From e72b64758d08923d5326caab208cc0ae1d656a6b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 08:18:58 +0000
Subject: [PATCH] Bump CsvHelper and 23 others

Bumps CsvHelper from 33.0.1 to 33.1.0
Bumps Google.Apis.Auth from 1.69.0 to 1.75.0
Bumps Google.Apis.Gmail.v1 from 1.69.0.3742 to 1.74.0.4162
Bumps MailKit from 4.16.0 to 4.17.0
Bumps MassTransit from 8.5.9 to 8.5.10
Bumps MassTransit.RabbitMQ from 8.5.9 to 8.5.10
Bumps MassTransit.TestFramework from 8.5.9 to 8.5.10
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.8 to 10.0.9
Bumps Microsoft.AspNetCore.OpenApi from 10.0.8 to 10.0.9
Bumps Microsoft.AspNetCore.SignalR.StackExchangeRedis from 10.0.8 to 10.0.9
Bumps Microsoft.Extensions.Configuration from 10.0.8 to 10.0.9
Bumps Microsoft.Extensions.Configuration.Binder from 10.0.8 to 10.0.9
Bumps Microsoft.Extensions.Configuration.EnvironmentVariables from 10.0.8 to 10.0.9
Bumps Microsoft.Extensions.Configuration.Json from 10.0.8 to 10.0.9
Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.8 to 10.0.9
Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.8 to 10.0.9
Bumps Microsoft.Extensions.Options from 10.0.8 to 10.0.9
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.15.3 to 1.16.0
Bumps OpenTelemetry.Extensions.Hosting from 1.15.3 to 1.16.0
Bumps Spectre.Console from 0.49.1 to 0.57.1
Bumps System.CommandLine from 2.0.0-beta5.25306.1 to 2.0.9
Bumps WireMock.Net from 2.8.0 to 2.11.0
Bumps xunit.runner.visualstudio from 3.1.4 to 3.1.5
Bumps Xunit.SkippableFact from 1.5.23 to 1.5.61

---
updated-dependencies:
- dependency-name: CsvHelper
  dependency-version: 33.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-patch
- dependency-name: Google.Apis.Auth
  dependency-version: 1.75.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-patch
- dependency-name: Google.Apis.Gmail.v1
  dependency-version: 1.74.0.4162
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-patch
- dependency-name: MailKit
  dependency-version: 4.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-patch
- dependency-name: MassTransit
  dependency-version: 8.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: MassTransit.RabbitMQ
  dependency-version: 8.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: MassTransit.TestFramework
  dependency-version: 8.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Microsoft.AspNetCore.SignalR.StackExchangeRedis
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Microsoft.Extensions.Configuration
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Microsoft.Extensions.Configuration.Binder
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Microsoft.Extensions.Configuration.EnvironmentVariables
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Microsoft.Extensions.Configuration.Json
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Microsoft.Extensions.Options
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-patch
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-patch
- dependency-name: Spectre.Console
  dependency-version: 0.57.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-patch
- dependency-name: System.CommandLine
  dependency-version: 2.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: WireMock.Net
  dependency-version: 2.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-minor-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
- dependency-name: Xunit.SkippableFact
  dependency-version: 1.5.61
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dotnet-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 src/Directory.Packages.props | 50 ++++++++++++++++++------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index 4c46d9d..e2cdf92 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -6,12 +6,12 @@
   <ItemGroup>
     <!-- Framework packages introduced by the SDK project templates (Api/Workers).
          Versionless PackageReferences in those csproj resolve to these. -->
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
     <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.8" />
     <!-- Test stack (versions ship with .NET SDK 10.0.204 templates / current as of 2026-06). -->
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
     <PackageVersion Include="coverlet.collector" Version="6.0.4" />
     <PackageVersion Include="FluentAssertions" Version="6.12.2" />
     <PackageVersion Include="NSubstitute" Version="5.3.0" />
@@ -31,10 +31,10 @@
     <!-- Redis -->
     <PackageVersion Include="StackExchange.Redis" Version="2.13.17" />
     <!-- Messaging (MassTransit 8.x = free Apache-2.0; 9.x is commercial) -->
-    <PackageVersion Include="MassTransit" Version="8.5.9" />
-    <PackageVersion Include="MassTransit.RabbitMQ" Version="8.5.9" />
+    <PackageVersion Include="MassTransit" Version="8.5.10" />
+    <PackageVersion Include="MassTransit.RabbitMQ" Version="8.5.10" />
     <!-- Plan 07 (Workers): in-memory test harness for the consumer unit tests (kept on the 8.5.9 line). -->
-    <PackageVersion Include="MassTransit.TestFramework" Version="8.5.9" />
+    <PackageVersion Include="MassTransit.TestFramework" Version="8.5.10" />
     <PackageVersion Include="RabbitMQ.Client" Version="7.2.1" />
     <!-- Secrets / KMS (Azure Key Vault Keys for envelope wrap/unwrap) -->
     <PackageVersion Include="Azure.Security.KeyVault.Keys" Version="4.10.0" />
@@ -45,8 +45,8 @@
     <PackageVersion Include="Serilog.Sinks.Console" Version="6.1.1" />
     <PackageVersion Include="Serilog.Sinks.InMemory" Version="2.0.0" />
     <PackageVersion Include="Serilog.Sinks.InMemory.Assertions" Version="2.0.0" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.15.3" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.16.0" />
     <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.15.1" />
     <!-- Health checks (Rabbitmq 9.0.0 = RabbitMQ.Client 7.x, matches MassTransit 8.5.9) -->
     <PackageVersion Include="AspNetCore.HealthChecks.NpgSql" Version="9.0.0" />
@@ -56,11 +56,11 @@
     <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.8" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.8" />
     <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.8" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.8" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.9" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.8" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.8" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.9" />
     <!-- Integration-test containers -->
     <PackageVersion Include="Testcontainers.PostgreSql" Version="4.12.0" />
     <PackageVersion Include="Testcontainers.Redis" Version="4.12.0" />
@@ -74,10 +74,10 @@
   <ItemGroup>
     <!-- 4.16.0 is the first release patching CVE-2026-41319 (MailKit STARTTLS response
          injection) and CVE-2026-30227 (MimeKit CRLF injection); earlier 4.x fails NU1902. -->
-    <PackageVersion Include="MailKit" Version="4.16.0" />
-    <PackageVersion Include="MimeKit" Version="4.16.0" />
+    <PackageVersion Include="MailKit" Version="4.17.0" />
+    <PackageVersion Include="MimeKit" Version="4.17.0" />
     <PackageVersion Include="Testcontainers" Version="4.12.0" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.9" />
   </ItemGroup>
 
