From d2e0bd20325c5742e6171deb810fc67fee52b1ed Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 11 Nov 2026 13:29:55 +0000
Subject: [PATCH] Bump Microsoft.CodeAnalysis.Analyzers and 5 others

Bumps Microsoft.CodeAnalysis.Analyzers from 3.3.4 to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp from 4.8.0 to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp.Workspaces from 4.8.0 to 5.9.0
Bumps Microsoft.NET.Test.Sdk from 17.14.1 to 18.11.1
Bumps System.Security.Cryptography.Pkcs from 10.0.13 to 11.0.0
Bumps xunit.runner.visualstudio from 3.1.4 to 4.0.1

---
updated-dependencies:
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp.Workspaces
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: System.Security.Cryptography.Pkcs
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 src/SheetStream.Analyzers/SheetStream.Analyzers.csproj   | 4 ++--
 src/SheetStream.Generators/SheetStream.Generators.csproj | 4 ++--
 .../SheetStream.Analyzers.Tests.csproj                   | 9 +++++----
 .../SheetStream.Generators.Tests.csproj                  | 7 ++++---
 4 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj b/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
index 4545293..27687fb 100644
--- a/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
+++ b/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
@@ -25,8 +25,8 @@
     <!-- 4.8.0 is the oldest compiler the analyzer supports (VS 2022 17.8 / .NET SDK 8.0). Newer compilers load
          analyzers built against older Microsoft.CodeAnalysis, so staying low maximises compatibility. PrivateAssets
          keeps the compiler assemblies out of any package that references this project. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/SheetStream.Generators/SheetStream.Generators.csproj b/src/SheetStream.Generators/SheetStream.Generators.csproj
index 99e2143..aafd07c 100644
--- a/src/SheetStream.Generators/SheetStream.Generators.csproj
+++ b/src/SheetStream.Generators/SheetStream.Generators.csproj
@@ -24,8 +24,8 @@
   <ItemGroup>
     <!-- 4.8.0 is the compiler shipped with .NET 8 / VS 17.8: the oldest host the generator supports.
          Newer SDKs (including .NET 10) load it unchanged. PrivateAssets keeps it out of any consumer's graph. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj b/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
index f676f74..793ec8a 100644
--- a/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
+++ b/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
@@ -9,16 +9,17 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" />
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing" Version="1.1.4" />
     <!-- The testing package only states a 1.0.1 floor for Workspaces, which restores as a .NET Framework package
          (NU1701). Pinning the same compiler version the analyzer builds against keeps restore clean. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.9.0" />
     <!-- Transitive dependency of the NuGet client used by the testing package; its default version has a known
          vulnerability (NU1903), so pull a patched one. Not used by the tests themselves. -->
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="11.0.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj b/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
index 280a6c2..6334ca5 100644
--- a/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
+++ b/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
@@ -10,11 +10,12 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1" />
     <!-- Same Roslyn the generator is compiled against, for the CSharpGeneratorDriver tests. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
   </ItemGroup>
 
   <ItemGroup>