[nevridge]

Summary

Bumps MicrosoftPlatformVersion from 10.0.8 to 10.0.11 in Directory.Build.props. Microsoft.EntityFrameworkCore.Sqlite 10.0.11 pulls SQLitePCLRaw 2.1.12, which is outside the affected range (<= 2.1.11) of GHSA-2m69-gcr7-jv3q. That clears the high-severity NU1903 warning in TaskFlow.Api and TaskFlow.Api.Tests.

10.0.11 is the smallest 10.0.x patch that carries the fix. It was chosen over the latest patch (10.0.13) to avoid upgrading further than needed, and later patches are left to Dependabot.

Closes #302

Assessment (AC 1-2)

• Advisory: GHSA-2m69-gcr7-jv3q (CVE-2025-6965), high. SQLite before 3.50.2 can corrupt memory when the number of aggregate terms exceeds the number of columns available. Affected: SQLitePCLRaw.lib.e_sqlite3 <= 2.1.11. GitHub lists no first patched version, but 2.1.12 and later are outside the range.
• Reachability: TaskFlow cannot easily reach this. Production code has no raw SQL and no extension loading. A grep for FromSql|ExecuteSql|SqlQuery|load_extension|EnableExtensions|fts5|CREATE VIRTUAL over TaskFlow.Api (excluding Migrations) found nothing. All SQL is EF-generated and parameterized, and the database is local and single-user.
• Fix available: yes. Microsoft.EntityFrameworkCore.Sqlite 10.0.9 and 10.0.10 still pull 2.1.11. 10.0.11 and 10.0.12 pull 2.1.12, and 10.0.13 pulls 2.1.13.

What changed

• Directory.Build.props: MicrosoftPlatformVersion 10.0.8 -> 10.0.11. This moves the whole platform group together (EF Core, Design/Tools, InMemory, Sqlite, and Microsoft.AspNetCore.OpenApi, which includes the OpenAPI source generator).
• Nothing under TaskFlow.Web, no compose files, Dockerfiles, workflows or Trivy config. No new direct package reference, so no extra comment is needed.

Verification

Gate	Result
dotnet build -c Release (incl. --no-incremental)	0 warnings, 0 errors, no NU1903
dotnet list TaskFlow.sln package --vulnerable --include-transitive	clean for both projects
Resolved SQLitePCLRaw.* (lib, bundle, core, provider)	2.1.12 in both projects
dotnet test --solution TaskFlow.sln	417 / 417 passed (includes real :memory: SQLite and the SqliteException 19 / 2067 checks)
dotnet format TaskFlow.sln --verify-no-changes	passes
Backend coverage	91.6% (threshold 75%)
Package group consistency	all platform packages resolve at 10.0.11, no mixed versions or downgrade warnings
Microsoft.OpenApi pin (#279)	Microsoft.AspNetCore.OpenApi 10.0.11 requires [2.7.5, 3.0.0); the 2.7.5 pin satisfies it exactly

Not verified locally (please confirm in CI)

• The TaskFlow.Api/Dockerfile restore. It failed locally with NU1301 (PartialChain) because of corporate TLS interception on the dev machine, unrelated to this change. Directory.Build.props is already copied in that file, and the Dockerfile.local restore passed.
• Trivy was not run locally. The latest security-scan run on main succeeded and did not flag this advisory, so no Trivy config was changed.
• There was no container smoke test of the new native e_sqlite3 2.1.12. The SQLite-backed tests passed on it.

Residual validator findings (Minor, informational, no action)

• A comment in TaskFlow.Api.csproj mentions Tools 10.0.8; it describes a past defect and is still accurate. The Tools and Design packages both resolve at 10.0.11.
• Microsoft.OpenApi 2.7.5 is now also the lower bound required by Microsoft.AspNetCore.OpenApi 10.0.11. The existing pin and the Dependabot major-version ignore stay valid.
• A stray local worktree copy of Directory.Build.props under .claude/worktrees still says 10.0.8. It is not part of the branch.