feat!: target net9.0 and net10.0 with configurable frameworks

[JacobAtchley]

Summary

• Target frameworks come from FirebendTargetFrameworks in Directory.Build.props (currently net9.0;net10.0). Samples and other runnable apps use FirebendAppTargetFramework (net10.0). Adding .NET 11 later means editing that list and adding one net11.0 block to Directory.Packages.props.
• Package versions move to central package management in Directory.Packages.props. Microsoft framework packages are versioned per framework: 9.0.x for net9.0 and 10.0.x for net10.0. Other packages are updated to their latest stable versions.
• A repo nuget.config restricts restore to nuget.org.
• global.json pins SDK 10.0.401 with rollForward: latestPatch, so local builds and CI run the same analyzer rules. CI reads it through actions/setup-dotnet@v4 (global-json-file) and also installs the 9.0 SDK for the net9.0 test runtime. CI uses actions/checkout@v4.
• The release workflow sets up .NET before installing Versionize, so the tool installs on the pinned SDK.
• Dependabot opens monthly dotnet-sdk updates for global.json.
• Packages now embed the icon and use PackageLicenseExpression (MIT) instead of the deprecated PackageIconUrl and PackageLicenseUrl (NU5048, NU5125).
• FluentAssertions is pinned to 7.x, because v8 requires a commercial license.
• The first commit is feat!: with a BREAKING CHANGE: footer, so Versionize will release a new major version.

json-patch-generator specifics

• Next version: 9.0.13 → 10.0.0.
• The netstandard2.1 target is dropped, so .NET Core 3.x and .NET 5–8 consumers can no longer install new versions.
• Microsoft.AspNetCore.JsonPatch and Microsoft.Extensions.DependencyInjection are versioned per framework. MSTest goes to 4.5.1 and Microsoft.NET.Test.Sdk to 18.10.1.
• Formatting violations that already existed on main are fixed: explicit public on interface members, and using order. JsonDiffDetector's lazily created serializer is now a thread-safe Lazy<JsonSerializer>.
• The changelog header was corrected (it was copied as "Lit Redis Changelog").

Test plan

• dotnet build -c Release: 0 warnings, 0 errors (SDK 10.0.401)
• dotnet format --verify-no-changes passes
• Tests: 22/22 on net9.0 and 22/22 on net10.0
• The package contains lib/net9.0 and lib/net10.0, the embedded icon, and the MIT license expression

🤖 Generated with Claude Code

https://claude.ai/code/session_01JMzvDp6hZ4dnMSGobxdo98

[mcarey1590]

Reviewed the full diff. Nothing blocking; leaning approve. CI green.

Worth checking before/after merge

• Release workflow (dotnet-release.yml, "Install Versionize"): Versionize now installs/runs after setup-dotnet, which provides only the 9.0.x and 10.0.401 SDKs. If the Versionize tool targets net8.0 only and roll-forward isn't permitted, the step fails. Because it has continue-on-error: true it would report "No release required" and 10.0.0 would silently never publish. CI can't exercise this (push-to-main only). Please check the tool's TFM or watch the first main run; DOTNET_ROLL_FORWARD=Major is the fallback.

Low / nits

• Directory.Build.props:5-6: FirebendTargetFrameworks has no Condition="'$(FirebendTargetFrameworks)'==''" guard, so it can't be overridden with -p: for a quick local build.
• Dropping netstandard2.1 is a real breaking change (9.0.13 → 10.0.0 via feat!). Looks forced since Microsoft.AspNetCore.JsonPatch 9.x/10.x has no netstandard asset. Consumers need net9.0+; worth a release-note line.
• FluentAssertions pinned to 7.2.2 (licensing) and nuget.config restricts restore to nuget.org. Both fine, just noting.
• Stray nested tests/JsonPatchGenerator.Tests/JsonPatchGenerator.Tests.sln is untouched legacy.

Ordering: this should release before auto-crud bumps its Firebend.JsonPatchGenerator reference (auto-crud#440 still pins 9.0.13).

[JacobAtchley]

Responses to the review:

• Versionize after setup-dotnet: I checked; there's no problem. Versionize 2.7.0 ships tools/net8.0, net9.0, net10.0 and net11.0, so the net9.0 and net10.0 builds run on the runtimes CI installs. To confirm, I installed it with a dotnet that has only the 9.0 and 10.0 runtimes, and versionize --dry-run reports bumping version from 9.0.13 to 10.0.0. Moving setup-dotnet ahead of the tool install was intentional: with global.json present, dotnet tool install needs a matching SDK, and otherwise it would depend on what the runner image happens to have preinstalled.
• FirebendTargetFrameworks override: a guard isn't needed. A -p: value on the command line is an MSBuild global property and overrides project properties regardless of conditions. For example, dotnet build -p:FirebendTargetFrameworks=net10.0 builds only net10.0 today.
• Dropping netstandard2.1: intended. As you note, Microsoft.AspNetCore.JsonPatch 9.x and 10.x have no netstandard asset. It's called out in the BREAKING CHANGE: footer, so Versionize's 10.0.0 changelog entry will include it.
• README: added a "Building from source" section covering global.json and the framework properties.
• Dependabot: now ignores major updates to the framework-aligned Microsoft packages, so it won't move the 9.0.x block to 10.x.
• The nested tests/JsonPatchGenerator.Tests/JsonPatchGenerator.Tests.sln: left alone in this PR. Happy to delete it in a follow-up.

[mcarey1590]

Verified the follow-ups against the branch: Versionize ordering explained and checked, README build section, Dependabot ignore for framework-aligned majors. Approving. Reminder: confirm the first main-branch release run publishes 10.0.0, and release before the auto-crud JsonPatchGenerator bump.