Update all dependencies (09/2026)

.github/workflows/build.yml

@@ -11,20 +11,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
         fetch-depth: 0
 
     - name: Git Semantic Version
       id: version
-      uses: PaulHatch/semantic-version@v6.0.3
+      uses: PaulHatch/semantic-version@4d6da96a9bc3116da3613309a11ff75fba58eb8d # v6.0.3
       with:
         tag_prefix: ''
         version_format: "${major}.${minor}.${patch}${{ !inputs.forRelease && '-preview${increment}' || '' }}"
         search_commit_body: true
 
     - name: Setup dotnet from global.json
-      uses: actions/setup-dotnet@v6
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
       with:
         global-json-file: global.json
 
@@ -35,7 +35,7 @@ jobs:
       run: dotnet test -c Release --no-build --report-trx --report-trx-filename "{asm}_report.trx" --coverage --coverage-output-format cobertura
 
     - name: Upload dotnet test results
-      uses: dorny/test-reporter@v3.0.0
+      uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       if: ${{ !cancelled() }}
       with:
         name: .NET Tests
@@ -57,13 +57,13 @@ jobs:
       run: cat codecoveragereport/SummaryGithub.md >> $GITHUB_STEP_SUMMARY
 
     - name: Upload code coverage report
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: code-coverage-report
         path: codecoveragereport
 
     - name: Upload package artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: packages
         path: "**/*.nupkg"

.github/workflows/codeql-analysis.yml

@@ -26,23 +26,23 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
       with:
         languages: ${{ matrix.language }}
 
     - name: Setup dotnet from global.json
-      uses: actions/setup-dotnet@v6
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
       with:
         global-json-file: global.json
 
     - name: Build projects
       run: dotnet build -c Release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/generate-docs.yml

@@ -7,15 +7,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Build documentation site
-        uses: wechooz/docfx-action@v10.0.0
+        uses: wechooz/docfx-action@893328456efc0d2dc91a9ebfe9d533ca594598bc # v10.0.0
         with:
           args: docs/docfx.json
 
       - name: Upload documentation archive
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: artifacts/_site
 

.github/workflows/publish-packages-myget.yml

@@ -21,7 +21,7 @@ jobs:
       name: ${{ inputs.environmentName }}
     steps:
       - name: Download package artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: packages
 

.github/workflows/publish-packages-nuget.yml

@@ -19,12 +19,12 @@ jobs:
       id-token: write
     steps:
       - name: Download package artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: packages
 
       - name: NuGet login (OIDC → temp API key)
-        uses: NuGet/login@v1
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1
         id: login
         with:
           user: ${{ secrets.owner }}

.github/workflows/release.yml

@@ -42,5 +42,5 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Publish documentation
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
         id: deployment

Directory.Packages.props

@@ -12,10 +12,10 @@
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="10.0.0" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.0.0" />
-		<PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.10.0" />
-		<PackageVersion Include="Microsoft.Testing.Extensions.TrxReport" Version="2.3.3" />
+		<PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.11.2" />
+		<PackageVersion Include="Microsoft.Testing.Extensions.TrxReport" Version="2.4.0" />
 		<PackageVersion Include="NSubstitute" Version="6.2.0" />
     <PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
-		<PackageVersion Include="xunit.v3.mtp-v2" Version="4.0.0" />
+		<PackageVersion Include="xunit.v3.mtp-v2" Version="4.0.1" />
   </ItemGroup>
 </Project>

global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "10.0.400",
+    "version": "10.0.401",
     "allowPrerelease": false,
     "rollForward": "latestFeature"
   },