Bump Roslyn to 5.0 - #1787

Update README, SECURITY, and NuGet readmes for Roslynator 2026.
Keep Visual Studio 2022 config paths for upgrade compatibility.
Remove unused analyzer code-fix refs from VS Code build project.
Ignore .vscode-test download folder from extension tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

The Unreleased #1787 bullet conflicted with the testing-package floor
at 3.8.0. CLI still targets 5.0.0; this repo's suite still runs at 5.0.0.

Co-authored-by: Cursor <cursoragent@cursor.com>

…mework (#1810)

* feat(testing): let consumers choose the Roslyn version

Lower the Roslyn dependency of the testing packages to 3.8.0 so the
effective Roslyn version is determined by the consumer's own
Microsoft.CodeAnalysis.* reference instead of being forced to a fixed
version.

- Decouple Roslynator.Testing.Common from the Roslynator.Core package by
  duplicating the handful of internal helpers it used.
- Add RoslynatorTestRoslynVersion so this repo's own test suite can run
  against a chosen Roslyn version; add a CI run at 4.7.0.
- Guard version-sensitive tests so the suite builds and passes at 4.7.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore: add PR link for testing framework change in changelog

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs: clarify testing-framework Roslyn version CI and 4.4 define

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: address PR 1810 review on testing Roslyn floor

Move the Testing Framework changelog entry to Breaking (including the
Core reference break), centralize ROSLYN_TEST_* defines for all test
projects, and clarify Default vs Latest parse LanguageVersion in the
NuGet readmes. Also pin RoslynatorTestRoslynVersion to 5.0.0 after the
Roslyn 5.0 merge and drop the incompatible 4.7 test matrix cell.

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore: remove obsolete test_roslyn_versions note from CI

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: stop saying the testing library targets Roslyn 5.0

The Unreleased #1787 bullet conflicted with the testing-package floor
at 3.8.0. CLI still targets 5.0.0; this repo's suite still runs at 5.0.0.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Josef Pihrt <josef.pihrt@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Updated [Microsoft.NET.Test.Sdk](https://github.com/microsoft/vstest)
from 18.8.1 to 18.9.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.NET.Test.Sdk's
releases](https://github.com/microsoft/vstest/releases)._

## 18.9.0

## What's Changed
* Fix tilde/exclamation characters corrupted in TerminalLogger test
output by @​nohwnd in microsoft/vstest#16046
* Make TranslationLayer Native AOT-compatible by @​drewnoakes in
microsoft/vstest#16045
* Guard GenerateProgramFile target against UseWinUI/UseUwpTools
evaluation order by @​nohwnd in
microsoft/vstest#16072
* Add RequestingAssembly to AssemblyResolveEventArgs for binary compat
by @​nohwnd in microsoft/vstest#16076
* Remove stale Microsoft.Extensions.FileSystemGlobbing binding redirect
from testhost.x86 and datacollector by @​Evangelink in
microsoft/vstest#16082
* Fix TRX attachment paths when LogFileName contains a subdirectory by
@​nohwnd in microsoft/vstest#15791
* Fix missing dumps for .NET Framework child processes in
NetClientHangDumper by @​nohwnd in
microsoft/vstest#16098
* Fix data collection channels to use negotiated protocol version
instead of V1 by @​nohwnd in
microsoft/vstest#16096
* Fix race condition in BlameCollector: skip hang dump when testhost
hasn't launched yet by @​nohwnd in
microsoft/vstest#16065
* Replace TestSDKAutoGeneratedCode with ExcludeFromCodeCoverage in
auto-generated Program files by @​nohwnd in
microsoft/vstest#16101
* Include testhost process path in crash error messages by @​nohwnd in
microsoft/vstest#16108
* Fix DataDriven test results being double-counted in TRX logger totals
by @​nohwnd in microsoft/vstest#15766
* Fix datacollector crash visibility: replace Assert with throwable
exceptions by @​nohwnd in microsoft/vstest#16048
* Add TreatErrorMessagesAsWarnings parameter to TRX logger by @​nohwnd
in microsoft/vstest#16106
* Wait for testhost stderr to drain before reading its crash output by
@​nohwnd in microsoft/vstest#16128
* Handle runtimeconfig.dev.json without additionalProbingPaths by @​tmat
in microsoft/vstest#16166
* Suggest Microsoft.NET.Test.Sdk when a managed test project brings no
testhost by @​nohwnd in microsoft/vstest#16169
* Fix x86 testhost loading mismatched x64 hostfxr (0x800700C1) when run
via vstest.console.exe directly (#​16151) by @​azat-msft in
microsoft/vstest#16156
* Preserve the real exception (type + stack trace) when a test run
aborts in BaseRunTests by @​nohwnd in
microsoft/vstest#16167

