chore(deps): update every language's dependencies and release them together at 0.16.0

.github/dependabot.yml

@@ -52,6 +52,46 @@ updates:
     commit-message:
       prefix: "chore(deps)"
 
+  # Java dependencies
+  - package-ecosystem: "maven"
+    directory: "/java"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "java"
+    commit-message:
+      prefix: "chore(deps)"
+
+  # PHP dependencies
+  - package-ecosystem: "composer"
+    directory: "/php"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "php"
+    commit-message:
+      prefix: "chore(deps)"
+
+  # Go dependencies (the module has none today; this keeps the go directive and
+  # any future require block from going stale)
+  - package-ecosystem: "gomod"
+    directory: "/go"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "go"
+    commit-message:
+      prefix: "chore(deps)"
+
   # GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"

.github/workflows/csharp.yml

@@ -88,7 +88,7 @@ jobs:
       - name: Setup .NET SDK
         uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '8.0.x'
+          dotnet-version: '10.0.x'
       - name: Restore Dependencies
         run: dotnet restore
       - name: Check formatting
@@ -115,15 +115,15 @@ jobs:
       - name: Setup .NET SDK
         uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '8.0.x'
+          dotnet-version: '10.0.x'
       - name: Restore Dependencies
         run: dotnet restore
       - name: Build
         # Warnings are annotated but the build stays green; -warnaserror is a
         # separate decision that would also fail on new analyzer releases.
         run: dotnet build --configuration Release --no-restore
       - name: Test
-        run: dotnet test --configuration Release --no-build -f net8
+        run: dotnet test --configuration Release --no-build
 
   pushToNuget:
     runs-on: ubuntu-latest
@@ -145,7 +145,7 @@ jobs:
       - name: Setup .NET SDK
         uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '8.0.x'
+          dotnet-version: '10.0.x'
       - name: Check if version already published to NuGet.org
         id: version-check
         run: |
@@ -236,7 +236,7 @@ jobs:
       - name: Setup .NET SDK
         uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '8.0.x'
+          dotnet-version: '10.0.x'
       - name: Install dependencies for PDF generation
         run: |
           sudo apt-get update
@@ -277,7 +277,7 @@ jobs:
       - name: Setup .NET SDK
         uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '8.0.x'
+          dotnet-version: '10.0.x'
       - name: Install DocFX
         run: |
           dotnet tool install -g docfx

.github/workflows/go.yml

@@ -82,7 +82,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.21'
+          go-version: '1.26'
           # This module has no dependencies: go/go.sum does not exist and
           # go.mod has no require block. Pointing the dependency cache at a
           # file that is not there made setup-go emit "Restore cache failed:
@@ -120,7 +120,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.21'
+          go-version: '1.26'
           # This module has no dependencies: go/go.sum does not exist and
           # go.mod has no require block. Pointing the dependency cache at a
           # file that is not there made setup-go emit "Restore cache failed:

.github/workflows/java.yml

@@ -79,10 +79,10 @@ jobs:
         with:
           persist-credentials: false
           submodules: true
-      - name: Set up JDK 11
+      - name: Set up JDK 21
         uses: actions/setup-java@v5
         with:
-          java-version: '11'
+          java-version: '21'
           distribution: 'temurin'
           cache: maven
       - name: Build with Maven
@@ -99,7 +99,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java: ['11', '17', '21']
+        java: ['21', '25']
     steps:
       - uses: actions/checkout@v7
         with:
@@ -127,10 +127,10 @@ jobs:
         with:
           persist-credentials: false
           submodules: true
-      - name: Set up JDK 11
+      - name: Set up JDK 21
         uses: actions/setup-java@v5
         with:
-          java-version: '11'
+          java-version: '21'
           distribution: 'temurin'
           cache: maven
       - name: Check formatting with Spotless
@@ -172,10 +172,10 @@ jobs:
             echo "have_creds=false" >> "$GITHUB_OUTPUT"
             echo "::warning::Skipping Maven Central publishing: CENTRAL_USERNAME, CENTRAL_TOKEN, GPG_PRIVATE_KEY and GPG_PASSPHRASE secrets are not configured. Generate a token at https://central.sonatype.com/account and add these repository secrets to enable publishing. No GitHub release will be created."
           fi
-      - name: Set up JDK 11
+      - name: Set up JDK 21
         uses: actions/setup-java@v5
         with:
-          java-version: '11'
+          java-version: '21'
           distribution: 'temurin'
           cache: maven
           server-id: central

