chore(deps): 批量合并 Dependabot 依赖升级并分组

.github/dependabot.yml

@@ -1,11 +1,22 @@
 version: 2
 updates:
   # GitHub Actions 与 NuGet 依赖每周检查一次，自动开 PR。
+  # 同一生态的更新合并为一个 PR，避免同族包（如 EF Core 各包）被拆开升级导致 CS1705。
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns: ["*"]
   - package-ecosystem: "nuget"
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      nuget:
+        patterns: ["*"]
+    ignore:
+      # 插件只编译期引用 Harmony，运行时用宿主 ClassIsland 自带的 0Harmony 2.4.2.0；
+      # 引用更高版本会让运行时请求不存在的程序集版本。跟随宿主升级时再手动调整。
+      - dependency-name: "Lib.Harmony"

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
         run: dotnet build RemoteCI.slnx -c Release
       - name: 测试
         run: dotnet test RemoteCI.slnx -c Release --no-build
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
       - name: 验证浏览器语音采集
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"

.github/workflows/release.yml

@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -171,7 +171,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -231,16 +231,16 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "channel=$channel" >> "$GITHUB_OUTPUT"
           echo "prerelease=$prerelease" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
       - name: 登录 GHCR
         uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: 构建并推送多架构镜像
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: server/RemoteCI.Server/Dockerfile

server/RemoteCI.Server/RemoteCI.Server.csproj

@@ -31,12 +31,12 @@
     <PackageReference Include="ClosedXML" Version="0.105.1" />
     <PackageReference Include="Markdig" Version="1.4.0" />
     <!-- Identity、SQLite provider 和 Design 保持同一 EF Core 补丁版本，避免测试依赖图出现 CS1705。 -->
-    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.12" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.12" />
+    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.13" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.13" />
     <PackageReference Include="QRCoder" Version="1.7.0" />
-    <!-- 2.1.12 覆盖 EF 的易受攻击传递版本 2.1.11。 -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.12" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12">
+    <!-- 显式引用（≥ 2.1.12）覆盖 EF 的易受攻击传递版本 2.1.11。 -->
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.13" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.13">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>

server/tests/RemoteCI.Server.Tests/RemoteCI.Server.Tests.csproj

@@ -10,7 +10,7 @@
 
   <ItemGroup>
     <PackageReference Include="ClosedXML" Version="0.105.1" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.12" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.13" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />

server/tests/RemoteCI.Server.Tests/WebSocketRelayTests.cs

@@ -301,7 +301,8 @@ await SendAsync(plugin, Envelope.PeerCapabilities(new PeerCapabilities
         }));
 
         var registry = _factory.Services.GetRequiredService<PeerRegistry>();
-        await WaitUntilAsync(() => registry.GetPluginDeviceSnapshots().Count == 1);
+        // 等能力上报处理完成，否则命令会因未声明 SoftwareInventory 能力被直接拒绝而不下发。
+        await WaitUntilAsync(() => registry.GetPluginDeviceSnapshots() is [{ HasExplicitCapabilities: true }]);
         var target = registry.GetPluginDeviceSnapshots().Single();
         var pending = registry.SendCommandAndWaitToConnectionAsync(new CommandMessage
         {