[mjs06-git]

What changed and why

Dependabot's open PRs (#14 to #17) edit version numbers in the project files, but since 2.5 (#19) every package
version lives in Directory.Packages.props (central package management), so none of them applies any more. This
PR takes the updates that work, in the central file, and holds back the ones that can't work yet.

Updated (from #14, all minor or patch, all MIT or Apache-2.0):

Package	From	To
Avalonia, Avalonia.Desktop, Avalonia.Skia, Avalonia.Themes.Fluent, Avalonia.Fonts.Inter, Avalonia.Headless.XUnit	12.1.3	12.1.4
DocumentFormat.OpenXml	3.3.0	3.5.1
Microsoft.Data.Sqlite	10.0.12	10.0.13
QRCoder	1.6.0	1.8.1
xunit.runner.visualstudio	3.1.4	3.1.5

Avalonia 12.1.4 needs SkiaSharp 3.119.4 and HarfBuzzSharp 8.3.1.3, which are already the pinned versions.

Held back: xunit 4 (#15 xunit.runner.visualstudio 4.0.1, #16 xunit.v3 4.0.2, #17 xunit.v3.assert 4.0.2).

• The UI tests run on Avalonia's xunit runner, and Avalonia.Headless.XUnit (12.1.4 included) is built on xunit v3
  3.2.2.
• xunit 4 runs only on Microsoft Testing Platform. Bump xunit.v3 from 3.2.2 to 4.0.2 #16 failed every build with "Testing with VSTest target is no
  longer supported by Microsoft.Testing.Platform on .NET 10 SDK".
• .github/dependabot.yml now ignores new xunit majors, with the reason. The xunit packages move together, with an
  Avalonia release that supports xunit 4.

How it was tested

• dotnet test Sde.sln with FEMA's answer key set up: 1,218 passed, 0 skipped, 0 failed.
• A second full run failed one test, MapToolsTests.ScreenshotsOfTheMapPage_LightAndDark_WithALayerAndFloodZones,
  which was already known to be flaky under load before these updates. It then passed three times on its own, and two
  more full app-test runs passed (269 of 269).
• Screenshots: the only ones that changed are the ones that change on every run (they show times and dates), so
  none are included.

Checklist

• dotnet build Sde.sln and dotnet test Sde.sln pass.
• If this touches src/Sde.Calculation, src/Sde.Data/Seed or the export formats, I ran the tests with FEMA's
  answer key (tools/answer-key/setup.sh) and they pass. (It doesn't touch them; the answer-key tests pass too.)
• Export.json, the .mdb import and SDE_n folders are unchanged, or this PR explains why FEMA's SDE still reads them.
• A database written by this version still opens in the previous release. (No database changes.)
• Nothing here is specific to one city, county, state agency or software vendor.
• No real addresses, owner names or photos, and nothing from decomp/, reference/OriginalCalc/ or extracted/.
• docs/screenshots/ changed only if the UI was meant to change. (Unchanged.)
• User-facing text is plain English, with no em dashes.

Replaces #14, #15, #16 and #17.

🤖 Generated with Claude Code