied
   --- End of inner exception stack trace ---, isDenial: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's FIRST member", fault: System.AggregateException: One or more errors occurred. (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's SECOND member", fault: System.AggregateException: One or more errors occurred. (The operation has timed out.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> System.TimeoutException: The operation has timed out.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall nested in an aggregate inside a wrapper", fault: System.InvalidOperationException: outer
 ---> System.AggregateException: One or more errors occurred. (Value does not fall within the expected range.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> System.ArgumentException: Value does not fall within the expected range.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---

   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall wrapped as InnerException", fault: System.InvalidOperationException: outer
 ---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "an aggregate of unrelated faults", fault: System.AggregateException: One or more errors occurred. (The operation has timed out.) (Value does not fall within the expected range.)
 ---> System.TimeoutException: The operation has timed out.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.ArgumentException: Value does not fall within the expected range.<---
, expected: False)
MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest ‑ Classifies(shape: "a MIXED aggregate — one transient branch, one genu"···, exception: System.AggregateException: One or more errors occurred. (Failed to connect to 10.42.18.4:5432) (source B is misconfigured)
 ---> MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.InvalidOperationException: source B is misconfigured<---
, expected: False)
MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest ‑ Classifies(shape: "a nested aggregate with one genuine leaf", exception: System.AggregateException: One or more errors occurred. (One or more errors occurred. (Failed to connect to 10.42.18.4:5432) (boom)) (Failed to connect to 10.42.18.4:5432)
 ---> System.AggregateException: One or more errors occurred. (Failed to connect to 10.42.18.4:5432) (boom)
 ---> MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.InvalidOperationException: boom<---

   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432<---
, expected: False)
MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest ‑ Classifies(shape: "a nested aggregate, all leaves transient", exception: System.AggregateException: One or more errors occurred. (One or more errors occurred. (Failed to connect to 10.42.18.4:5432)) (Failed to connect to 10.42.18.4:5432)
 ---> System.AggregateException: One or more errors occurred. (Failed to connect to 10.42.18.4:5432)
 ---> MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432
   --- End of inner exception stack trace ---
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432<---
, expected: True)
…

♻️ This comment has been updated with latest results.

[rbuergi]

The maintainer decided to replace ImageSharp in core. #6598 removes SixLabors.ImageSharp from Directory.Packages.props and drops its Dependabot ignore block: the thumbnail generator, ImageSharp's only consumer, now uses SkiaSharp.

That supersedes this PR's ImageSharp pin (3.1.12 → 3.2.0) and its >=3.2.0 ignore. Once #6598 merges, this PR conflicts on those hunks. A @dependabot recreate should then regenerate it with only the Testcontainers and xunit bumps.

[Copilot]

🟡 Changes recommended

It suppresses patched ImageSharp releases, splits the xUnit package family, and contradicts the PR description.

3 open findings

• ImageSharp ignore blocks security fixes and patched releases · New
• Align xunit.v3.assert with the xUnit 4.0.2 package family · New
• Correct PR metadata for the held ImageSharp update · New

What changed in this PR

Updates test infrastructure dependencies while holding ImageSharp due to license enforcement.

Changes:

• Updates Testcontainers and xUnit packages.
• Blocks ImageSharp 3.2.0+ upgrades.
• Documents ImageSharp licensing and security concerns.

File	Description
Directory.Packages.props	Updates package versions and documents the ImageSharp hold.
.github/​dependabot.yml	Extends the ImageSharp ignore range to 3.2.0+.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rbuergi]

Resolved by replacing the package rather than holding it. main replaced SixLabors.ImageSharp with SkiaSharp in the thumbnail generator (#6598), and this branch merged origin/main in dd9742f. The ignore block and the 3.1.12 pin are both gone from this pull request, so nothing suppresses a security release any more.

[rbuergi]

After the merge of origin/main (dd9742f) ImageSharp is no longer in the tree at all; main replaced it with SkiaSharp (#6598). The pull request body now carries a note saying the diff applies five updates and that the ImageSharp line was dropped, not bumped.