chore(deps): update .NET dependencies and CI actions

[dex-the-ai]

Summary

This replaces #145 and is opened from my account so it's easier to track, as @ejscribner asked in #145 (comment). I rebuilt the branch on current main, so it keeps #146's continue-on-error: true on the Slack step and #146's README changes. I also re-checked every direct dependency against NuGet today (2026-09-29). Several have had new releases since #145 was opened in July.

Closes #145. It also covers the older Dependabot PRs #139, #141, #142 and #143.

Updated dependencies

Ecosystem	Dependency	main	This PR	Was in #145	Notes
NuGet	BCrypt.Net-Next	4.1.0	4.2.0	4.2.0
NuGet	CouchbaseNetClient	3.9.1	3.9.6	3.9.3	Newer since #145
NuGet	Couchbase.Extensions.DependencyInjection	3.9.1	3.9.6	3.9.3	Newer since #145
NuGet	Swashbuckle.AspNetCore	6.5.0	10.2.3	10.2.3	Program.cs now uses using Microsoft.OpenApi;
NuGet	Swashbuckle.AspNetCore.Annotations	8.1.1	10.2.3	10.2.3
NuGet	Microsoft.NET.Test.Sdk	17.11.1	18.10.1	18.7.0	Newer since #145
NuGet	xunit.runner.visualstudio	2.8.2	4.0.0	3.1.5	New major version. It still runs xUnit v2 tests on net8.0
NuGet	coverlet.collector	6.0.4	10.1.0	10.0.1	Newer since #145
NuGet	coverlet.msbuild	6.0.4	10.1.0	10.0.1	Newer since #145
NuGet	Microsoft.AspNetCore.Mvc.Testing	8.0.15	8.0.31	8.0.22	Latest 8.0.x. 10.x needs net10.0
Actions	actions/checkout	v2	v7	—	Not in #145. v2 runs on a deprecated Node runtime
Actions	actions/setup-dotnet	v1	v6	—	Not in #145. Same reason
Actions	ravsamhq/notify-slack-action	v1	2.5.0	2.5.0	Latest release. continue-on-error from #146 is kept

Left unchanged: xunit 2.9.3, Newtonsoft.Json 13.0.4 and Couchbase.Transactions 3.9.0 are already on their latest stable versions. The target framework stays at net8.0.

Validation

I ran this locally with the .NET 8 SDK (8.0.425) against a fresh Couchbase Server 7.6.4 container with travel-sample loaded:

dotnet restore Org.Quickstart.sln
dotnet build Org.Quickstart.sln --configuration Debug --no-restore
DB_CONN_STR=couchbase://<local> DB_USERNAME=<local> DB_PASSWORD=<local> \
  dotnet test src/Org.Quickstart.IntegrationTests --no-build --verbosity normal

Check	Result
Restore / build	Passed, 0 warnings, 0 errors
Integration tests	35/35 passed (Total tests: 35, Passed: 35)
main with the same setup, as a baseline	35/35 passed
GET /swagger/v1/swagger.json	OpenAPI 3.0.4, 7 paths
GET /index.html (Swagger UI)	HTTP 200
GET /api/v1/airline/list?limit=2	Returned travel-sample airlines

Note: at test shutdown the log shows ObjectDisposedException from CouchbaseLifetimeService.Close(). This also happens on main with the old package versions, so this PR doesn't cause it. It doesn't affect test results.

Risk notes

• Swashbuckle 6 → 10 is the only change that needed a code edit (the OpenAPI namespace import). I checked that the Swagger JSON and UI still render.
• xunit.runner.visualstudio 4.0.0 and the updated GitHub Actions are major-version bumps. CI on this PR will confirm them on the GitHub runner.

Rollback

Revert this PR.

🤖 Generated with Claude Code

[dex-the-ai]

CI status: the red build check comes from the CI environment, not from this PR

The Test step on main has never actually run any tests. The workflow only builds Org.Quickstart.API. dotnet test --no-build in the test project then finds nothing to run and passes. The first CI run on this PR (run 36587887277) passed in 22s without running a single test.

I fixed this in 6e18a0e ci: build the whole solution so integration tests actually run. Restore and build now use Org.Quickstart.sln. With that fix, CI runs all 35 integration tests against the CI Capella cluster, and all 35 fail. The SDK can't resolve the cluster's node hostnames from the GitHub runner:

Bootstrapping: attempted global bootstrapping on endpoint svc-dqise-node-032.<cluster>.cloud.couchbase.com:11207 has failed.
System.Net.Sockets.SocketException (00000005, 0xFFFDFFFF): Name or service not known

Baseline check. I ran the same fixed workflow against unchanged main code on a temporary branch, using the old package versions (run 36589763072). It gave the identical result: 35/35 failed with the same DNS errors. The temporary branch is deleted. So the failure comes from the CI Capella cluster or network, and the package updates don't cause it. Locally, against Couchbase Server 7.6.4 with travel-sample, this PR passes 35/35.

Someone with access to the CI Capella cluster (the DB_CONN_STR repo variable) should check that it is running and reachable. Once it is, re-running this check should pass. If you'd rather keep this PR to dependencies only, I can drop the CI build fix and do it separately. Without it, CI goes back to green but still runs no tests.