Review, validate, and merge all open Dependabot dependency-update PRs

[JoshuaRowePhantom]

Summary

There are 12 open Dependabot PRs in JoshuaRowePhantom/Phantom.Workspaces spanning NuGet package updates (Avalonia, Dock, Microsoft.Extensions.*, MongoDB.Bson, coverlet, xunit, MCP, JsonSchema/JsonPatch) and GitHub Actions updates (actions/checkout, actions/upload-artifact). This issue tracks reviewing, validating (full build + full test suite green), and merging each PR — or deliberately closing any that must not be taken, with the reason recorded. Impact: dependencies are drifting from upstream; security and compatibility updates are unapplied, and grouped/coordinated updates (Avalonia + Dock) risk conflicting with each other if landed in the wrong order.

Open Dependabot PRs

PR	Update	Type	Notes / Risk
#1339	Dock.Avalonia, Dock.Avalonia.Themes.Fluent 12.0.0.2 -> 12.1.0.2	NuGet	Higher risk. Dock is currently deliberately pinned at 12.0.0.2 in features\Directory.Packages.props (see Dock.Avalonia, Dock.Avalonia.Themes.Fluent, Dock.Model.Avalonia, Dock.Model.Mvvm, Dock.Serializer.SystemTextJson). A 12.0.0.2 -> 12.1.0.2 upgrade was previously evaluated in the context of reference-cycle serialization fixes. Must stay mutually compatible with the Avalonia versions landed by #1336 / #1227. Note this PR only bumps two of the five Dock.* pins — the other three would need to move in lockstep.
#1337	microsoft group (10 updates)	NuGet	Broad blast radius. Bumps: Microsoft.AspNetCore.TestHost 10.0.8→10.0.11, Microsoft.DevTunnels.Contracts/Management 1.3.50→1.3.51, Microsoft.Extensions.AI.Abstractions/AI.OpenAI 10.5.2→10.9.0, Microsoft.Extensions.Logging/Logging.Abstractions/Logging.Console 10.0.7→10.0.11, Microsoft.Extensions.TimeProvider.Testing 10.7.0→10.9.0, and Microsoft.NET.Test.Sdk 17.14.1→18.9.0 (major bump for the test SDK). Touches Extensions.AI (used broadly across LLM/agent code) and the test host.
#1336	avalonia group (8 updates) 12.1.0 -> 12.1.1	NuGet	Coordinated Avalonia patch bump across Avalonia, Avalonia.Desktop, Avalonia.Fonts.Inter, Avalonia.Headless, Avalonia.Headless.XUnit, Avalonia.Markup.Xaml.Loader, Avalonia.Themes.Fluent, and Avalonia.Controls.WebView 12.0.1→12.1.0. Must be reconciled with #1227 (overlapping subset) and validated against the Dock version chosen in #1339.
#1230	JsonSchema.Net 9.2.1 -> 9.4.0	NuGet	Low risk. Straightforward minor bump.
#1227	Avalonia and 5 others	NuGet	Overlaps with #1336 — bumps Avalonia.Headless / Avalonia.Headless.XUnit 12.1.0 -> 12.1.1 (subset of #1336). Whichever lands second must be rebased/closed as redundant.
#1117	MongoDB.Bson 3.4.0 -> 3.10.0	NuGet	Minor-version jump. Note MongoDB.Driver is pinned at 3.4.0 alongside MongoDB.Bson in Directory.Packages.props — bumping only MongoDB.Bson may drift the two out of sync; verify the driver still supports the newer Bson or bump both together.
#1115	JsonPatch.Net 5.0.2 -> 5.0.3	NuGet	Low risk. Patch bump.
#29	xunit.runner.visualstudio 3.1.4 -> 3.1.5	NuGet	Low risk. Patch bump.
#19	ModelContextProtocol, ModelContextProtocol.AspNetCore	NuGet	Higher risk. MCP libraries — potential API-surface changes; verify pinned ModelContextProtocol / ModelContextProtocol.AspNetCore 1.3.0 targets still compile and tests pass.
#14	coverlet.collector 6.0.4 -> 10.0.1	NuGet	Higher risk — major-version jump (6.x -> 10.x) affecting the test/coverage pipeline. Verify coverage output still works locally and in CI.
#2	actions/upload-artifact v4 -> v7	GitHub Actions	Higher risk — major bump. upload-artifact v4+ changed artifact behavior (no more artifact mutation, one artifact per name per run). Verify all .github\workflows\*.yml still upload/collect artifacts correctly.
#1	actions/checkout v4 -> v7	GitHub Actions	Higher risk — major bump. Confirm submodule / fetch-depth / token behavior is unchanged for ci.yml, ci-full.yml, publish-validation.yml, and release.yml.

