Release v3.3.1: dependency updates and security fixes

[chullybun]

Summary

Patch release with dependency maintenance and security fixes; no major-version dependency upgrades or intended DbEx API changes.

• Set the package version to 3.3.1 and update the changelog.
• Update Microsoft.Data.SqlClient to 6.1.7, MySql.Data to 9.7.0, and Npgsql to 10.0.3.
• Update Microsoft.Extensions packages to 10.0.13 and EF Core SQL Server test packages to 8.0.32, 9.0.21, and 10.0.13 for their respective target frameworks.
• Pin System.Security.Cryptography.Pkcs to 8.0.2 for net8.0 and 9.0.21 for net9.0/net10.0, addressing GHSA-2fmv-rv2c-59x7 and GHSA-846f-f764-76mx.
• Update Microsoft.NET.Test.Sdk to 17.14.1 and NUnit to 4.6.1, with explicit async delegates for assertion compatibility.

Validation

• Solution restore and build succeed.
• NuGet's transitive dependency audit reports no known vulnerable packages.
• CI run 38643500830 passed all 34 tests on each of .NET 8, 9, and 10 (102 total). This resolves the review concern about database integration validation: the local SQL Server login issue did not affect CI.
• Both Snyk code and security checks passed on the original commit.
• Added the author Signed-off-by trailer. The amended commit contains identical file changes; checks on the updated head must complete before merge.

[Copilot]

🔵 Needs a closer look

Database-dependent tests remain blocked, leaving provider upgrades without runtime integration validation before release.

0 open findings

What changed in this PR

Prepares DbEx v3.3.1 with dependency updates, security patches, and compatible test assertions.

Changes:

• Updates dependencies within existing major versions and adds framework-specific cryptography patches.
• Adjusts async exception assertions for NUnit 4.6.
• Bumps the package version and documents the release.

File	Description
tests/​DbEx.Test/​SqlServerMigrationTest.cs	Adds explicit async delegate casts for NUnit compatibility.
tests/​DbEx.Test/​PostgresMigrationTest.cs	Adds explicit async delegate casts for NUnit compatibility.
tests/​DbEx.Test/​DbEx.Test.csproj	Updates test and configuration dependencies.
tests/​DbEx.Test.Empty/​DbEx.Test.Empty.csproj	Updates SQL Server dependencies and adds cryptography patches.
src/​DbEx/​DbEx.csproj	Updates logging abstractions.
src/​DbEx.SqlServer/​DbEx.SqlServer.csproj	Updates SqlClient and adds framework-specific cryptography patches.
src/​DbEx.Postgres/​DbEx.Postgres.csproj	Updates Npgsql.
src/​DbEx.MySql/​DbEx.MySql.csproj	Updates MySql.Data.
Common.targets	Sets package version to 3.3.1.
CHANGELOG.md	Documents dependency and security updates.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chullybun]

Release preparation is complete for v3.3.1. The author sign-off has been added. The integration-validation concern in the Copilot review is resolved: CI run https://github.com/Avanade/DbEx/actions/runs/38643500830 passed all 34 tests on each of .NET 8, 9, and 10, and both Snyk checks passed. The sign-off amendment changed commit metadata only; the release files are unchanged. The PR title and description now reflect the final release scope and validation. Checks on the amended head must pass, and required reviewer approval is still needed before merge.