chore(deps): update packages and adopt the new analyzer rules

- Take every framework-aligned pin to the latest of its own band, hold the
  .NET 11 entries on preview 7 until the release is out, and leave
  Microsoft.CodeAnalysis.CSharp on the 4.x line it is pinned to on purpose
- Scope the .NET Framework group's pins to the legs that reference them, since
  transitive pinning would otherwise apply them to every graph
- Turn on the rules the 4.x analyzers add, and pass the capacity or comparer
  through a collection expression where SST2106 asks for it

Author: glennawatson

.editorconfig

@@ -1527,6 +1527,7 @@ dotnet_diagnostic.SST1706.severity = error # An extension block targets a broad
 dotnet_diagnostic.SST1707.severity = error # Extension blocks should be ordered by receiver type
 dotnet_diagnostic.SST1708.severity = error # An extension method never uses its this receiver
 dotnet_diagnostic.SST1709.severity = error # A method in an *Extensions class whose first parameter lacks this
+dotnet_diagnostic.SST1710.severity = error # Prefer an extension indexer over an accessor-shaped extension method
 dotnet_diagnostic.SST1800.severity = error # Record classes should be sealed
 dotnet_diagnostic.SST1801.severity = error # A positional record parameter does not match the configured casing
 dotnet_diagnostic.SST1802.severity = error # A record declares a settable rather than init-only instance property
@@ -1538,6 +1539,7 @@ dotnet_diagnostic.SST2102.severity = error # A span-targeted stackalloc initiali
 dotnet_diagnostic.SST2103.severity = error # A collection-builder factory call can use a collection expression
 dotnet_diagnostic.SST2104.severity = error # A short builder-local sequence can return a collection expression
 dotnet_diagnostic.SST2105.severity = error # A literal array materialized with LINQ can use a collection expression
+dotnet_diagnostic.SST2106.severity = error # Pass the capacity or comparer through a collection expression
 dotnet_diagnostic.SST2200.severity = error # A single-use backing field can use the C# 14 field keyword
 dotnet_diagnostic.SST2201.severity = error # A return-only switch statement can use a switch expression
 dotnet_diagnostic.SST2202.severity = error # An object creation repeats an explicit target type
@@ -1626,6 +1628,7 @@ dotnet_diagnostic.SST2285.severity = error # A null guard is conjoined with a me
 dotnet_diagnostic.SST2286.severity = error # ToString is called on a receiver already typed as string
 dotnet_diagnostic.SST2287.severity = error # A while loop owns its counter, so a for header would gather it
 dotnet_diagnostic.SST2288.severity = error # A conditional expression has a boolean literal in exactly one branch
+dotnet_diagnostic.SST2289.severity = error # An unsafe block that no longer needs an unsafe context
 # Design
 dotnet_diagnostic.SST2300.severity = error # A class implements IDisposable but builds only half of the disposal pattern
 dotnet_diagnostic.SST2301.severity = error # A class implementing IEquatable for itself can still be derived from
@@ -1664,6 +1667,8 @@ dotnet_diagnostic.SST2333.severity = error # A generic equality contract lacks i
 dotnet_diagnostic.SST2334.severity = error # A publicly visible type has no `[DebuggerDisplay]`
 dotnet_diagnostic.SST2335.severity = error # Parts of a partial type disagree on the `static` modifier
 dotnet_diagnostic.SST2336.severity = error # A concrete attribute type declares no [AttributeUsage]
+dotnet_diagnostic.SST2337.severity = error # Declare a fully known hierarchy as closed
+dotnet_diagnostic.SST2338.severity = none # Declare a hand-rolled discriminated type as a union
 
 # Correctness
 dotnet_diagnostic.SST2400.severity = error # Two arguments name each other's parameters and have been transposed
@@ -1757,6 +1762,7 @@ dotnet_diagnostic.SST2495.severity = error # A [Flags] combination includes bits
 dotnet_diagnostic.SST2496.severity = error # An explicit Dispose/Close an enclosing using already performs
 dotnet_diagnostic.SST2497.severity = error # A member forwards to itself, so calling it recurses until the stack is gone
 dotnet_diagnostic.SST2498.severity = error # nameof on a type parameter is the constant "T"
+dotnet_diagnostic.SST2499.severity = error # Read the exit status rather than the exit code when a process can be signalled
 
