chore: update dependencies and build tooling

[niemyjski]

Summary

Refresh dependencies across the client, integrations, tests, samples, and build tooling. Re-audited on September 2, 2026 against NuGet.org and official upstream releases; target frameworks and public APIs remain unchanged. Also fixes a pre-existing settings-cache initialization race exposed by native Windows CI.

• .NET SDK 10.0.400 / runtime 10.0.11 and SourceLink 10.0.400 remain current stable releases.
• New September pass: log4net 3.4.0, NLog 6.2.0, Microsoft.NET.Test.Sdk 18.9.0, xUnit framework/assertions/VS adapter 4.0.0, Lambda SystemTextJson serializer 3.0.1, Lambda ASP.NET Core server 10.2.1, AWS Setup 4.0.101.1, and devcontainer image 2.2.2-10.0-noble.
• Retain matching Microsoft.Extensions 8/9/10 release lines for each target and RandomData 1.2.2 for net472; these are deliberate compatibility constraints, not missed upgrades.
• Use official actions/checkout@v7 and actions/setup-dotnet@v6 major refs per maintainer preference. Verified these currently resolve to 3d3c42e5aac5ba805825da76410c181273ba90b1 and a98b56852c35b8e3190ac28c8c2271da59106c68. Major refs are mutable, unlike the previous SHA pins.
• Keep least-privilege workflow tokens, disabled persisted checkout credentials, native NuGet publishing, and Dependabot coverage for NuGet, Actions, Dev Container Features, and the SDK.
• Addressed review feedback on Windows publishing: quote every package path and use null-delimited file enumeration in both publish loops. Mocked execution of the actual workflow scripts preserves spaces/wildcard characters and the existing minver exclusion without publishing artifacts.

Release-note review and compatibility

• log4net 3.4.0 includes security-audit hardening: bounded regex/locking/network waits, record integrity, and credential redaction. Some appender timeout defaults change upstream; no opt-outs or suppressions were added. The Exceptionless appender smoke passed.
• NLog 6.2 improves AOT, scope properties, and async target reliability. The Exceptionless target's existing API use still builds and submits the expected event.
• xUnit 4.0 changes default Microsoft Testing Platform integration and parallelism APIs. Use the official xunit.v3.mtp-off package to preserve this repository's VSTest/dotnet test workflow and replace the obsolete collection attribute with Parallelization(Mode = ParallelMode.None). No target-framework changes or added test suppressions; all 328 baseline test identities/outcomes matched before the subsequent race regression coverage.
• Test SDK 18.9.0 fixes test-host/reporting issues, including .NET Framework process handling.
• AWS Lambda release notes describe the serializer's net10 trimming fix and response-streaming log-level adjustment. AWS SDK release notes cover client clock-skew configuration, shared error parsing, and region-hostname validation; existing sample startup needs no changes.

Security and provenance

• Checked all 71 declared package references plus the workflow tool (56 unique IDs) against the official NuGet version index. No unaddressed stable direct-package updates remain within the documented framework constraints.
• Fresh full Windows-shaped solution and all nine SDK-style sample audits: no known vulnerable or deprecated direct/transitive NuGet packages.
• OSV Scanner 2.5.1: no issues across 28 manifests, including legacy MVC packages.config.
• Downloaded all nine newly changed direct NuGet archives from NuGet.org; dotnet nuget verify --all passed content hashes and available author/repository signatures for every archive.
• The earlier gpr removal remains: it embedded vulnerable Newtonsoft.Json 9.0.1 and NuGet.Packaging 5.6.0. Native dotnet nuget push preserves best-effort GitHub publishing and required Feedz behavior.
• Verified official MCR image metadata and the frozen Feature digest. The built image resolves global.json to SDK 10.0.400 / runtime 10.0.11.

Fresh validation

• Dependency-only baseline comparison: 310 passed, 18 unchanged skips; exact test-name/outcome comparison matched all 328 cases. After the race fix and two added event-filter regression cases: 312 passed, 18 unchanged skips. The final comparison still preserves all 328 baseline identities/outcomes; only the two passing regression cases were added.
• Native Windows CI exposed CanGetLogSettingsMultithreaded throwing KeyNotFoundException between publication of two cache entries. Strengthening the test to exercise 1,000 cold starts reproduced the same failure locally before the fix; it passes afterward. Added equivalent concurrent event-filter coverage and assertions that settings updates take effect.
• Full Windows-shaped rebuild (netstandard2.0, net462, net472, net8, net9, net10 and Windows TFMs): 0 warnings, 0 errors.
• All 12 packages created; only the pre-existing package-readme advisories remain.
• All nine SDK-style samples built in Release with 0 warnings; WinForms/WPF covered modern Windows and net462 targets.
• Focused local NLog/log4net event-capture and Lambda serializer roundtrip smoke passed; adapter events cancelled before transport.
• Console sample started, submitted one synthetic event, and exited; generated storage moved out of the worktree.
• ASP.NET Core and Lambda ASP.NET Core samples started on loopback and reached their intentional exception endpoints (500; ASP.NET Core returned Problem Details).
• Blazor dev host served both HTML and framework JavaScript with HTTP 200; this is host/asset proof, not an interactive browser test.
• Official Dev Containers CLI 0.89.0 build with --frozen-lockfile succeeded. The resulting container booted without networking and resolved the repository's global.json correctly. This closes the previous local devcontainer build gap.
• actionlint 1.7.12 (official checksum verified), JSON parsing, and git diff --check: passed.
• Final hosted CI at f9ddd3de39a7a8515d66f2df7fa7c39cb323fde6: all six Linux/macOS/Windows push + pull-request builds and CLA passed. Native Windows executed 613 passing tests / 36 existing skips across net10.0 and net472. Windows push run also packaged all clients and successfully published CI packages to both configured feeds; Windows PR run passed independently. No release-tag publishing was triggered.

Thermonuclear review

Reviewed the complete branch diff and upstream behavior changes: no new branching or helper layers, no duplicated SDK patch owner, and no file-size growth concern. Removed the redundant thread-count setting once parallelism is explicitly disabled.

The CI race fix replaces two-phase cache initialization with one atomic GetOrAdd. The nested boolean cache was never populated, so its field, reads, and no-op invalidation loop are removed rather than adding synchronization around dead state. This reduces production code by 35 lines, preserves the existing prefix comparer and filtering behavior, and adds focused regression assertions. The two affected source/test files remain under 250 lines.

Boundaries and coordination

MVC, WCF, and Web Forms builds were retried: this Mac lacks Visual Studio WebApplication targets and .NET Framework developer packs. Windows desktop sample runtime and AWS-hosted invocation were not claimed as local proof. NuGet/OSV audits do not constitute a full container OS vulnerability scan.

This supersedes package updates in #361–#365. Rechecked the active worktrees and open feature PRs; unrelated MAUI and serializer/DI work remains untouched. #368 retains the existing small core project-file overlap when rebased.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4d2a4383cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T03:23:48.114874Z	f9ddd3d	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

The changes are primarily dependency/tooling updates with a single minor CI script robustness nit noted in review comments.

Pull request overview

This PR refreshes NuGet dependencies and build/developer tooling across the Exceptionless .NET repo (tests, platform integrations, samples, CI, and devcontainer) while keeping target frameworks and production code behavior unchanged.

Changes:

• Updates test tooling to xUnit v4 / MTP-off + Microsoft.NET.Test.Sdk 18.9.0, and adjusts assembly-level parallelism configuration.
• Bumps key integration dependencies (e.g., NLog, log4net, MessagePack, Microsoft.Extensions packages, AWS Lambda/AWS SDK sample refs).
• Modernizes CI/workflow tooling (checkout/setup-dotnet majors, MinVer CLI), adds Dependabot coverage for additional ecosystems, and refreshes the devcontainer image/lock.

File summaries

File	Description
test/Exceptionless.Tests/Properties/AssemblyInfo.cs	Updates assembly-level xUnit parallelism control for xUnit v4.
test/Exceptionless.Tests/Exceptionless.Tests.csproj	Bumps test SDK and switches to xUnit v4 MTP-off + VS adapter v4.
test/Exceptionless.TestHarness/Exceptionless.TestHarness.csproj	Updates xUnit assertions package version.
test/Exceptionless.MessagePack.Tests/Exceptionless.MessagePack.Tests.csproj	Bumps test SDK and switches to xUnit v4 MTP-off + VS adapter v4.
src/Platforms/Exceptionless.NLog/Exceptionless.NLog.csproj	Updates NLog dependency version.
src/Platforms/Exceptionless.MessagePack/Exceptionless.MessagePack.csproj	Updates MessagePack dependency version.
src/Platforms/Exceptionless.Log4net/Exceptionless.Log4net.csproj	Updates log4net dependency version.
src/Platforms/Exceptionless.Extensions.Logging/Exceptionless.Extensions.Logging.csproj	Updates Microsoft.Extensions.Logging versions per target framework.
src/Platforms/Exceptionless.Extensions.Hosting/Exceptionless.Extensions.Hosting.csproj	Updates Microsoft.Extensions.Hosting.Abstractions versions per target framework.
src/Exceptionless/Exceptionless.csproj	Updates core package references (Configuration.Abstractions, Reflection.Metadata).
samples/Exceptionless.SampleLambdaAspNetCore/Exceptionless.SampleLambdaAspNetCore.csproj	Updates AWS Setup + Lambda ASP.NET Core Server dependencies.
samples/Exceptionless.SampleLambda/Exceptionless.SampleLambda.csproj	Updates Lambda core + STJ serializer dependency versions.
samples/Exceptionless.SampleBlazorWebAssemblyApp/Exceptionless.SampleBlazorWebAssemblyApp.csproj	Updates Blazor WebAssembly package versions.
global.json	Updates pinned .NET SDK feature band version.
build/common.props	Updates SourceLink package version.
.github/workflows/build-windows.yml	Updates action majors, MinVer CLI, publish logic, and workflow permissions.
.github/workflows/build-osx.yml	Updates action majors, MinVer CLI, and checkout credential persistence behavior.
.github/workflows/build-linux.yml	Updates action majors, MinVer CLI, and checkout credential persistence behavior.
.github/dependabot.yml	Expands Dependabot coverage to Actions, Dev Containers, and dotnet-sdk.
.devcontainer/devcontainer.json	Updates devcontainer base image and adds dotnet feature configuration.
.devcontainer/devcontainer-lock.json	Adds devcontainer feature lock for reproducibility.

Review details

• Files reviewed: 21/21 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.