The shipped .NET runtime (10.0.13, CVE-2026-70197) can't update itself: no Dependabot for global.json, and NuGet bump PRs fail locked restore #369

Found by an audit on 2026-11-11. Root cause of #367 and #366, and of why they'll keep reopening.

What the Trivy scan found (release-sbom-scan run of 2026-11-09)

8 HIGH, all in the self-contained .NET runtime 10.0.13 that the desktop app and tool ship (Microsoft.NETCore.App.Runtime.{linux-arm64,win-arm64,win-x64,…}):

• CVE-2026-70197: arbitrary code execution via an out-of-bounds write, fixed in 10.0.14;
• GHSA-p3jp-9v83-76w9 (CVE-2026-111497): .NET Brotli, fixed in 10.0.14.

Why it didn't fix itself

1. Nothing updates the SDK. global.json pins 10.0.402 (rollForward patch), and .github/dependabot.yml has no dotnet-sdk ecosystem. The self-contained runtime comes from the SDK, so it only moves when someone bumps global.json by hand.
2. Dependabot's NuGet PRs can't pass CI. Directory.Build.props:22 sets RestorePackagesWithLockFile, and CI restores in locked mode. When a group bump changes a package that other projects get transitively (Microsoft.Data.Sqlite, Microsoft.ML.OnnxRuntime), Dependabot updates Directory.Packages.props but not those projects' packages.lock.json. Every build then fails with NU1004 ("Lock file version [10.0.13, ), central package management version [10.0.14, )"). That's PR Bump the nuget-minor-and-patch group with 7 updates #365 today (it includes the 10.0.14 bumps); Bump the nuget-minor-and-patch group with 4 updates #361 was closed unmerged the same way.

Fix

• Now (unblocks Desktop app and tool: patch release needed #367/Container image: patch release needed #366): bump global.json to the 10.0.x SDK that ships runtime 10.0.14. Take Bump the nuget-minor-and-patch group with 7 updates #365's package bumps, run dotnet restore --force-evaluate, commit the 12 packages.lock.json files, then tag the patch release. Merge build(deps): bump dotnet/aspnet from 9e3919a to 9b755ea in /src/SemanticRouter.Host #359 and build(deps): bump dotnet/sdk from 747cbad to de4fe90 in /src/SemanticRouter.Host #360 (base-image digests) for the container if they're green once rebased.
• So it stays fixed: add package-ecosystem: dotnet-sdk (directory /) to dependabot.yml, and a small workflow on dependabot/nuget/** branches that runs dotnet restore --force-evaluate and pushes the lock files back. Use an app token, not GITHUB_TOKEN, so CI re-runs on the pushed commit.

Generated by Claude Code