From 168917c40e5cf6d188b0d7a510c393d6f7064574 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 14 Oct 2026 20:31:10 +0000
Subject: [PATCH] Bump the test-and-tooling group with 5 updates

Bumps Microsoft.CodeAnalysis.Analyzers from 3.3.4 to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp from 4.8.0 to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp.Workspaces from 4.8.0 to 5.9.0
Bumps Microsoft.NET.Test.Sdk from 17.14.1 to 18.11.0
Bumps xunit.runner.visualstudio from 3.1.4 to 4.0.1

---
updated-dependencies:
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp.Workspaces
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 src/SheetStream.Analyzers/SheetStream.Analyzers.csproj      | 4 ++--
 src/SheetStream.Generators/SheetStream.Generators.csproj    | 4 ++--
 .../SheetStream.Analyzers.Tests.csproj                      | 6 +++---
 .../SheetStream.Generators.Tests.csproj                     | 6 +++---
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj b/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
index 4545293..27687fb 100644
--- a/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
+++ b/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
@@ -25,8 +25,8 @@
     <!-- 4.8.0 is the oldest compiler the analyzer supports (VS 2022 17.8 / .NET SDK 8.0). Newer compilers load
          analyzers built against older Microsoft.CodeAnalysis, so staying low maximises compatibility. PrivateAssets
          keeps the compiler assemblies out of any package that references this project. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/SheetStream.Generators/SheetStream.Generators.csproj b/src/SheetStream.Generators/SheetStream.Generators.csproj
index 99e2143..aafd07c 100644
--- a/src/SheetStream.Generators/SheetStream.Generators.csproj
+++ b/src/SheetStream.Generators/SheetStream.Generators.csproj
@@ -24,8 +24,8 @@
   <ItemGroup>
     <!-- 4.8.0 is the compiler shipped with .NET 8 / VS 17.8: the oldest host the generator supports.
          Newer SDKs (including .NET 10) load it unchanged. PrivateAssets keeps it out of any consumer's graph. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj b/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
index f676f74..6471edf 100644
--- a/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
+++ b/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
@@ -12,13 +12,13 @@
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing" Version="1.1.4" />
     <!-- The testing package only states a 1.0.1 floor for Workspaces, which restores as a .NET Framework package
          (NU1701). Pinning the same compiler version the analyzer builds against keeps restore clean. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.9.0" />
     <!-- Transitive dependency of the NuGet client used by the testing package; its default version has a known
          vulnerability (NU1903), so pull a patched one. Not used by the tests themselves. -->
     <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj b/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
index 280a6c2..57ba31d 100644
--- a/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
+++ b/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
@@ -10,11 +10,11 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1" />
     <!-- Same Roslyn the generator is compiled against, for the CSharpGeneratorDriver tests. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
   </ItemGroup>
 
   <ItemGroup>