[jasonleenaylor]

Combines the two open Dependabot PRs, #1220 (actions-minor) and #1221 (nuget-minor), into one branch so they share one CI cycle. This also supersedes #1159, the earlier combined PR, which #1221 had already replaced.

How it was built

The five commits from the two PRs are cherry-picked onto current main in order, keeping their original authors:

• Chore: Bump the actions-minor group across 1 directory with 2 updates #1220's Dependabot commit, with its body trimmed to pass gitlint: the link bullets and the linked group summary are removed, and the per-dependency lines and updated-dependencies: trailer are kept.
• Chore: Bump the nuget-minor group with 15 updates #1221's Dependabot commit, byte-identical.
• John Lambert's three follow-up commits from Chore: Bump the nuget-minor group with 15 updates #1221, byte-identical:
  • Hold SIL.LibPalaso at beta0042 (18.0.0 needs icu.net 4 and fails restore with NU1109), and move Avalonia.Desktop with the rest of Avalonia.
  • Move the System.Diagnostics.DiagnosticSource binding redirect in App.config to 9.0.0.22.
  • Take SIL.LCModel beta0182 and System.Reflection.Metadata 10.0.12.

The icu.net 4 triage for the held LibPalaso upgrade is on #1221.

Versions

Source	Package	Old	New
#1220	EnricoMi/publish-unit-test-result-action	2.24.0	2.25.0
#1220	softprops/action-gh-release	3.0.2	3.0.3
#1221	Avalonia, Avalonia.Headless, Avalonia.Headless.NUnit, Avalonia.Skia, Avalonia.Win32.Interoperability	11.3.17	11.3.22
#1221	Semi.Avalonia	11.3.14	11.3.22
#1221	dotnet-coverage	18.10.0	18.12.0
#1221	dotnet-reportgenerator-globaltool	5.5.11	5.5.12
#1221	Encoding-Converters-Core	0.9.8	0.9.9
#1221	System.Diagnostics.DiagnosticSource	9.0.2	9.0.22
#1221	System.Drawing.Common, System.Resources.Extensions, System.Security.Permissions	9.0.18	9.0.22
#1221 (John)	Avalonia.Desktop	11.3.17	11.3.22
#1221 (John)	SIL.LCModel	11.0.0-beta0180	11.0.0-beta0182
#1221 (John)	System.Reflection.Metadata	10.0.10	10.0.12
#1221 (held)	SIL.Core, SIL.libpalaso.l10ns	18.0.0-beta0042 / beta0012	unchanged

No major-version bumps.

Checked locally

• gitlint and git log --check pass on all five commits.
• No pin comment blocks any bump: the DependencyModel hold at 9.0.16 is untouched, and System.Drawing.Common's ParatextData requirement is a floor.
• build.ps1 -BuildTests -SkipNative succeeds, and the restored assets resolve to the new versions.
• The Paratext lexicon plugin's external references show no change from this batch. Compared against an older main build, the only differences are the FieldWorks version and PCRE.NET 1.6, which come from SIL.Machine 3.9.6 already on main. Since SIL.LCModel moves, a manual smoke test of the lexicon plugin in Paratext before release is still worthwhile.
• Tests were left to CI.

Dependabot PRs show a red Build Debug and run tests because they cannot read secrets.CODECOV_TOKEN; this PR runs from a repo-owned branch, so its CI result is the meaningful one.

🤖 Generated with Claude Code

---

This change is 

[github-actions]

NUnit Tests

    1 files  ±0      1 suites  ±0   14m 29s ⏱️ +17s
7 057 tests ±0  6 972 ✅ ±0  85 💤 ±0  0 ❌ ±0 
7 066 runs  ±0  6 981 ✅ ±0  85 💤 ±0  0 ❌ ±0 

Results for commit 4674610. ± Comparison against base commit 412ee26.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.52%. Comparing base (412ee26) to head (4674610).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1235      +/-   ##
==========================================
- Coverage   40.52%   40.52%   -0.01%     
==========================================
  Files        1559     1559              
  Lines      356091   356091              
  Branches    41589    41589              
==========================================
- Hits       144298   144295       -3     
- Misses     182482   182483       +1     
- Partials    29311    29313       +2     

see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.