chore(deps): Bump the nuget-minor-patch group with 5 updates (#576)

* chore(deps): Bump the nuget-minor-patch group with 5 updates

Bumps Aspire.Hosting.JavaScript from 13.5.0 to 13.5.1
Bumps Aspire.Hosting.PostgreSQL from 13.5.0 to 13.5.1
Bumps Aspire.Hosting.Redis from 13.5.0 to 13.5.1
Bumps Aspire.Hosting.Testing from 13.5.0 to 13.5.1
Bumps Microsoft.OpenApi from 2.12.0 to 2.12.2

---
updated-dependencies:
- dependency-name: Aspire.Hosting.JavaScript
  dependency-version: 13.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Aspire.Hosting.PostgreSQL
  dependency-version: 13.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Aspire.Hosting.Redis
  dependency-version: 13.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Aspire.Hosting.Testing
  dependency-version: 13.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.OpenApi
  dependency-version: 2.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): regenerate downstream packages.lock.json (#203)

* ci: point the --locked-mode drift guard at the new Microsoft.OpenApi pin

#576's group bump moved Microsoft.OpenApi 2.12.0 -> 2.12.2, so the drift
guard's hard-coded sed source (2.12.0) no longer matched and the guard failed
with 'drift-guard perturbation target not found'. Update the perturbation to
2.12.2 -> 2.12.1 and the grep target to 2.12.1.

Verified locally: the perturbation lands and the --locked-mode restore fails
with NU1004 (stale lock), which is exactly what the guard asserts.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: cluckwork-lockfix[bot] <cluckwork-lockfix[bot]@users.noreply.github.com>
Co-authored-by: mforce <mforce@protonmail.com>

Author: 3 people

.github/workflows/ci.yml

@@ -288,11 +288,11 @@ jobs:
           work="$(mktemp -d)"
           git archive HEAD | tar -x -C "$work"
           cd "$work"
-          sed -i 's#<PackageReference Include="Microsoft.OpenApi" Version="2.12.0" #<PackageReference Include="Microsoft.OpenApi" Version="2.11.0" #' \
+          sed -i 's#<PackageReference Include="Microsoft.OpenApi" Version="2.12.2" #<PackageReference Include="Microsoft.OpenApi" Version="2.12.1" #' \
             src/Cluckwork.Api/Cluckwork.Api.csproj
           # Fail loudly (don't silently pass) if the pin used as the perturbation
           # target has since moved — the guard must be kept pointing at a real pin.
-          grep -q '<PackageReference Include="Microsoft.OpenApi" Version="2.11.0" ' \
+          grep -q '<PackageReference Include="Microsoft.OpenApi" Version="2.12.1" ' \
             src/Cluckwork.Api/Cluckwork.Api.csproj \
             || { echo "::error::drift-guard perturbation target not found; update the Microsoft.OpenApi version it edits"; exit 1; }
           if docker build --target build -f src/Cluckwork.Api/Dockerfile -t cluckwork-lockdrift:ci . ; then

src/Cluckwork.Api/Cluckwork.Api.csproj

@@ -13,7 +13,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.*" />
     <!-- Pin patched Microsoft.OpenApi: transitive 2.0.0 has GHSA-v5pm-xwqc-g5wc (NU1903) -->
-    <PackageReference Include="Microsoft.OpenApi" Version="2.12.0" />
+    <PackageReference Include="Microsoft.OpenApi" Version="2.12.2" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.*" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.*">
       <PrivateAssets>all</PrivateAssets>

src/Cluckwork.Api/packages.lock.json

@@ -15,9 +15,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Aspire.Hosting.JavaScript" Version="13.5.0" />
-    <PackageReference Include="Aspire.Hosting.PostgreSQL" Version="13.5.0" />
-    <PackageReference Include="Aspire.Hosting.Redis" Version="13.5.0" />
+    <PackageReference Include="Aspire.Hosting.JavaScript" Version="13.5.1" />
+    <PackageReference Include="Aspire.Hosting.PostgreSQL" Version="13.5.1" />
+    <PackageReference Include="Aspire.Hosting.Redis" Version="13.5.1" />
   </ItemGroup>
 
   <ItemGroup>

src/Cluckwork.AppHost/Cluckwork.AppHost.csproj

@@ -14,7 +14,7 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Aspire.Hosting.Testing" Version="13.5.0" />
+    <PackageReference Include="Aspire.Hosting.Testing" Version="13.5.1" />
   </ItemGroup>
 
   <ItemGroup>