From 26cf75a74f01ae72e3b7dc2aaa777a18d0a6dd43 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 12 Oct 2026 08:43:45 +0000
Subject: [PATCH 1/3] Bump the nuget-minor-patch group with 6 updates

Bumps SixLabors.ImageSharp from 3.1.12 to 3.2.0
Bumps Testcontainers from 4.15.0 to 4.16.0
Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1
Bumps xunit.v3 from 4.0.1 to 4.0.2
Bumps xunit.v3.extensibility.core from 4.0.1 to 4.0.2
Bumps xunit.v3.runner.console from 4.0.1 to 4.0.2

---
updated-dependencies:
- dependency-name: SixLabors.ImageSharp
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Testcontainers
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: xunit.v3
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: xunit.v3.extensibility.core
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: xunit.v3.runner.console
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Directory.Packages.props | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 5d44c95607..fdf3f2f336 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -183,7 +183,7 @@
     <PackageVersion Include="Serilog.AspNetCore" Version="10.0.0" />
     <PackageVersion Include="Serilog.Settings.Configuration" Version="10.0.1" />
     <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.2.0" />
     <!-- Share-card rendering (OgCardRenderer). SkiaSharp is MIT; the NoDependencies native build
          deliberately drops the fontconfig/libfreetype link, so the portal image needs NO apt
          packages and the base image stays as it is — the font is supplied from an embedded
@@ -256,7 +256,7 @@
     <!-- The memex test container package (src/MeshWeaver.Testcontainers): a real memex from the
          platform build as a test substrate, the way Testcontainers.PostgreSql gives a test a real
          Postgres. Same version as the test tree pins. -->
-    <PackageVersion Include="Testcontainers" Version="4.15.0" />
+    <PackageVersion Include="Testcontainers" Version="4.16.0" />
     <PackageVersion Include="SSH.NET" Version="2026.0.0" /> <!-- High GHSA-q939-rpr3-3284; transitive via Testcontainers, direct-ref override in test/Directory.Build.props -->
     <!-- 🚨 THESE TWO ARE ONE FAMILY AND MUST MOVE TOGETHER — they were SPLIT, and the split was
          invisible because both halves were green.
@@ -330,11 +330,11 @@
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
     <PackageVersion Include="UglyToad.PdfPig" Version="1.7.0-custom-5" />
     <PackageVersion Include="Verify.XunitV3" Version="31.28.0" />
-    <PackageVersion Include="xunit.v3" Version="4.0.1" />
+    <PackageVersion Include="xunit.v3" Version="4.0.2" />
     <PackageVersion Include="xunit.v3.assert" Version="4.0.1" />
-    <PackageVersion Include="xunit.v3.extensibility.core" Version="4.0.1" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.0" />
-    <PackageVersion Include="xunit.v3.runner.console" Version="4.0.1" />
+    <PackageVersion Include="xunit.v3.extensibility.core" Version="4.0.2" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.1" />
+    <PackageVersion Include="xunit.v3.runner.console" Version="4.0.2" />
     <PackageVersion Include="NSubstitute" Version="6.2.0" />
     <PackageVersion Include="Octokit" Version="14.0.0" />
     <PackageVersion Include="Octokit.Reactive" Version="14.0.0" />

From 69df4feb567127076dac1547b50c87e1e8afd591 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Roland=20B=C3=BCrgi?=
 <6334612+rbuergi@users.noreply.github.com>
Date: Mon, 12 Oct 2026 17:30:59 +0200
Subject: [PATCH 2/3] =?UTF-8?q?build(deps):=20hold=20SixLabors.ImageSharp?=
 =?UTF-8?q?=20at=203.1.12=20=E2=80=94=203.2.0=20enforces=20a=20paid=20lice?=
 =?UTF-8?q?nce?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