.github/workflows/php.yml

@@ -79,10 +79,10 @@ jobs:
         with:
           persist-credentials: false
           submodules: true
-      - name: Set up PHP 8.3
+      - name: Set up PHP 8.4
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.3'
+          php-version: '8.4'
           extensions: mbstring
           tools: composer:v2
       - name: Validate composer.json
@@ -106,7 +106,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-version: ['8.1', '8.2', '8.3', '8.4']
+        php-version: ['8.4', '8.5']
     steps:
       - uses: actions/checkout@v7
         with:
@@ -143,7 +143,7 @@ jobs:
       - name: Set up PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.3'
+          php-version: '8.4'
           extensions: mbstring
           tools: composer:v2
       - name: Check if version already published

.github/workflows/release-audit.yml

@@ -14,6 +14,7 @@ name: release-audit
 on:
   push:
     branches: main
+  pull_request:
   schedule:
     # Weekly, so drift introduced outside a push is still noticed.
     - cron: '17 6 * * 1'
@@ -33,6 +34,22 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # Hard failure: reads only the working tree, so a disagreement between the
+  # implementations is always a defect and never a transient registry answer.
+  consistency:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+      - name: Check that every implementation declares the same version
+        run: node scripts/version-consistency.mjs
+
   audit:
     runs-on: ubuntu-latest
     timeout-minutes: 10

.gitignore

@@ -298,6 +298,9 @@ paket-files/
 __pycache__/
 *.pyc
 
+# setuptools metadata, written by `pip install -e python/`
+*.egg-info/
+
 # Cake - Uncomment if you are using it
 # tools/**
 # !tools/packages.config

.gitkeep

@@ -1,2 +1,3 @@
 # .gitkeep file auto-generated at 2026-08-28T06:09:39.810Z for PR creation at branch issue-288-cc91e23553e8 for issue https://github.com/link-foundation/links-notation/issues/288
-# Updated: 2026-08-28T07:33:05.436Z
+# Updated: 2026-08-28T07:33:05.436Z
+# Updated: 2026-08-28T11:11:17.987Z

.gitpod.yml

@@ -6,7 +6,7 @@ tasks:
     command: |
       echo "🔧 Testing C# implementation..."
       cd csharp
-      dotnet test -c Release -f net8
+      dotnet test -c Release
       echo "✅ C# tests completed"
 
   - name: Test JavaScript

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
+    rev: v6.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
@@ -14,7 +14,7 @@ repos:
 
   # JavaScript/TypeScript
   - repo: https://github.com/pre-commit/mirrors-eslint
-    rev: v8.56.0
+    rev: v10.9.1
     hooks:
       - id: eslint
         files: \.(js|ts)$
@@ -24,20 +24,20 @@ repos:
 
   # Python
   - repo: https://github.com/psf/black
-    rev: 24.1.1
+    rev: 26.5.1
     hooks:
       - id: black
         language_version: python3
         files: \.py$
 
   - repo: https://github.com/PyCQA/isort
-    rev: 5.13.2
+    rev: 9.0.1
     hooks:
       - id: isort
         files: \.py$
 
   - repo: https://github.com/PyCQA/flake8
-    rev: 7.0.0
+    rev: 7.3.0
     hooks:
       - id: flake8
         files: \.py$
@@ -53,7 +53,7 @@ repos:
 
   # Markdown
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: v0.39.0
+    rev: v0.49.1
     hooks:
       - id: markdownlint
         args: ['--fix']

CHANGELOG.md

@@ -8,6 +8,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- CI/CD: Dependabot covers every ecosystem in the repository. The `maven`,
+  `composer` and `gomod` manifests were unwatched, so Java, PHP and Go were
+  never offered updates ([#292](https://github.com/link-foundation/links-notation/issues/292))
+- CI/CD: `scripts/version-consistency.mjs`, a hard-failing check on every pull
+  request that the seven implementations declare the same version. The release
+  audit only warns, because a bump legitimately lands before the release that
+  publishes it; disagreement between the implementations reads only the working
+  tree and is always a defect
+  ([#292](https://github.com/link-foundation/links-notation/issues/292))
 - Native PHP implementation of the Links Notation parser and formatter
   (`link-foundation/links-notation` on Packagist), with a full PHPUnit test
   suite ported from Python, PSR-12 linting and a dedicated CI workflow
@@ -49,6 +58,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   registry confirms it ([#290](https://github.com/link-foundation/links-notation/issues/290))
 
