From d2e49fc034dca4afa8bf686a0ddfa04b57218cb8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 10 Nov 2026 23:43:21 +0000
Subject: [PATCH] Bump CommunityToolkit.Mvvm and 13 others

Bumps CommunityToolkit.Mvvm from 8.4.0 to 8.4.2
Bumps DuckDB.NET.Data.Full from 1.5.6 to 1.5.6.1
Bumps Microsoft.AspNetCore.OpenApi from 10.0.13 to 10.0.15
Bumps Microsoft.AspNetCore.TestHost from 10.0.13 to 10.0.15
Bumps Microsoft.Data.Sqlite from 10.0.12 to 10.0.15
Bumps Microsoft.Extensions.Hosting from 10.0.10 to 10.0.15
Bumps Microsoft.Extensions.Hosting.WindowsServices from 10.0.13 to 10.0.15
Bumps ModelContextProtocol from 2.2.0 to 2.4.0
Bumps Oracle.ManagedDataAccess.Core from 23.26.301 to 23.26.400
Bumps SkiaSharp from 4.153.1 to 4.155.0
Bumps SQLitePCLRaw.lib.e_sqlite3 to 2.1.14
Bumps System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.15
Bumps System.Security.Cryptography.ProtectedData from 10.0.12 to 10.0.15
Bumps xunit.runner.visualstudio from 3.1.4 to 3.1.5

---
updated-dependencies:
- dependency-name: CommunityToolkit.Mvvm
  dependency-version: 8.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.Data.Sqlite
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: SkiaSharp
  dependency-version: 4.155.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: System.Security.Cryptography.Pkcs
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: System.Security.Cryptography.ProtectedData
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.Extensions.Hosting.WindowsServices
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: DuckDB.NET.Data.Full
  dependency-version: 1.5.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Oracle.ManagedDataAccess.Core
  dependency-version: 23.26.400
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: System.Security.Cryptography.Pkcs
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: System.Security.Cryptography.ProtectedData
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.Extensions.Hosting
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: ModelContextProtocol
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: SQLitePCLRaw.lib.e_sqlite3
  dependency-version: 2.1.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: SQLitePCLRaw.lib.e_sqlite3
  dependency-version: 2.1.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: Microsoft.AspNetCore.TestHost
  dependency-version: 10.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-and-patch
- dependency-name: SkiaSharp
  dependency-version: 4.155.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 src/Rotula.App/Rotula.App.csproj                           | 2 +-
 src/Rotula.Cli/Rotula.Cli.csproj                           | 4 ++--
 src/Rotula.Data.Pack.DuckDb/Rotula.Data.Pack.DuckDb.csproj | 2 +-
 src/Rotula.Data.Pack.Oracle/Rotula.Data.Pack.Oracle.csproj | 6 +++---
 src/Rotula.Data/Rotula.Data.csproj                         | 7 ++++---
 src/Rotula.Mcp/Rotula.Mcp.csproj                           | 4 ++--
 src/Rotula.Rendering/Rotula.Rendering.csproj               | 2 +-
 .../Rotula.Data.Integration/Rotula.Data.Integration.csproj | 2 +-
 .../Rotula.Data.Packs.Tests/Rotula.Data.Packs.Tests.csproj | 2 +-
 tests/Rotula.Data.SamplePack/Rotula.Data.SamplePack.csproj | 2 +-
 tests/Rotula.Tests/Rotula.Tests.csproj                     | 4 ++--
 tools/brand/Rotula.Brand.csproj                            | 2 +-
 12 files changed, 20 insertions(+), 19 deletions(-)

diff --git a/src/Rotula.App/Rotula.App.csproj b/src/Rotula.App/Rotula.App.csproj
index 5449ed4..3001581 100644
--- a/src/Rotula.App/Rotula.App.csproj
+++ b/src/Rotula.App/Rotula.App.csproj
@@ -10,7 +10,7 @@
 
   <ItemGroup>
     <!-- CommunityToolkit.Mvvm: MIT. -->
-    <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0" />
+    <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.2" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Rotula.Cli/Rotula.Cli.csproj b/src/Rotula.Cli/Rotula.Cli.csproj
index 54b26bd..9ef4e30 100644
--- a/src/Rotula.Cli/Rotula.Cli.csproj
+++ b/src/Rotula.Cli/Rotula.Cli.csproj
@@ -33,9 +33,9 @@
 