3.2.0 backports Six Labors licence enforcement into the 3.x line; the
Release build of tools/MeshWeaver.ThumbnailGenerator failed with
'No Six Labors license found' on this PR. Keep the other five bumps,
pin ImageSharp back to 3.1.12, and move the Dependabot ignore from
>=4.0.0 to >=3.2.0. The open advisories (fixed only in 4.1.2) are
noted next to the hold: the licence-or-replace decision is open.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml   | 12 +++++++++---
 Directory.Packages.props |  5 ++++-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 95536daef4..6a437b2ea9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -77,13 +77,19 @@ updates:
       #   'sixlabors.lic' file ... Please obtain a license from https://sixlabors.com/pricing/
       #
       # So this is not a preference to weigh: 4.x cannot build here at all without a purchased key,
-      # and MeshWeaver ships Apache-2.0 / MIT. 3.1.x remains Apache-2.0 and keeps receiving security
-      # patches, which is why the floor is on the MAJOR and ordinary 3.1.x bumps still flow.
+      # and MeshWeaver ships Apache-2.0 / MIT. 3.1.x remains Apache-2.0, which is why ordinary 3.1.x bumps still flow.
       #
       # The exit is a commercial decision, not a technical one: if a Six Labors licence is ever
       # bought, drop this block AND provision the key for CI and every developer machine.
+      #
+      # 🚨 AND 3.2.0 IS THE SAME WALL: its release backports "licence enforcement" into the 3.x line.
+      # Measured on #6549 (3.1.12 -> 3.2.0): sixlabors.imagesharp/3.2.0/build/SixLabors.ImageSharp
+      # .targets(35,5): error : No Six Labors license found. So the hold starts at 3.2.0, not at the
+      # major; 3.1.x patches still flow. Holding here does NOT buy safety: GHSA-j3p4-wp97-rph4,
+      # GHSA-j9gm-c75j-xc9q and GHSA-jjfr-hcj7-qf5w (high, 2026-10-07) cover every version up to
+      # 4.1.1 and are patched only in 4.1.2 - the licence-or-replace decision above is now open.
       - dependency-name: "SixLabors.ImageSharp*"
-        versions: [">=4.0.0"]
+        versions: [">=3.2.0"]
 
   - package-ecosystem: pip
     directory: "/clients/python"
diff --git a/Directory.Packages.props b/Directory.Packages.props
index fdf3f2f336..4ad58044fc 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -183,7 +183,10 @@
     <PackageVersion Include="Serilog.AspNetCore" Version="10.0.0" />
     <PackageVersion Include="Serilog.Settings.Configuration" Version="10.0.1" />
     <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
-    <PackageVersion Include="SixLabors.ImageSharp" Version="3.2.0" />
+    <!-- HELD at 3.1.12: 3.2.0 backports the Six Labors licence ENFORCEMENT into the 3.x line (its
+         MSBuild targets fail the build with "No Six Labors license found"), so every 3.2+ release is
+         pay-to-use exactly like 4.x. .github/dependabot.yml ignores ">=3.2.0" for the same reason. -->
+    <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.12" />
     <!-- Share-card rendering (OgCardRenderer). SkiaSharp is MIT; the NoDependencies native build
          deliberately drops the fontconfig/libfreetype link, so the portal image needs NO apt
          packages and the base image stays as it is — the font is supplied from an embedded

From 5e349941ba86b67747ee4a395daee2f92a0a5598 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Roland=20B=C3=BCrgi?=
 <6334612+rbuergi@users.noreply.github.com>
Date: Tue, 13 Oct 2026 10:45:05 +0200
Subject: [PATCH 3/3] build(deps): move xunit.v3.assert to 4.0.2 with the rest
 of the xUnit v3 family

DependencyMajorUpgrades treats xunit.v3, xunit.v3.assert, xunit.v3.extensibility.core and
xunit.v3.runner.console as one lockstep line; the group bump left the assert pin at 4.0.1.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 Directory.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index c018630821..4c5245ea60 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -331,7 +331,7 @@
     <PackageVersion Include="UglyToad.PdfPig" Version="1.7.0-custom-5" />
     <PackageVersion Include="Verify.XunitV3" Version="31.28.0" />
     <PackageVersion Include="xunit.v3" Version="4.0.2" />
-    <PackageVersion Include="xunit.v3.assert" Version="4.0.1" />
+    <PackageVersion Include="xunit.v3.assert" Version="4.0.2" />
     <PackageVersion Include="xunit.v3.extensibility.core" Version="4.0.2" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.1" />
     <PackageVersion Include="xunit.v3.runner.console" Version="4.0.2" />