deps: fold the ten Dependabot bumps into one commit on top of v2.6.1, with every lock file regenerated

[camarigor]

Summary

Folds all ten open Dependabot PRs into one commit on top of the current main (v2.6.1 plus #212), with all four lock files regenerated through dotnet restore --force-evaluate rather than copied. That includes src/Jellyfin.Plugin.TwoFactorAuth/packages.jf12.lock.json, the Jellyfin 12 lock that none of the Dependabot PRs touch (Dependabot only knows the default lock path), so the two src locks stay in step.

Two of the bumps needed more than a version change, both explained below: MailKit 4.18.0 binds to BCL assemblies that .NET 9 does not ship at the referenced version, so the 10.11 package now bundles three more DLLs (build.sh, build.ps1, meta.json, THIRD-PARTY.md); and QuestPDF moves past a deliberate pin, with the evidence I could gather.

Supersedes #184, #185, #186, #187, #206, #207, #208, #209, #210 and #211, and replaces my #201 (four of the same bumps on top of v2.6.0; I am closing it in favour of this one).

Dependency	From	To	Where
actions/setup-dotnet	v5.4.0	v6.0.0	ci (2 jobs), codeql, dependabot-lockfiles (same SHA as #187)
actions/attest-build-provenance	v4.1.1	v4.2.2	release (same SHA as #186)
github/codeql-action init, analyze, upload-sarif	v4.37.3	v4.38.0	codeql and scorecard, the three together as dependabot.yml requires (same SHA as #185)
MailKit	4.17.0	4.18.0	src csproj (#206), plus the packaging change below
MaxMind.Db	5.1.0	5.2.0	src csproj (#207)
Microsoft.CodeAnalysis.NetAnalyzers	10.0.400	10.0.401	src csproj (#208)
QuestPDF	2026.5.0	2026.8.0	src csproj (#210), see the pin note below
NSubstitute	6.1.0	6.2.0	tests csproj (#184)
Microsoft.AspNetCore.TestHost	9.0.18	9.0.20	tests csproj (#209)
Microsoft.NET.Test.Sdk	18.7.0	18.10.0	tests csproj (#211)

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change (existing behaviour, config, or API changes)
• Security fix
• Documentation only
• CI / build / tests only (the workflow pins, the analyzer and the three test packages)
• Refactor (no functional change)
• Dependency update of three runtime packages (MailKit, MaxMind.Db, QuestPDF) and the packaging change the MailKit one needs; no plugin code changes

Related issues

Supersedes #184, #185, #186, #187, #206, #207, #208, #209, #210, #211. Replaces #201. Same approach as #165 (one commit, every lock file regenerated) and relies on the lock file check from #166. The QuestPDF pin comment in the csproj points at #77.

How was this tested?

• Added or updated unit tests: existing suite, unchanged
• Added or updated integration tests
• Tested manually against a running Jellyfin server (state version)
• N/A (explain why below)

Server tested against: Jellyfin 10.11.11 and Jellyfin 12.0.0, official Docker images (glibc), with the two packages build.sh produces from this branch (the 10.11 package, and the Jellyfin 12 package via JELLYFIN_VERSION=12.0.0), plus a Mailpit container as the SMTP server.

Local, with the .NET SDK 9.0.316 (the 9.0.x line CI installs):

• dotnet restore JellyfinSecurity.sln --force-evaluate, then dotnet restore JellyfinSecurity.sln --locked-mode: passes.
• dotnet build JellyfinSecurity.sln -c Release: 0 errors. The two CS8602 warnings are the ones in Jellyfin12ShellTests.cs that tests: assert the embedded inject.js is present before reading it (CS8602) #202 fixes; they are on main already.
• dotnet test -c Release: 511 passed, 0 failed.
• node --test tests/oidc-bridge.test.mjs: 8 passed.

Local, with the .NET SDK 10.0.400 for the Jellyfin 12 build: dotnet restore src/Jellyfin.Plugin.TwoFactorAuth -p:JellyfinVersion=12.0.0 --locked-mode passes and dotnet build -c Release -p:JellyfinVersion=12.0.0 has 0 warnings, 0 errors.

Packages: build.sh fat gives 45 files for 10.11 (the 42 of the official 2.6.1.0 zip plus System.Formats.Asn1.dll, System.Security.Cryptography.Pkcs.dll and Microsoft.Bcl.Cryptography.dll, all listed in meta.json, 23 entries) and 41 files for Jellyfin 12 (same as the official -jf12 zip; the patched meta.json lists 19 assemblies, none of the four net9-only ones).