Affected Files

File	Reason
features\Directory.Packages.props	Central NuGet version pins for the main solution; nearly all NuGet bumps land here (Avalonia*, Dock., Microsoft.Extensions., MongoDB., ModelContextProtocol, JsonSchema.Net, JsonPatch.Net, xunit.runner.visualstudio, coverlet.collector).
Any additional Directory.Packages.props under submodules (e.g. Phantom.Workspaces-LLM, if bumped independently)	Verify no secondary CPM file exists that also pins these packages; if so, keep versions in sync.
Any .csproj under features\ with a direct Version="..." attribute	Sanity-check — the repo uses central package management so this should be rare, but confirm no direct pins bypass CPM.
features\.github\workflows\ci.yml, ci-full.yml, publish-validation.yml, release.yml	Bumps for actions/checkout@v4 -> v7 (#1) and actions/upload-artifact@v4 -> v7 (#2).

Design / Fix (process)

Ordered plan:

1. Land low-risk NuGet bumps first, one at a time, each with a full local build + full test run and a green CI:
   • Bump JsonPatch.Net from 5.0.2 to 5.0.3 #1115 JsonPatch.Net 5.0.2 -> 5.0.3
   • Bump JsonSchema.Net from 9.2.1 to 9.4.0 #1230 JsonSchema.Net 9.2.1 -> 9.4.0
   • Bump xunit.runner.visualstudio from 3.1.4 to 3.1.5 #29 xunit.runner.visualstudio 3.1.4 -> 3.1.5
   • Bump MongoDB.Bson from 3.4.0 to 3.10.0 #1117 MongoDB.Bson 3.4.0 -> 3.10.0 — decide whether to also bump MongoDB.Driver in the same change to keep the pair in sync.
2. Land the GitHub Actions bumps Bump actions/checkout from 4 to 7 #1 (actions/checkout v4 -> v7) and Bump actions/upload-artifact from 4 to 7 #2 (actions/upload-artifact v4 -> v7). Confirm every workflow under features\.github\workflows still runs; pay particular attention to artifact upload/download naming under upload-artifact v4+.
3. Resolve the Avalonia + Dock cluster together (Bump Dock.Avalonia and Dock.Avalonia.Themes.Fluent #1339, Bump the avalonia group with 8 updates #1336, Bump Avalonia and 5 others #1227). Steps:
   • Explicitly decide whether to lift the deliberate Dock.* = 12.0.0.2 pin. If yes, extend Bump Dock.Avalonia and Dock.Avalonia.Themes.Fluent #1339 to also bump Dock.Model.Avalonia, Dock.Model.Mvvm, and Dock.Serializer.SystemTextJson to 12.1.0.2 so all five Dock packages move together.
   • Pick the target Avalonia version (12.1.1 from Bump the avalonia group with 8 updates #1336, superset of Bump Avalonia and 5 others #1227) and confirm Dock 12.1.0.2 is compatible.
   • Merge in an order that avoids conflicts — typically Avalonia group first, then Dock — rebasing whichever lands second, and closing Bump Avalonia and 5 others #1227 as subsumed by Bump the avalonia group with 8 updates #1336.
   • Record the decision (accept Dock bump vs. hold the pin) in a comment on this issue.
4. Land the microsoft group (Bump the microsoft group with 10 updates #1337). Special attention to Microsoft.NET.Test.Sdk 17 -> 18 (major) and Microsoft.Extensions.AI.* 10.5.2 -> 10.9.0 (AI stack).
5. Land the higher-risk singletons with extra validation:
   • Bump coverlet.collector from 6.0.4 to 10.0.1 #14 coverlet.collector 6 -> 10 (verify coverage report generation locally + CI).
   • Bump ModelContextProtocol and ModelContextProtocol.AspNetCore #19 ModelContextProtocol / .AspNetCore (verify MCP host/client code compiles and MCP-related tests pass).
6. Post-merge: trigger Dependabot to re-check (or let its next scheduled run happen) and confirm no residual PRs remain unaddressed.
7. For any PR that cannot be taken, close it with a comment stating the reason (e.g., "Dock pin retained deliberately — see this issue") so future Dependabot runs don't quietly re-open the same bump without context.

