[angularsen]

Fixes CI restore failure seen in #1751 (and on master):

CodeGen/CodeGen.csproj : error NU1903: Warning As Error: Package 'System.Security.Cryptography.Pkcs' 8.0.1 has a known high severity vulnerability, https://github.com/advisories/GHSA-846f-f764-76mx

Changes

• Pin System.Security.Cryptography.Pkcs 10.0.14 in CodeGen. It comes in transitively via NuGet.Protocol, and even 7.9.0 still depends on 8.0.1. Fixes GHSA-846f-f764-76mx and GHSA-2fmv-rv2c-59x7.
• Bump to latest stable:

Package	Old	New	Where
Microsoft.NET.Test.Sdk	18.6.0 / 18.5.1	18.11.0	root, Modular
xunit.runner.visualstudio	3.1.5	4.0.1	root, Modular
MinVer	7.0.0	8.0.0	root, Modular
NuGet.Protocol	7.6.0	7.9.0	root
Serilog	4.3.1	4.4.0	root
System.Text.Json	10.0.9	10.0.14	root
System.Collections.Immutable	9.0.8 / 9.0.0	10.0.14	root, Samples
System.Reflection.Metadata	9.0.0	10.0.14	Samples

MinVer 8's only breaking change rejects MinVerDefaultPreReleasePhase, which is not used here.

• Pin the de-CH digit group separator in the FeetInchesTests separator cases. ubuntu-latest moved to 26.04, whose ICU ships CLDR 48, and CLDR 48 changed the de-CH separator from ’ to '. This is unrelated to the package bumps.

Known limitation, not fixed here

With CLDR 48 data, Length.TryParseFeetInches returns false for de-CH input that combines feet and inches using the ASCII apostrophe separator, such as 1'000' 6". The apostrophe is also a feet abbreviation, and the lazy feet regex stops at the first one. Feet-only input such as 1'000' still parses. The pinned test does not cover this case.

Intentionally not updated

• Microsoft.CodeAnalysis.CSharp 4.14.0 (Modular): the Roslyn version sets the minimum compiler version for generator consumers.
• System.Text.Json and related build-only versions in UnitsNet.Modular/Directory.Packages.props: they mirror STJ's netstandard2.0 dependency floor.
• UnitsNet 4.144.0 / 4.72.0 in the versioned PerfTests projects.
• xunit 2.9.3 → v3 is a migration, not a bump.

Verified locally

• UnitsNet.slnx: build and all tests pass (net48, net8, net9, net10).
• UnitsNet.Modular.slnx (Platform=ProjectReferences, Release): build and 116 tests pass.
• The 4 sample apps build.
• dotnet list package --vulnerable: no findings.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98%. Comparing base (3bf1ef4) to head (2dc9258).

Additional details and impacted files

@@          Coverage Diff           @@
##           master   #1752   +/-   ##
======================================
  Coverage      98%     98%           
======================================
  Files         515     515           
  Lines       24092   24092           
======================================
  Hits        23692   23692           
  Misses        400     400           

Flag	Coverage Δ
net48	97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[angularsen]

[claude-opus-5-5] via babysit-pr, on behalf of the PR operator.

Reviewed head: 2dc9258470bbc9d215c15c613047dd88378402d7, base 3bf1ef4b3. Independent reviewer: Codex gpt-6.1-sol, medium effort.

Verdict	Result
Functional	clear, no findings
Convention	clear, no findings

CI fix in this round: the two remaining FeetInchesTests failures came from ubuntu-latest moving to 26.04, whose ICU ships CLDR 48. CLDR 48 changed the de-CH group separator from ’ to '. The tests now pin the separator.

Checks: PR Build & Test and PR net48 Build & Test (both required) pass, as do Modular build/test/pack and codecov. claude-review fails about 2 seconds in with is_error:true and zero cost on every run of this PR. It is not a required check and produced no review.

Open for maintainer: Length.TryParseFeetInches returns false for de-CH feet-and-inches input with the ASCII apostrophe separator, such as 1'000' 6". This parser limitation predates the PR and is not fixed here.

Limits: the reviewer could not build or run tests locally and relied on CI logs. The vulnerability scan and net8/net9 results are from the author's local run.