Live:

• Jellyfin 10.11.11 (.NET 9), 10.11 package: plugin Active, the log shows Loaded assembly System.Formats.Asn1, Version=10.0.0.0 from the plugin folder. POST TwoFactorAuth/TestSmtp to Mailpit without TLS: 200, message received. With STARTTLS against Mailpit's self-signed certificate: 500 with SslHandshakeException ("The server's SSL certificate could not be validated"), and with a host name the certificate does not cover: SslHandshakeException: The host name (mailhost) did not match the name given in the server's SSL certificate (mailpit). That last message is the one code path in MailKit 4.18 that touches System.Formats.Asn1 (SslHandshakeException.GetDnsNames, which parses the subject alternative names).
• The same 10.11 container with the three new DLLs removed from the plugin folder (and from the installed meta.json), which is what deps: Bump MailKit from 4.17.0 to 4.18.0 #206 alone would ship: sending without TLS still works, but the host name mismatch case answers System.IO.FileNotFoundException: Could not load file or assembly 'System.Formats.Asn1, Version=10.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51' instead of the certificate message. Putting the three DLLs back restores the SslHandshakeException.
• Jellyfin 12.0.0 (.NET 10), Jellyfin 12 package (2.6.1.1, 41 files): plugin Active, TestSmtp without TLS 200 and received, with the self-signed certificate SslHandshakeException as expected.
• Jellyfin 12.0.0, 10.11 package (the 45-file one, which is what a 10.11 host would get and what my own production runs as a fallback build): plugin Active, the four net9-only assemblies load next to the ones .NET 10 ships, TestSmtp without TLS 200 and received, self-signed certificate SslHandshakeException, NativeDependencyLayout (fix(native): repair the root .so copies by rename and load nothing before first use #212) replaced the musl copies at the zip root with the linux-x64 hashes, the three DB-IP Lite databases from my production host load (Diagnostics geoip_asn, geoip_country, geoip_city all Ok), and POST TwoFactorAuth/RecoveryCodes/Pdf returns a valid PDF 1.4 (one A4 page, all ten codes, checked with poppler).
• No [ERR] or [WRN] lines from the plugin in any of the containers apart from the TestSmtp failures I provoked.

About the MailKit packaging change. MailKit 4.18.0 references System.Formats.Asn1 10.0.0.0, and MimeKit 4.18.0 references System.Security.Cryptography.Pkcs 10.0.0.0, which in turn needs Microsoft.Bcl.Cryptography 10.0.0.0 (read from the assembly metadata). .NET 9 ships System.Formats.Asn1 9.0.0.0, so on a 10.11 host those references can only be satisfied by app-local copies, and the net9 publish output indeed gains the three DLLs while the net10 publish does not (.NET 10 has them). build.sh copies a fixed list of assemblies and meta.json names them, so without this change the 10.11 zip would ship MailKit 4.18.0 without the assemblies it binds to, with the failure above. The change treats the three the way System.Formats.Cbor.dll is already treated: bundled and listed for 10.11, skipped for the Jellyfin 12 package and removed from its meta.json, through one list (NET9_ONLY_ASSEMBLIES) instead of one hard-coded name.

About the QuestPDF pin. The csproj pins 2026.5.0 because 2026.6.0 "produced an invalid recovery-codes PDF (Failed to load PDF document)" and #77 was closed for it. What I checked, all on linux-x64 glibc:

• I rendered the recovery-codes document through RecoveryCodePdfService itself (a small console harness referencing the plugin project) with 2026.5.0, 2026.6.0 and 2026.8.0. All three give a PDF 1.4 with one page, poppler parses each one, and pdftotext output is identical across the three apart from the timestamp line. The 2026.8.0 file also opens in Chromium's PDF viewer with the codes visible.
• So I could not reproduce the 2026.6.0 failure here, which means this PR shows that 2026.8.0 renders correctly on linux-x64 glibc, in the harness and inside Jellyfin 12; it does not explain what broke in June. If that failure was on arm64 or musl, this PR does not cover it, and I am happy to drop the QuestPDF line and keep the pin if you prefer.

About MaxMind.Db 5.2.0 (the release fixes decoding of some four-byte data pointers and of oversized integers): I ran the same lookups against the DB-IP Lite ASN, Country and City databases with 5.1.0 and 5.2.0 for six addresses (IPv4 and IPv6, including a private one) and the results are identical: ASN, organisation, country, city and coordinates.