 # Testing
 dotnet_diagnostic.SST2500.severity = error # A test method contains no assertion and no expected-exception check
@@ -1821,6 +1827,7 @@ dotnet_diagnostic.PSH1020.severity = error # Prefer a jagged array over a multid
 dotnet_diagnostic.PSH1021.severity = error # An explicit GC.Collect forces collection the runtime tunes itself
 dotnet_diagnostic.PSH1022.severity = error # A parameterless new EventArgs() where EventArgs.Empty would serve
 dotnet_diagnostic.PSH1023.severity = error # A local anonymous type allocates where a tuple would not
+dotnet_diagnostic.PSH1024.severity = error # Build a BitArray from a span instead of a temporary array
 dotnet_diagnostic.PSH1100.severity = error # Hot-path code should avoid System.Linq.Enumerable calls
 dotnet_diagnostic.PSH1101.severity = none # LINQ predicate simplification — production code avoids LINQ on hot paths
 dotnet_diagnostic.PSH1102.severity = none # LINQ type-filter simplification — production code avoids LINQ on hot paths
@@ -1892,6 +1899,7 @@ dotnet_diagnostic.PSH1313.severity = error # A synchronous call where an async o
 dotnet_diagnostic.PSH1314.severity = error # Read and write streams through the memory-based overloads
 dotnet_diagnostic.PSH1315.severity = error # A blocking wait on an awaitable that may not be done
 dotnet_diagnostic.PSH1316.severity = error # A ValueTask is awaited in a loop or awaited after being copied
+dotnet_diagnostic.PSH1318.severity = error # Validate options asynchronously instead of blocking
 dotnet_diagnostic.PSH1400.severity = error # Use the static HashData method for one-shot hashing
 dotnet_diagnostic.PSH1401.severity = error # Attribute types should be sealed
 dotnet_diagnostic.PSH1402.severity = error # Use const for compile-time constants
@@ -1946,6 +1954,7 @@ dotnet_diagnostic.SES1006.severity = error # A Data Protection key ring is persi
 dotnet_diagnostic.SES1007.severity = error # A cryptographic primitive is implemented by hand
 dotnet_diagnostic.SES1008.severity = error # An XML signature is verified with the no-key CheckSignature overload
 dotnet_diagnostic.SES1009.severity = error # A password is stored without a slow, salted key-derivation function
+dotnet_diagnostic.SES1010.severity = error # Do not implement AES key wrapping by hand
 
 # Transport
 dotnet_diagnostic.SES1102.severity = error # Do not accept any server certificate

src/Directory.Packages.props

@@ -5,7 +5,7 @@
     <CentralPackageTransitivePinningEnabled>trueCentralPackageTransitivePinningEnabled>
     
-    <RoslynCommonAnalyzersVersion>3.46.0RoslynCommonAnalyzersVersion>
+    <RoslynCommonAnalyzersVersion>4.1.0RoslynCommonAnalyzersVersion>
     <AvaloniaVersion>12.1.2AvaloniaVersion>
   PropertyGroup>
   <ItemGroup>
@@ -19,12 +19,12 @@
     <PackageVersion Include="Roslynator.Analyzers" Version="5.0.0"/>
     <PackageVersion Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="5.6.0"/>
     <PackageVersion Include="PublicApiSharp.Analyzers" Version="1.0.7"/>
-    <PackageVersion Include="SonarAnalyzer.CSharp" Version="10.33.0.1635"/>
+    <PackageVersion Include="SonarAnalyzer.CSharp" Version="10.34.0.3385"/>
   ItemGroup>
   