## New Contributors
* @​drewnoakes made their first contribution in
microsoft/vstest#16045

**Full Changelog**:
microsoft/vstest@v18.8.0...v18.9.0

Commits viewable in [compare
view](microsoft/vstest@v18.8.1...v18.9.0).
</details>

Updated [nbgv](https://github.com/dotnet/Nerdbank.GitVersioning) from
3.10.91 to 3.10.94.

<details>
<summary>Release notes</summary>

_Sourced from [nbgv's
releases](https://github.com/dotnet/Nerdbank.GitVersioning/releases)._

## 3.10.94

## What's Changed
* Fix version height parity for filtered paths by @​AArnott in
dotnet/Nerdbank.GitVersioning#1489


**Full Changelog**:
dotnet/Nerdbank.GitVersioning@v3.10.91...v3.10.94

Commits viewable in [compare
view](dotnet/Nerdbank.GitVersioning@v3.10.91...v3.10.94).
</details>

Updated
[Nerdbank.GitVersioning](https://github.com/dotnet/Nerdbank.GitVersioning)
from 3.10.91 to 3.10.94.

<details>
<summary>Release notes</summary>

_Sourced from [Nerdbank.GitVersioning's
releases](https://github.com/dotnet/Nerdbank.GitVersioning/releases)._

## 3.10.94

## What's Changed
* Fix version height parity for filtered paths by @​AArnott in
dotnet/Nerdbank.GitVersioning#1489


**Full Changelog**:
dotnet/Nerdbank.GitVersioning@v3.10.91...v3.10.94

Commits viewable in [compare
view](dotnet/Nerdbank.GitVersioning@v3.10.91...v3.10.94).
</details>

Updated [Roslynator.Analyzers](https://github.com/dotnet/roslynator)
from 4.16.0 to 5.0.0.

<details>
<summary>Release notes</summary>

_Sourced from [Roslynator.Analyzers's
releases](https://github.com/dotnet/roslynator/releases)._

## 5.0.0

### Added

- Add `roslyn5.0` NuGet package flavor (`analyzers/dotnet/roslyn5.0/cs`)
([PR](dotnet/roslynator#1787))

### Breaking

- Enable nullable annotations on `Roslynator.Common` and
`Roslynator.Workspaces.Common`
([#​1817](dotnet/roslynator#1817))
- Source-breaking for projects that compile against this surface with
nullable reference types enabled.
- [Testing Framework] Lower Roslyn dependency of testing packages to
3.8.0 so that the Roslyn version is determined by the consumer's own
`Microsoft.CodeAnalysis.*` reference instead of being forced to a fixed
version ([PR](dotnet/roslynator#1810))
- `Roslynator.Testing.Common`, `Roslynator.Testing.CSharp`,
`Roslynator.Testing.CSharp.Xunit` and `Roslynator.Testing.CSharp.MSTest`
now depend on `Microsoft.CodeAnalysis.*` `>= 3.8.0` (previously `>=
4.14.0`).
  - `Roslynator.Testing.Common` no longer depends on `Roslynator.Core`.
- **Action required:** a test project that previously relied on the
testing framework to pull in Roslyn 4.14.0 should now add its own
reference, e.g. `<PackageReference
Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.14.0" />`.
The chosen version raises the maximum C# language version the parser can
accept; test sources still parse at `CSharpParseOptions.Default` unless
you set parse options / `LanguageVersion` (for example
`LanguageVersion.Latest`).
- **Action required:** a test project that used `Roslynator.Core` types
via the old transitive dependency must now add an explicit
`Roslynator.Core` package reference.

