Bump non-Roslyn dependencies

[kzu]

Summary

Bumps non-Roslyn package and MSBuild SDK dependencies to their latest stable versions discovered from NuGet.org, while leaving all Microsoft.CodeAnalysis.* references unchanged.

Also updates the Spectre CLI regression test to use the public async ICommand execution path required by Spectre.Console.Cli 0.55.0, whose typed Command<TSettings>.Execute override is now protected.

Bumped

• Microsoft.Build.NoTargets: 3.5.0 -> 3.7.134
• NuGetizer: 1.2.4/1.4.6 -> 1.4.9
• Devlooped.Extensions.DependencyInjection: 2.2.0 -> 2.3.1 in the attributed compatibility package
• Microsoft.Extensions.DependencyInjection: 7.0.0/10.0.1 -> 10.0.9
• Microsoft.Extensions.DependencyInjection.Abstractions: 10.0.1 -> 10.0.9
• System.Formats.Asn1: 10.0.1 -> 10.0.9
• System.ComponentModel.Composition: 10.0.1 -> 10.0.9
• System.Composition.AttributedModel: 10.0.1 -> 10.0.9
• System.Composition.Hosting: 10.0.1 -> 10.0.9
• System.Composition.TypedParts: 10.0.1 -> 10.0.9
• Microsoft.Bcl.TimeProvider: 10.0.1 -> 10.0.9
• Spectre.Console.Cli: 0.53.1 -> 0.55.0
• PolySharp: 1.14.1/1.15.0 -> 1.16.0
• Merq: 2.0.0 -> 3.0.0

Not changed

• All Microsoft.CodeAnalysis.* PackageReferences remain unchanged as requested.
• Floating Devlooped.Extensions.DependencyInjection sample references remain at 42.* for the repo's local dogfood package flow.

Validation

Using temporary SDKs installed under /tmp because the agent image did not include dotnet:

• dotnet test src/CodeAnalysis.Tests/CodeAnalysis.Tests.csproj - passed, with existing NU1608 warnings from the unchanged Roslyn testing package set
• dotnet test src/DependencyInjection.Tests/DependencyInjection.Tests.csproj - passed with 0 warnings

Slack Thread

  

[kzu]

🧪 Details on Ubuntu 24.04.4 LTS

from retest v1.1.0 on .NET 10.0.9 with 💜 by @devlooped