Chore: Bump 16 dependencies from 2 dependabot PRs

[jasonleenaylor]

Combines the two open Dependabot PRs so the repository pays for one CI cycle instead of two, and carries the two fixes their bumps need to build.

Supersedes #1116, #1154 and #1117.

What it combines

Source	Packages	Change
#1116	softprops/action-gh-release	3.0.2 -> 3.0.3
#1154	Avalonia, Avalonia.Headless, Avalonia.Headless.NUnit, Avalonia.Skia, Avalonia.Win32.Interoperability	11.3.17 -> 11.3.22
#1154	SilLcmVersion	11.0.0-beta0180 -> 11.0.0-beta0182
#1154	SilLibPalasoVersion	18.0.0-beta0030 -> 18.0.0-beta0042
#1154	EncodingConvertersCoreVersion	0.9.8 -> 0.9.9
#1154	System.Drawing.Common, System.Resources.Extensions, System.Security.Permissions	9.0.18 -> 9.0.20
#1154	System.Reflection.Metadata	10.0.10 -> 10.0.12
#1154	System.Diagnostics.DiagnosticSource	9.0.2 -> 9.0.20

All semver-patch. No major bumps.

#1117 is an older form of the same nuget group: it still bumps Avalonia.Themes.Fluent, which main no longer references, and it predates main's own SIL version moves. #1154 (created by @dependabot recreate) replaces it.

Two fixes the bumps need

Both were found by building locally; both would have failed CI on #1154 as it stands.

Avalonia.Desktop was left behind. Dependabot's group moved five Avalonia packages to 11.3.22 but not Avalonia.Desktop, which pulls Avalonia.Win32 transitively. At 11.3.17 beside the others it fails FwAvaloniaPreviewHost outright:

error MSB3277: Found conflicts between different versions of "Avalonia.Win32" that could not be resolved.
  "Avalonia.Win32, Version=11.3.17.0" vs "Avalonia.Win32, Version=11.3.22.0"

The group's pattern list is *, so this is not a scoping gap in .github/dependabot.yml; Avalonia.Desktop is a direct PackageReference in two projects and 11.3.22 is published. Avalonia.BuildServices was also left at 11.3.2, so it may not be a one-off.

The DiagnosticSource binding redirect had to move with the package. On net462 that package encodes its patch in the assembly version: the 9.0.2 package shipped assembly 9.0.0.2 and 9.0.20 ships 9.0.0.20 (verified by reading both packages). Src/Common/FieldWorks/App.config redirected Avalonia's 8.0.0.0 reference to 9.0.0.2, a file that no longer exists after the bump. The comment above that redirect already states the rule -- "newVersion must match the assembly version of the deployed DLL" -- so this is the maintenance it asks for.

How it was built

Original commits cherry-picked onto current main, authors and dates preserved. #1154's commit body is prose-only and is byte-identical; #1116's body had its markdown link bullets removed to satisfy gitlint's 80-column body rule. The two fixes are separate commits so they read as deliberate changes rather than edits to a bot's commit.

Verified locally

• gitlint --commits origin/main.. -- clean
• git log --check whitespace -- clean
• comment-hygiene and token-hygiene -- clean
• build.ps1 -BuildTests -SkipNative -- succeeded, 0 warnings, 0 errors
• resolved versions match the picked commits (Avalonia/11.3.22, Avalonia.Desktop/11.3.22, Avalonia.Win32/11.3.22, SIL.Core/18.0.0-beta0042, SIL.LCModel/11.0.0-beta0182, System.Diagnostics.DiagnosticSource/9.0.20), so nothing was shadowed by local dev packages
• full managed suite -- 6,185 executed, 6,185 passed, 0 failed (85 not run: explicit/desktop-only)
• Paratext contract: this batch moves SIL.Core, SIL.LCModel* and Encoding-Converters-Core, which ILRepack internalizes into FwParatextLexiconPlugin.dll. Its external references were compared between a build of origin/main and a build of this branch: 52 references, identical, so nothing new has to resolve inside Paratext's process.

Not verified

• Native code was not rebuilt (-SkipNative, artifacts seeded); no native source changes here.
• Native tests were not run.
• The merged lexicon plugin was not loaded in a real Paratext. Nothing automated covers the merged assembly, so a manual smoke there is still worth doing before release.
• Whether Dependabot will keep omitting Avalonia.Desktop and Avalonia.BuildServices from the group.

Note for reviewers

Dependabot PRs show a red Build Debug and run tests because they cannot read secrets.CODECOV_TOKEN. This PR runs from a repository-owned branch, so its CI result is the real one.

Co-authored-by: Claude Opus 5 noreply@anthropic.com

---

This change is 

[github-actions]

NUnit Tests

    1 files  ±0      1 suites  ±0   12m 52s ⏱️ +16s
6 232 tests ±0  6 147 ✅ ±0  85 💤 ±0  0 ❌ ±0 
6 241 runs  ±0  6 156 ✅ ±0  85 💤 ±0  0 ❌ ±0 

Results for commit acdf48b. ± Comparison against base commit a1d73aa.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.95%. Comparing base (118c2f6) to head (acdf48b).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1159   +/-   ##
=======================================
  Coverage   38.95%   38.95%           
=======================================
  Files        1520     1520           
  Lines      352476   352476           
  Branches    40636    40636           
=======================================
+ Hits       137298   137299    +1     
+ Misses     185896   185894    -2     
- Partials    29282    29283    +1     

see 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.