[siebe41]

Part of #369. Fixes main's NU1004 breakage and the red container image check on every open PR (e.g. #371).

What changes:

• global.json: SDK 10.0.402 → 10.0.404. That SDK ships runtime 10.0.15 (released 2026-11-10, per dotnet/core's releases.json). The tool and the desktop app are self-contained, so they take their runtime from the SDK. This picks up:
  • CVE-2026-70197 and the Brotli advisory GHSA-p3jp-9v83-76w9 (both fixed in 10.0.14);
  • the ASP.NET Core CVE-2026-114146, -114147 and -114149 that Trivy now reports (fixed in 10.0.15).
• Dockerfile base images: sdk:10.0 and aspnet:10.0-noble-chiseled-extra move to the manifest-list digests Microsoft published on 2026-11-10. Both are still multi-platform, and both are still pinned by digest.
• Dependabot: new dotnet-sdk ecosystem, so the next runtime security patch arrives as a PR instead of waiting for a hand bump.
• Docs: CONTRIBUTING.md's SDK version, and a Security line in the changelog.

Lock files (added after #365 merged into main without them, which broke every locked restore):

• .github/workflows/lock-files.yml: runs dotnet restore --force-evaluate on deps/** and dependabot/nuget/** pushes and publishes the lock files as an artifact and as a patch in the log. It does not push.
• The 7 regenerated lock files: Sqlite 10.0.14 and OnnxRuntime 1.31.1, plus the samples' project version.

#369 stays open for the last piece: committing a Dependabot NuGet PR's lock files without someone downloading them by hand.

How it was checked: I had no .NET toolchain or registry access in this session, so CI is the build check. The digests come from MCR's catalog, and the container job's Trivy step confirms the image is now on 10.0.15.

https://claude.ai/code/session_019RzMAamGr97qWo8icku8EK

---

Generated by Claude Code

[siebe41]

Why the first CI run went red: #365 (Dependabot: Microsoft.Data.Sqlite 10.0.14, Microsoft.ML.OnnxRuntime 1.31.1) merged into main at 01:52 without its packages.lock.json updates. That broke every locked restore with NU1004, on main and on every PR, not just this one. This is the failure #369 describes.

Fixed in this PR:

• I merged main in.
• I added .github/workflows/lock-files.yml. On a deps/** or dependabot/nuget/** push it runs dotnet restore --force-evaluate for every project and publishes the lock files, as an artifact and as a patch in the log. It doesn't push itself, because a GITHUB_TOKEN push wouldn't start CI.
• I committed the 7 lock files it generated: the Sqlite/OnnxRuntime bumps, plus two sample lock files that still recorded project version 0.6.0.

---

Generated by Claude Code