Upgrade OpenTelemetry, Testcontainers, xunit and AWSSDK.S3

[michaelTBF]

Routine dependency maintenance — four upgrades in one PR, no behaviour change intended.

Package	From	To
OpenTelemetry.Exporter.Console, .Exporter.OpenTelemetryProtocol, .Extensions.Hosting, .Instrumentation.AspNetCore, .Instrumentation.Http, .Instrumentation.Runtime	1.17.0	1.18.0
Testcontainers.PostgreSql	4.0.0	4.14.0
xunit (both test projects)	2.9.2	2.9.3
AWSSDK.S3	4.0.102	4.0.102.4

Two things worth a reviewer's attention

Testcontainers deprecates the parameterless builder constructors. 4.14 wants the image passed to the constructor instead of via .WithImage(), so the four container fixtures (PostgresFixture, S3ReportSourceTests, and the two POP3 suites) move their image string up one line. Without it the build carries four CS0618 warnings; with it the solution builds clean. Same images, same versions — only where the string is passed changed.

The upgrade clears a high-severity advisory. Testcontainers 4.0.0 pinned SSH.NET 2023.0.0 transitively, which trips NU1903 on every restore. 4.14.0 resolves SSH.NET 2026.0.0, and dotnet list package --vulnerable --include-transitive now reports clean for all three projects. That warning is gone from restore output.

Deliberately out of scope

• xunit.runner.visualstudio 2.8.2 → 4.0.0 and Microsoft.NET.Test.Sdk 17.14.1 → 18.9.0 — both major bumps to the test runner rather than the assertion library, and worth their own PR where a green run is the whole point of the diff.
• xunit v3 is a separate package id (xunit.v3) with API changes; 2.9.3 is the in-place upgrade of what is referenced today.
• The remaining Microsoft.* 10.0.10 → 10.0.11 bumps, which are an EF Core/ASP.NET set that should move together.

Verification

All run against this branch on net10.0:

• dotnet build DmarcAnalyzerApp.slnx — succeeded, 0 warnings, 0 errors
• dotnet test src/api.tests — 842 passed, 0 failed
• dotnet test src/api.integration.tests — 78 passed, 0 failed (real Docker, PostgreSQL + MinIO + GreenMail containers)
• Lockfiles regenerated with dotnet restore --force-evaluate, since the image and CI restore in locked mode and a stale lockfile fails there rather than locally.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Pro Plus

Run ID: 5c525189-c492-4a27-aab3-0f600a8a41f0

📥 Commits

Reviewing files that changed from the base of the PR and between bbbfefc and 5b62819.

📒 Files selected for processing (10)

• src/api.integration.tests/DmarcAnalyzer.Api.IntegrationTests.csproj
• src/api.integration.tests/Pop3MailboxRetentionTests.cs
• src/api.integration.tests/Pop3MailboxSyncTests.cs
• src/api.integration.tests/PostgresFixture.cs
• src/api.integration.tests/S3ReportSourceTests.cs
• src/api.integration.tests/packages.lock.json
• src/api.tests/DmarcAnalyzer.Api.Tests.csproj
• src/api.tests/packages.lock.json
• src/api/DmarcAnalyzer.Api.csproj
• src/api/packages.lock.json

Included review availability: Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

The pull request updates AWS S3, OpenTelemetry, xUnit, and Testcontainers dependencies. It also updates transitive lockfile resolutions and passes container images directly to Testcontainers builders.

Dependency and integration test updates

Layer / File(s)	Summary
API dependency version updates src/api/DmarcAnalyzer.Api.csproj, src/api/packages.lock.json	AWS S3 and OpenTelemetry references and locked resolutions move to newer versions.
Integration test dependencies and containers src/api.integration.tests/...	xUnit and Testcontainers dependencies are updated. GreenMail, PostgreSQL, and MinIO builders receive image names through constructors.
API test dependency alignment src/api.tests/...	xUnit, AWS SDK, and OpenTelemetry references and lockfile entries are updated.

Estimated code review effort: 2 (Simple) | ~15 minutes

Merge Risk: ⚪ Minimal · up to 5b628

This PR updates dependencies and adjusts test-container constructors without changing intended product behavior; the solution builds cleanly and all reported tests pass, so no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main dependency upgrades, including OpenTelemetry, Testcontainers, xunit, and AWSSDK.S3.
Description check	✅ Passed	The description directly explains the dependency upgrades, Testcontainers constructor changes, vulnerability resolution, scope exclusions, and verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4 files. (6 skipped: 6 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/upgrade-nuget-packages

---

_{Comment @coderabbitai help to get the list of available commands.}