upgrade all nuget packages that can be updated

[drmoisan]

Summary

• Upgrades 46 NuGet packages across all 17 projects to their latest available versions; 1 package added as a new transitive dependency, 0 removed.
• The dominant group is the Microsoft.Extensions.* / System.* runtime family moving 10.0.10 → 10.0.11 (~35 packages); the largest single jump is Microsoft.Graph 6.2.0 → 6.5.0.
• No target framework change (all projects stay on net481), and no Compile, None, or ProjectReference item changes — no source file is added, removed, or moved.
• Assembly binding redirects grow from 978 to 1026 entries (+48), matching the upgraded and newly-introduced assemblies.
• The raw diff (+2695 / −7141) overstates the change: most of it is NuGet rewriting multi-line XML attributes onto single lines. This reformatting is what breaks format-check — see Verification.

Why

Routine dependency maintenance: take every package that has an available update, so the solution stays current on the runtime, Graph SDK, test platform, and analyzer packages rather than accumulating drift.

No PR Intent fields were supplied in the context bundle, and no issue is referenced by the commit, so the motivation above is inferred from the commit and the diff only.

What Changed

Runtime and BCL family — 10.0.10 → 10.0.11

Microsoft.Bcl.AsyncInterfaces, Microsoft.Bcl.Cryptography, Microsoft.Bcl.Memory, Microsoft.Bcl.Numerics, Microsoft.Bcl.TimeProvider, Microsoft.Extensions.Configuration (+ .Abstractions, .Binder, .EnvironmentVariables), Microsoft.Extensions.DependencyInjection (+ .Abstractions), Microsoft.Extensions.Diagnostics.Abstractions, Microsoft.Extensions.FileProviders.Abstractions, Microsoft.Extensions.Hosting.Abstractions, Microsoft.Extensions.Logging (+ .Abstractions, .Configuration), Microsoft.Extensions.Options (+ .ConfigurationExtensions), Microsoft.Extensions.Primitives, System.CodeDom, System.Collections.Immutable, System.Diagnostics.DiagnosticSource, System.Drawing.Common, System.Formats.Asn1, System.IO.Pipelines, System.Memory.Data, System.Net.Http.WinHttpHandler, System.Numerics.Tensors, System.Reflection.Metadata, System.Security.Cryptography.ProtectedData, System.Text.Encoding.CodePages, System.Text.Encodings.Web, System.Text.Json, System.Threading.Channels, System.Threading.Tasks.Dataflow.

Graph and Azure client stack

Package	From	To
Microsoft.Graph	6.2.0	6.5.0
Azure.Core	1.60.0	1.61.0
System.ClientModel	1.14.0	1.15.0
System.Net.ServerSentEvents	(absent)	added

System.Net.ServerSentEvents is the only new package id. It arrives as a transitive dependency of the upgraded client stack and receives a binding redirect in all 16 app.config files.

Test and analyzer tooling

Package	From	To
Microsoft.TestPlatform.ObjectModel	18.8.1	18.9.0
Microsoft.TestPlatform.AdapterUtilities	18.8.1	18.9.0
Microsoft.Extensions.TimeProvider.Testing	10.8.0	10.9.0
SonarAnalyzer.CSharp	10.31.0.145097	10.32.0.713
Meziantou.Analyzer	3.0.138	3.0.156
Roslynator.Analyzers	4.15.0	4.16.0
AngleSharp	1.7.0	1.7.1

Files touched (50)

• 17 .csproj — <Reference> assembly versions, HintPath package-folder paths, and analyzer <Import> props/targets paths only.
• 17 packages.config — package version attributes.
• 16 app.config — bindingRedirect / assemblyIdentity entries.

Architecture / How It Fits Together

Nothing structural changes. These are packages.config-style (non-SDK, non-PackageReference) .NET Framework projects, so each upgrade touches three coordinated places per project:

1. packages.config records the resolved package version.
2. .csproj carries a matching <Reference> with the strong-name version and a HintPath into ..\packages\<Id>.<Version>\.
3. app.config carries a bindingRedirect so the loaded assembly version resolves at runtime.