   <ItemGroup>
     <!-- OpenAPI document of the REST server (MIT). -->
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.13" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.15" />
     <!-- Runs "rotula serve" as a Windows service (MIT); does nothing when started from a console. -->
-    <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.13" />
+    <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.15" />
   </ItemGroup>
 
 </Project>
diff --git a/src/Rotula.Data.Pack.DuckDb/Rotula.Data.Pack.DuckDb.csproj b/src/Rotula.Data.Pack.DuckDb/Rotula.Data.Pack.DuckDb.csproj
index fb274d5..2cfd199 100644
--- a/src/Rotula.Data.Pack.DuckDb/Rotula.Data.Pack.DuckDb.csproj
+++ b/src/Rotula.Data.Pack.DuckDb/Rotula.Data.Pack.DuckDb.csproj
@@ -13,7 +13,7 @@
 
   <ItemGroup>
     <!-- MIT. The "Full" variant bundles the native DuckDB library; a win-x64 publish keeps only that platform's copy. -->
-    <PackageReference Include="DuckDB.NET.Data.Full" Version="1.5.6" />
+    <PackageReference Include="DuckDB.NET.Data.Full" Version="1.5.6.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Rotula.Data.Pack.Oracle/Rotula.Data.Pack.Oracle.csproj b/src/Rotula.Data.Pack.Oracle/Rotula.Data.Pack.Oracle.csproj
index 8ddeea0..e876a60 100644
--- a/src/Rotula.Data.Pack.Oracle/Rotula.Data.Pack.Oracle.csproj
+++ b/src/Rotula.Data.Pack.Oracle/Rotula.Data.Pack.Oracle.csproj
@@ -17,14 +17,14 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Oracle.ManagedDataAccess.Core" Version="23.26.301" />
+    <PackageReference Include="Oracle.ManagedDataAccess.Core" Version="23.26.400" />
     <!-- Oracle pulls System.Security.Cryptography.ProtectedData 8.0.0 (through its configuration dependency) while Rotula.Data is built against 10.x;
          naming the newer MIT package here settles the version conflict (MSB3277) instead of hiding the warning. -->
-    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.12" />
+    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.15" />
     <!-- Oracle also pulls System.Security.Cryptography.Pkcs 8.0.1, which has published advisories (GHSA-846f-f764-76mx high,
          GHSA-2fmv-rv2c-59x7 moderate) that NuGet audit turns into build errors. The patched MIT package is named here; the Oracle
          library itself stays unmodified. -->
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.15" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Rotula.Data/Rotula.Data.csproj b/src/Rotula.Data/Rotula.Data.csproj
index a8b5dcd..2263826 100644
--- a/src/Rotula.Data/Rotula.Data.csproj
+++ b/src/Rotula.Data/Rotula.Data.csproj
@@ -28,15 +28,16 @@
          "Distributable Code" licence terms, not a permissive licence. The owner accepted those terms on
          2026-10-10 (see docs/decisions.md); the notice is listed in THIRD-PARTY-NOTICES.md. -->
 
-    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.12" />
+    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.15" />
     <PackageReference Include="MySqlConnector" Version="2.6.2" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.14" />
     <PackageReference Include="System.Data.Odbc" Version="10.0.12" />
-    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.12" />
+    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.15" />
     <!-- Not used directly. Microsoft.Data.SqlClient 7.1.1 brings System.Security.Cryptography.Pkcs 9.0.18, which has published
          advisories (GHSA-846f-f764-76mx high, GHSA-2fmv-rv2c-59x7 moderate). NuGet audit turns them into build errors here, so
          the patched version is pinned until SqlClient depends on it. -->
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.15" />
   </ItemGroup>
 
 </Project>
diff --git a/src/Rotula.Mcp/Rotula.Mcp.csproj b/src/Rotula.Mcp/Rotula.Mcp.csproj
index 8e7ed38..b0c19ae 100644
--- a/src/Rotula.Mcp/Rotula.Mcp.csproj
+++ b/src/Rotula.Mcp/Rotula.Mcp.csproj
@@ -41,9 +41,9 @@
 
   <ItemGroup>
     <!-- Official C# MCP SDK: MIT. -->
-    <PackageReference Include="ModelContextProtocol" Version="2.2.0" />
+    <PackageReference Include="ModelContextProtocol" Version="2.4.0" />
     <!-- Generic host (MIT): runs the MCP stdio transport and gives dependency injection. -->
-    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.15" />
   </ItemGroup>
 
