Dependency security updates and NSubstitute 6.0 upgrade

[jschick04]

Summary

Dependency security updates plus the NSubstitute 6.0 test-framework upgrade, split into two commits so the urgent security fix can be reviewed and reverted independently of the test migration.

Commit 1 - Bump dependencies and refresh security pins

• AngleSharp -> 1.5.2 (new transitive pin) - fixes CVE-2026-54570 (GHSA-pgww-w46g-26qg, mutation XSS). AngleSharp 1.4.0 came transitively through bUnit 2.7.2 (test-only). The advisory was tripping NuGetAudit (NU1902) as an error and breaking the build.
• SQLitePCLRaw.lib.e_sqlite3 3.50.3 -> 3.53.3 - refreshes the existing CVE-2025-6965 (GHSA-2m69-gcr7-jv3q) override. Latest stable Microsoft.Data.Sqlite 10.0.10 still references the vulnerable bundle 2.1.11; the upstream fix (SQLitePCLRaw 3.x) is only in 11.0-preview, so the pin stays (Remove temporary SQLitePCLRaw.lib.e_sqlite3 3.50.3 security override once Microsoft.Data.Sqlite ships the CVE-2025-6965 fix #604).
• Routine bumps: Microsoft.Extensions.{DependencyInjection, .Abstractions, Logging.Abstractions} 10.0.9 -> 10.0.10; Microsoft.Data.Sqlite / EntityFrameworkCore.Sqlite 10.0.9 -> 10.0.10; System.CommandLine 2.0.9 -> 2.0.10; Fluxor.Blazor.Web 6.9.0 -> 6.10.0; Microsoft.NET.Test.Sdk 18.6.0 -> 18.8.1.
• Held: Microsoft.Maui.Controls ($(MauiVersion)) and Microsoft.WindowsAppSDK 2.2.0 - WindowsAppSDK tracks the MAUI head transitive resolution and cannot be validated locally.

Commit 2 - Upgrade NSubstitute to 6.0.0 and migrate test matchers

NSubstitute 6.0 enables nullable-reference annotations on its public API, breaking compilation under TreatWarningsAsErrors across 33 test files (~210 matcher guards + ~67 CallInfo accessors). Uniform, behavior-preserving migration:

• Arg.Is<T>(x => BODY) dereferencing x -> Arg.Is<T>(x => x != null && BODY) (an is-not-null pattern is illegal in an expression tree; != null compiles there and still narrows nullability).
• callInfo.Arg<T>() / ((T)callInfo[N]) -> callInfo.ArgAt<T>(N) (non-null typed positional accessor).
• Value-type interpolated-string-handler matchers (WarningLogHandler, ErrorLogHandler) need no null guard; their ToString() is non-null.

Includes a test-quality audit of every touched test (remove tautologies / weak-redundant assertions). All touched tests exercise real behavior, so 0 removals.

Validation

• Full unit suite green: 6,209 tests, 0 failed / 0 skipped / 0 warnings (TreatWarningsAsErrors).
• dotnet list package --vulnerable -> 35 projects, no vulnerable packages.
• Reviewed by a 4-model review panel; no blocking issues.

Notes

• The MAUI head (EventLogExpert.csproj) is not buildable in this local environment (pre-existing nuget.exe prerequisite); CI validates it.

[Copilot]

Pull request overview

Updates centrally managed dependencies to address security advisories and upgrades the NSubstitute test framework to 6.0, migrating the affected unit tests to the new nullable-annotated API patterns.

Changes:

• Bump NuGet package versions and add/refresh security pins (AngleSharp, SQLitePCLRaw native bundle, assorted routine bumps).
• Upgrade NSubstitute to 6.0 and migrate tests from callInfo.Arg<T>() / indexer casts to callInfo.ArgAt<T>(n).
• Update NSubstitute argument matchers in tests to include explicit null guards required by the new nullable annotations.

