Update dependencies to latest stable versions (#690)

Co-authored-by: Stefan Broenner <stbrnner@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

CHANGELOG.md

@@ -12,6 +12,9 @@ This changelog covers all components:
 
 ### Changed
 
+- **Dependency freshness refresh (June 2026)**: Bumped centrally managed packages to their latest stable versions: Dax.Formatter (1.2.0 → 1.2.2), Spectre.Console (0.56.0 → 0.57.1; Spectre.Console.Cli stays at 0.55.0 — no newer stable), the OpenTelemetry family (1.15.x → 1.16.0: Api, Extensions.Hosting, Instrumentation.Http, Instrumentation.SqlClient), Microsoft.Identity.Client + Extensions.Msal (4.84.2 → 4.85.2), Polly.Core/Extensions/RateLimiting (8.6.6 → 8.7.0), StreamJsonRpc (2.25.25 → 2.25.29), Nerdbank.MessagePack security pin (1.2.4 → 1.2.30), Microsoft.NET.StringTools + Build.Framework + Build.Utilities.Core (18.6.3 → 18.7.1), Microsoft.NET.Test.Sdk (18.6.0 → 18.7.0), coverlet.collector (6.1.0 → 10.0.1), and Scriban (7.2.4 → 7.2.5). VS Code extension dev dependency @types/node bumped to ^26.0.1; npm install reports 0 vulnerabilities. Solution builds clean (0 warnings/0 errors) and extension compiles.
+
+
 - **Excel COM interop is PIA-first on the 16.x Excel PIA** (#559): Updated `Microsoft.Office.Interop.Excel` to 16.x and moved Power Query (`Workbook.Queries`, `WorkbookQuery`) plus Data Model measure/format APIs (`ModelMeasures`, `ModelMeasure`, `ModelFormat*`) back to strongly typed PIA access. Remaining `dynamic` usage is limited to APIs still outside the referenced Excel PIA or external Office/VBE object models.
 
 - **Excel PIA is now genuinely embedded; the hand-rolled `office.dll` assembly resolver is removed** (#559): `EmbedInteropTypes=true` set as metadata on a `<PackageReference>` is silently ignored by the .NET SDK, so the Excel PIA was being *referenced* (not embedded). The built assemblies therefore carried a transitive dependency on `office v16.0.0.0`, which forced a runtime `office.dll` load and a `FileNotFoundException: office, Version=16.0.0.0` in any host without the hand-rolled resolver (e.g. test hosts with no `Main`). The fix forces real interop embedding via a repo-root `Directory.Build.targets` target (sets `EmbedInteropTypes` on the resolved reference path) and makes the PIA compile-only with `<ExcludeAssets>runtime</ExcludeAssets>`. Only the Excel interop types actually used are baked into `ExcelMcp.ComInterop`/`ExcelMcp.Core` — none of which are Office.Core types — so the assemblies no longer reference `office.dll` at all. Consequently `RegisterOfficeAssemblyResolver()`/`ResolveOfficeDll()` were deleted from the MCP Server and CLI startup paths, and no test-side resolver is needed; Core/ComInterop tests (which have no `Main`) now load and run without it. `AutomationSecurity` continues to be accessed late-bound via `((dynamic)(object))` because the Office.Core enum type is intentionally not referenced.

