Repair mixed xunit pins: bump xunit group to 4.0.2 and xunit.analyzers to 2.2.0

[trejjam]

Repairs the mixed xUnit pins on main and brings every xUnit v3 package to 4.0.2.

main is currently broken on its own, independently of any open PR. The pins are inconsistent: xunit.v3.mtp-v2, xunit.v3.core.mtp-v2 and xunit.v3.runner.inproc.console sit at 4.0.0 while the rest are at 4.0.1. Since xunit.v3.core.mtp-v2 4.0.0 requires xunit.v3.extensibility.core (= 4.0.0) exactly, restore fails, and NU1608 is escalated to an error by WarningConfiguration.targets. Reproduced on a clean clone of main:

error NU1608: Detected package version outside of dependency constraint:
xunit.v3.core.mtp-v2 4.0.0 requires xunit.v3.extensibility.core (= 4.0.0)
but version xunit.v3.extensibility.core 4.0.1 was resolved.

The same error occurs for xunit.v3.runner.inproc.console 4.0.0. This is why the scheduled CI Build on main has been failing. #298 changes some of these pins but not all, so it does not resolve the inconsistency.

Changes

Directory.Packages.props only, plus the regenerated lock file:

• xunit.analyzers 2.1.0 -> 2.2.0
• xunit.v3.core.mtp-v2, xunit.v3.runner.inproc.console, xunit.v3.mtp-v2 4.0.0 -> 4.0.2
• xunit.v3.assert, xunit.v3.common, xunit.v3.extensibility.core, xunit.v3.runner.common 4.0.1 -> 4.0.2

Verify and Verify.XUnitV3 stay at 31.9.0. They are already consistent with each other, and Verify.XUnitV3 31.9.0 depends on xunit.v3.extensibility.core 3.2.1 as a minimum, which 4.0.2 satisfies.

Lock file regenerated with dotnet restore --force-evaluate.

Validation

Run locally with this repo's CI commands:

• CI=true dotnet restore --nologo passes, where the same command fails on main
• dotnet build --no-restore --nologo --configuration Release: 0 warnings, 0 errors
• dotnet test --no-build --configuration Release: 9 total, 9 passed, across net8.0, net9.0 and net10.0
• dotnet format --no-restore --verify-no-changes -v diag: clean

No Verify snapshot files changed.

Follow-up

.github/updater.yml sets targetFramework: netstandard2.0, which matches the generator project but not the test project (net8.0;net9.0;net10.0). The xUnit packages are only used by the test project. This mismatch is why the bot never updated xunit.v3.mtp-v2, xunit.v3.core.mtp-v2 and xunit.v3.runner.inproc.console: their dependency groups only cover net472 and net8.0, neither of which a netstandard2.0 consumer can use, so they were silently skipped. Left unchanged here; it needs a decision about whether the updater should infer per-project target frameworks instead of taking one value from config.

Note

The commit is unsigned because the 1Password SSH agent was unavailable on the machine that produced it.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T11:48:39.635483Z	f03b735	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.