   <ItemGroup>
     <PackageVersion Include="BenchmarkDotNet" Version="0.15.8"/>
-    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.9.0"/>
+    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.10.0"/>
     <PackageVersion Include="System.Reactive" Version="7.0.0"/>
     <PackageVersion Include="Microsoft.Reactive.Testing" Version="7.0.0"/>
     <PackageVersion Include="System.Reactive.Async" Version="6.0.0-alpha.18"/>
@@ -34,42 +34,42 @@
   <ItemGroup>
     <PackageVersion Include="Avalonia" Version="$(AvaloniaVersion)"/>
     <PackageVersion Include="Avalonia.Headless" Version="$(AvaloniaVersion)"/>
-    <PackageVersion Include="Microsoft.AspNetCore.Components" Version="8.0.30" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0'))"/>
-    <PackageVersion Include="Microsoft.AspNetCore.Components" Version="9.0.19" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net10.0'))"/>
-    <PackageVersion Include="Microsoft.AspNetCore.Components" Version="10.0.11" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net10.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
+    <PackageVersion Include="Microsoft.AspNetCore.Components" Version="8.0.31" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0'))"/>
+    <PackageVersion Include="Microsoft.AspNetCore.Components" Version="9.0.20" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net10.0'))"/>
+    <PackageVersion Include="Microsoft.AspNetCore.Components" Version="10.0.12" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net10.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
     <PackageVersion Include="Microsoft.AspNetCore.Components" Version="11.0.0-preview.7.26381.103" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
-    <PackageVersion Include="Microsoft.AspNetCore.Components.Web" Version="8.0.30" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0'))"/>
-    <PackageVersion Include="Microsoft.AspNetCore.Components.Web" Version="9.0.19" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net10.0'))"/>
-    <PackageVersion Include="Microsoft.AspNetCore.Components.Web" Version="10.0.11" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net10.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
+    <PackageVersion Include="Microsoft.AspNetCore.Components.Web" Version="8.0.31" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0'))"/>
+    <PackageVersion Include="Microsoft.AspNetCore.Components.Web" Version="9.0.20" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net10.0'))"/>
+    <PackageVersion Include="Microsoft.AspNetCore.Components.Web" Version="10.0.12" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net10.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
     <PackageVersion Include="Microsoft.AspNetCore.Components.Web" Version="11.0.0-preview.7.26381.103" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
-    <PackageVersion Include="Microsoft.Bcl.TimeProvider" Version="10.0.11"/>
+    <PackageVersion Include="Microsoft.Bcl.TimeProvider" Version="10.0.12"/>
     <PackageVersion Include="Microsoft.Extensions.Configuration" Version="11.0.0-preview.7.26381.103" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="11.0.0-preview.7.26381.103" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
     <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="11.0.0-preview.7.26381.103" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
     <PackageVersion Include="Microsoft.Extensions.Logging" Version="11.0.0-preview.7.26381.103" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="11.0.0-preview.7.26381.103" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
-    <PackageVersion Include="Microsoft.Maui.Core" Version="10.0.100" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net10.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
+    <PackageVersion Include="Microsoft.Maui.Core" Version="10.0.101" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net10.0')) AND !$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
     <PackageVersion Include="Microsoft.Maui.Core" Version="11.0.0-preview.7.26406.9" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net11.0'))"/>
     <PackageVersion Include="Microsoft.WindowsAppSDK" Version="2.4.0"/>
   ItemGroup>
   
-  <ItemGroup>
+  <ItemGroup Condition="$(TargetFramework.StartsWith('net4'))">
     <PackageVersion Include="System.ValueTuple" Version="4.6.2"/>
-    <PackageVersion Include="System.Threading.Channels" Version="10.0.11"/>
+    <PackageVersion Include="System.Threading.Channels" Version="10.0.12"/>
     <PackageVersion Include="System.Runtime.CompilerServices.Unsafe" Version="6.1.2"/>
     <PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0"/>
     <PackageVersion Include="System.Buffers" Version="4.6.1"/>
     <PackageVersion Include="System.Memory" Version="4.6.3"/>
-    <PackageVersion Include="System.Collections.Immutable" Version="10.0.11"/>
+    <PackageVersion Include="System.Collections.Immutable" Version="10.0.12"/>
   ItemGroup>
   
   <ItemGroup>
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0"/>
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0"/>
-    <PackageVersion Include="TUnit" Version="1.66.8"/>
-    <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.11.0"/>
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.10.0"/>
+    <PackageVersion Include="TUnit" Version="1.66.27"/>
+    <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.11.2"/>
   ItemGroup>
   <Import Project="$(MSBuildThisFileDirectory)/directory.packages.support.props" Condition="Exists('$(MSBuildThisFileDirectory)/directory.packages.support.props')"/>
 Project>

src/Primitives.Shared/SignalOperatorMixins.CollectionSignals.cs

@@ -79,7 +79,7 @@ public IDisposable Subscribe(IObserver> observer)
         {
             ArgumentExceptionHelper.ThrowIfNull(observer);
 
