[mpcs2013]

Summary

Two dependency advisories make build red on every code PR (#167, #164, the Dependabot queue). This PR fixes both. Nothing is deployed, so there was no live exposure.

1. ASP.NET Core 10.0.12 → 10.0.13

• Advisories: GHSA-fpq8-4vhr-rcxx and GHSA-rv87-ccxw-8ggf (Critical); GHSA-494h-xx7x-5frh, GHSA-f4g7-52wc-p8x7 and GHSA-mf4x-w4gh-4656 (High). They fail the release-image scan.
• Directory.Packages.props: the six Microsoft 10.0.12 packages go to 10.0.13.
• dotnet-tools.json: dotnet-ef 10.0.13.
• .github/release/base-images.Dockerfile: the aspnet and runtime 10.0-noble-chiseled-extra digests move to the 10.0.13 builds. Each digest was read two ways (registry HEAD and the MCR catalog), and the image env shows DOTNET_VERSION/ASPNET_VERSION 10.0.13.

2. MessagePack 2.5.302 → 2.5.307 (error NU1902, GHSA-qhrr-8q5h-9q3h / CVE-2026-92707, Moderate)

• It arrives transitively: Aspire.Hosting 13.5.4 → StreamJsonRpc 2.25.29 → MessagePack.
• It fails restore of Decisya.AppHost, so build-test, codeql and deploy-guards go red.
• Fix: a central transitive pin (CentralPackageTransitivePinningEnabled), with no suppression. Drop the pin once Aspire's own graph carries ≥ 2.5.303.

Cooldown: Marco waived the 7-day cooldown for .NET 10.0.13 (released 2026-10-13) once, on 2026-10-17. It sets no precedent. MessagePack 2.5.307 (2026-10-03) is already past the cooldown.

Ostium freeze: no file under the frozen identity paths changes; only the versions of the OpenIdConnect and JwtBearer packages move. Ostium's packages need the same 10.0.13 bump; that goes through the exchange with Marco's approval.

Rollback: revert this PR. The advisories return and build goes red again. There is no data step.

Verification

What	Where	Result
dotnet restore --force-evaluate	local	no NU19xx
dotnet list package --vulnerable --include-transitive	local	none
dotnet build -warnaserror	local	0 warnings, 0 errors
.NET unit tests (pre-push filters)	local	1768 passed, 0 failed
.claude/tests, deploy/tests	local	OK (4 and 14 skipped)
G3	docs/security/threat-models/dotnet-10-0-13-messagepack.md	PASS-WITH-NOTES (required: .github/release/ is a review-required path)
G6	docs/security/reviews/166.md	PASS after the re-check (S-166-01, a stale date, fixed)
Release-image scan, build-test, codeql, deploy-guards	CI on this PR	must be green before merge

Package pin added: MessagePack 2.5.307. It is an existing transitive dependency, pinned centrally to the patched line for GHSA-qhrr-8q5h-9q3h; no new package.

Merge conditions (G3 G4-166-01/02)

1. Stacked. This PR targets issue/142-go-http2-exceptions, so the chain is main ← chore(image-scan): renew the #120 openssl and zlib exceptions to 2026-11-02 (#143) #144 ← feat(image-scan): adr-0015 item 4 caddy go exceptions, deploy guard, collector 0.163.1 (#142) #167 ← fix(deps): bump .net to 10.0.13 and pin messagepack 2.5.307 for security advisories (#166) #168. Each stacked PR must be green on its own CI run before it merges, because the ruleset protects only main. Record each run link in the manifest:
   • fix(deps): bump .net to 10.0.13 and pin messagepack 2.5.307 for security advisories (#166) #168: release build with the image scan, build-test, image-scan, codeql, deploy-guards, claude-config;
   • chore(image-scan): renew the #120 openssl and zlib exceptions to 2026-11-02 (#143) #144: its own run, with the release build triggered.
2. No new exception for api, bff, migrator, .NET or MessagePack. The run must show 0 blocking for those images. Re-check the CVE-2016-20013 libc6 entries on this base-image bump.
3. Close Security: bump .NET to 10.0.13 and MessagePack to 2.5.307 (Critical/High ASP.NET Core and NU1902 advisories) #166 by hand when chore(image-scan): renew the #120 openssl and zlib exceptions to 2026-11-02 (#143) #144 merges: Closes #166 only fires on a merge into main.

Backlog (#83)

S-166-02: confirm base-image digests against a third source. S-166-03: a nuget.config with signed-package trust. The comment in the frozen tests/Decisya.Api.Tests/Authentication/TenancyDatabaseFixture.cs still says "pinned 10.0.12".

Closes #166

🤖 Generated with Claude Code

Docs: docs/ai/pipeline/166.md, docs/security/reviews/166.md