Reviewed changes

Copilot reviewed 34 out of 34 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
Directory.Packages.props	Central package version bumps and security pins (SQLite native bundle override, AngleSharp transitive pin).
tests/Unit/EventLogExpert.Windows.Tests/ActivationDispatcherTests.cs	Use CallInfo.ArgAt<T>(0) for main-thread delegate extraction under NSubstitute 6.
tests/Unit/EventLogExpert.UI.Tests/LogTable/LogTablePaneGroupingTests.cs	Migrate captured arguments to ArgAt and add null guards in matchers.
tests/Unit/EventLogExpert.UI.Tests/FilterPane/FilterPaneTests.cs	Add null guard to Arg.Is<IReadOnlyList<SavedFilter>> matcher.
tests/Unit/EventLogExpert.UI.Tests/FilterLibrary/LibrarySavedTabHeaderTests.cs	Add null guard to announcement string matcher.
tests/Unit/EventLogExpert.UI.Tests/FilterLibrary/LibraryEntryRowTests.cs	Add null guards to matchers; migrate call[2] access to ArgAt(2).
tests/Unit/EventLogExpert.UI.Tests/FilterLibrary/FilterLibraryModalTests.cs	Migrate CallInfo.Arg<T>() to ArgAt, and add null guards to matchers.
tests/Unit/EventLogExpert.UI.Tests/FilterEditor/ScenarioClipboardExporterTests.cs	Add null guard to exported warning message matcher.
tests/Unit/EventLogExpert.UI.Tests/DetailsPane/DetailsPaneTests.cs	Add null guard to clipboard text matcher.
tests/Unit/EventLogExpert.UI.Tests/DatabaseTools/Tabs/ManageDatabasesTabTests.cs	Add null guards to matchers; minor whitespace/formatting changes in selection-mode tests.
tests/Unit/EventLogExpert.UI.Tests/DatabaseTools/Tabs/CreateDatabaseTabTests.cs	Use ArgAt<CreateDatabaseRequest>(0) for request extraction in Returns callback.
tests/Unit/EventLogExpert.UI.Tests/Database/DatabaseRecoveryHostTests.cs	Replace call[0] casts with ArgAt<T>(0) for main-thread callbacks.
tests/Unit/EventLogExpert.UI.Tests/Database/DatabaseEntryRowTests.cs	Migrate context menu captured argument to ArgAt(2); add null guard in matcher.
tests/Unit/EventLogExpert.UI.Tests/Dashboard/EmptyStateDashboardTests.cs	Add null guards to scenario and announcement matchers.
tests/Unit/EventLogExpert.UI.Tests/Banner/CriticalBannerTests.cs	Add null guard to clipboard-copy matcher.
tests/Unit/EventLogExpert.UI.Tests/Banner/AttentionBannerTests.cs	Add null guards to error banner message matchers.
tests/Unit/EventLogExpert.Runtime.Tests/Update/UpdateServiceTests.cs	Add null guards to update failure alert message matchers.
tests/Unit/EventLogExpert.Runtime.Tests/Update/Deployment/DeploymentServiceTests.cs	Migrate CallInfo.Arg<T>() to ArgAt, add null guards for Uri/options/message matchers.
tests/Unit/EventLogExpert.Runtime.Tests/Scenarios/ScenarioLaunchServiceTests.cs	Add null guards to dispatched action matchers.
tests/Unit/EventLogExpert.Runtime.Tests/Scenarios/ScenarioApplyServiceTests.cs	Add null guards; migrate captured dispatch argument to ArgAt(0).
tests/Unit/EventLogExpert.Runtime.Tests/Scenarios/ScenarioApplyIntegrationTests.cs	Migrate captured dispatch argument to ArgAt(0).
tests/Unit/EventLogExpert.Runtime.Tests/Scenarios/Favorites/ScenarioFavoriteCommandsTests.cs	Add null guards to action matchers.
tests/Unit/EventLogExpert.Runtime.Tests/Scenarios/Favorites/EffectsTests.cs	Add null guards to dispatched action matchers.
tests/Unit/EventLogExpert.Runtime.Tests/LogTable/EffectsTests.cs	Add null guards to dispatched action and preference matchers.
tests/Unit/EventLogExpert.Runtime.Tests/FilterPane/EffectsTests.cs	Add null guards to dispatched action matchers (including date-range success cases).
tests/Unit/EventLogExpert.Runtime.Tests/FilterLibrary/FilterLibraryEffectsTests.cs	Migrate captured args to ArgAt; add null guards throughout matchers.
tests/Unit/EventLogExpert.Runtime.Tests/FilterLibrary/FilterLibraryCommandsTests.cs	Add null guards to dispatched action matchers.
tests/Unit/EventLogExpert.Runtime.Tests/FilterLenses/FilterLensEffectsTests.cs	Add null guard to dispatched action matcher.
tests/Unit/EventLogExpert.Runtime.Tests/FilterLenses/FilterLensCommandsTests.cs	Add null guards to dispatched action matchers.
tests/Unit/EventLogExpert.Runtime.Tests/EventLog/PartialLoadCoordinatorTests.cs	Migrate captured dispatch argument to ArgAt(0).
tests/Unit/EventLogExpert.Runtime.Tests/EventLog/EffectsTests.cs	Add null guards to dispatched action matchers; migrate captured args to ArgAt(0).
tests/Unit/EventLogExpert.Runtime.Tests/EventLog/DatabaseCoordinationEffectsReloadTests.cs	Migrate call.Args()[0] usage to ArgAt(0); add null guards to matchers.
tests/Unit/EventLogExpert.Runtime.Tests/Database/DatabaseOperationCoordinatorTests.cs	Add null guards to message and set/list matchers.
tests/Unit/EventLogExpert.Runtime.Tests/Alerts/AlertDialogServiceTests.cs	Add null guards to inline alert request matcher; migrate main-thread delegate extraction to ArgAt(0).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 36 out of 36 changed files in this pull request and generated no new comments.