Directory.Packages.props

@@ -8,8 +8,8 @@
     <!-- Excel COM Interop PIA -->
     <PackageVersion Include="Microsoft.Office.Interop.Excel" Version="16.0.18925.20022" />
     <!-- UI Framework -->
-    <PackageVersion Include="Dax.Formatter" Version="1.2.0" />
-    <PackageVersion Include="Spectre.Console" Version="0.56.0" />
+    <PackageVersion Include="Dax.Formatter" Version="1.2.2" />
+    <PackageVersion Include="Spectre.Console" Version="0.57.1" />
     <PackageVersion Include="Spectre.Console.Cli" Version="0.55.0" />
     <!-- Microsoft Extensions for MCP Server -->
     <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.9" />
@@ -20,10 +20,10 @@
     <PackageVersion Include="Microsoft.ApplicationInsights.WorkerService" Version="3.1.2" />
     <!-- Base SDK needed for tests that directly use TelemetryClient -->
     <PackageVersion Include="Microsoft.ApplicationInsights" Version="3.1.2" />
-    <PackageVersion Include="OpenTelemetry.Api" Version="1.15.3" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.15.3" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.15.1" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.SqlClient" Version="1.15.2" />
+    <PackageVersion Include="OpenTelemetry.Api" Version="1.16.0" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.16.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.SqlClient" Version="1.16.0" />
     <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.8.1" />
     <PackageVersion Include="Azure.Core" Version="1.59.0" />
     <PackageVersion Include="Microsoft.Extensions.Resilience" Version="10.7.0" />
@@ -38,21 +38,21 @@
     <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.9" />
     <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.9" />
     <PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.Identity.Client" Version="4.84.2" />
-    <PackageVersion Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.84.2" />
+    <PackageVersion Include="Microsoft.Identity.Client" Version="4.85.2" />
+    <PackageVersion Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.85.2" />
     <PackageVersion Include="Microsoft.IdentityModel.Abstractions" Version="8.19.1" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageVersion Include="OpenTelemetry.PersistentStorage.Abstractions" Version="1.1.0" />
     <PackageVersion Include="OpenTelemetry.PersistentStorage.FileSystem" Version="1.1.0" />
-    <PackageVersion Include="Polly.Core" Version="8.6.6" />
-    <PackageVersion Include="Polly.Extensions" Version="8.6.6" />
-    <PackageVersion Include="Polly.RateLimiting" Version="8.6.6" />
-    <PackageVersion Include="StreamJsonRpc" Version="2.25.25" />
+    <PackageVersion Include="Polly.Core" Version="8.7.0" />
+    <PackageVersion Include="Polly.Extensions" Version="8.7.0" />
+    <PackageVersion Include="Polly.RateLimiting" Version="8.7.0" />
+    <PackageVersion Include="StreamJsonRpc" Version="2.25.29" />
     <!-- Security override: StreamJsonRpc transitively pins vulnerable Nerdbank.MessagePack versions -->
-    <PackageVersion Include="Nerdbank.MessagePack" Version="1.2.4" />
+    <PackageVersion Include="Nerdbank.MessagePack" Version="1.2.30" />
     <PackageVersion Include="MessagePack" Version="3.1.7" />
     <PackageVersion Include="MessagePack.Annotations" Version="3.1.7" />
-    <PackageVersion Include="Microsoft.NET.StringTools" Version="18.6.3" />
+    <PackageVersion Include="Microsoft.NET.StringTools" Version="18.7.1" />
     <PackageVersion Include="Microsoft.NETCore.Platforms" Version="7.0.4" />
     <PackageVersion Include="System.ClientModel" Version="1.14.0" />
     <PackageVersion Include="System.Buffers" Version="4.6.1" />
@@ -70,22 +70,22 @@
     <!-- MCP SDK - Latest stable preview -->
     <PackageVersion Include="ModelContextProtocol" Version="1.4.0" />
     <!-- Testing Framework -->
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.6.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
     <PackageVersion Include="System.Net.Http" Version="4.3.5" />
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.2" />
     <PackageVersion Include="xunit" Version="2.9.3" />
     <PackageVersion Include="xunit.analyzers" Version="1.27.0" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
-    <PackageVersion Include="coverlet.collector" Version="6.1.0" />
+    <PackageVersion Include="coverlet.collector" Version="10.0.1" />
     <PackageVersion Include="MartinCostello.Logging.XUnit" Version="0.7.1" />
     <!-- Code Analysis and Security -->
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.3.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.3.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.301" />
     <!-- Template Engine for Skill Generation -->
-    <PackageVersion Include="Scriban" Version="7.2.4" />
+    <PackageVersion Include="Scriban" Version="7.2.5" />
     <!-- MSBuild Task Development -->
-    <PackageVersion Include="Microsoft.Build.Framework" Version="18.6.3" />
-    <PackageVersion Include="Microsoft.Build.Utilities.Core" Version="18.6.3" />
+    <PackageVersion Include="Microsoft.Build.Framework" Version="18.7.1" />
+    <PackageVersion Include="Microsoft.Build.Utilities.Core" Version="18.7.1" />
   </ItemGroup>
 </Project>

vscode-extension/package-lock.json

@@ -76,7 +76,7 @@
     "lint": "oxlint src -D correctness -D suspicious -D perf --deny-warnings"
   },
   "devDependencies": {
-    "@types/node": "^25.9.2",
+    "@types/node": "^26.0.1",
     "@types/vscode": "^1.118.0",
     "@vscode/vsce": "^3.9.2",
     "oxlint": "^1.69.0",