Bump .NET SDK to 10.0.403 (CVE-2026-111497)

.github/workflows/ci.yml

@@ -28,6 +28,9 @@ jobs:
         with:
           global-json-file: global.json
 
+      - name: Show .NET info
+        run: dotnet --info
+
       - name: Verify pinned SDK
         shell: bash
         run: |

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+* SDK pin raised to 10.0.403 (runtime 10.0.14) for CVE-2026-111497 (GHSA-p3jp-9v83-76w9).
+
 ## [1.1.0] - 2026-08-03
 
 ### Added

CONTRIBUTING.md

@@ -4,7 +4,7 @@ Thank you for contributing. This repository builds specialized .NET libraries, n
 
 ## Development setup
 
-1. Install .NET SDK **10.0.302** exactly (see `global.json`).
+1. Install .NET SDK **10.0.403** exactly (see `global.json`).
 2. Restore, build, and test:
 
 ```bash

README.md

@@ -1,7 +1,7 @@
 # FunctionFoundry
 
 [![CI](https://github.com/Chookees/FunctionFoundry/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/Chookees/FunctionFoundry/actions/workflows/ci.yml)
-[![.NET](https://img.shields.io/badge/.NET-10.0.302-512BD4?logo=dotnet&logoColor=white)](global.json)
+[![.NET](https://img.shields.io/badge/.NET-10.0.403-512BD4?logo=dotnet&logoColor=white)](global.json)
 [![Tests](https://img.shields.io/badge/tests-271%20passed-brightgreen)](docs/coverage-summary.md)
 [![Coverage](https://img.shields.io/badge/coverage-85.8%25%20line-brightgreen)](docs/coverage-summary.md)
 [![Branch Coverage](https://img.shields.io/badge/branch%20coverage-remeasure-lightgrey)](docs/coverage-summary.md)
@@ -32,7 +32,7 @@ Each product has a dedicated README under `src/<Package>/README.md` describing e
 
 ## Requirements
 
-* .NET SDK **10.0.302** (pinned in `global.json`; roll-forward disabled)
+* .NET SDK **10.0.403** (pinned in `global.json`; roll-forward disabled; runtime 10.0.14)
 * Target framework: `net10.0`
 * C# 14.0
 

docs/FINAL_REPORT.md

@@ -7,7 +7,7 @@
 * `tests/` — per-package xUnit projects + Engineering.Tests
 * `samples/` / `benchmarks/` — per-package executables
 * `docs/adr`, `docs/packages`, CI under `.github/workflows`
-* Central build: `Directory.Build.props/targets`, `Directory.Packages.props`, `global.json` (**10.0.302**)
+* Central build: `Directory.Build.props/targets`, `Directory.Packages.props`, `global.json` (**10.0.302**; note: SDK pin later raised to **10.0.403** / runtime 10.0.14 for CVE-2026-111497)
 
 ## 2. Delivered packages
 
@@ -92,7 +92,7 @@ See `docs/packages/size-and-compatibility-report-v1.md`.
 * PBI commit order on main not strictly 01→12
 * Separate `v0.5.0` tag omitted
 * Unicode confusables: compact subset, not full UCD
-* SDK maintenance upgrade **10.0.301 → 10.0.302**
+* SDK maintenance upgrade **10.0.301 → 10.0.302** (later raised to **10.0.403** / runtime 10.0.14 for CVE-2026-111497)
 
 ## 16. Remaining known risks
 

docs/adr/0003-sdk-pinning-policy.md

@@ -2,7 +2,7 @@
 
 * **Status:** Accepted
 * **Date:** 2026-07-14
-* **Updated:** 2026-08-03
+* **Updated:** 2026-10-26
 * **Deciders:** FunctionFoundry architects
 
 ## Context
@@ -11,7 +11,7 @@ Silent SDK roll-forward can change analyzer behavior, pack outputs, and language
 
 ## Decision
 
-* Pin SDK `10.0.302` in `global.json` (maintenance upgrade from `10.0.301`).
+* Pin SDK `10.0.403` in `global.json` (security/maintenance upgrade from `10.0.302`; runtime 10.0.14 for CVE-2026-111497).
 * Set `rollForward` to `disable`.
 * Target `net10.0` and C# 14.0.
 * Treat future SDK moves as explicit maintenance upgrades with changelog notes and CI verification.

docs/coverage-summary.md

@@ -2,6 +2,8 @@
 
 Measured with Coverlet Cobertura on a Release `net10.0` build (SDK **10.0.302**), aggregated by unique package name (same methodology as CI).
 
+Note: SDK pin later raised to **10.0.403** / runtime 10.0.14 for CVE-2026-111497; remeasure coverage under the new SDK when convenient.
+
 **Unit tests:** 242 passed, 0 failed, 0 skipped.
 
 ## Overall

global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "10.0.302",
+    "version": "10.0.403",
     "rollForward": "disable",
     "allowPrerelease": false
   }

tests/FunctionFoundry.Engineering.Tests/SdkPinningTests.cs

@@ -10,7 +10,7 @@ public void GlobalJson_pins_exact_sdk_without_roll_forward()
         string path = FindRepoFile("global.json");
         using JsonDocument document = JsonDocument.Parse(File.ReadAllText(path));
         JsonElement sdk = document.RootElement.GetProperty("sdk");
-        Assert.Equal("10.0.302", sdk.GetProperty("version").GetString());
+        Assert.Equal("10.0.403", sdk.GetProperty("version").GetString());
         Assert.Equal("disable", sdk.GetProperty("rollForward").GetString());
         Assert.False(sdk.GetProperty("allowPrerelease").GetBoolean());
     }