 ### Changed
+- Every language's dependencies updated to their current releases, including the
+  major bumps: PHPUnit 10 to 13, PHP_CodeSniffer 3 to 4, xunit 2 to xunit.v3 4,
+  JUnit 5 to 6, `maven.compiler.release` 11 to 21, Go 1.21 to 1.24 (CI on 1.26),
+  `net8.0` to `net10.0`, and PHP `>=8.1` to `>=8.4` (CI on 8.4 and 8.5). Each
+  suite was run against the new versions before the bump was kept
+  ([#292](https://github.com/link-foundation/links-notation/issues/292))
+- C#: the test project runs on Microsoft.Testing.Platform. The .NET 10 SDK
+  dropped the VSTest path xunit v2 used, so `csharp/global.json` selects the new
+  runner and the test project builds as a self-executing `Exe`
+  ([#292](https://github.com/link-foundation/links-notation/issues/292))
 - Grammar: a reference is a `delimited_reference` (`n_quoted_reference` or
   `empty_reference`) or a `simple_reference`; the three delimiters `"`, `'`
   and `` ` `` are documented as equivalent, and an even delimiter run that does

csharp/Link.Foundation.Links.Notation.Tests/Link.Foundation.Links.Notation.Tests.csproj

@@ -1,8 +1,11 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net8</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <IsPackable>false</IsPackable>
+    <!-- xunit v3 test projects are self-executing: each one builds into its own
+         test host, so it has to be an Exe rather than a library. -->
+    <OutputType>Exe</OutputType>
     <LangVersion>latest</LangVersion>
     <Nullable>enable</Nullable>
     <RootNamespace>Link.Foundation.Links.Notation.Tests</RootNamespace>
@@ -14,10 +17,10 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
-    <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.0" PrivateAssets="All" />
-    <PackageReference Include="coverlet.collector" Version="10.0.1" PrivateAssets="All" />
+    <!-- Microsoft.NET.Test.Sdk, xunit.runner.visualstudio and coverlet.collector
+         are all VSTest components; under Microsoft.Testing.Platform xunit.v3
+         provides the runner and none of them are used. -->
+    <PackageReference Include="xunit.v3" Version="4.0.0" />
   </ItemGroup>
 
   <ItemGroup>

csharp/Link.Foundation.Links.Notation/Link.Foundation.Links.Notation.csproj

@@ -4,9 +4,9 @@
     <Description>Link.Foundation's Links Notation parser and formatter for .NET</Description>
     <Copyright>Konstantin Diachenko</Copyright>
     <AssemblyTitle>Link.Foundation.Links.Notation</AssemblyTitle>
-    <VersionPrefix>0.15.0</VersionPrefix>
+    <VersionPrefix>0.16.0</VersionPrefix>
     <Authors>Konstantin Diachenko</Authors>
-    <TargetFramework>net8</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <PackageId>Link.Foundation.Links.Notation</PackageId>
     <PackageTags>Link.Foundation;Protocols.Lino;Lino;IListExtensions;Link;Parser</PackageTags>
     <PackageProjectUrl>https://link-foundation.github.io/links-notation</PackageProjectUrl>
@@ -41,7 +41,6 @@ Test cases suite is updated.</PackageReleaseNotes>
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
     <PackageReference Include="Pegasus" Version="4.1.0" />
     <PackageReference Include="Platform.Collections" Version="0.4.0" />
   </ItemGroup>

csharp/README.md

@@ -172,7 +172,7 @@ Note: C# formatting checks are integrated into the CI pipeline using
 
 ## Dependencies
 
-- .NET 8.0
+- .NET 10.0
 - Microsoft.CSharp (4.7.0)
 - Pegasus (4.1.0)
 - Platform.Collections (0.3.2)