   <!-- Plan 05 (Connector: Graph). Microsoft.Graph v5 (Kiota-based) + Azure.Identity (already pinned above)
@@ -87,14 +87,14 @@
        (CentralPackageTransitivePinningEnabled); pinned explicitly here for deterministic, audit-clean restore. -->
   <ItemGroup>
     <PackageVersion Include="Microsoft.Graph" Version="5.105.0" />
-    <PackageVersion Include="WireMock.Net" Version="2.8.0" />
+    <PackageVersion Include="WireMock.Net" Version="2.11.0" />
     <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.8" />
     <!-- Override the transitive Microsoft.Kiota.Abstractions (Graph.Core 3.2.5 floats to 1.21.1, which has
          CVE-2026-44503 / GHSA-7j59-v9qr-6fq9, a high-severity RedirectHandler header-leak → fails NU1903).
          1.22.0 is the patched release; pinning it here lifts the transitive resolution solution-wide. -->
     <PackageVersion Include="Microsoft.Kiota.Abstractions" Version="1.22.0" />
     <!-- Conditional [SkippableFact] for the gated M365 live-smoke tests (xUnit 2.9.3 has no dynamic skip). -->
-    <PackageVersion Include="Xunit.SkippableFact" Version="1.5.23" />
+    <PackageVersion Include="Xunit.SkippableFact" Version="1.5.61" />
   </ItemGroup>
 
   <!-- Plan 06 (Connector: Gmail). Google.Apis.Gmail.v1 is the Gmail v1 SDK; Google.Apis.Auth supplies
@@ -102,8 +102,8 @@
        Newtonsoft.Json stack transitively (auto-pinned via CentralPackageTransitivePinningEnabled).
        WireMock.Net (pinned above) mocks Gmail HTTP for offline fixtures. -->
   <ItemGroup>
-    <PackageVersion Include="Google.Apis.Gmail.v1" Version="1.69.0.3742" />
-    <PackageVersion Include="Google.Apis.Auth" Version="1.69.0" />
+    <PackageVersion Include="Google.Apis.Gmail.v1" Version="1.74.0.4162" />
+    <PackageVersion Include="Google.Apis.Auth" Version="1.75.0" />
   </ItemGroup>
 
   <!-- Plan 08 (API) test stack. Microsoft.AspNetCore.Mvc.Testing boots the in-process server via
@@ -114,7 +114,7 @@
     <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.8" />
     <!-- Task 6: the Redis SignalR backplane for horizontal hub fan-out across API nodes
          (conditionally enabled when Redis:Configuration is present; off in tests). -->
-    <PackageVersion Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="10.0.9" />
   </ItemGroup>
 
   <!-- Plan 08 (API) identity + auth. Microsoft.AspNetCore.Identity.EntityFrameworkCore hosts the
@@ -123,12 +123,12 @@
        handler the issuer uses. Pinned to the .NET 10 servicing line (10.0.8). -->
   <ItemGroup>
     <PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.8" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
   </ItemGroup>
 
   <!-- Plan 08 (API) Task 5: CsvHelper (MS-PL/Apache-2.0) parses the multipart mailbox-scope CSV upload. -->
   <ItemGroup>
-    <PackageVersion Include="CsvHelper" Version="33.0.1" />
+    <PackageVersion Include="CsvHelper" Version="33.1.0" />
   </ItemGroup>
 
   <!-- Plan 08 (API) Task 10: QuestPDF (MIT for OSS via the Community license) renders the downloadable
@@ -141,9 +141,9 @@
        the human-readable tables/spinners; the Configuration.Json + EnvironmentVariables providers back
        the profile/secret resolution stack. All MIT/Apache-2.0, container-friendly. -->
   <ItemGroup>
-    <PackageVersion Include="System.CommandLine" Version="2.0.0-beta5.25306.1" />
-    <PackageVersion Include="Spectre.Console" Version="0.49.1" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.8" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.8" />
+    <PackageVersion Include="System.CommandLine" Version="2.0.9" />
+    <PackageVersion Include="Spectre.Console" Version="0.57.1" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.9" />
   </ItemGroup>
 </Project>