Clear the dependency advisories that turned the audit red

[arnelirobles]

The dependency audit job has been failing since at least 15 August. Every other job passes: build and test are green on both Windows and Ubuntu, the core-stays-dependency-free check passes, formatting passes.

No shipped package was affected

Checked before changing anything:

SHIPPED projects affected:        0
TEST/EXAMPLE projects affected:  13

All five advisories reached test projects only. Anyone consuming Mapsicle from NuGet was never exposed. The problem was a red build, not a vulnerable release.

What was actually wrong

Package	Reached via	Fix
System.Net.Http 4.3.0	xunit 2.4.2	xunit 2.9.3
System.Text.RegularExpressions 4.3.0	xunit 2.4.2	xunit 2.9.3
SQLitePCLRaw.lib.e_sqlite3 2.1.6	Microsoft.Data.Sqlite 8.0.0	8.0.30
System.Text.Json 8.0.0	Microsoft.AspNetCore.Mvc.Testing 8.0.0	8.0.30

The first two are the .NET Standard 1.x compatibility shims that old xunit still dragged in. Modern xunit dropped them. The other two were patch-zero packages that have had thirty patches published since.

Nothing in this repository changed to cause the failure. The advisories were published against dependencies that were already sitting there, which is why there is no commit behind the first red run.

Verified, running CI's exact command

dotnet restore Mapsicle.sln /p:NuGetAudit=true /p:NuGetAuditMode=all \
  /p:WarningsNotAsErrors= /p:TreatWarningsAsErrors=true

EXIT: 0        advisories: 0

And the whole suite:

525 passed, 0 failed, across 13 test projects

Two follow-ups worth opening separately

Central Package Management. These versions are declared independently in 13 .csproj files, which is why one bump touched thirteen places and why they had drifted (coverlet.collector was at 6.0.0 in seven projects and 6.0.4 in one). A Directory.Packages.props makes the next advisory a one-line change.

The audit will go red again. It is NuGetAuditMode=all with TreatWarningsAsErrors=true, so any advisory published against any transitive dependency of any project fails the build, with no commit behind it. That is a defensible choice for a package with this many downloads, but it means the job is a scheduled maintenance obligation rather than a gate on the diff. Worth either running it on a schedule as well as on PRs, so it is noticed on its own terms, or scoping the failure to shipped projects and reporting test-only advisories as warnings.

Summary by CodeRabbit

• Chores
  • Updated testing and code coverage tooling to newer versions across the test suite.
  • Refreshed supporting test utilities, including database testing dependencies.
  • No changes were made to application functionality or public APIs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4f138aae-1778-4566-81bf-1348f10c38d8

📥 Commits

Reviewing files that changed from the base of the PR and between 4ecfa62 and 4ac9f2a.

📒 Files selected for processing (13)

• tests/Mapsicle.AspNetCore.Tests/Mapsicle.AspNetCore.Tests.csproj
• tests/Mapsicle.Audit.Tests/Mapsicle.Audit.Tests.csproj
• tests/Mapsicle.Caching.Tests/Mapsicle.Caching.Tests.csproj
• tests/Mapsicle.Dapper.Tests/Mapsicle.Dapper.Tests.csproj
• tests/Mapsicle.DataAnnotations.Tests/Mapsicle.DataAnnotations.Tests.csproj
• tests/Mapsicle.EntityFramework.Tests/Mapsicle.EntityFramework.Tests.csproj
• tests/Mapsicle.Fluent.Tests/Mapsicle.Fluent.Tests.csproj
• tests/Mapsicle.Json.Tests/Mapsicle.Json.Tests.csproj
• tests/Mapsicle.NamingConventions.Tests/Mapsicle.NamingConventions.Tests.csproj
• tests/Mapsicle.Performance.Tests/Mapsicle.Performance.Tests.csproj
• tests/Mapsicle.Serilog.Tests/Mapsicle.Serilog.Tests.csproj
• tests/Mapsicle.Tests/Mapsicle.Tests.csproj
• tests/Mapsicle.Validation.Tests/Mapsicle.Validation.Tests.csproj

Included review availability: Your plan includes up to 3 reviews per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Updated testing and supporting package versions in 13 test project files. Existing package asset settings and selected unchanged dependencies remain intact.

Changes

Test dependency updates

Layer / File(s)	Summary
Upgrade test package references tests/*/*.csproj	Updated Microsoft.NET.Test.Sdk, xUnit, xUnit runner, Coverlet Collector, ASP.NET Core testing, and SQLite package versions. Existing asset settings remain unchanged where specified.
Estimated code review effort: 1 (Trivial)	~5 minutes

Merge Risk: ⚪ Minimal · up to 4ac9f

This change updates dependencies used by test projects to clear audit advisories without affecting shipped packages. No actionable merge-blocking risk remains beyond normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: updating dependencies to resolve the failing dependency audit.
Description check	✅ Passed	The description clearly explains the advisories, affected projects, dependency updates, verification results, and follow-up items.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bugfix/test-dependency-advisories

---

_{Comment @coderabbitai help to get the list of available commands.}