Security: bump .NET to 10.0.13 and MessagePack to 2.5.307 (Critical/High ASP.NET Core and NU1902 advisories) #166

Why

The release-image scan in the build job fails on Microsoft.AspNetCore.App.Runtime.linux-x64 10.0.12:

• .NET 10.0.13 (SDK 10.0.402) was released on 2026-10-13.
• Every PR whose build job builds the release image is red. That is almost every Dependabot PR opened on 2026-10-14 (chore(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 #150, chore(deps): Bump actions/setup-node from 7.0.0 to 7.1.0 #154, chore(deps-dev): bump @vitejs/plugin-react from 6.1.1 to 6.1.2 in /src/Decisya.Web #155, chore(deps-dev): bump vite from 8.3.1 to 8.3.3 in /src/Decisya.Web #157 to chore: Bump Microsoft.Testing.Extensions.CodeCoverage from 18.11.2 to 18.12.0 #163), and it will hit every code PR, including feat(api): adopt the Ostium Jwt and Backchannel packages (first identity switch) #164. Run 38607877182 (PR chore: Bump Microsoft.Testing.Extensions.CodeCoverage from 18.11.2 to 18.12.0 #163) shows the failure.
• The Dependabot docker job for /.github/release failed on 2026-10-14, so no bump PR exists.
• Exposure: none today, because the stack is not deployed (0.17 Deploy: tagged build deploys to the private VPS #29, 0.17b2 NAS bring-up: DSM checks, work-window deploy, first F1-F4 measurement #132).

Found on 2026-10-17 while checking #142. This is reported at once under CLAUDE.md, so it is exempt from #83 and from the tooling freeze.

Scope

• Bump the 10.0.12 pins to 10.0.13:
  • Directory.Packages.props: Microsoft.Extensions.DependencyInjection(.Abstractions), Microsoft.AspNetCore.Authentication.OpenIdConnect and .JwtBearer, Microsoft.EntityFrameworkCore.Design, Microsoft.AspNetCore.Mvc.Testing;
  • dotnet-tools.json (dotnet-ef);
  • the comments that name 10.0.12.
• Bump the aspnet and runtime digests in .github/release/base-images.Dockerfile to the 10.0.13 builds. Resolve each digest two ways, as ContainerImages.cs documents.
• G4 confirms which component the scan reads: the base image runtime, or a runtime pack from the SDK used for publish. If the CI SDK is the source, raise it so publish uses 10.0.13.
• The 7-day cooldown ends on 2026-10-20, so no waiver is needed from that date.
• No migration change: EF ProductVersion annotations in existing migrations stay as generated.

Added 2026-10-17 (Marco)

• MessagePack NU1902 is folded into this issue.
  • Advisory: GHSA-qhrr-8q5h-9q3h / CVE-2026-92707 (Moderate), "Nested arrays can blow past buffer length limits". Published 2026-10-15, fixed in 2.5.303.
  • Path: transitive, Aspire.Hosting 13.5.4 -> StreamJsonRpc 2.25.29 -> MessagePack 2.5.302.
  • Effect: dotnet restore fails with error NU1902 in Decisya.AppHost and Decisya.AppHost.Tests, so CI/build-test, CI/codeql and CI/deploy-guards fail on every PR (seen on PR feat(image-scan): adr-0015 item 4 caddy go exceptions, deploy guard, collector 0.163.1 (#142) #167, run 39029446071).
  • Fix: a central transitive pin of MessagePack 2.5.307. That is the newest 2.5.x, published 2026-10-03, so it is past the cooldown.
• Cooldown waiver: Marco waived the 7-day cooldown for .NET 10.0.13 (released 2026-10-13) once, on 2026-10-17. The reasons are the Critical/High advisories and the blockers piling up across projects. It sets no precedent.

Done when

• build (including the release-image scan), build-test, codeql and deploy-guards are green on this issue's PR, with no new exception and no NU1902 suppression.
• The Dependabot PRs that were red only because of this finding are green after a rebase.