build(deps): consolidate validated dependency updates

[xshaheen]

Summary

This repairs the grouped Dependabot update so the SDK ships one coherent dependency contract instead of changing central restore pins alone. It upgrades the five Microsoft Testing Platform extensions to 2.3.3 and Meziantou.Analyzer to 3.0.138, with the shipped properties and package snapshots updated in lockstep.

Source: Dependabot PR #35.

Dependency disposition

Dependency	Old	New	Ecosystem	Risk	Source PR	Disposition
Microsoft.Testing.Extensions.CrashDump	2.3.2	2.3.3	NuGet	Low; patch, shipped test-tool contract	#35	Include
Microsoft.Testing.Extensions.HangDump	2.3.2	2.3.3	NuGet	Low; patch, shipped test-tool contract	#35	Include
Microsoft.Testing.Extensions.HotReload	2.3.2	2.3.3	NuGet	Low; patch, shipped test-tool contract	#35	Include
Microsoft.Testing.Extensions.Retry	2.3.2	2.3.3	NuGet	Low; patch, shipped test-tool contract	#35	Include
Microsoft.Testing.Extensions.TrxReport	2.3.2	2.3.3	NuGet	Low; patch, shipped test-tool contract	#35	Include
Meziantou.Analyzer	3.0.129	3.0.138	NuGet	Medium; analyzer diagnostics can affect consumers	#35	Include

All proposed versions are stable, listed, non-deprecated, and older than the seven-day release quarantine. NuGet metadata reports no advisories for these versions. The Meziantou analyzer-rule coverage gate found no new unreviewed diagnostic IDs.

Security disposition

Alert / advisory	Severity	Affected paths	Patched version	Related PR	Expected resolution
No open Dependabot alerts	N/A	N/A	N/A	N/A	Nothing pending against main

GitHub Dependabot alerts were queried successfully and returned zero open findings. Code scanning returned no analysis found; secret scanning is disabled. Those two surfaces are unavailable as evidence for this run. No alert was dismissed or modified.

Compatibility repairs

• Synchronized central pins with the SDK-owned shipped MTP version properties.
• Synchronized the mandatory Meziantou analyzer property used by consumer projects.
• Updated exact package dependency snapshots and the reviewed analyzer baseline metadata.
• No breaking API, configuration, serialization, or obsolete API changes were required.

Validation

• dotnet restore headless-sdk.slnx — passed.
• dotnet build headless-sdk.slnx --configuration Release --no-restore --no-incremental -p:GeneratePackageOnBuild=false -v:minimal -nologo — passed with 0 warnings and 0 errors.
• dotnet pack headless-sdk.slnx --configuration Release --no-restore --no-build --output ./artifacts/packages-results — passed; six packages produced.
• dotnet test headless-sdk.slnx --configuration Release --no-restore --no-build -- --report-trx --results-directory ./artifacts/test-results/full — passed: 159 total, 157 succeeded, 2 platform-expected skips, 0 failed.
• Focused version consistency, package contract, and analyzer rule coverage — passed: 6/6, 11/11, and 1/1.
• dotnet format headless-sdk.slnx --no-restore --verify-no-changes --verbosity minimal — passed.
• dotnet list headless-sdk.slnx package --vulnerable --include-transitive --format json --no-restore — no vulnerable top-level or transitive packages reported.
• Resolved assets contain Meziantou.Analyzer 3.0.138 and all five MTP extensions at 2.3.3 across every affected project.
• Pre-PR review — correctness, testing, and strict .NET reviewers reported no findings or residual risks.

The repository has no Makefile, so make bootstrap and Makefile-owned targets were unavailable; validation used the repository's exact GitHub Actions commands.

Excluded or deferred findings

None. Every proposal in #35 was eligible and included. There were no dependency-related security findings, no incompatible candidates, and no quarantined releases.

Remaining risks and manual review

• Hosted CI is not yet evidence; wait for Build, test, and pack, platform smoke jobs, and Final status on this exact head.
• Review the shipped dependency contract changes because these versions flow into consumer projects.
• Repository administrators may enable code scanning and secret scanning to close the two unavailable security surfaces; this is not a dependency-fix blocker.

Post-Deploy Monitoring & Validation

No additional operational monitoring is required because this changes build-time analyzer and test-tool package pins only. The merge gate is exact-head hosted CI; any restore, analyzer, package-contract, or platform-smoke failure should block merge and trigger a revert of these two dependency commits.

This PR was created by dependency automation. It has not been approved or merged.