chore(deps): update NuGet packages (patch/minor)

[github-actions]

Caution

Protected files were modified in this change.
This pull request is in request_review mode and requires explicit human scrutiny before merge.

Protected files: Directory.Packages.props

NuGet package updates

Minor

Package	Old	New
Microsoft.Extensions.DependencyInjection.AutoActivation	10.8.0	10.9.0
ReactiveUI.Reactive	24.0.0	24.1.0
ReactiveUI.Blazor.Reactive	24.0.0	24.1.0
ReactiveUI.Maui.Reactive	24.0.0	24.1.0
ReactiveUI.WPF.Reactive	24.0.0	24.1.0
ReactiveUI.WinUI.Reactive	24.0.0	24.1.0
Microsoft.WindowsAppSDK	2.3.1	2.4.0
Microsoft.NET.Test.Sdk	18.8.1	18.9.0

Patch

Package	Old	New
Microsoft.Extensions.DependencyInjection	10.0.10	10.0.11
System.Threading.RateLimiting	10.0.10	10.0.11
Microsoft.AspNetCore.Components.WebAssembly	10.0.10	10.0.11
Microsoft.AspNetCore.Components.WebAssembly.DevServer	10.0.10	10.0.11

---

Packages deliberately not updated

• Microsoft.CodeAnalysis.CSharp (5.0.0 → 5.9.0): Left at 5.0.0 per the documented policy — a source generator must not reference a Roslyn version newer than the host SDK feature band floor. Raising it would silently break Stellar.SourceGenerators for any consumer below SDK 10.0.3xx.
• xunit.runner.visualstudio (3.1.5 → 4.0.0): 4.0.0 is the xunit v3 runner; it is not compatible with the xunit 2.x packages in use here. Kept at 3.1.5.
• xunit (2.9.3): No newer stable 2.x release. Policy explicitly forbids migrating to xunit v3.
• stylecop.analyzers (1.2.0-beta.556): No stable release exists; kept on the 1.2.0-beta.* line. No newer beta was found.
• Avalonia / Avalonia.Desktop / Avalonia.Fonts.Inter / Avalonia.Themes.Fluent (12.1.1): dotnet list --outdated showed no newer stable release.
• All other packages (FluentValidation, ReactiveGenerator, ReactiveUI.SourceGenerators, ReactiveMarbles.ObservableEvents.SourceGenerator, Microsoft.Maui.Controls, CommunityToolkit.*, Mopups, Uno.WinUI, System.Reactive, Microsoft.Reactive.Testing, coverlet.collector, Microsoft.Extensions.Logging.Debug, Microsoft.CodeAnalysis.NetAnalyzers, Roslynator.Analyzers): already at latest stable.

---

Pre-existing build failures (unrelated to this PR)

dotnet build Stellar.slnf fails with syntax errors in Stellar.Avalonia/AvaloniaObjectObservableForProperty.cs and Stellar.Uno/DependencyObjectObservableForProperty.cs. These are pre-existing issues — only Directory.Packages.props was modified in this PR and git diff HEAD confirms those source files are unchanged.

---

Verification

dotnet restore Stellar.slnf                                                    ✅ succeeded
dotnet build Stellar.UnitTests/Stellar.UnitTests.csproj --configuration Release  ✅ 0 errors, 0 warnings
dotnet test  Stellar.UnitTests/Stellar.UnitTests.csproj --configuration Release  ✅ 259 passed, 0 failed

Full Stellar.slnf build has pre-existing failures in Avalonia/Uno (see above); the test project and all its dependencies build and pass cleanly.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• avbuildtelapiv1.avaloniaui.net
• ccsca2021.crl.certum.pl
• ccsca2021.ocspcertum.com
• crl.certum.pl
• subca.crl.certum.pl
• subca.ocspcertum.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "avbuildtelapiv1.avaloniaui.net"
    - "ccsca2021.crl.certum.pl"
    - "ccsca2021.ocspcertum.com"
    - "crl.certum.pl"
    - "subca.crl.certum.pl"
    - "subca.ocspcertum.com"

See Network Configuration for more information.

Generated by Dependency update · sonnet46 2M · ◷

[github-actions]

Protected files were modified in this pull request and require manual scrutiny before merge.

Please verify that each protected-file change is intentional, policy-compliant, and safe:

• Protected files: Directory.Packages.props

[Copilot]

Pull request overview

This PR updates centrally managed NuGet package versions in Directory.Packages.props to pick up recent patch/minor releases across the StellarUI stack (Microsoft.Extensions / Blazor WASM, ReactiveUI 24.1, WindowsAppSDK, and test SDK), keeping dependency baselines current while preserving the existing pinning policy for Roslyn/xUnit.

Changes:

• Bumped Microsoft.Extensions.DependencyInjection and System.Threading.RateLimiting to 10.0.11, and Microsoft.Extensions.DependencyInjection.AutoActivation to 10.9.0.
• Updated the ReactiveUI .Reactive family from 24.0.0 to 24.1.0.
• Updated Microsoft.WindowsAppSDK to 2.4.0 and Microsoft.NET.Test.Sdk to 18.9.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.