deps: staleness sweep — every pin to latest published

[ANcpLua]

Version.props is SDK truth: it ships inside the packages and flows into every consumer, so a stale pin there is a stale pin everywhere. The trigger was ANcpLua.Analyzers — GlobalPackages.props injects it as a GlobalPackageReference, so a consumer on this SDK physically cannot reach 2.1.2 until this file moves. Swept everything else in the same pass.

Every version verified against the flat-container index and cross-checked against the search API, so an unlisted version cannot masquerade as latest. No package moved to a prerelease unless its current pin was already a prerelease of the same package (the four Microsoft.Agents.AI preview-track packages have no stable release at all).

Package	Old	New
DotNetSdkVersion (→ Microsoft.CodeAnalysis.NetAnalyzers, templates' global.json)	10.0.301	10.0.400
Basic.Reference.Assemblies.Net100	1.8.9	1.8.11
Meziantou.Framework	6.0.1	6.0.4
Meziantou.Framework.FullPath	3.0.1	3.0.4
Meziantou.Framework.ProcessWrapper	2.0.1	2.0.4
Meziantou.Framework.TemporaryDirectory	3.0.1	3.0.4
xunit.v3.mtp-v2	3.2.2	4.0.0
AwesomeAssertions	9.4.0	9.6.0
Microsoft.Testing.Platform + the five MTP extensions	2.3.2	2.4.0
Microsoft.Testing.Extensions.CodeCoverage	18.9.0	18.11.0
GitHubActionsTestLogger	3.0.4	3.0.5
ANcpLua.Analyzers	2.1.1	2.1.2
MicrosoftExtensionsVersion (dotnet/extensions family)	10.8.0	10.9.0
AspNetCoreVersion	10.0.10	10.0.11
Microsoft.Bcl.AsyncInterfaces	10.0.10	10.0.11
NuGet.Protocol / NuGet.Packaging	7.6.0	7.9.0
MSBuild.StructuredLogger	2.3.213	2.3.246
Microsoft.Agents.AI stable track (core, Abstractions, Workflows, OpenAI, Workflows.Declarative)	1.13.0	1.20.0
Microsoft.Agents.AI preview track (Hosting, Hosting.AGUI.AspNetCore, Anthropic, DevUI)	1.13.0-preview.260703.1	1.20.0-preview.260831.1
global.json ANcpLua.NET.Sdk.Test self-pin (last published)	3.4.44	3.4.46

Already latest, left alone: Roslyn 5.9.0, Microsoft.CodeAnalysis.Analyzers 5.9.0, Microsoft.CodeAnalysis.BannedApiAnalyzers 5.6.0, AwesomeAssertions.Analyzers 9.0.8, Microsoft.Sbom.Targets 4.1.5, Microsoft.Deployment.DotNet.Releases 1.0.2 (2.0.0 is prerelease only).

Fallout, fixed rather than capped

• NuGet.* 7.9.0 annotates GetResourceAsync<T>() and DownloadResourceResult.PackageReader as nullable → six CS8602 in ConfigFilesGenerator under TreatWarningsAsErrors. Each site now throws naming the source or package it could not resolve, instead of dereferencing blind.
• Meziantou.Framework.FullPath 3.0.4 ships MFFP0015, which caught Build_WhenEditorConfigFileExists_IncludedInBinlog comparing a FullPath by its ordinal string form. The macOS /private realpath variant is now built as a FullPath and compared with the platform's comparer.

Nothing was pinned back, and no shim was added.

Why 2.1.2 matters beyond the version number

ANcpLua.Analyzers 2.1.2 is the release that makes <AlAnalysisMode> work at all — the three profiles shipped as sectioned analyzer configs, whose globs Roslyn resolves relative to the package folder under ~/.nuget/packages/, so every profile was inert. They are now emitted with is_global = true. The stale 2.1.0 comment in Version.props is rewritten to say this.

Generated files

src/Config/Analyzer.xunit.analyzers.editorconfig regenerated by ConfigFilesGenerator for xunit.v3 4.0.0 — 21 new rules (xUnit1054-1069, xUnit2033, xUnit3004-3007). No drift in the NetAnalyzers, ANcpLua.Analyzers or BannedApiAnalyzers configs.

Gates

Local macOS: dotnet build -c Release clean (0 warnings), and all 245 SDK behaviour tests pass — the suite packs the SDK and builds throwaway consumer projects against it across all three import styles, so the bumped pins are exercised through the real import chain, not just compiled.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.