chore: update dependencies and build tooling

[niemyjski]

Summary

• update the .NET SDK to the August 2026 security release (10.0.400, runtime 10.0.11) and refresh all compatible stable NuGet dependencies across core libraries, target-specific integrations, tests, and samples
• keep net8.0 and net9.0 Microsoft.Extensions references on their matching major lines while updating each to its latest supported patch
• update official GitHub Actions to checkout v7.0.1 and setup-dotnet v6.0.0, pinned to verified immutable commit SHAs
• align the pinned devcontainer with SDK 10.0.400 via the official Dev Containers .NET feature and lock its resolved image digest for reproducible builds
• add Dependabot coverage for GitHub Actions, Dev Container features, and global.json; the SDK check runs daily with the shortest supported explicit cooldown

Security and provenance

• dotnet list Exceptionless.Net.Windows.slnx package --vulnerable --include-transitive: no vulnerable packages
• dotnet list Exceptionless.Net.Windows.slnx package --deprecated --include-transitive: no deprecated packages
• osv-scanner scan source --recursive .: no issues across all 28 manifests, including the legacy MVC packages.config
• downloaded the exact newly refreshed NuGet archives from NuGet.org and verified their content hashes and available author/repository signatures
• removed the third-party gpr publishing tool, whose package embeds vulnerable Newtonsoft.Json 9.0.1 and NuGet.Packaging 5.6.0; publishing now uses the SDK's native dotnet nuget push
• explicitly restrict Linux/macOS workflow tokens to contents: read; Windows receives only contents: read and packages: write
• disable persisted checkout credentials in all workflows
• verified the latest official Action releases and their signed commits, the Microsoft devcontainer manifest, and the official Dev Containers feature manifest; the committed lockfile records the independently verified Feature digest

Validation

• exact Microsoft .NET 10.0.400 SDK archive: official SHA-512 verified
• dotnet build --configuration Release Exceptionless.Net.NonWindows.slnx: succeeded, 0 warnings
• dotnet test --configuration Release --no-build Exceptionless.Net.NonWindows.slnx: 310 passed, 18 existing skips
• Windows-shaped Release rebuild across net462, net472, net8.0, net9.0, and net10.0: succeeded, 0 warnings
• Windows-shaped package creation: succeeded
• all 7 SDK-style cross-platform samples: Release rebuild succeeded, 0 warnings
• Windows Forms and WPF samples: cross-targeted Release rebuild succeeded for modern Windows and net462, 0 warnings
• console sample: launched and exercised with synthetic local events; generated storage was removed afterward
• complete solution and per-sample compatible-version audits: no outdated dependencies
• GitHub YAML/JSON parsing, actionlint, official Dev Containers config resolution, and git diff --check: passed
• final hosted matrix at c46685f: all 6 Linux, macOS, and Windows push/PR jobs plus CLA passed
• push-triggered Windows job exercised native GitHub Packages and Feedz publication for all 12 packages; both feeds returned the expected duplicate-version results and the job passed

Sample/runtime boundary

The legacy MVC, WCF, and Web Forms samples require Visual Studio WebApplication targets and .NET Framework developer packs that are unavailable on macOS. ASP.NET Core and Blazor dev-host startup stalls were reproduced unchanged on untouched origin/main, so they are pre-existing runtime/toolchain behavior rather than regressions from this branch.

The official Dev Containers CLI resolves the edited configuration and exact feature successfully. A full local container build could not be completed because Docker Desktop stalled resolving the otherwise verified MCR manifest; hosted repository CI does not exercise the devcontainer.

Coordination

This consolidates and supersedes the package updates in #361, #362, #363, #364, and #365. Open feature PRs #367 and #368 were inspected but intentionally not absorbed because their MAUI and serializer/DI changes are not on main; #368 will have a small src/Exceptionless/Exceptionless.csproj rebase overlap.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4d2a4383cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".