chore(deps): update minor and patch updates (nuget)

Rueckbau des Inline-Workarounds. Der Runner konnte den reusable workflow
nicht mehr laden, weil git fetch gegen die Forge crashte. Ursache war kein
Bug, sondern eine Kompromittierung ueber CVE-2026-59774: ein injizierter
packObjectsHook ersetzte git pack-objects durch einen Malware-Dropper.

Gitea laeuft jetzt auf 1.27.2, der Hook ist entfernt, fetch funktioniert
wieder. Die Scan-Definition liegt damit wieder an einer Stelle statt in
sieben Dateien. Details: Obsidian "Projekte/Hellion Forge/Forge
Security-Incident 2026-08-15.md".

.gitea/workflows/build.yml

@@ -35,7 +35,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
         with:
           dotnet-version: 10.0.x
 

.gitea/workflows/release.yml

@@ -54,7 +54,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
         with:
           dotnet-version: 10.0.x
 

.gitea/workflows/security.yml

@@ -1,4 +1,8 @@
 name: Security
+
+# Ruft den zentralen Scan-Workflow in security-workflows auf
+# (Semgrep SAST + Trivy filesystem scan).
+
 on:
   push:
     branches: [main, master]
@@ -11,10 +15,6 @@ jobs:
   scan:
     uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main
     with:
-      # MessageStore.cs uses string-interpolation in CommandText for table
+      # MessageStore.cs interpoliert SQL-Strings, die plugin-lokal sicher sind;
-      # names and clause-joins that come from internal code constants, not
+      # Semgrep matcht das Pattern, CodeQL mit Datenflussanalyse nicht.
-      # user input. Values are bound via SqlParameter, the SQL surface is
-      # local-only inside a Dalamud plugin. Semgrep matches the pattern
-      # without dataflow, so it flags those eight call sites; CodeQL
-      # would not. Suppressed for this repo only.
       semgrep-exclude-rules: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli'

HellionChat/HellionChat.csproj

@@ -14,7 +14,7 @@
     <ItemGroup>
         <!-- Closed ranges prevent surprise major bumps during lock file regeneration -->
         <PackageReference Include="MessagePack" Version="[3.1.4, 4.0.0)" />
-        <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.7" />
+        <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.11" />
         <!-- v1.5.0 DI-container foundation; matches Lightless pin (Hosting 10.0.7) -->
         <PackageReference
             Include="Microsoft.Extensions.DependencyInjection"
@@ -30,7 +30,7 @@
              Media-Foundation-based codecs do not). Using the sub-package avoids pulling in
              NAudio.WinForms (which requires WindowsDesktop and does not build on Linux hosts).
              WaveOutEvent and WaveFileReader both live in NAudio.WinMM + NAudio.Core. -->
-        <PackageReference Include="NAudio.WinMM" Version="2.2.1" />
+        <PackageReference Include="NAudio.WinMM" Version="2.3.0" />
         <PackageReference Include="Pidgin" Version="[3.5.1, 4.0.0)" />
         <PackageReference Include="SixLabors.ImageSharp" Version="[3.1.12, 4.0.0)" />
     </ItemGroup>