### Changed

- Bump Roslyn to 5.0.0
([PR](dotnet/roslynator#1787))
  - CLI targets Roslyn 5.0.0
- Solution build and tests use Roslyn 5.0.0 by default (the testing
*packages* floor at 3.8.0; see Breaking)
- Replace Visual Studio 2022 extension with **Roslynator 2026** for
Visual Studio 2026 (`[18.0,19.0)`)
([PR](dotnet/roslynator#1787))
- Extension ships refactorings and compiler diagnostic code fixes;
analyzers via NuGet
- [Roslynator
2022](https://marketplace.visualstudio.com/items?itemName=josefpihrt.Roslynator2022)
remains available as the last 4.x VSIX
- Visual Studio Code extension ships refactorings and compiler
diagnostic code fixes only
([PR](dotnet/roslynator#1787))
  - Analyzers require Roslynator NuGet packages
- Requires OmniSharp with Roslyn 5.x (C# extension 1.39.15+; set
`dotnet.server.useOmnisharp` to `true`)

### Removed

- Remove leftover implementations of obsolete analyzers (XML descriptors
remain). Enable the successor rules instead: RCS0014 → RCS0061, RCS0022
→ RCS0021, RCS0038 → RCS0015, RCS0043 → RCS0020, RCS0047 → RCS0053,
RCS1008/RCS1009/RCS1010/RCS1012/RCS1176/RCS1177 → RCS1264, RCS1035 →
RCS1260, RCS1036 → RCS0063,
RCS1038/RCS1040/RCS1041/RCS1066/RCS1072/RCS1091/RCS1106 → RCS1259,
RCS1063/RCS1064/RCS1065 → RCS1252, RCS1100/RCS1101 → RCS1253, RCS1237 →
RCS1254.
- Remove `SyntaxInverter` (`Roslynator.CSharp.Workspaces`). Use
`SyntaxLogicalInverter`.
- Remove unused obsolete `DiagnosticCategories` constants and make the
type `internal`.
- Remove unused `ROS0001`/`ROS0002` diagnostic IDs.
- Remove obsolete constructors/properties from the testing package
(`DiagnosticTestData`, `CompilerDiagnosticFixTestData`,
`RefactoringTestData`).
- Remove legacy config keys `roslynator.max_line_length`,
`roslynator.prefix_field_identifier_with_underscore`, and
`roslynator_suppress_unity_script_methods`. Use
`roslynator_max_line_length`,
`roslynator_prefix_field_identifier_with_underscore`, and
`roslynator_unity_code_analysis.enabled`.
- [CLI] Remove obsolete command `generate-doc-root`. Use `generate-doc
--root-file-path` instead.
- Remove bundled analyzers from Visual Studio extension
([PR](dotnet/roslynator#1787))
- Use
[Roslynator.Analyzers](https://www.nuget.org/packages/roslynator.analyzers)
NuGet package for diagnostics
- Remove bundled analyzers from Visual Studio Code extension
([PR](dotnet/roslynator#1787))
  - Use Roslynator NuGet packages for diagnostics
- Remove `AnalyzersOptionsPage` from Visual Studio extension
([PR](dotnet/roslynator#1787))
- Drop support for Visual Studio 2022 VSIX
([PR](dotnet/roslynator#1787))
- Pin last 4.x release ([Roslynator
2022](https://marketplace.visualstudio.com/items?itemName=josefpihrt.Roslynator2022))
or use NuGet packages on Visual Studio 2022

### Fixed

- Fix analyzers
[RCS1263](https://josefpihrt.github.io/docs/roslynator/analyzers/RCS1263)
and
[RCS1139](https://josefpihrt.github.io/docs/roslynator/analyzers/RCS1139)
for C# 14 extension block documentation
([PR](dotnet/roslynator#1799))