Checklist (tick as each PR is merged or deliberately closed):

• Bump JsonPatch.Net from 5.0.2 to 5.0.3 #1115 JsonPatch.Net 5.0.2 -> 5.0.3
• Bump JsonSchema.Net from 9.2.1 to 9.4.0 #1230 JsonSchema.Net 9.2.1 -> 9.4.0
• Bump xunit.runner.visualstudio from 3.1.4 to 3.1.5 #29 xunit.runner.visualstudio 3.1.4 -> 3.1.5
• Bump MongoDB.Bson from 3.4.0 to 3.10.0 #1117 MongoDB.Bson 3.4.0 -> 3.10.0 (± MongoDB.Driver)
• Bump actions/checkout from 4 to 7 #1 actions/checkout v4 -> v7
• Bump actions/upload-artifact from 4 to 7 #2 actions/upload-artifact v4 -> v7
• Bump the avalonia group with 8 updates #1336 avalonia group 12.1.0 -> 12.1.1
• Bump Avalonia and 5 others #1227 Avalonia headless subset (likely closed as subsumed by Bump the avalonia group with 8 updates #1336)
• Bump Dock.Avalonia and Dock.Avalonia.Themes.Fluent #1339 Dock.Avalonia + Dock.Avalonia.Themes.Fluent 12.0.0.2 -> 12.1.0.2 (decision recorded)
• Bump the microsoft group with 10 updates #1337 microsoft group (10 updates)
• Bump coverlet.collector from 6.0.4 to 10.0.1 #14 coverlet.collector 6.0.4 -> 10.0.1
• Bump ModelContextProtocol and ModelContextProtocol.AspNetCore #19 ModelContextProtocol + .AspNetCore

Expected Tests

This is a dependency-maintenance / process bug, not a code-logic change, so no new tests are authored. The acceptance gate is that the existing full build and full test suite must remain green after each merge.

Verification	Scope	What It Confirms
Full solution build	all projects under features\	No compile breaks from bumped APIs (esp. Microsoft.Extensions.AI 10.5 -> 10.9, MCP, Avalonia 12.1.1, Dock 12.1.0.2).
Full test suite (fast + slow)	all test projects	No behavioral regressions from dependency updates.
CI workflow run	.github\workflows\ci.yml, ci-full.yml, publish-validation.yml, release.yml	actions/checkout@v7 + actions/upload-artifact@v7 succeed end-to-end (checkout + artifact upload/download).
Coverage output	test + coverage pipeline	coverlet.collector 10.x still emits usable coverage results.

Package -> primary existing test coverage mapping:

• MongoDB.Bson / MongoDB.Driver bumps -> Phantom.Workspaces.Data.MongoDB.Tests (and any Mongo-backed integration tests).
• Dock.* and Avalonia.* bumps -> dock persistence / tab-switching / layout-serialization tests (the same areas that surfaced the previous reference-cycle serialization work).
• Microsoft.Extensions.AI.* and ModelContextProtocol.* bumps -> LLM / agent / MCP host + client test projects.
• Microsoft.NET.Test.Sdk bump -> exercised implicitly by every test project running under the new SDK.
• xunit.runner.visualstudio / coverlet.collector -> the entire test + coverage pipeline (run-tests skill invocation).

Related issues / PRs

Individual Dependabot PRs tracked by this issue:

• Bump Dock.Avalonia and Dock.Avalonia.Themes.Fluent #1339
• Bump the microsoft group with 10 updates #1337
• Bump the avalonia group with 8 updates #1336
• Bump JsonSchema.Net from 9.2.1 to 9.4.0 #1230
• Bump Avalonia and 5 others #1227
• Bump MongoDB.Bson from 3.4.0 to 3.10.0 #1117
• Bump JsonPatch.Net from 5.0.2 to 5.0.3 #1115
• Bump xunit.runner.visualstudio from 3.1.4 to 3.1.5 #29
• Bump ModelContextProtocol and ModelContextProtocol.AspNetCore #19
• Bump coverlet.collector from 6.0.4 to 10.0.1 #14
• Bump actions/upload-artifact from 4 to 7 #2
• Bump actions/checkout from 4 to 7 #1

If a prior discussion exists about the deliberate Dock.* = 12.0.0.2 pin (evaluated alongside reference-cycle serialization fixes when 12.1.0.2 was considered), link it here as context for the Dock decision in step 3 of the plan.

