[SIkebe]

Summary

• Adopt the October 25 .NET 11 RC 3 out-of-band security release. Pin SDK 11.0.100-rc.3.26522.148 and align ASP.NET Core, EF Core, Microsoft.Extensions, and local dotnet-ef tooling with 11.0.0-rc.3.26522.148. Update third-party notices and source-build documentation.
• Keep Microsoft.AspNetCore.Components.WebView.Wpf at 11.0.0-rc.2.26505.5, the latest .NET 11 prerelease listed by the official NuGet Gallery. Its dependency range accepts the RC 3 WebView package; the resolved graph, build, and automated WebView E2E suite were verified. No workflow or migration changes are required.
• Keep GitHub.Copilot.SDK at 1.0.26 and its bundled native runtime at 1.0.103. This PR targets .NET, not an independent Copilot runtime update.

Official evidence and applicability

Evidence / change	Decision
.NET release metadata and RC 3 release notes	Confirm the shipped SDK/runtime and framework package versions used here.
October OOB security update: Brotli and SocketAsyncEventArgs fixes	Adopt through the runtime update. The app uses HTTP and TCP preview servers. No direct Brotli API use or automatic-decompression configuration was found; this is not a claim of a demonstrated exploitable Brotli path.
Blazor WebAssembly debugger fix	No additional packages needed: WPF/BlazorWebView does not use WebAssembly Server or DevServer packages.
Linux source-build tarball ownership fix	Not applicable to this Windows app.
Component release-note index	SDK, ASP.NET Core, EF Core, WPF, libraries, runtime, C#, MSBuild, and NuGet area notes are published through RC 2; the corresponding RC 3 paths returned 404. The RC 3 note documents security fixes, not new feature APIs. Existing C# 15 and runtime-async settings remain unchanged.
WPF BlazorWebView package	Preserve the independently versioned WPF bridge rather than invent a matching RC 3 version.

Runtime fixes require no application source changes. Existing self-contained installers must be rebuilt and republished; installing a newer host SDK/runtime does not update their bundled runtime. This PR does not publish a release or claim installed-package smoke coverage.

Related Issues

N/A - no issue to close.

Scope

• App UI / workflow
• Core services / data model
• Copilot SDK / agent behavior
• Preview / WebView2
• Documentation / release readiness
• Tests / tooling
• Other: .NET SDK and framework dependency upgrade

Validation

• dotnet build RepoSyncRadar.sln -warnaserror - passed, zero warnings/errors.
• dotnet test RepoSyncRadar.sln -- --filter-not-trait Category=Manual - executed as dotnet test RepoSyncRadar.sln --timeout 10m -- --filter-not-trait Category=Manual; failed, 1,579 passed and 2 failed. App.Tests: 827 passed; App.E2E.Tests: 27 passed; Integrations.Tests: 55 passed; Core.Tests: 670 passed and 2 failed.
• Focused tests: dotnet test tests/RepoSyncRadar.Core.Tests/RepoSyncRadar.Core.Tests.csproj -- --filter-class RepoSyncRadar.Core.Tests.Services.Preview.TcpPreviewPortAllocatorTests - failed, 2 passed and 2 failed. Both failures assert that listening ports must be skipped. A runtime-only comparison with the same compiled tests on the installed RC 2 runtime, roll-forward disabled, reproduced both failures. The temporary ignored runtimeconfig change was restored. Allocator code is unchanged and is not modified here.
• N/A - no UI/WebView behavior changes; automated WebView E2E tests passed. Installed-package manual smoke and screenshots were not performed.
• dotnet restore RepoSyncRadar.sln - passed.
• dotnet tool restore - passed.
• dotnet ef migrations list --project src\RepoSyncRadar.Core\RepoSyncRadar.Core.csproj --startup-project src\RepoSyncRadar.Core\RepoSyncRadar.Core.csproj --context RadarDbContext --no-build - passed; listed five existing migrations as pending against the local design-time database.
• dotnet ef migrations has-pending-model-changes --project src\RepoSyncRadar.Core\RepoSyncRadar.Core.csproj --startup-project src\RepoSyncRadar.Core\RepoSyncRadar.Core.csproj --context RadarDbContext --no-build - passed, no model changes since the last migration.
• git diff --check - passed.

Risk And Rollback

• User impact: Rebuilt releases use RC 3 runtime security fixes, with no intended UI, auth, Copilot, or database behavior changes.
• Operational risk: Prerelease compatibility, particularly the RC 2 WPF bridge with RC 3 Blazor dependencies. Build and automated E2E coverage passed; two port-allocation test failures remain documented. Rebuilt self-contained packages still need release-time installed-package smoke validation.
• Rollback plan: Revert this commit to restore prior SDK, package, and tool pins if a compatibility regression is confirmed. This loses RC 3 security fixes; RC 2 is not a safe long-term release target.

Release Notes

• User-facing change
• Internal-only change
• No release note needed

Release note draft:

Update the .NET 11 SDK and framework dependencies to RC 3. Rebuilt installers include the out-of-band runtime security fixes; existing installed packages require a new release to receive them.

[Copilot]

🔵 Needs a closer look

Human acceptance is needed for the reported baseline test failures and remaining installed-package compatibility risk with the retained RC 2 WPF bridge.

No open issues 🎉

What changed in this PR

Updates RepoSyncRadar’s SDK and framework dependencies to .NET 11 RC 3 so rebuilt installers can receive the out-of-band runtime security fixes, without application logic changes.

Changes:

• Aligns the SDK, framework packages, and local dotnet-ef tool with RC 3.
• Retains the independently versioned RC 2 WPF bridge and unchanged Copilot SDK/runtime.
• Synchronizes dependency notices and source-build documentation.

File	Description
src/​RepoSyncRadar.App/​Settings/​ThirdPartyNotices.cs	Updates notices to match framework package versions.
README.md	Documents the RC 3 source-build prerequisite.
global.json	Pins the RC 3 SDK.
Directory.Packages.props	Updates centrally managed framework and test dependencies.
.github/​copilot-instructions.md	Synchronizes the documented SDK pin.
.config/​dotnet-tools.json	Aligns dotnet-ef with RC 3 EF Core packages.

_{Review effort: Balanced}