chore(deps): bump NetDid.* → 2.3.0, NetCrypto → 1.2.0 (v1.1.0)

[moisesja]

Summary

Foundation dependency bump for downstream convergence with net-wallet-sdk 0.2.0 (closes #16), released as v1.1.0.

• NetDid.Core / NetDid.Method.Key / NetDid.Extensions.DependencyInjection 2.0.1 → 2.3.0
• NetCrypto 1.1.0 → 1.2.0
• NetCid stays 1.6.0
• CredentialsVersion 1.0.0 → 1.1.0

The issue was filed against net-did 2.2.0; this lands 2.3.0 — the latest on the line — which supersedes it. NetDid.Core 2.3.0 requires exactly NetCrypto 1.2.0 / NetCid 1.6.0, same convergence.

Why this is a clean, dependency-only change

• No NU1605. NetDid.Core 2.3.0 transitively depends on NetCrypto 1.2.0, so pinning NetCrypto to 1.2.0 is required by the net-did bump (leaving it at 1.1.0 would be the downgrade). DataProofsDotnet.* 1.1.0 wants NetCrypto 1.1.0 / NetCid 1.6.0 — both satisfied. The whole graph converges on NetCrypto 1.2.0 / NetCid 1.6.0.
• No public API delta. Credentials uses net-did only for DID resolution / did:key. The net-did 2.1→2.3 changes tightened the did:webvh update/deactivate driver, which this library does not exercise.

Verification (mirrors the release gate)

• ✅ dotnet build -c Release — 0 warnings (warnings-as-errors)
• ✅ dotnet test --filter "Category!=Conformance" — 391 tests, 0 failures
• ✅ tools/check-no-newtonsoft-closure.sh — default consumer closure Newtonsoft-free (resolved graph: NetCrypto 1.2.0, NetDid.* 2.3.0, NetCid 1.6.0)
• ✅ tools/check-api-compat.sh — all 3 packages vs published 1.0.0 baseline: no breaking changes

Also fixed

tools/check-api-compat.sh passed the package-to-validate as --package <path>, but Microsoft.DotNet.ApiCompat.Tool 10.0.301 takes it positionally. This gate had never actually run (1.0.0 was the first release → no baseline → SKIP), so the bug was latent; it would have failed this release. Now corrected and passing against the real 1.0.0 baseline.

Note

packages.lock.json regeneration from the issue's acceptance list is N/A — this repo has no lock files and does not set RestorePackagesWithLockFile.

🤖 Generated with Claude Code

[moisesja]

Reviewed the diff (CHANGELOG.md, Directory.Build.props, Directory.Packages.props, tools/check-api-compat.sh, plus the checked-in tasks/todo-...md plan).

Overall: clean, well-scoped dependency-only bump. Single commit, no source/API changes, rationale for the NetCrypto 1.1.0→1.2.0 pin (required transitively by NetDid.Core 2.3.0, not optional) is correctly explained and matches how central package management is set up here. Changelog entry is thorough. Grepped the repo for stray references to the old pins (2.0.1, NetCrypto 1.1.0) outside the touched files — none found.

A couple of minor notes, nothing blocking:

1. Scope: this PR bundles the version bump with an unrelated fix to tools/check-api-compat.sh (positional vs. --package arg). Justified here since it's the only way to actually exercise the ApiCompat gate for this bump (previously never ran, since 1.0.0 had no baseline), but worth calling out explicitly in case that's not intentional.
2. Directory.Packages.props comment: the reworded header comment has an awkward line break ("...issue #16). Not / every entry is referenced yet: the / later milestones...") — cosmetic only.
3. I don't have a dotnet SDK available in this review environment, so I could not independently reproduce the build/test/ApiCompat results claimed in the description — the two build + test checks were still in_progress as of this review. Please confirm they're green before merging.

No correctness or security concerns. Approving pending green CI.

---

Generated by Claude Code