[ajs-uk-dev]

Closes #570.

Every NuGet package is on its latest release that adds no cost. Every production project now reports no known vulnerabilities (dotnet list package --vulnerable --include-transitive). One Moderate advisory remains, in a test-only package; see Known limit.

What changed

Package updates. The upgrades were made in Visual Studio. Three of them needed code changes:

Package	Change	Why
Refit 13 → 16	Infrastructure references Refit.Reflection	Refit 16 builds requests at compile time. IZendeskApi.GetTicketsForView takes a Dictionary query that can't be flattened at compile time (warning RF006). Without the reflection builder, resolving the Zendesk client throws NotSupportedException. The worker crash-looped and 11 unit tests failed. RF006 is still reported as a warning; it's now only a notice.
GovUk.Frontend.AspNetCore 4.4 → 5.0	[DateInput(ErrorMessagePrefix = …)] on the three window-admin dates: exercise start and end, and next opportunity	<govuk-date-input> now throws without a prefix, so those pages returned an error page. The prefixes keep the wording users saw before ("Next opportunity must be a real date").
GovUk.Frontend.AspNetCore 5.0	.gitignore entries for the GOV.UK Frontend files	5.0 no longer serves the GOV.UK CSS, JS, fonts and icons from the assembly. It copies them into wwwroot on every build. They come from the package, so they aren't committed. The app's own images in wwwroot/assets/images stay tracked.
Microsoft.Playwright 1.62 → 1.63	E2E image v1.63.0-noble	The bindings and the image's Chromium must match.

Directory.Packages.props cleanup. The file only applies to the projects under src/. The test projects set their own versions in their .csproj files, so the test-package entries in props did nothing and had drifted, for example Playwright 1.62 vs 1.63. I removed 17 entries that nothing in src/ references:

• test packages: xunit, the xunit runner, SkippableFact, xRetry, NSubstitute, coverlet, Test.Sdk, both Playwright packages, Testcontainers.PostgreSql and ImageSharp
• never referenced at all: the three NUnit packages, Microsoft.Extensions.Hosting, Options.ConfigurationExtensions and Cryptography.Pkcs

The file is now sorted, with a comment saying it doesn't reach tests/. The Playwright pin check (scripts/check-playwright-pin.sh), the CI browser-cache key and docs/E2E-Playwright.md were all reading the dead entry; they now read the E2E .csproj.

Worker bug fix (pre-existing, found during the upgrade). ContentStagingSessionRetentionJob, added in #354, looks up IContentStagingSessionStore from a new scope on each hourly run. The worker deliberately skips AddPersistenceDependencies and registers its persistence services by hand, and this store was never added. So since 1 September every run has thrown, logged "Content staging session retention tick failed", and deleted nothing. Abandoned import previews, each holding a whole parsed CMS bundle, were only removed when someone started another import. Host startup didn't catch it, because the job only looks the store up when it runs, and its unit tests pass the store in directly.

• The worker's registrations move unchanged from Program.cs into WorkerServiceExtensions.AddWorkerServices, plus the one missing line.
• RulesEngineWorkerProgramTests checks the text of the worker's startup code. It now reads both files.

Known limit

SixLabors.ImageSharp stays on 3.1.12 in the E2E project. GHSA-gwg2-r3hj-4w44 (Moderate) is only fixed in 4.1.2. ImageSharp 4 fails the build without a Six Labors licence key, which #570 rules out as added cost. The exposure is small:

• it's a test-only dependency that is never deployed
• it only reads PNG screenshots the suite takes itself

Dependabot PR #572 proposes the same 4.1.2 bump and will fail for the same reason. It should be closed, or ImageSharp added to Dependabot's ignore list, unless DfE takes a licence.

Verification

All run locally on this branch, with the containers rebuilt from it:

Suite	Result
Unit	6,439 of 6,439 pass
Integration	997 of 997 pass
E2E (Linux Playwright container, make test-e2e)	305 pass, 2 skipped (the usual two)

• web: /healthcheck returns 200. /govuk-frontend.min.css, .min.js, the fonts, favicon.ico and manifest.json all return 200 from the published image.
• rules_engine: stays up. Its first maintenance run logs 0 exceptions; before the fix it logged the retention failure.
• Builds: all projects build with 0 errors. scripts/check-playwright-pin.sh passes (NuGet 1.63.0 == image v1.63.0).

Tests added

IntegrationTests/Worker/WorkerMaintenanceJobsTests builds the worker's real service registrations (AddWorkerServices) against the Testcontainers Postgres:

• Every maintenance job runs once through that setup. It finds the jobs by namespace, so a future job that isn't wired into the test fails it.
• The content-staging job deletes an expired session row.

Both failed with the production error ("No service for type IContentStagingSessionStore") before the store was registered.