Bump EF Core and OpenIdConnect packages to .NET 10.0.11

[michaelTBF]

Summary

• Bumps Microsoft.AspNetCore.Authentication.OpenIdConnect, Microsoft.EntityFrameworkCore, .Design, .Relational (src/api) and .InMemory (src/api.tests) from 10.0.10 to 10.0.11
• Regenerates the three packages.lock.json files to match
• No changes needed to CI or the Dockerfile — both already float to the latest 10.0.x SDK/runtime patch, so they'll pick up 10.0.11 automatically

The August 2026 .NET servicing release (10.0.11) fixes several runtime CVEs, notably relevant to this Linux-hosted API:

• CVE-2026-62909 (CVSS 7.8): on Linux, the runtime diagnostics IPC socket could silently fall back to the abstract namespace, bypassing filesystem permissions and letting another local user attach and read process memory
• CVE-2026-62901 (CVSS 7.5): unauthenticated remote DoS via an infinite loop in System.Net.WebSockets permessage-deflate handling
• CVE-2026-62898 (CVSS 7.5): use-after-free info disclosure in Microsoft QUIC, relevant if HTTP/3 is enabled

(Several other CVEs in this release are WPF/desktop-only and don't apply to this server app.)

Test plan

• dotnet build — succeeded, 0 warnings/errors
• dotnet test (unit suite, src/api.tests) — 846/846 passed
• dotnet test (integration suite, src/api.integration.tests) — could not run in the dev sandbox (no reachable Docker daemon); unaffected by this change

---

Generated by Claude Code

[Copilot]

Pull request overview

Updates .NET dependencies to the 10.0.11 servicing release while preserving locked dependency resolution.

Changes:

• Updates OpenID Connect and EF Core packages to 10.0.11.
• Regenerates API, unit-test, and integration-test lockfiles.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/api/DmarcAnalyzer.Api.csproj	Updates API package references.
src/api/packages.lock.json	Locks updated API dependencies.
src/api.tests/DmarcAnalyzer.Api.Tests.csproj	Updates EF Core InMemory.
src/api.tests/packages.lock.json	Locks updated unit-test dependencies.
src/api.integration.tests/packages.lock.json	Locks updated integration-test dependencies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Pro Plus

Run ID: a13bb5e3-481d-49af-bd88-893161f37143

📥 Commits

Reviewing files that changed from the base of the PR and between f7a1601 and 314c5a3.

📒 Files selected for processing (5)

• src/api.integration.tests/packages.lock.json
• src/api.tests/DmarcAnalyzer.Api.Tests.csproj
• src/api.tests/packages.lock.json
• src/api/DmarcAnalyzer.Api.csproj
• src/api/packages.lock.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Updated API and test project dependencies from .NET 10.0.10 to 10.0.11. Refreshed lockfiles, dependency constraints, transitive package versions, and content hashes. Updated Newtonsoft.Json from 13.0.3 to 13.0.4.

Changes

.NET dependency update

Layer / File(s)	Summary
Direct package version updates src/api/DmarcAnalyzer.Api.csproj, src/api.tests/DmarcAnalyzer.Api.Tests.csproj, src/api/packages.lock.json, src/api.tests/packages.lock.json, src/api.integration.tests/packages.lock.json	Updated direct OpenID Connect and Entity Framework Core references and project constraints to 10.0.11.
Resolved dependency graph refresh src/api/packages.lock.json, src/api.tests/packages.lock.json, src/api.integration.tests/packages.lock.json	Refreshed Entity Framework Core, Microsoft.Extensions, authentication, and Newtonsoft.Json resolutions, dependency references, and content hashes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 314c5

This PR updates .NET package patch versions and corresponding lockfiles without application-code changes; build and unit tests pass, and no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: updating EF Core and OpenID Connect packages to version 10.0.11.
Description check	✅ Passed	The description directly explains the package updates, lockfile regeneration, security objectives, and test results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (5 skipped: 5 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/upbeat-pascal-0o6jgw

---

_{Comment @coderabbitai help to get the list of available commands.}