Version 10.6.1 (#13283)

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Code owners must approve every pull request (see branch protection on develop and main).
+* @yasmoradi @msynk

.github/agents/dependency-update.md

@@ -17,7 +17,7 @@ Work the surfaces in this order. Each is independent; batch the network lookups.
 3. GitHub Actions (`.github/workflows/`, `src/Templates/Boilerplate/Bit.Boilerplate/.github/workflows/`, `src/Butil/tests/Bit.Butil.Tests.E2E/ci/`)
 4. Azure DevOps tasks (`src/Templates/Boilerplate/Bit.Boilerplate/.azure-devops/workflows/`)
 5. devcontainers (`.devcontainer/`, `src/Templates/Boilerplate/Bit.Boilerplate/.devcontainer/`)
-6. `.config/dotnet-tools.json` (4 files), `global.json` (3 files)
+6. `dnx <package>@<version>` calls in workflows and docs (`vpk`, `dotnet-ef`), `global.json` (3 files)
 7. Container image tags in the Aspire AppHost
 
 ## The hold-back rules
@@ -57,7 +57,7 @@ consumes a test project, so every band takes the newest patch of its own band. L
 
 **Version ranges stay.** `[8.0.0,9.0.0)` is a compatibility contract, not a pin.
 
-**`Bit.*` self-references track the in-development version**, currently `10.6.0`. Never read
+**`Bit.*` self-references track the in-development version**, currently `10.6.1`. Never read
 these off nuget.org — the published `latest` is behind the working tree by design, and unrelated
 higher-numbered lines exist there.
 
@@ -81,6 +81,20 @@ gh api "repos/<owner>/<repo>/git/trees/<sha>?recursive=1" --jq '[.tree[]|select(
 A non-zero count on a JavaScript action that vendors `node_modules` means it will not stage. This is
 worth checking for *any* action bump, not just this one — it is invisible in the release notes.
 
+**MAUI is held at 10.0.100** (`Microsoft.Maui.Controls` and `Components.WebView.Maui`, in the
+Boilerplate, the BlazorUI demo and the Butil sample). 10.0.101 bundles an `Svg.Skia` that calls a
+SkiaSharp overload missing from the SkiaSharp next to it, so the resizetizer fails with `MAUIR0001` /
+`MissingMethodException: SKImageFilter.CreateMatrixConvolution` on any SVG icon with a `<filter>`
+([dotnet/maui#38319](https://github.com/dotnet/maui/issues/38319)). Move only once that issue is
+closed and `dotnet build -f net10.0-ios` passes on the Boilerplate. `WebView.WindowsForms` has no
+resizetizer and is not held.
+
+**`Xamarin.Firebase.Messaging` is held at 125.1.1.** 125.1.2 pulls `Xamarin.AndroidX.Fragment` 1.9.0
+(through `GooglePlayServices.Base` 118.10.1), which absorbed the ktx classes, while the rest of the
+graph still brings `Fragment.Ktx` 1.8.9.x. R8 then fails the Android build with
+`Type androidx.fragment.app.FragmentKt is defined multiple times`. Move it only once something else in
+the graph already brings `Fragment.Ktx` 1.9.0 (an empty stub), rather than pinning Ktx in the template.
+
 When a held pin's rationale no longer holds — the oldest supported SDK moved, TS 7 was adopted
 repo-wide — say so in the report rather than acting on it.
 
@@ -149,8 +163,13 @@ Runner images (`runs-on`) are part of this: no `ubuntu-latest`, pin the concrete
 
 ### Azure DevOps
 
-Tasks are major-versioned (`UseDotNet@2`, `FileTransform@2`). Confirm against Microsoft's task
-reference; there is no API. All eight in use were current as of the last sweep.
+Tasks are major-versioned (`UseDotNet@2`, `FileTransform@2`). The newest major is the highest
+`<Task>V<n>` folder in `gh api repos/microsoft/azure-pipelines-tasks/contents/Tasks --jq '.[].name'`.
+A task can change name across majors while keeping its id: `NodeTool@1` resolves to `UseNodeV1`.
+
+`AzureRmWebAppDeployment` is on @4 while @5 exists. For `webAppLinux` @5 defaults to `oneDeploy` with
+`CleanDeploymentFlag: true`, which deletes wwwroot files missing from the package — a deploy-behaviour
+decision for the maintainer, not a routine bump.
 
