Move to .NET SDK 10.0.402 and runtime 10.0.13 - #388

Deliberate move to the .NET 10.0.13 security release, following the SDK pin in #385. The one-week cooldown is skipped at William's direction because the release carries security fixes.

Why

.NET 10.0.13 (13 October 2026) ships SDK 10.0.402 and lists 44 CVEs. The one most relevant here is CVE-2026-105016, a remote code execution vulnerability in Microsoft QUIC. MSRC rates it Critical for .NET 8 to 11 installed on Windows, where .NET bundles MsQuic. Runtime 10.0.13 bundles msquic.dll 2.5.11.159415436; 10.0.12 bundled 2.5.10.154561281. I read both versions from the official SDK zip, whose SHA-512 matched releases.json.

Changes

• SDK: global.json and every workflow dotnet-version pin move to 10.0.402. rollForward stays disable.
• MAUI workload set: stays at 10.0.401 (android-smoke.yml, mac-catalyst.yml, scripts/maui_https_ci.ps1). Workload sets belong to the 10.0.400 feature band, and none was published for 10.0.402: the newest sets on nuget.org are 10.401.0 and 10.401.1. Moving the set is a separate, validated step, so the MAUI apps keep runtime 10.0.12 (see Known gaps). The iOS app reports 10.0.12 in this PR's run, as it did on the engine head.
• Shipped dependency minimums, 10.0.12 to 10.0.13:
  • System.Threading.RateLimiting, both core targets.
  • System.Text.Json, core .NET Standard 2.0 asset.
  • Microsoft.Extensions.DependencyInjection and Microsoft.Extensions.Hosting.Abstractions, DI package.
  • An application that references one of these directly at an earlier version must move it, or NuGet reports NU1605. The changelog says so.
• Lock files: all are regenerated with SDK 10.0.402. Every resolved change is 10.0.12 to 10.0.13, including the implicit Microsoft.NET.ILLink.Tasks and the ILCompiler packages in the AOT smoke.
  • The six MAUI locks can't be regenerated without the workload. They mirror the same two entries (ILLink.Tasks, RateLimiting) using the content hashes NuGet recorded in the core lock. Their old 10.0.12 hashes matched the core lock's, so the method is consistent. CI's locked restores of the MAUI jobs check them.
  • coverlet.MTP keeps its own Microsoft.Extensions.Configuration* dependencies at the 10.0.12 it requests (test-only, lowest-applicable resolution).
  • One change is not a version move. test/EmbedIO.HttpsCertificates has no package dependencies, and re-evaluation rewrote its lock from format version 1 to version 2, the format NuGet writes now.
• Exact-runtime probes: RuntimeCloseProbe (csproj and its two version checks), AppContainerSmoke and the native dependency probe template move to runtime 10.0.13, so they exercise the runtime the repository now builds with.
• Docs and changelog: CONTRIBUTING, SECURITY, the MAUI HTTPS validation guide, the DI architecture page, the legacy-compatibility guide, the close-probe guide and the HTTP/3 quiet-host page describe the new pins. The HTTP/3 guide adds the Windows runtime requirement for CVE-2026-105016.

What 10.0.13 contains (checked against the public v10.0.13 tag)

• Contained: the macOS accept correction for dotnet/runtime#121848. Backport #133567 (merge 5e9f5ef8) is an ancestor of v10.0.13. EmbedIO keeps its macOS IPv6 accept worker. Removing it is a separate decision that needs macOS evidence, and applications can still run on earlier runtimes. docs/user-reports/mac-accept-reset.md records this.
• Not contained: the System.Net.Quic send-buffer fix, dotnet/runtime#135591 (merge cba3c1d6, 13 October). It is not in v10.0.13, and a search found no release/10.0 backport. The HTTP/3 memory limitation and Track System.Net.Quic send-buffer retention and native-provider endurance #278 are unchanged. The HTTP/3 guide, the endurance record and the changelog now say so.
• Unchanged: the MsQuic rebind retry and its CI quarantine. Linux and macOS load the host's libmsquic (CI pins 2.6.2), which a runtime update does not change. MSRC lists no Linux or macOS product for CVE-2026-105016.

