Update NuGet dependencies

[Copilot]

Description of Change

Bumps all NuGet dependencies to latest compatible versions.

Notable upgrades:

• SkiaSharp.Extended.UI.Maui 3.0.0-preview.18 → 3.0.0 (stable release)
• SkiaSharp 3.119.1 → 3.119.2 (Spectre mitigation security improvement)
• Microsoft.Extensions.Logging.Debug / Microsoft.SourceLink.GitHub aligned to .NET 10
• LightInject 6.6.4 → 7.0.1 (adds opt-in keyed services support, targets .NET 8)
• AndroidX Camera 1.4.1 → 1.5.2.1 (CameraX 1.5: high-frame-rate video, dual concurrent camera, Ultra HDR/RAW support — existing simple capture flows are unaffected)
• Xamarin.AndroidX.Core.SplashScreen 1.0.1.12 → 1.2.0.1 (improved Android 12+ backward compat)
• Xamarin.Google.MLKit.BarcodeScanning 117.3.0 → 117.3.0.6 (binding patch, bug fixes)
• Xamarin.AndroidX.Tracing 1.3.0.1 → 1.3.0.2 (binding patch)
• Newtonsoft.Json 13.0.3 → 13.0.4 (AOT/trim annotations, Index support for JArray, TimeOnly deserialization improvements)
• BitMiracle.LibTiff.NET 2.4.649 → 2.4.660 (internal/build fixes)

Test tooling:

• xunit 2.4.1 → 2.9.3 (2.9.3 is the final v2.x release; Assert.Equivalent now supports Uri, new Assert.IsType overload — no impact on our tests)
• xunit.runner.visualstudio 2.4.3 → 3.1.5
• Microsoft.NET.Test.Sdk 16.11.0 → 18.3.0
• coverlet.collector 6.0.4 → 8.0.0
• FluentAssertions 6.9.0 → 6.12.2 (stays on v6 to avoid commercial license in v8; no breaking changes)

Todos

• I have tested on an Android device.
• I have tested on an iOS device.
• I have supported accessibility

View original Slack conversation

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[haavamoa]

@copilot Se her
Daymn
Sick
Can you summarize from the release notes of the dependencies what we get by updating? We are afraid to do it due to potential breaking changes

[Copilot]

@copilot Se her
Daymn
Sick...

Here's a summary of what each update brings and the risk level:

---

🟢 Low / No Risk — Maintenance bumps

Package	Change	Notes
SkiaSharp 3.119.1 → 3.119.2	Adds Spectre mitigation flag to the Linux native lib	Security improvement, no API changes
BitMiracle.LibTiff.NET 2.4.649 → 2.4.660	No public release notes; patch-level bump	Internal/build fixes only
Newtonsoft.Json 13.0.3 → 13.0.4	AOT/trim annotations, Index support for JArray, TimeOnly deserialization improvements, XML edge-case fixes	Purely additive. One community-reported edge case around NullValueHandling in custom SerializerSettings — unlikely to affect us
Microsoft.Extensions.Logging.Debug 7.0.0 → 10.0.3	Aligns version number with .NET 10; behavior is identical (thin wrapper over Debug.WriteLine)	No code changes needed
Microsoft.SourceLink.GitHub 8.0.0 → 10.0.103	Aligns with .NET 10 tooling	No functional change; improves debugger source-stepping
Xamarin.AndroidX.Tracing 1.3.0.1 → 1.3.0.2	Binding patch	No API changes
ML Kit BarcodeScanning 117.3.0 → 117.3.0.6	Binding patch for Google ML Kit 17.3.0	No new public APIs; performance/bug fixes from Google
FluentAssertions 6.9.0 → 6.12.2	Bug fixes and minor improvements in the 6.x line	No breaking changes; v6 API unchanged
coverlet.collector 6.0.4 → 8.0.0	Test coverage tool update	Dev tooling only, no runtime impact

---

🟡 Minor attention needed

Package	Change	Notes
xunit 2.4.1 → 2.9.3	Bug fixes; Assert.IsType gets new overload; Assert.Equivalent now supports Uri	One behavioral change: TheoryData<T[]> (array generic params) was tightened in 2.9.0 and fixed in 2.9.2. Our tests don't use TheoryData at all, so this does not affect us. 2.9.3 is the final v2.x release — future fixes go to v3 only
xunit.runner.visualstudio 2.4.3 → 3.1.5	Aligns with xunit 2.9.x	CI test output may change slightly (TeamCity flow IDs removed from collection names)
Microsoft.NET.Test.Sdk 16.11.0 → 18.3.0	Test host update	Dev tooling only
LightInject 6.6.4 → 7.0.1	New EnableMicrosoftCompatibility option for keyed services support (Microsoft.Extensions.DependencyInjection), targets .NET 8, fixes CanGetInstance NPE with unregistered types	Only used by MemoryLeakTests. No breaking API changes found — the new option is opt-in

---

🟠 Worth testing on device

Package	Change	Notes
Xamarin.AndroidX.Camera.View/Camera2 1.4.1 → 1.5.2.1	CameraX 1.5 is a significant update: high-frame-rate/slow-motion video, Feature Group API, dual concurrent camera improvements, Ultra HDR/RAW support	API additions are non-breaking for existing usage, but the SessionConfig API was rewritten. Our barcode scanner uses Camera2 — existing simple capture flows should be unaffected, but worth running the scanner on a real device
Xamarin.AndroidX.Core.SplashScreen 1.0.1.12 → 1.2.0.1	Better backward-compat for Android 12+ splash screens on older devices	Worth running through app launch on an Android device to confirm splash screen still shows correctly
SkiaSharp.Extended.UI.Maui 3.0.0-preview.18 → 3.0.0 (stable)	Official stable graduation of the preview we were already using. Targets .NET 9+, removes Xamarin.Forms support, requires .UseSkiaSharp() registration	We were already on preview.18 so the risk is low, but confirm Lottie animations still render correctly

---

Bottom line: Almost everything is low-risk maintenance. The three packages worth a quick device smoke-test are the Camera, SplashScreen, and SkiaSharp.Extended stable release. No code changes are required for any of these updates based on how the library currently uses them.