 ### devcontainers
 
@@ -167,11 +186,13 @@ The `image` follows the newest .NET SDK: `curl -s
 https://builds.dotnet.microsoft.com/dotnet/release-metadata/10.0/releases.json` → `.latest-sdk`. Both
 devcontainers must agree.
 
-### dotnet-tools and global.json
+### dnx tool versions and global.json
 
-`vpk` must equal the `Velopack` PackageReference version in the same project — Velopack requires the
-CLI and the library to match, and this has drifted before. `dotnet-ef` should equal the EF Core
-package version.
+There are no `.config/dotnet-tools.json` manifests any more: every tool is run with `dnx
+<package>@<version>`, so the pins live in the workflow and doc lines that call them (`grep -rn "dnx
+.*@"`). `vpk` must equal the `Velopack` PackageReference version in the same project — Velopack
+requires the CLI and the library to match, and this has drifted before. `dotnet-ef` should equal the
+EF Core package version.
 
 `src/global.json` is `rollForward: disable` and tracks the newest SDK. The two template
 `global.json` files are `10.0.100` + `latestFeature` deliberately — they must accept any 10.0.x on a
@@ -228,3 +249,30 @@ different versions across projects. These are the ones worth a maintainer's atte
 - `npm install` in every directory whose `package.json` changed.
 - `dotnet build` the affected solutions; a Roslyn or MSBuild pin change needs a real build.
 - Never rewrite files through Python or `sed` — BOM and CRLF get clobbered. Use targeted edits.
+
+## Ship it
+
+Finish every sweep with an issue, a PR and a full CI run. `upstream` is `bitfoundation/bitplatform`,
+`origin` is the maintainer's fork.
+
+1. Issue on upstream, label `dependencies`, title `Project dependencies are outdated`. The body
+   lists what is behind, in a sentence or two per surface.
+2. Branch named after the issue number, cut from `upstream/develop`, not from whatever branch is
+   checked out. When the working tree sits on another branch, apply the diff in a worktree
+   (`git worktree add ../bitplatform-<n> -b <n> upstream/develop`, then `git diff | git apply --3way`)
+   so that branch and any build running on it stay untouched.
+3. One commit, `feat(deps): update project dependencies #<n>`. Push to `origin`.
+4. PR from `<fork-owner>:<n>` into `upstream/develop`, title `Update project dependencies (#<n>)`.
+   The body starts with `closes #<n>` and carries the report: Changed, Breaking or important,
+   Held back, Missed / drifted, Not verified.
+5. Run `all.ci.yml` on the fork against the branch and give its URL with the PR link:
+
+   ```bash
+   gh workflow run all.ci.yml --repo <fork-owner>/bitplatform --ref <n>
+   gh run list --repo <fork-owner>/bitplatform --workflow all.ci.yml --branch <n> --limit 1 --json url --jq '.[0].url'
+   ```
+
+   A red job goes into the PR as a comment, with the failing step and its first error line.
+6. Clean up at once, without asking: `git restore` the pushed files in the original checkout (after
+   `git diff <pushed-commit> -- <files>` comes back empty), delete build artifacts the sweep created,
+   and `git worktree remove` the worktree. `git status` must match what it was before the sweep.

.github/workflows/admin-sample.cd.yml

@@ -85,8 +85,7 @@ jobs:
     - name: Use Bit.ResxTranslator
       run: |
             cd AdminPanel
-            dotnet tool install --global Bit.ResxTranslator --prerelease
-            bit-resx-translate
+            dnx Bit.ResxTranslator --prerelease
 
     - name: Update core appsettings.json
       uses: devops-actions/variable-substitution@ae7b1f3676ae374dc70282e6b9650bc50b611222 # v1.2
@@ -116,7 +115,15 @@ jobs:
           dotnet build AdminPanel/src/Client/AdminPanel.Client.Web/AdminPanel.Client.Web.csproj -t:BeforeBuildTasks -p:Version="${{ vars.APP_VERSION}}" --no-restore -c Release
 
     - name: Publish Server Web
-      run: dotnet publish AdminPanel/src/Server/AdminPanel.Server.Web/AdminPanel.Server.Web.csproj -c Release -o server-web -p:Version="${{ vars.APP_VERSION}}" -p:AspNetCoreHostingModel=OutOfProcess
+      run: dotnet publish AdminPanel/src/Server/AdminPanel.Server.Web/AdminPanel.Server.Web.csproj -c Release -o server-web -p:Version="${{ vars.APP_VERSION}}" -p:AspNetCoreHostingModel=OutOfProcess -p:BitMinifyAggressive=true -p:BitMinifyMapOutputPath="${{ github.workspace }}/bit-minifier.map"
+
+    # Every publish renames afresh, so this map reads the stack traces of this release and of no other. It lives in
+    # obj, which this checkout throws away - kept here, and never next to the client, which would serve it.
+    - name: Upload minifier map artifact
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: AdminPanel-minifier-map
+        path: bit-minifier.map
 
     - name: Publish Server API
       run: dotnet publish AdminPanel/src/Server/AdminPanel.Server.Api/AdminPanel.Server.Api.csproj -c Release -o server-api -p:Version="${{ vars.APP_VERSION}}" -p:AspNetCoreHostingModel=OutOfProcess
@@ -245,7 +252,14 @@ jobs:
       run: dotnet build AdminPanel/src/Client/AdminPanel.Client.Core/AdminPanel.Client.Core.csproj -t:BeforeBuildTasks -p:Version="${{ vars.APP_VERSION}}" -p:WasmEnableSIMD=true --no-restore -c Release
 
     - name: Publish
-      run: dotnet publish AdminPanel/src/Client/AdminPanel.Client.Web/AdminPanel.Client.Web.csproj -c Release -o client -p:WasmEnableSIMD=true -p:Version="${{ vars.APP_VERSION}}"
+      run: dotnet publish AdminPanel/src/Client/AdminPanel.Client.Web/AdminPanel.Client.Web.csproj -c Release -o client -p:WasmEnableSIMD=true -p:Version="${{ vars.APP_VERSION}}" -p:BitMinifyAggressive=true -p:BitMinifyMapOutputPath="${{ github.workspace }}/bit-minifier.map"
+
+    # what the stack traces this client logs are read back through: see the note in the server web job
+    - name: Upload minifier map artifact
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: AdminPanelClient-minifier-map
+        path: bit-minifier.map
 
     - name: Upload to asw
       run: |
@@ -283,8 +297,7 @@ jobs:
     - name: Use Bit.ResxTranslator
       run: |
             cd AdminPanel
-            dotnet tool install --global Bit.ResxTranslator --prerelease
-            bit-resx-translate
+            dnx Bit.ResxTranslator --prerelease
 