## 4.16.1

### Fixed

- Fix analyzer
[RCS1060](https://josefpihrt.github.io/docs/roslynator/analyzers/RCS1060)
to not report a file that contains only multiple partial declarations of
the same type ([PR](dotnet/roslynator#1798))
- Fix analyzer
[RCS1231](https://josefpihrt.github.io/docs/roslynator/analyzers/RCS1231)
to not suggest `in` for `ref struct` parameters
([#​1725](dotnet/roslynator#1725))
([PR](dotnet/roslynator#1807))
- Fix analyzer
[RCS1260](https://josefpihrt.github.io/docs/roslynator/analyzers/RCS1260)
false positive for `omit_when_single_line` on multi-line
object/collection initializers
([#​1439](dotnet/roslynator#1439))
([PR](dotnet/roslynator#1808))
- Fix analyzer
[RCS0036](https://josefpihrt.github.io/docs/roslynator/analyzers/RCS0036)
to report blank lines between single-line declarations in records
([PR](dotnet/roslynator#1813))
- Fix analyzer
[RCS1046](https://josefpihrt.github.io/docs/roslynator/analyzers/RCS1046)
to report `async void` methods without `Async` suffix
([PR](dotnet/roslynator#1790))
- Fix analyzer
[RCS1265](https://josefpihrt.github.io/docs/roslynator/analyzers/RCS1265)
to not report catch clauses with a `when` filter
([PR](dotnet/roslynator#1789))
- Fix analyzer
[RCS0034](https://josefpihrt.github.io/docs/roslynator/analyzers/RCS0034)
for types with a primary constructor and multiple constraint clauses
([PR](dotnet/roslynator#1791))
- Fix analyzer
[RCS1231](https://josefpihrt.github.io/docs/roslynator/analyzers/RCS1231)
to not report `CancellationToken` in sync methods returning `Task`
([PR](dotnet/roslynator#1802))
- [CLI] Fix GitLab output format to use relative paths, forward slashes,
and 1-based line numbers
([PR](dotnet/roslynator#1792))
- [CLI] Fix `generate-doc` to omit internal interfaces from type
declarations and the Implements section
([PR](dotnet/roslynator#1801))

Commits viewable in [compare
view](dotnet/roslynator@v4.16.0...v5.0.0).
</details>

Updated [TUnit](https://github.com/thomhurst/TUnit) from 1.65.0 to
1.65.68.

<details>
<summary>Release notes</summary>

_Sourced from [TUnit's
releases](https://github.com/thomhurst/TUnit/releases)._

## 1.65.68

<!-- Release notes generated using configuration in .github/release.yml
at v1.65.68 -->

## What's Changed
### Other Changes
* fix: convert foreign array element-wise for trailing array parameter
(#​6678) by @​thomhurst in thomhurst/TUnit#6681
### Dependencies
* chore(deps): update tunit to 1.65.63 by @​thomhurst in
thomhurst/TUnit#6672
* chore(deps): update aspire to 13.5.3 by @​thomhurst in
thomhurst/TUnit#6674
* chore(deps): update verify to v32 by @​thomhurst in
thomhurst/TUnit#6680


**Full Changelog**:
thomhurst/TUnit@v1.65.63...v1.65.68

## 1.65.63

<!-- Release notes generated using configuration in .github/release.yml
at v1.65.63 -->

## What's Changed
### Other Changes
* Fix mocking hidden generic interface methods by @​thomhurst in
thomhurst/TUnit#6671
### Dependencies
* chore(deps): update aspire to 13.5.2 by @​thomhurst in
thomhurst/TUnit#6655
* chore(deps): update opentelemetry to 1.18.0 by @​thomhurst in
thomhurst/TUnit#6653
* chore(deps): update dependency azure.data.tables to 12.12.0 by
@​thomhurst in thomhurst/TUnit#6654
* chore(deps): update tunit to 1.65.51 by @​thomhurst in
thomhurst/TUnit#6661
* chore(deps): update dependency svgo to v4.1.0 by @​thomhurst in
thomhurst/TUnit#6663
* chore(deps): update dependency picomatch to v4.0.7 by @​thomhurst in
thomhurst/TUnit#6664
* chore(deps): update dependency awssdk.sqs to 4.0.100.11 by @​thomhurst
in thomhurst/TUnit#6666
* chore(deps): update dependency nunit3testadapter to 6.3.0 by
@​thomhurst in thomhurst/TUnit#6667
* chore(deps): update dependency azure.storage.blobs to 12.29.2 by
@​thomhurst in thomhurst/TUnit#6668


**Full Changelog**:
thomhurst/TUnit@v1.65.51...v1.65.63

## 1.65.51

<!-- Release notes generated using configuration in .github/release.yml
at v1.65.51 -->

