chore(deps): bump NuGet packages (Aug 2026)

[github-actions]

Caution

Protected files were modified in this change.
This pull request is in request_review mode and requires explicit human scrutiny before merge.

Protected files: Directory.Packages.props

NuGet dependency update

Verification commands run and passed:

dotnet restore Stellar.slnf
dotnet build Stellar.slnf --configuration Release --no-restore
dotnet test Stellar.UnitTests/Stellar.UnitTests.csproj --configuration Release --no-build

All 259 tests passed.

---

Patch updates

Package	Old	New
Microsoft.Extensions.DependencyInjection	10.0.10	10.0.11
Microsoft.Extensions.Logging.Debug	10.0.10	10.0.11
System.Threading.RateLimiting	10.0.10	10.0.11
Microsoft.AspNetCore.Components.WebAssembly	10.0.10	10.0.11
Microsoft.AspNetCore.Components.WebAssembly.DevServer	10.0.10	10.0.11

Minor updates

Package	Old	New
ReactiveUI.Reactive	24.0.0	24.1.0
ReactiveUI.Blazor.Reactive	24.0.0	24.1.0
ReactiveUI.Maui.Reactive	24.0.0	24.1.0
ReactiveUI.WPF.Reactive	24.0.0	24.1.0
ReactiveUI.WinUI.Reactive	24.0.0	24.1.0
Microsoft.Extensions.DependencyInjection.AutoActivation	10.8.0	10.9.0
Microsoft.NET.Test.Sdk	18.8.1	18.9.0
Microsoft.WindowsAppSDK	2.3.1	2.4.0

---

Deliberately skipped

• Microsoft.CodeAnalysis.CSharp 5.0.0 → 5.6.0 — pinned to 5.0.0 per repository policy. A generator only loads in a host whose Roslyn is at least the version it references; raising this above 5.0.0 would silently break consumers on SDK 10.0.1xx and 10.0.2xx.
• xunit.runner.visualstudio 3.1.5 → 4.0.0 — v4 of the runner is designed for xunit v3; the repository stays on xunit 2.9.3, so taking the v4 runner would break test discovery.
• All other packages (Roslynator.Analyzers, stylecop.analyzers, FluentValidation, System.Reactive, ReactiveGenerator, ReactiveUI.SourceGenerators, ReactiveMarbles.ObservableEvents.SourceGenerator, CommunityToolkit.*, Mopups, Avalonia.*, Uno.WinUI, Microsoft.Reactive.Testing, coverlet.collector, xunit) — already at the latest stable release according to dotnet list package --outdated.

---

Pre-existing build errors fixed

The following two files had syntax errors already present in HEAD (committed as part of the ReactiveUI 24 / Avalonia 12 migration) that prevented dotnet build from succeeding. They are unrelated to the package versions being updated, but the verification requirement means the build must pass before opening this PR:

• Stellar.Avalonia/AvaloniaObjectObservableForProperty.cs: \"null\" used inside an interpolated-string expression hole (invalid — should be "null" using C# 11+ bare-quote support); and a missing opening { on the void Handler(...) local function.
• Stellar.Uno/DependencyObjectObservableForProperty.cs: same \"null\" issue on the matching throw statement.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• avbuildtelapiv1.avaloniaui.net
• ccsca2021.crl.certum.pl
• ccsca2021.ocspcertum.com
• crl.certum.pl
• subca.crl.certum.pl
• subca.ocspcertum.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "avbuildtelapiv1.avaloniaui.net"
    - "ccsca2021.crl.certum.pl"
    - "ccsca2021.ocspcertum.com"
    - "crl.certum.pl"
    - "subca.crl.certum.pl"
    - "subca.ocspcertum.com"

See Network Configuration for more information.

Generated by Dependency update · sonnet46 2.4M · ◷

[github-actions]

Protected files were modified in this pull request and require manual scrutiny before merge.

Please verify that each protected-file change is intentional, policy-compliant, and safe:

• Protected files: Directory.Packages.props

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates framework/package dependencies and fixes minor C# source issues (string literal escaping and a missing brace) in the UI-specific observable implementations.

Changes:

• Fix ArgumentException message interpolation to use a normal string literal ("null") inside the interpolation expression.
• Fix/adjust a local handler function brace in Avalonia observable code.
• Bump several NuGet package versions in Directory.Packages.props.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
Stellar.Uno/DependencyObjectObservableForProperty.cs	Fix string literal escaping inside an interpolated expression in an exception message.
Stellar.Avalonia/AvaloniaObjectObservableForProperty.cs	Fix handler brace and update exception message interpolation.
Directory.Packages.props	Update centrally-managed package versions across the repo.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.