What changed

• .github/workflows/ci.yml, codeql.yml, dependabot-lockfiles.yml: actions/setup-dotnet v6.0.0 (the dotnet-version: "9.0.x" input the workflows use is unchanged).
• .github/workflows/release.yml: actions/attest-build-provenance v4.2.2.
• .github/workflows/codeql.yml, scorecard.yml: github/codeql-action v4.38.0 for init, analyze and upload-sarif in the same commit, so the config a newer init writes is read by the same analyze version (the deadlock ci: bump github/codeql-action/analyze from 4.37.3 to 4.37.7 #155 hit).
• src/Jellyfin.Plugin.TwoFactorAuth/Jellyfin.Plugin.TwoFactorAuth.csproj: MailKit 4.18.0, MaxMind.Db 5.2.0, Microsoft.CodeAnalysis.NetAnalyzers 10.0.401, QuestPDF 2026.8.0. The pin comment above QuestPDF is left in place for you to update or keep.
• build.sh: a NET9_ONLY_ASSEMBLIES list (System.Formats.Cbor.dll plus the three new ones) with a helper, used by the copy loop to skip them for Jellyfin 12 and by the meta.json patch to remove them there; the three new DLLs added to the copy list right after MimeKit.dll, before the last entry, so the removal leaves valid JSON.
• build.ps1: the same three DLLs in $RequiredFiles (that script only builds the 10.11 package).
• src/Jellyfin.Plugin.TwoFactorAuth/meta.json: the three DLLs after MimeKit.dll in assemblies.
• THIRD-PARTY.md: three MIT rows for them, next to System.Formats.Cbor.
• tests/Jellyfin.Plugin.TwoFactorAuth.Tests/Jellyfin.Plugin.TwoFactorAuth.Tests.csproj: NSubstitute 6.2.0, Microsoft.AspNetCore.TestHost 9.0.20, Microsoft.NET.Test.Sdk 18.10.0.
• src/.../packages.lock.json and packages.jf12.lock.json: the four src packages, MimeKit 4.18.0 and BouncyCastle.Cryptography 2.7.0 behind MailKit, and on net9 also System.Formats.Asn1, System.Security.Cryptography.Pkcs and Microsoft.Bcl.Cryptography 10.0.0.
• tests/.../Tests/packages.lock.json: the three test packages, the src packages that flow through the project reference, Microsoft.CodeCoverage and Microsoft.TestPlatform.* 18.10.0 behind Microsoft.NET.Test.Sdk, and Newtonsoft.Json, System.Collections.Immutable and System.Reflection.Metadata dropping out because the new test SDK no longer pulls them.
• tests/.../Fuzz/packages.lock.json: the src packages through the project reference.

Checklist

• My code follows the existing style (run dotnet format if unsure)
• I've added comments only where the why isn't obvious from the code
• I've updated the README / SECURITY.md / docs if behaviour or config changed (THIRD-PARTY.md for the three bundled assemblies; nothing user-facing changed)
• I've considered backwards compatibility (config migration, file formats, on-disk state): the 10.11 package grows by three assemblies, the Jellyfin 12 package keeps its 41 files
• I've checked the security implications (auth bypass, secret handling, input validation): every action stays SHA-pinned with the SHAs Dependabot resolved; the three new assemblies are the Microsoft packages NuGet resolved, locked by hash
• CI passes (dotnet build + dotnet test green)

Screenshots / log slices

dotnet restore JellyfinSecurity.sln --locked-mode                                   -> ok (SDK 9.0.316)
dotnet restore src/... -p:JellyfinVersion=12.0.0 --locked-mode                      -> ok (SDK 10.0.400)
dotnet test tests/Jellyfin.Plugin.TwoFactorAuth.Tests -c Release
  Passed! - Failed: 0, Passed: 511, Skipped: 0, Total: 511

Jellyfin 10.11.11, 10.11 package from this branch (45 files):
  Loaded assembly System.Formats.Asn1, Version=10.0.0.0, ... from /config/plugins/Jellyfin Security_2.6.1.0/TwoFactorAuth/System.Formats.Asn1.dll
  POST /TwoFactorAuth/TestSmtp (plain)            -> 200, message in Mailpit
  POST /TwoFactorAuth/TestSmtp (STARTTLS, wrong host name)
    -> 500, MailKit.Security.SslHandshakeException: The host name (mailhost) did not match the name given in the server's SSL certificate (mailpit).
  same, with the three new DLLs removed from the plugin folder:
    -> 500, System.IO.FileNotFoundException: Could not load file or assembly 'System.Formats.Asn1, Version=10.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51'.

Jellyfin 12.0.0, 10.11 package from this branch:
  geoip_asn      Ok    loaded from /config/geoip/dbip-asn-lite.mmdb
  geoip_country  Ok    loaded from /config/geoip/dbip-country-lite.mmdb
  geoip_city     Ok    loaded from /config/geoip/dbip-city-lite.mmdb
  POST /TwoFactorAuth/RecoveryCodes/Pdf          -> 200 application/pdf (PDF 1.4, 1 page, 10 codes)

Additional notes

• The four src bumps from Dependabot (deps: Bump MailKit from 4.17.0 to 4.18.0 #206, deps: Bump MaxMind.Db from 5.1.0 to 5.2.0 #207, deps: Bump Microsoft.CodeAnalysis.NetAnalyzers from 10.0.400 to 10.0.401 #208, deps(fuzz): Bump QuestPDF from 2026.5.0 to 2026.8.0 #210) leave packages.jf12.lock.json untouched. build.sh does not restore in locked mode, so a release would still build, but the committed Jellyfin 12 lock would no longer describe the graph; this PR regenerates it.
• Jellyfin.Controller, Jellyfin.Model, Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt stay as pinned; they are on the Dependabot ignore list on purpose.
• If MailKit's next bump moves the BCL references again (a 4.19 built against .NET 11 packages, say), the NET9_ONLY_ASSEMBLIES list is the one place to update, and build.sh fails loudly when a listed assembly is missing from the publish output.