## What's Changed
### Other Changes
* Compile public documentation snippets by @​thomhurst in
thomhurst/TUnit#6652
* Fix covariant property override discovery by @​thomhurst in
thomhurst/TUnit#6660
### Dependencies
* chore(deps): update tunit to 1.65.38 by @​thomhurst in
thomhurst/TUnit#6644
* chore(deps): update dependency fscheck to 3.4.0 by @​thomhurst in
thomhurst/TUnit#6646
* chore(deps): update dependency awssdk.sqs to 4.0.100.10 by @​thomhurst
in thomhurst/TUnit#6647
* chore(deps): update aspire to 13.5.1 by @​thomhurst in
thomhurst/TUnit#6648
* chore(deps): update dependency stackexchange.redis to 3.1.31 by
@​thomhurst in thomhurst/TUnit#6650
* chore(deps): update opentelemetry to 1.18.0 by @​thomhurst in
thomhurst/TUnit#6651


**Full Changelog**:
thomhurst/TUnit@v1.65.38...v1.65.51

## 1.65.38

<!-- Release notes generated using configuration in .github/release.yml
at v1.65.38 -->

## What's Changed
### Other Changes
* Fix mocks for inaccessible method signature types by @​thomhurst in
thomhurst/TUnit#6641
### Dependencies
* chore(deps): update dependency awssdk.sqs to 4.0.100.9 by @​thomhurst
in thomhurst/TUnit#6636
* chore(deps): update tunit to 1.65.31 by @​thomhurst in
thomhurst/TUnit#6637
* chore(deps): update dependency dompurify to v3.4.14 by @​thomhurst in
thomhurst/TUnit#6640
* chore(deps): update aspire to 13.5.0 by @​thomhurst in
thomhurst/TUnit#6638
* chore(deps): update dependency cliwrap to 3.10.5 by @​thomhurst in
thomhurst/TUnit#6642


**Full Changelog**:
thomhurst/TUnit@v1.65.31...v1.65.38

## 1.65.31

<!-- Release notes generated using configuration in .github/release.yml
at v1.65.31 -->

## What's Changed
### Other Changes
* Add xunit.v3.aot to speed comparison by @​campersau in
thomhurst/TUnit#6621
* Suppress HTML reports for nested test runs by @​thomhurst in
thomhurst/TUnit#6620
* Address xUnit speed comparison review feedback by @​thomhurst in
thomhurst/TUnit#6623
* Fix docs TypeScript 7 compatibility by @​thomhurst in
thomhurst/TUnit#6625
* Refresh docs npm dependencies by @​thomhurst in
thomhurst/TUnit#6624
* Switch to SignalWire llms.txt plugin by @​thomhurst in
thomhurst/TUnit#6627
* Remove single-test discovery copies by @​thomhurst in
thomhurst/TUnit#6631
* Skip unused scheduler work for unconstrained suites by @​thomhurst in
thomhurst/TUnit#6632
* Skip empty test registration work by @​thomhurst in
thomhurst/TUnit#6628
* Skip absent hook pipelines by @​thomhurst in
thomhurst/TUnit#6630
* Fix mocks with inaccessible constructor parameter types by @​thomhurst
in thomhurst/TUnit#6635
### Dependencies
* chore(deps): update dependency awssdk.sqs to 4.0.100.8 by @​thomhurst
in thomhurst/TUnit#6608
* chore(deps): update tunit to 1.65.0 by @​thomhurst in
thomhurst/TUnit#6609
* chore(deps): update dependency testcontainers.postgresql to 4.14.0 by
@​thomhurst in thomhurst/TUnit#6612
* chore(deps): update dependency testcontainers.kafka to 4.14.0 by
@​thomhurst in thomhurst/TUnit#6611
* chore(deps): update dependency testcontainers.redis to 4.14.0 by
@​thomhurst in thomhurst/TUnit#6613
* chore(deps): update dependency microsoft.net.test.sdk to 18.9.0 by
@​thomhurst in thomhurst/TUnit#6614
* chore(deps): update xunit to v4 by @​thomhurst in
thomhurst/TUnit#6616


**Full Changelog**:
thomhurst/TUnit@v1.65.0...v1.65.31

Commits viewable in [compare
view](thomhurst/TUnit@v1.65.0...v1.65.68).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>