From 1ba283886ae7ce70a88481c89d101e6aa2e936a6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 11 Nov 2026 04:50:13 +0000
Subject: [PATCH 1/2] Bump System.Security.Cryptography.Pkcs from 10.0.15 to
 11.0.0

---
updated-dependencies:
- dependency-name: System.Security.Cryptography.Pkcs
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 backend/src/ProCoderJi.Api/ProCoderJi.Api.csproj |  2 +-
 backend/src/ProCoderJi.Api/packages.lock.json    | 14 +++++++++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/backend/src/ProCoderJi.Api/ProCoderJi.Api.csproj b/backend/src/ProCoderJi.Api/ProCoderJi.Api.csproj
index 64abc31..e33774d 100644
--- a/backend/src/ProCoderJi.Api/ProCoderJi.Api.csproj
+++ b/backend/src/ProCoderJi.Api/ProCoderJi.Api.csproj
@@ -19,7 +19,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.15" />
     <PackageReference Include="MongoDB.Driver" Version="3.13.0" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.15" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="11.0.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/backend/src/ProCoderJi.Api/packages.lock.json b/backend/src/ProCoderJi.Api/packages.lock.json
index 9ee392a..55e96e2 100644
--- a/backend/src/ProCoderJi.Api/packages.lock.json
+++ b/backend/src/ProCoderJi.Api/packages.lock.json
@@ -83,9 +83,12 @@
       },
       "System.Security.Cryptography.Pkcs": {
         "type": "Direct",
-        "requested": "[10.0.15, )",
-        "resolved": "10.0.15",
-        "contentHash": "4jEv/lXDuQkh60lPU3hlwASErXdv1ZMKmsxVuBfZWiVKT5Q2QGo58kTa6rN519+PU+m4Hsj1m3yT8fN+Xw0XZw=="
+        "requested": "[11.0.0, )",
+        "resolved": "11.0.0",
+        "contentHash": "G8mTjSWrwaPJ2bJRbKuI4ZqdKUYcANK0KtNH3s8/va3nXiF/Pk/yhv2R17rv5PBKJO5+ZXDyhTnZXh0W9v0J8w==",
+        "dependencies": {
+          "System.Formats.Asn1": "11.0.0"
+        }
       },
       "Azure.Core": {
         "type": "Transitive",
@@ -477,6 +480,11 @@
           "System.Security.Cryptography.ProtectedData": "9.0.11"
         }
       },
+      "System.Formats.Asn1": {
+        "type": "Transitive",
+        "resolved": "11.0.0",
+        "contentHash": "RSIrJ7D8gEHykZWTfS/r9tz/G5YpxIQAaFFXSLLHhVaRed+/26KvqaXvUtqqMJMlNjubAcMvf3UJ+E6ABT8AWw=="
+      },
       "System.IdentityModel.Tokens.Jwt": {
         "type": "Transitive",
         "resolved": "7.7.1",

From cae906451a45feb7af05dc1c22df3e31a9e3ecb1 Mon Sep 17 00:00:00 2001
From: Satyam Yadav <114805086+Coding-Professional@users.noreply.github.com>
Date: Wed, 11 Nov 2026 10:36:43 +0530
Subject: [PATCH 2/2] docs: explain solution-wide NuGet lock refreshes

---
 docs/maintainer-guide.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/docs/maintainer-guide.md b/docs/maintainer-guide.md
index ab5a515..197b481 100644
--- a/docs/maintainer-guide.md
+++ b/docs/maintainer-guide.md
@@ -101,6 +101,13 @@ Merge one overlapping dependency change at a time. Let remaining branches refres
 their current diff and CI. Close a superseded update only after confirming that its changes are
 already included. Keep security updates visible; fewer routine PRs should not hide an urgent fix.
 
+For NuGet updates, refresh the complete solution with
+`dotnet restore backend/ProCoderJi.slnx --force-evaluate`, then verify
+`dotnet restore backend/ProCoderJi.slnx --locked-mode`. API or test dependencies also affect
+referencing projects, including `backend/tests/ProCoderJi.BrowserHost/`. Commit every changed
+`packages.lock.json` so clean CI restores use the same graph. Check the collector's required
+Test SDK version when updating Coverlet, and verify that CI records executed API lines.
+
 Follow [Security notes](security.md) for current known findings. Do not use `npm audit fix --force`,
 unrelated downgrades or broad overrides just to obtain a clean summary. New runtime dependencies
 need a concrete use and a discussion of their maintenance cost.