Rebased onto #387 (c9eb1d2)

• Rebased once onto the engine head after Cover untested paths and fix two inherited defects they exposed #387 merged. The base moved no lock file, package version or SDK pin. Only the CHANGELOG conflicted: both sides added bullets at the top of 2.0.0, and both are kept, this one first. git range-diff against the tested a4ff58e shows no other difference. The test-count floor, 6052, comes from the base.
• Pre-push checks on f9d3c79 are clean:
  • dotnet format whitespace test/EmbedIO.RuntimeCloseProbe --folder --verify-no-changes, the only project with C# changes
  • scripts/check_analyzer_suppressions.py
  • git diff --check
• The AnalyzerGuard needs a heavy slot, and Dispatch admitted TCP requests straight to the handler #381's benchmark held both. A grep of the added C# lines for a postfix ! stood in for it and found none. CI's static-analysis job runs the AnalyzerGuard.
• The validation below ran on a4ff58e (base 56e8e7a). Its CI run 38463220739 passed after one rerun of the iOS MAUI job, whose first attempt hit the known WebView navigation flake (Investigate intermittent MAUI iOS HTTPS navigation and finish timeouts #185).

Validation (local, Windows, private official SDK 10.0.402, heavy slot, -m:1)

• Forced lock regeneration for 31 projects. Two first failed with NU1103: the NuGet HTTP cache still held version lists from before the 10.0.13 publication. Both passed with --no-http-cache.
• dotnet restore --locked-mode passes for every project with a committed lock that restores without a MAUI workload.
• CI's static-analysis steps pass:
  • scripts/test_analyzer_suppressions.py, scripts/test_analyzer_inventory.py, scripts/test_merge_review.py, scripts/check_analyzer_suppressions.py
  • dotnet run --project tools/EmbedIO.AnalyzerGuard -c Release --no-restore -- .
  • dotnet format whitespace EmbedIO.sln --verify-no-changes
  • dotnet build EmbedIO.sln -c Release -p:RunAnalyzers=true -p:EnforceCodeStyleInBuild=true: 0 warnings, 0 errors.
  • AppContainerSmoke also builds and passes format verification.
• dotnet pack EmbedIO.sln -c Release, then scripts/check_packages.py: all five packages verified. The nuspec dependency groups read 10.0.13 as listed above.
• RuntimeCloseProbe binds to runtime 10.0.13: its runtimeconfig.json names 10.0.13 with rollForward: Disable, and it starts on the private SDK, which carries only 10.0.13.
• git diff --check is clean.
• Not run locally: the test suites, the AOT publish and the MAUI apps. Full hosted CI must be green, including MAUI, AOT, AppContainer and the HTTP/3 host controls that this diff triggers.

Known gaps

• MAUI runtime: the MAUI apps stay on runtime 10.0.12 here. Workload sets 10.0.401 and 10.0.401.1 list Microsoft.NET.Workload.Mono.ToolChain.Current 10.0.112, which installs the 10.0.12 Mono packs. Workload set 10.0.402, published on nuget.org at 20:22Z today, lists 10.0.113 (runtime 10.0.13). It also moves the iOS, Mac Catalyst, macOS and tvOS SDK packs to 27.0.10722, the dotnet/macios ".NET 10 - Xcode 27.0 support" release, while the macOS jobs select Xcode 26.6. It also moves Android to 36.1.118. Adopting it is a separate, validated step that includes the Xcode move. The weekly updater in the follow-up PR watches for workload sets and would propose it.
• Conformance image: test/EmbedIO.Conformance/docker/Dockerfile still pins the mcr.microsoft.com/dotnet/sdk:10.0.401 image digest. At 20:27Z MCR returned 404 for sdk:10.0.402, and the floating sdk:10.0 tag still served the 10.0.401 digest. Until the digest moves, the manual conformance container can't build this branch, because global.json disables roll-forward. No workflow uses that image. I'll move the digest in a follow-up once MCR publishes the 10.0.402 image.

The roll-forward residual from #385 is now deliberate: setup-dotnet installs the latest LTS runtime, 10.0.13, and that is the runtime the repository pins.

Part of engine program #181 and umbrella PR #182. GitHub Projects are intentionally unused.