HellionChat/packages.lock.json

@@ -27,13 +27,13 @@
       },
       "Microsoft.Data.Sqlite": {
         "type": "Direct",
-        "requested": "[10.0.7, )",
+        "requested": "[10.0.11, )",
-        "resolved": "10.0.7",
+        "resolved": "10.0.11",
-        "contentHash": "DZ6G2QuyPrsh5VS+wfiZbNBtYT6p+CkxXjD0aZHF04xso7QsG/uk0JpG30hzYlK6u/wtTzta1Dqfgbc/Sl2sDA==",
+        "contentHash": "7je7UELzm131GiLYc4PpZvfKXIgIyzPM+v+tjcd/nbnuWRfgcONYKzDTqJlURxwVCFsVnlpmq6y6yn4qvR8QXQ==",
         "dependencies": {
-          "Microsoft.Data.Sqlite.Core": "10.0.7",
+          "Microsoft.Data.Sqlite.Core": "10.0.11",
-          "SQLitePCLRaw.bundle_e_sqlite3": "2.1.11",
+          "SQLitePCLRaw.bundle_e_sqlite3": "2.1.12",
-          "SQLitePCLRaw.core": "2.1.11"
+          "SQLitePCLRaw.core": "2.1.12"
         }
       },
       "Microsoft.Extensions.DependencyInjection": {
@@ -104,11 +104,11 @@
       },
       "NAudio.WinMM": {
         "type": "Direct",
-        "requested": "[2.2.1, )",
+        "requested": "[2.3.0, )",
-        "resolved": "2.2.1",
+        "resolved": "2.3.0",
-        "contentHash": "xFHRFwH4x6aq3IxRbewvO33ugJRvZFEOfO62i7uQJRUNW2cnu6BeBTHUS0JD5KBucZbHZaYqxQG8dwZ47ezQuQ==",
+        "contentHash": "5G1dRjsZm50T3luyuqcmI2BSvj3K4ZJaD/x776/0Epj88qOsOryDZG40+MufwIk1UFJSFWhRobBqtJYFc8Ss4g==",
         "dependencies": {
-          "NAudio.Core": "2.2.1"
+          "NAudio.Core": "2.3.0"
         }
       },
       "Pidgin": {
@@ -141,10 +141,10 @@
       },
       "Microsoft.Data.Sqlite.Core": {
         "type": "Transitive",
-        "resolved": "10.0.7",
+        "resolved": "10.0.11",
-        "contentHash": "xVrtBg3M1wJlBDkoT0dXEYB/wSc8bIHJPYtw/bu1AqpWgF79uPSs87DAhERR/Ilumre6TKZa1cjMg3VUUObVLA==",
+        "contentHash": "hubA20AGenQ4Sx0ElWaPpB8DISjXpdx463+1zOGRslsT0e/t/06ITv+pHsop8CcJ0d8PZLfgnT7juCDVD79Dkw==",
         "dependencies": {
-          "SQLitePCLRaw.core": "2.1.11"
+          "SQLitePCLRaw.core": "2.1.12"
         }
       },
       "Microsoft.Extensions.Configuration": {
@@ -377,29 +377,29 @@
       },
       "NAudio.Core": {
         "type": "Transitive",
-        "resolved": "2.2.1",
+        "resolved": "2.3.0",
-        "contentHash": "GgkdP6K/7FqXFo7uHvoqGZTJvW4z8g2IffhOO4JHaLzKCdDOUEzVKtveoZkCuUX8eV2HAINqi7VFqlFndrnz/g=="
+        "contentHash": "jMd7r6dB6tAtXhOYL58ntPqwERNm1/Rhw5MKOIYvsnXzuX+PTGsa2VMam6n0npZYSwlSidKa4GAm4bFcXFUlcg=="
       },
       "SQLitePCLRaw.bundle_e_sqlite3": {
         "type": "Transitive",
-        "resolved": "2.1.11",
+        "resolved": "2.1.12",
-        "contentHash": "DC4nA7yWnf4UZdgJDF+9Mus4/cb0Y3Sfgi3gDnAoKNAIBwzkskNAbNbyu+u4atT0ruVlZNJfwZmwiEwE5oz9LQ==",
+        "contentHash": "mAgscpQMLw5/nfA1Q5oJVAT29yROUo1ifZGbbTpx/lwZpSxMUGoYbKfmvdm8oXER+RzxqBmmQzeBEVKfeHv2nw==",
         "dependencies": {
-          "SQLitePCLRaw.lib.e_sqlite3": "2.1.11",
+          "SQLitePCLRaw.lib.e_sqlite3": "2.1.12",
-          "SQLitePCLRaw.provider.e_sqlite3": "2.1.11"
+          "SQLitePCLRaw.provider.e_sqlite3": "2.1.12"
         }
       },
       "SQLitePCLRaw.core": {
         "type": "Transitive",
-        "resolved": "2.1.11",
+        "resolved": "2.1.12",
-        "contentHash": "PK0GLFkfhZzLQeR3PJf71FmhtHox+U3vcY6ZtswoMjrefkB9k6ErNJEnwXqc5KgXDSjige2XXrezqS39gkpQKA=="
+        "contentHash": "ETpNw9DY3ckWLgRRAeCHj+GKOuPi61aeczkXhgHexUvqoZBAYg8RYESE2J7O1M7+o6QbdSEZwrw9bfqztUVWXg=="
       },
       "SQLitePCLRaw.provider.e_sqlite3": {
         "type": "Transitive",
-        "resolved": "2.1.11",
+        "resolved": "2.1.12",
-        "contentHash": "Y/0ZkR+r0Cg3DQFuCl1RBnv/tmxpIZRU3HUvelPw6MVaKHwYYR8YNvgs0vuNuXCMvlyJ+Fh88U1D4tah1tt6qw==",
+        "contentHash": "W3oH4XIfCzFrgUSDKHhN6N+dgzA5YHOR2VxX8GB6Qy7CyrJJgxPEG8NirgYWlPQC5P2jz2knSsexWu4tDUL33g==",
         "dependencies": {
-          "SQLitePCLRaw.core": "2.1.11"
+          "SQLitePCLRaw.core": "2.1.12"
         }
       },
       "System.Diagnostics.EventLog": {

dotnet-tools.json

@@ -4,7 +4,7 @@
     "isRoot": true,
     "tools": {
         "csharpier": {
-            "version": "1.2.6",
+            "version": "1.3.0",
             "commands": ["csharpier"],
             "rollForward": false
         }