From c5e875e9a27a22d50efd5663228723c0aff3175d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 13:27:52 +0000
Subject: [PATCH] Bump Microsoft.CodeAnalysis.Analyzers and 4 others

Bumps Microsoft.CodeAnalysis.Analyzers from 3.3.4 to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp from 4.8.0 to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp.Workspaces from 4.8.0 to 5.9.0
Bumps Microsoft.NET.Test.Sdk from 17.14.1 to 18.11.0
Bumps xunit.runner.visualstudio from 3.1.4 to 4.0.1

---
updated-dependencies:
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp.Workspaces
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 src/SheetStream.Analyzers/SheetStream.Analyzers.csproj     | 4 ++--
 src/SheetStream.Generators/SheetStream.Generators.csproj   | 4 ++--
 .../SheetStream.Analyzers.Tests.csproj                     | 7 ++++---
 .../SheetStream.Generators.Tests.csproj                    | 7 ++++---
 4 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj b/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
index 4545293..27687fb 100644
--- a/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
+++ b/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
@@ -25,8 +25,8 @@
     <!-- 4.8.0 is the oldest compiler the analyzer supports (VS 2022 17.8 / .NET SDK 8.0). Newer compilers load
          analyzers built against older Microsoft.CodeAnalysis, so staying low maximises compatibility. PrivateAssets
          keeps the compiler assemblies out of any package that references this project. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/SheetStream.Generators/SheetStream.Generators.csproj b/src/SheetStream.Generators/SheetStream.Generators.csproj
index 99e2143..aafd07c 100644
--- a/src/SheetStream.Generators/SheetStream.Generators.csproj
+++ b/src/SheetStream.Generators/SheetStream.Generators.csproj
@@ -24,8 +24,8 @@
   <ItemGroup>
     <!-- 4.8.0 is the compiler shipped with .NET 8 / VS 17.8: the oldest host the generator supports.
          Newer SDKs (including .NET 10) load it unchanged. PrivateAssets keeps it out of any consumer's graph. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj b/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
index f676f74..1039bfe 100644
--- a/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
+++ b/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
@@ -9,16 +9,17 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" />
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing" Version="1.1.4" />
     <!-- The testing package only states a 1.0.1 floor for Workspaces, which restores as a .NET Framework package
          (NU1701). Pinning the same compiler version the analyzer builds against keeps restore clean. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.9.0" />
     <!-- Transitive dependency of the NuGet client used by the testing package; its default version has a known
          vulnerability (NU1903), so pull a patched one. Not used by the tests themselves. -->
     <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj b/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
index 280a6c2..52dae46 100644
--- a/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
+++ b/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
@@ -10,11 +10,12 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1" />
     <!-- Same Roslyn the generator is compiled against, for the CSharpGeneratorDriver tests. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
   </ItemGroup>
 
   <ItemGroup>