From 4695711b99221ea56531371f553ce377b7254fb9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 26 Aug 2026 08:51:28 +0000
Subject: [PATCH] Bump the minor-and-patch group with 7 updates

Bumps Microsoft.CodeAnalysis.CSharp from 5.6.0 to 5.9.0
Bumps Microsoft.NET.Test.Sdk from 17.11.1 to 17.14.1
Bumps MongoDB.Driver from 3.10.0 to 3.11.0
Bumps MySqlConnector from 2.6.1 to 2.6.2
Bumps StackExchange.Redis from 3.0.17 to 3.1.31
Bumps System.Security.Cryptography.Xml from 10.0.10 to 10.0.11
Bumps xunit from 2.9.2 to 2.9.3

---
updated-dependencies:
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 17.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MongoDB.Driver
  dependency-version: 3.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: MySqlConnector
  dependency-version: 2.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: MySqlConnector
  dependency-version: 2.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: StackExchange.Redis
  dependency-version: 3.1.31
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: StackExchange.Redis
  dependency-version: 3.1.31
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: System.Security.Cryptography.Xml
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: System.Security.Cryptography.Xml
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: xunit
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 src/Tabbit.csproj                                |  8 ++++----
 test/Tabbit.Tests/Tabbit.Tests.csproj            | 12 ++++++------
 test/fixtures/tools/FixtureGen/FixtureGen.csproj |  2 +-
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/Tabbit.csproj b/src/Tabbit.csproj
index 39a9be272..9bfa38e98 100644
--- a/src/Tabbit.csproj
+++ b/src/Tabbit.csproj
@@ -442,7 +442,7 @@
       arrives as another syntax tree. Pinned to the version this SDK's own compiler is, so
       a rule file accepts exactly the C# the rest of the repository does.
     -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.6.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
     <!--
       Scriban rather than Handlebars or Fluid: no dependencies of its own, and its `{{ }}`
       syntax does not collide with anything in the languages being generated - which
@@ -471,10 +471,10 @@
   <ItemGroup>
     <!-- Database export targets. MySqlConnector rather than MySql.Data: it is fully
          async and MIT licensed. -->
-    <PackageReference Include="MySqlConnector" Version="2.6.1" />
+    <PackageReference Include="MySqlConnector" Version="2.6.2" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
-    <PackageReference Include="MongoDB.Driver" Version="3.10.0" />
-    <PackageReference Include="StackExchange.Redis" Version="3.0.17" />
+    <PackageReference Include="MongoDB.Driver" Version="3.11.0" />
+    <PackageReference Include="StackExchange.Redis" Version="3.1.31" />
   </ItemGroup>
 
   <!--
diff --git a/test/Tabbit.Tests/Tabbit.Tests.csproj b/test/Tabbit.Tests/Tabbit.Tests.csproj
index b5478fe3c..1b798f6a6 100644
--- a/test/Tabbit.Tests/Tabbit.Tests.csproj
+++ b/test/Tabbit.Tests/Tabbit.Tests.csproj
@@ -54,15 +54,15 @@
   <ItemGroup>
     <!-- The database tests query the servers directly to confirm what the exporters
          actually wrote, rather than trusting the exporters' own reports. -->
-    <PackageReference Include="MySqlConnector" Version="2.6.1" />
+    <PackageReference Include="MySqlConnector" Version="2.6.2" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
-    <PackageReference Include="MongoDB.Driver" Version="3.10.0" />
-    <PackageReference Include="StackExchange.Redis" Version="3.0.17" />
+    <PackageReference Include="MongoDB.Driver" Version="3.11.0" />
+    <PackageReference Include="StackExchange.Redis" Version="3.1.31" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
   </ItemGroup>
 
@@ -81,7 +81,7 @@
       a build nobody reads the warnings of is a build that hides the next real one - the
       warning noise had already pushed a test into slicing JSON out of stdout by hand.
     -->
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.11" />
   </ItemGroup>
 
 </Project>
diff --git a/test/fixtures/tools/FixtureGen/FixtureGen.csproj b/test/fixtures/tools/FixtureGen/FixtureGen.csproj
index 3f790c1c8..ccb6aa3e5 100644
--- a/test/fixtures/tools/FixtureGen/FixtureGen.csproj
+++ b/test/fixtures/tools/FixtureGen/FixtureGen.csproj
@@ -17,7 +17,7 @@
     <!-- Same transitive pull-up as src/Tabbit.csproj: NPOI brings in
          System.Security.Cryptography.Xml 8.0.2, which has known high-severity
          advisories. Both NPOI consumers need the pin until NPOI ships a fixed one. -->
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.11" />
   </ItemGroup>
 
 </Project>