All three stayed consistent in this change: no package id resolves to more than one version anywhere in the solution, so there is no split-version hazard between projects.

Verification

Completed (from CI on 8f30fd53)

Check	Result
actionlint	PASS
build-analyzers — build with analyzers and code style enforcement	PASS
build-nullable — build with nullable warnings as errors	PASS
mstest-coverage — MSTest suite with coverage	PASS
format-check — CSharpier dotnet csharpier check .	FAIL

The three upgraded analyzer packages (Sonar, Meziantou, Roslynator) did not introduce new build-breaking diagnostics — build-analyzers and build-nullable are both green — which is the main risk this kind of upgrade usually carries.

The one failure

format-check fails on 33 files — every app.config and packages.config in the diff. The cause is purely stylistic: the repository formats these XML files with one attribute per line, and the NuGet package manager rewrote them with all attributes on a single line. CSharpier reports Was not formatted for 32 of them and The file did not end with a single newline for VBFunctions.Test\packages.config. No .csproj file is flagged.

Fix: run dotnet csharpier . at the repo root and commit the result. That restores the repo's XML style without altering any package version.

Recommended

dotnet csharpier .                 # then commit — clears the format-check failure
dotnet tool run csharpier --check .
msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true
vstest.console.exe <test-assembly-paths> /EnableCodeCoverage

Beyond the toolchain, a manual smoke test of the Outlook add-in is worth doing: binding-redirect changes are not exercised by the unit test suite, and this PR touches redirects in every project.

Backward Compatibility / Migration Notes

• No public API of this repository changes.
• No target framework change — all projects remain net481.
• Microsoft.Graph 6.2.0 → 6.5.0 is the only multi-minor jump. It is within the same major version, so no breaking change is expected, but it is the upgrade most worth a second look.
• Because these are packages.config projects, anyone with an existing working copy should restore packages before building, as the ..\packages\<Id>.<Version>\ folder names have changed.

Risks and Mitigations

• Binding redirect regressions at runtime. 48 new dependentAssembly entries and ~394 redirects retargeted to 10.0.0.11. Unit tests do not exercise the add-in's real assembly-load path.
  Mitigation: CI builds and the MSTest suite pass; smoke-test the add-in in Outlook before merging. Rollback is a single-commit revert.
• Microsoft.Graph 6.2.0 → 6.5.0 behavior drift. Three minor versions of the Graph SDK.
  Mitigation: review any Graph call sites for changed defaults; the build and test suite are green.
• format-check is red, so the PR is not mergeable under a required-checks policy.
  Mitigation: one dotnet csharpier . commit, as above. No package version is affected.
• Reformatting hides semantic change from reviewers. The raw diff is ~9,800 changed lines, of which the meaningful portion is far smaller.
  Mitigation: review with git diff -w or read the tables above rather than the raw diff.

Review Guide

The raw diff is large and almost entirely mechanical. Suggested order:

1. Start with the tables above — they are the complete semantic change set (46 upgrades, 1 addition, 0 removals).
2. packages.config files — the source of truth for versions. Small and readable.
3. One .csproj, e.g. UtilitiesCS/UtilitiesCS.csproj (the largest at 139 lines changed) — confirm <Reference> versions and HintPath values agree with packages.config. The other 16 follow the same pattern.
4. One app.config, e.g. TaskMaster/app.config — confirm redirects match. Verified across all 16: 394 redirects added at 10.0.0.11, 357 removed at 10.0.0.10, 48 net-new dependentAssembly blocks.
5. Skip the reformatting noise. git diff -w collapses most of it; the multi-line-to-single-line attribute rewrite accounts for the bulk of the −7141 deletions.

Follow-ups

• Commit a dotnet csharpier . pass to clear format-check (required before merge).
• Consider whether the NuGet package manager should be configured to preserve the repo's XML formatting, or whether csharpier should run automatically after a package operation — this reformatting churn will recur on every future upgrade PR.
• Smoke-test the Outlook add-in against the new binding redirects.

GitHub Auto-close

None — the context bundle records no verified or author-asserted autoclose issues, and the commit references no issue.