[JoshuaRowePhantom]

Design

Working on branch fix/1346-dependabot-upgrades (from features). Per our integration flow I will not click-merge Dependabot PRs; I apply the equivalent version bumps locally, keep the full build + test suite green after each group, commit on this branch (to be fast-forwarded into features), and then close each PR with a disposition comment (APPLIED-VIA-FEATURES / HELD / SUBSUMED).

Ordered plan (green-gated per group)

1. Low-risk NuGet: Bump JsonPatch.Net from 5.0.2 to 5.0.3 #1115 JsonPatch.Net 5.0.3, Bump JsonSchema.Net from 9.2.1 to 9.4.0 #1230 JsonSchema.Net 9.4.0, Bump xunit.runner.visualstudio from 3.1.4 to 3.1.5 #29 xunit.runner.visualstudio 3.1.5, Bump MongoDB.Bson from 3.4.0 to 3.10.0 #1117 MongoDB.Bson 3.10.0 (+ MongoDB.Driver 3.10.0 together to keep the pair in sync).
2. GitHub Actions: Bump actions/checkout from 4 to 7 #1 actions/checkout v4→v7, Bump actions/upload-artifact from 4 to 7 #2 actions/upload-artifact v4→v7 (both already CLOSED on GitHub; artifact names are unique per upload so v7 mutation rules are safe). Applied locally to the workflow yml anyway.
3. Avalonia + Dock cluster: Bump the avalonia group with 8 updates #1336 avalonia group → 12.1.1 (+ Avalonia.Controls.WebView 12.1.0); Bump Avalonia and 5 others #1227 SUBSUMED by Bump the avalonia group with 8 updates #1336. Bump Dock.Avalonia and Dock.Avalonia.Themes.Fluent #1339 Dock: I will move all five Dock.* pins (Dock.Avalonia, Dock.Avalonia.Themes.Fluent, Dock.Model.Avalonia, Dock.Model.Mvvm, Dock.Serializer.SystemTextJson) 12.0.0.2→12.1.0.2 together and validate against Avalonia 12.1.1. If the dock persistence / tab-switching / layout tests are not green, I HOLD the Dock pin at 12.0.0.2 and close Bump Dock.Avalonia and Dock.Avalonia.Themes.Fluent #1339 with the reason.
4. microsoft group (Bump the microsoft group with 10 updates #1337): TestHost 10.0.11, DevTunnels 1.3.51, Extensions.AI.Abstractions/OpenAI 10.9.0, Logging 10.0.11, TimeProvider.Testing 10.9.0, Microsoft.NET.Test.Sdk 17.14.1→18.9.0 (major).
5. Higher-risk singletons: Bump coverlet.collector from 6.0.4 to 10.0.1 #14 coverlet.collector 6.0.4→10.0.1, Bump ModelContextProtocol and ModelContextProtocol.AspNetCore #19 ModelContextProtocol(.AspNetCore) 1.3.0→1.4.0.

Green gate

After each group: dotnet build --no-incremental (zero error lines) + scripts\run-tests.ps1 -Mode fast -NoBuild. Any bump that cannot be made green with reasonable effort is reverted (HELD) and its PR closed with the precise reason; the rest still land. Final: stability run over dependency-sensitive classes (Mongo/dock/LLM/MCP) + full suite once. Known pre-existing Mongo flake #791 (Cluster.WaitForDescriptionChangedAsync hang) is treated as unrelated. Submodule pointer left untouched.

[JoshuaRowePhantom]

Diagnosis: full-suite hang is unrelated to this change

Test: Phantom.Workspaces.Llm.Core.Tests.AgentFactoryTests.CreateAgentChat_UsesAgentDefinitionChatHistoryTool ([Trait("Category","SlowDocker")])
Known bug: #791 (Hang: AgentFactoryTests stuck at Cluster.WaitForDescriptionChangedAsync in ConnectContainerAsync) — new occurrence recorded there with the dump.
Why unrelated: the hang is the MongoDB driver waiting for the test-spun test-mongo container to become selectable (Cluster.SelectServerAsync inside the unchanged MongoDbConnectionBroker.ConnectContainerAsync). All non-Docker Mongo tests exercising the 3.10 Bson/driver surface pass (incl. 10x stability), the fast suite is fully green, and the broker code is untouched on this branch.
Dump archived: dumps\791\testhost_39600_20260819T094224_hangdump.dmp (gitignored).

Full-suite counts: 5949 passed, 0 failed, host aborted only on the #791 SlowDocker hang.