-            List<int> values = new(_range.Count);
+            List<int> values = [with(capacity: _range.Count)];
             for (var i = 0; i < _range.Count; i++)
             {
                 values.Add(_range.Start + i);

src/Primitives.Shared/SignalOperatorMixins.StatefulSignals.cs

@@ -330,12 +330,12 @@ private HashSet CreateSeen() =>
 #if NET8_0_OR_GREATER
             (_source is RangeSignal range ? range.Count : 0) switch
             {
-                var capacity when capacity > 0 => new(capacity, _comparer),
+                var capacity when capacity > 0 => [with(capacity, _comparer)],
                 _ when _comparer is null => [],
-                _ => new(_comparer),
+                _ => [with(_comparer)],
             };
 #else
-            new(_comparer);
+            [with(_comparer)];
 #endif
     }
 

src/Primitives.Shared/SignalOperatorParityMixins.AggregateHelpers.cs

@@ -104,7 +104,7 @@ private static int CountDistinctRange(
             Func<T, TKey> keySelector,
             IEqualityComparer<TKey>? comparer)
         {
-            HashSet<TKey> seen = comparer is null ? [] : new(comparer);
+            HashSet<TKey> seen = comparer is null ? [] : [with(comparer)];
             var typedSelector = (Func<int, TKey>)(object)keySelector;
             for (var i = 0; i < range.Count; i++)
             {

src/Primitives.Shared/SignalOperatorParityMixins.AwaitableTerminals.cs

@@ -278,7 +278,7 @@ public Task> CollectListAsync()
 
             if (source is RangeSignal range && typeof(T) == typeof(int))
             {
-                List<int> integers = new(range.Count);
+                List<int> integers = [with(capacity: range.Count)];
                 for (var i = 0; i < range.Count; i++)
                 {
                     integers.Add(range.Start + i);

src/ReactiveUI.Primitives.Async.Core/Operators/ToDictionaryAsync.cs

@@ -148,7 +148,7 @@ private sealed class ToDictionaryTaskWitness(
         where TKey : notnull
     {
         /// The dictionary that accumulates key-value pairs from the source sequence.
-        private readonly Dictionary<TKey, TValue> _map = comparer is null ? new() : new(comparer);
+        private readonly Dictionary<TKey, TValue> _map = comparer is null ? [] : [with(comparer)];
 
         /// 
         protected override ValueTask OnNextAsyncCore(TSource value, CancellationToken cancellationToken)

src/ReactiveUI.Primitives.Core/Advanced/DistinctByCountAggregator.cs

@@ -21,7 +21,7 @@ public readonly record struct
     /// The key selector.
     /// The key comparer, or  for the default comparer.
     public DistinctByCountAggregator(Func<T, TKey> keySelector, IEqualityComparer<TKey>? comparer)
-        : this(keySelector, comparer is null ? [] : new(comparer), 0)
+        : this(keySelector, comparer is null ? [] : [with(comparer)], 0)
     {
     }
 

src/ReactiveUI.Primitives.Core/Advanced/DistinctByLongCountAggregator.cs

@@ -21,7 +21,7 @@ public readonly record struct
     /// The key selector.
     /// The key comparer, or  for the default comparer.
     public DistinctByLongCountAggregator(Func<T, TKey> keySelector, IEqualityComparer<TKey>? comparer)
-        : this(keySelector, comparer is null ? [] : new(comparer), 0L)
+        : this(keySelector, comparer is null ? [] : [with(comparer)], 0L)
     {
     }
 

src/ReactiveUI.Primitives.Core/Advanced/DistinctByWitness.cs

@@ -35,7 +35,7 @@ public DistinctByWitness(IObserver observer, Func keySelector, IEqua
     {
         _observer = observer;
         _keySelector = keySelector;
-        _seen = comparer is null ? [] : new(comparer);
+        _seen = comparer is null ? [] : [with(comparer)];
     }
 
     ///