     - name: Update core appsettings.json
       uses: devops-actions/variable-substitution@ae7b1f3676ae374dc70282e6b9650bc50b611222 # v1.2
@@ -305,21 +318,19 @@ jobs:
       continue-on-error: true
       run: |
           cd AdminPanel\src\Client\AdminPanel.Client.Windows\
-          dotnet tool restore
-          dotnet vpk download s3 --endpoint ${{ vars.R2_ENDPOINT }} --bucket ${{ env.R2_BUCKET }} --keyId ${{ secrets.R2_ACCESS_KEY_ID }} --secret ${{ secrets.R2_SECRET_ACCESS_KEY }} -o .\Releases
+          dnx vpk@1.2.0 -- download s3 --endpoint ${{ vars.R2_ENDPOINT }} --bucket ${{ env.R2_BUCKET }} --keyId ${{ secrets.R2_ACCESS_KEY_ID }} --secret ${{ secrets.R2_SECRET_ACCESS_KEY }} -o .\Releases
 
     - name: Publish
       run: |
           cd AdminPanel\src\Client\AdminPanel.Client.Windows\
           dotnet publish AdminPanel.Client.Windows.csproj -c Release -o .\publish-result -r win-x64 -p:Version="${{ vars.APP_VERSION}}" -p:PublishReadyToRun=true -p:PublishReadyToRunComposite=true --self-contained
-          dotnet tool restore
-          dotnet vpk pack -u AdminPanel.Client.Windows -v "${{ vars.APP_VERSION }}" -p .\publish-result -e AdminPanel.Client.Windows.exe -r win-x64 --framework webview2 --icon .\wwwroot\favicon.ico --packTitle 'AdminPanel'
+          dnx vpk@1.2.0 -- pack -u AdminPanel.Client.Windows -v "${{ vars.APP_VERSION }}" -p .\publish-result -e AdminPanel.Client.Windows.exe -r win-x64 --framework webview2 --icon .\wwwroot\favicon.ico --packTitle 'AdminPanel'
 
     # The update feed behind WindowsUpdate.FilesUrl.
     - name: Upload releases to R2
       run: |
           cd AdminPanel\src\Client\AdminPanel.Client.Windows\
-          dotnet vpk upload s3 --endpoint ${{ vars.R2_ENDPOINT }} --bucket ${{ env.R2_BUCKET }} --keyId ${{ secrets.R2_ACCESS_KEY_ID }} --secret ${{ secrets.R2_SECRET_ACCESS_KEY }} -o .\Releases --keepMaxReleases 10
+          dnx vpk@1.2.0 -- upload s3 --endpoint ${{ vars.R2_ENDPOINT }} --bucket ${{ env.R2_BUCKET }} --keyId ${{ secrets.R2_ACCESS_KEY_ID }} --secret ${{ secrets.R2_SECRET_ACCESS_KEY }} -o .\Releases --keepMaxReleases 10
 
   build_blazor_hybrid_android:
     name: build blazor hybrid (android)
@@ -366,8 +377,7 @@ jobs:
     - name: Use Bit.ResxTranslator
       run: |
             cd AdminPanel
-            dotnet tool install --global Bit.ResxTranslator --prerelease
-            bit-resx-translate
+            dnx Bit.ResxTranslator --prerelease
 
     - name: Update core appsettings.json
       uses: devops-actions/variable-substitution@ae7b1f3676ae374dc70282e6b9650bc50b611222 # v1.2
@@ -445,8 +455,7 @@ jobs:
     - name: Use Bit.ResxTranslator
       run: |
             cd AdminPanel
-            dotnet tool install --global Bit.ResxTranslator --prerelease
-            bit-resx-translate
+            dnx Bit.ResxTranslator --prerelease
 
     - name: Update core appsettings.json
       uses: devops-actions/variable-substitution@ae7b1f3676ae374dc70282e6b9650bc50b611222 # v1.2
@@ -489,7 +498,7 @@ jobs:
 
     # App Store submission stays manual.
     - name: Upload to TestFlight
-      uses: apple-actions/upload-testflight-build@5e75ff58276689011512ba87a381d93dc67dbcf8 # v5.3.0
+      uses: apple-actions/upload-testflight-build@1fc69ca369a60b813eaaa2d936eda22794b52e17 # v5.4.0
       with:
         app-path: ${{ steps.ipa.outputs.path }}
         app-type: ios