 </Project>
diff --git a/src/Rotula.Rendering/Rotula.Rendering.csproj b/src/Rotula.Rendering/Rotula.Rendering.csproj
index 1e224a8..0eb0cd6 100644
--- a/src/Rotula.Rendering/Rotula.Rendering.csproj
+++ b/src/Rotula.Rendering/Rotula.Rendering.csproj
@@ -19,7 +19,7 @@
 
   <ItemGroup>
     <!-- SkiaSharp: MIT. Pulls the Windows native assets transitively. -->
-    <PackageReference Include="SkiaSharp" Version="4.153.1" />
+    <PackageReference Include="SkiaSharp" Version="4.155.0" />
     <!-- ZXing.Net: Apache-2.0. Used only as a barcode ENCODER (bit matrices); drawing is done by us. -->
     <PackageReference Include="ZXing.Net" Version="0.16.11" />
   </ItemGroup>
diff --git a/tests/Rotula.Data.Integration/Rotula.Data.Integration.csproj b/tests/Rotula.Data.Integration/Rotula.Data.Integration.csproj
index fa04426..2fa1945 100644
--- a/tests/Rotula.Data.Integration/Rotula.Data.Integration.csproj
+++ b/tests/Rotula.Data.Integration/Rotula.Data.Integration.csproj
@@ -13,7 +13,7 @@
          coverage gate, and a second project that loads Rotula.Core with almost no coverage must not be picked. -->
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/Rotula.Data.Packs.Tests/Rotula.Data.Packs.Tests.csproj b/tests/Rotula.Data.Packs.Tests/Rotula.Data.Packs.Tests.csproj
index 34ad70b..ca09580 100644
--- a/tests/Rotula.Data.Packs.Tests/Rotula.Data.Packs.Tests.csproj
+++ b/tests/Rotula.Data.Packs.Tests/Rotula.Data.Packs.Tests.csproj
@@ -21,7 +21,7 @@
          failed depending on which report's folder name sorted first. -->
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/Rotula.Data.SamplePack/Rotula.Data.SamplePack.csproj b/tests/Rotula.Data.SamplePack/Rotula.Data.SamplePack.csproj
index 067b251..03f2ca1 100644
--- a/tests/Rotula.Data.SamplePack/Rotula.Data.SamplePack.csproj
+++ b/tests/Rotula.Data.SamplePack/Rotula.Data.SamplePack.csproj
@@ -21,7 +21,7 @@
     <ProjectReference Include="..\..\src\Rotula.Data\Rotula.Data.csproj" Private="false" ExcludeAssets="runtime" />
     <ProjectReference Include="..\Rotula.Data.SamplePack.Dep\Rotula.Data.SamplePack.Dep.csproj" />
     <!-- Apache-2.0, already a Rotula dependency; here it only supplies a native library for the loader tests. -->
-    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.14" />
     <None Include="pack.json" CopyToOutputDirectory="PreserveNewest" />
     <None Include="NOTICES.txt" CopyToOutputDirectory="PreserveNewest" />
   </ItemGroup>
diff --git a/tests/Rotula.Tests/Rotula.Tests.csproj b/tests/Rotula.Tests/Rotula.Tests.csproj
index 9c0fca5..1b24057 100644
--- a/tests/Rotula.Tests/Rotula.Tests.csproj
+++ b/tests/Rotula.Tests/Rotula.Tests.csproj
@@ -12,10 +12,10 @@
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
     <PackageReference Include="ZXing.Net" Version="0.16.11" />
     <!-- In-memory server for the print engine's REST API tests (MIT). -->
-    <PackageReference Include="Microsoft.AspNetCore.TestHost" Version="10.0.13" />
+    <PackageReference Include="Microsoft.AspNetCore.TestHost" Version="10.0.15" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tools/brand/Rotula.Brand.csproj b/tools/brand/Rotula.Brand.csproj
index 7e91eba..39ebd7f 100644
--- a/tools/brand/Rotula.Brand.csproj
+++ b/tools/brand/Rotula.Brand.csproj
@@ -18,7 +18,7 @@
 
   <ItemGroup>
     <!-- SkiaSharp: MIT. Same version as Rotula.Rendering. -->
-    <PackageReference Include="SkiaSharp" Version="4.153.1" />
+    <PackageReference Include="SkiaSharp" Version="4.155.0" />
   </ItemGroup>
 
 </Project>