chore(deps): consolidate dependabot updates and fix package downgrade conflicts

[devin-ai-integration]

Summary

Consolidates the safe dependabot updates currently open in the repository and fixes the companion package downgrade errors (NU1605) that caused the Security & Quality and Coverage Reports CI jobs to fail.

Migrations applied

PR	Package	Files changed	Notes
#143	Microsoft.EntityFrameworkCore 10.0.8 → 10.0.9	src/Eaf.Middleware.Application/Eaf.Middleware.Application.csproj	Safe patch update.
#142	Microsoft.Data.SqlClient 7.0.1 → 7.0.2	src/Eaf.Middleware.Web.Core/Eaf.Middleware.Web.Core.csproj	Requires System.IdentityModel.Tokens.Jwt and Microsoft.IdentityModel.JsonWebTokens ≥ 8.16.0.
#141	log4net 3.3.1 → 3.3.2	src/Eaf.Log4NetServiceBus/Eaf.Log4NetServiceBus.csproj, test/Eaf.Log4NetServiceBus.Tests/Eaf.Log4NetServiceBus.Tests.csproj	Safe patch update.
#140	EPPlus 8.6.0 → 8.6.1	src/Eaf.Middleware.Application/Eaf.Middleware.Application.csproj, Templates/Api/test/Eaf.ProjectName.Tests/Eaf.ProjectName.Tests.csproj	Also updates the test project that was still pinning 8.6.0, which caused the NU1605 downgrade.
#138	actions/checkout v6 → v7	.github/workflows/opencode.yml, .github/workflows/opencode-auto-fix.yml	Aligns with the rest of the workflows.

Companion fixes

• src/Eaf.SqlServerCache/Eaf.SqlServerCache.csproj: bumped System.IdentityModel.Tokens.Jwt and Microsoft.IdentityModel.JsonWebTokens from 8.13.0 to 8.18.0 to satisfy the new transitive dependency Microsoft.Data.SqlClient 7.0.2 → Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0.
• .github/dependabot.yml: added an ignore rule for AutoMapper major-version updates because Abp.AutoMapper 10.4.0 is binary-incompatible with AutoMapper >= 15.0.0 (see common.props comment). This prevents future broken PRs like Bump AutoMapper from 14.0.0 to 16.2.0 #139.

Not migrated

• PR Bump AutoMapper from 14.0.0 to 16.2.0 #139 (AutoMapper 14.0.0 → 16.2.0): cannot be migrated as-is. Abp.AutoMapper 10.4.0 is binary-incompatible with AutoMapper >= 15.0.0, and the codebase uses MapperConfiguration APIs that changed across major versions. The dependabot ignore rule above addresses this.

Verification

• dotnet restore Eaf.sln ✅
• dotnet restore Templates/Api/Eaf.ApiWithSrc.sln ✅
• dotnet build Eaf.sln --configuration Release ✅ (0 errors, pre-existing warnings)
• dotnet build Templates/Api/Eaf.ApiWithSrc.sln --configuration Release ✅ (0 errors, pre-existing warnings)
• dotnet test executed locally for the affected test projects:
  • Eaf.Log4NetServiceBus.Tests ✅
  • Eaf.SqlServerCache.Tests ✅
  • Eaf.Middleware.Application.Tests ✅
  • Eaf.Middleware.Web.Core.Tests ✅

Checklist

• I have followed the repository guidelines
• I have checked existing open PRs for the same update
• I have successfully built the affected solutions locally
• I have run the affected tests locally
• No secrets or generated files were committed
• This PR does not introduce breaking changes

Component Type

• EAF Module
• UI Template
• API Template
• Worker Template
• Documentation
• Infrastructure/CI/CD
• Other

Link to Devin session: https://app.devin.ai/sessions/e2405afbbf894ccfa44c405c5464cee2
Requested by: @afonsoft

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud