Bump Microsoft.CodeAnalysis.Analyzers and Microsoft.CodeAnalysis.CSharp

[dependabot]

Updated Microsoft.CodeAnalysis.Analyzers from 3.11.0 to 5.9.0-1.26328.17.

Release notes

Sourced from Microsoft.CodeAnalysis.Analyzers's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

• Core

5.0.1

Release Notes
Install Instructions

Repo

• Core

4.2.0-4.22266.5

Release

4.2.0-3.22151.16

Release

4.2.0-1.22108.11

Release

4.0.0-2.21354.7

Release

4.0.0-2.21254.26

Release

4.0.0-1.21277.15

Release

Commits viewable in compare view.

Updated Microsoft.CodeAnalysis.CSharp from 4.14.0 to 5.9.0.

Release notes

Sourced from Microsoft.CodeAnalysis.CSharp's releases.

5.0.4

Release

5.0.2

Release Notes
Install Instructions

Repos

• Core

5.0.1

Release Notes
Install Instructions

Repo

• Core

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[raroche]

Closing — this is the Roslyn build-floor trap the pin exists to prevent, and CI now shows it breaking concretely.

Microsoft.CodeAnalysis.CSharp is deliberately held at 4.14.0. The comment in Directory.Packages.props records why: Dependabot's earlier bump to 5.6.0 (PR #331) passed CI but broke dotnet build on any SDK whose compiler is older (CS9057), and it was reverted in #337. This PR repeats that bump, only further (5.9.0).

Concrete evidence this time — build site (DocFX) fails:

error CS0246: The type or namespace name 'PropertyId' could not be found
  src/NetPdf/Rendering/MarginBoxStyle.cs(403,37)

PropertyId is produced by NetPdf.SourceGen, so the new Roslyn stops the source generator from running — exactly the failure mode the pin guards against.

Also note Microsoft.CodeAnalysis.Analyzers is being moved to a prerelease (5.9.0-1.26328.17), which is not something this repo should take from an automated bump.

Per the pin's own rule: bump only in lockstep with the minimum supported .NET SDK, not to the latest Roslyn.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.