[imnasnainaec]

Summary

Updates SIL.BuildTasks and SIL.ReleaseTasks to 4.0.0. Also fixes master restore, which fails today, and clears every vulnerable package reported by dotnet list package --vulnerable --include-transitive.

Why restore broke

The floating 18.0.0-* libpalaso references now resolve to stable 18.0.0. That release requires higher minimums than Chorus pinned, so restore fails with NU1605 (package downgrade):

 SIL.Lift 18.0.0 -> SIL.Core.Desktop 18.0.0
-  -> L10NSharp >= 11.0.1          but LibChorus pins 10.0.0-*
-  -> System.Resources.Extensions >= 10.0.12   but LibChorus pins 6.0.0
 SIL.Lift 18.0.0 -> SIL.WritingSystems 18.0.0
-  -> icu.net >= 4.0.0            but LibChorus pins 3.0.1
 SIL.TestUtilities 18.0.0
-  -> NUnit >= 3.14.0             but test projects pin 3.13.3

Version changes

Package	From	To	Why
SIL.ReleaseTasks	3.0.0	4.0.0	Goal
SIL.BuildTasks	3.3.0 / 2.6.0-beta0030 / 2.5.0	4.0.0	Goal
SIL.* (libpalaso)	18.0.0-*	18.0.0	Pin; resolves the same
L10NSharp	10.0.0-*	11.0.1	Restore
icu.net	3.0.1	4.0.0	Restore
System.Resources.Extensions	6.0.0	10.0.13	Restore
NUnit	3.13.3	3.14.0	Restore
System.ServiceModel.Primitives	4.8.1	10.1.0	Security
NuGet.CommandLine (l10n)	6.7.0	6.14.3	Security

• L10NSharp 11 and icu.net 4: the breaking change in both is dropping the net461 target. Chorus already targets net462.
• SIL.*Tasks 4: they no longer pass their own dependencies on to consumers. Chorus didn't rely on any of them.

Security

• System.ServiceModel.Primitives (LibChorus, netstandard2.0 only)
  • 4.8.1 brings in System.Security.Cryptography.Xml 4.7.0 (GHSA-vh55-786g-wjwj).
  • 4.10.3 and 8.1.2 still bring in vulnerable Cryptography.Xml or Pkcs versions.
  • 10.1.0's netstandard2.0 build depends only on System.Security.Principal.Windows.
• NuGet.CommandLine in l10n/l10n.proj
  • Critical advisory GHSA-68w7-72jg-6qpp.
  • Build tool only: it runs nuget.exe pack for the l10ns package.

Other fixes

• Chorus.csproj: references System.ServiceModel directly. L10NSharp 11 stopped bringing it in, which broke the net462 build of ChorusHubClient.cs (CS1069).
• l10n/l10n.proj: referenced a property that doesn't exist, PkgGitVersion_GitVersion_MsBuild. NuGet generates PkgGitVersion_MsBuild.
  • The manual GitVersion import never ran. It's removed, because NuGet already imports those targets.
  • RestartBuild was always true, so UpdateCrowdin always ran a second pass.

Considered and rejected

• GitVersion 6: covered by Update GitVersion dependency to 6.3.0 #364. That PR has open concerns about version-string continuity for downstream products.
• NUnit 4/5, NUnit3TestAdapter 6, Microsoft.NET.Test.Sdk 18, Autofac 9, SourceLink 10: major-version jumps that need real migration work. Out of scope.

Evidence

• Before: dotnet restore Chorus.sln fails with NU1605 in every project except Chorus and ChorusHubApp.
  After: restore succeeds, and the Release build has 0 errors.
• Before: dotnet list package --vulnerable --include-transitive reports System.Security.Cryptography.Xml 4.7.0 in five projects. Restoring l10n.proj warns that NuGet.CommandLine 6.7.0 has a critical advisory (NU1904).
  After: no vulnerable packages in either.
• Tests run locally: ChorusHubTests (6 passed, 5 skipped) and Chorus.Tests (68 passed, 31 skipped), both on net462. The LibChorus suites run in CI.
• SIL.BuildTasks 4.0: MakeWixForDistFiles ran successfully. Component GUIDs in the regenerated .wxs files were unchanged; only the RemoveFile ids differed, and those are randomized on every run.
• Chorus Hub installer: the wixproj's Restore installs SIL.BuildTasks 4.0.0, and its FileUpdate (run on a copy of License.rtf) stamps the license year. StampLicenseYear itself wasn't run, because WiX isn't installed locally.
• l10n.proj: after restore, RestartBuild evaluates to false and -t:GetVersion succeeds. UpdateCrowdin and PackageL10ns were not run, because they need Crowdin.

Merge Danger

Door: two-way

These are version bumps only. Reverting the commit restores the previous state.

Blast Radius: consumers

• The SIL.Chorus.LibChorus nuspec now requires at least L10NSharp 11.0.1, icu.net 4.0.0 and System.Resources.Extensions 10.0.13. Consumers already on libpalaso 18 need these anyway.
• Consumers using the netstandard2.0 build of LibChorus will get WCF client 10.1.0.
• An open PR that edits the same PackageReference lines, such as Update GitVersion dependency to 6.3.0 #364, will need a small rebase.

🤖 Generated with Claude Code

---

This change is 

[github-actions]

Test Results

       9 files  ±0     347 suites  ±0   51m 35s ⏱️ - 4m 1s
1 042 tests ±0     986 ✔️ ±0    56 💤 ±0  0 ❌ ±0 
3 289 runs  ±0  3 166 ✔️ ±0  123 💤 ±0  0 ❌ ±0 

Results for commit 5ef1ec2. ± Comparison against base commit 050c057.

♻️ This comment has been updated with latest results.