deps: align ASP.NET Core, EF Core and Test SDK versions

[Cat5Dog2]

Rolls the six open Dependabot PRs (#124, #125, #126, #128, #129, #130) into a single change, and closes the version gaps those PRs would have left behind.

Background

1. Updates that were never opened as PRs

The nuget ecosystem runs with open-pull-requests-limit: 5, and the five open PRs consumed every slot. These packages had 10.0.10 available with no PR to bring it in:

• Microsoft.EntityFrameworkCore.SqlServer
• Microsoft.AspNetCore.Mvc.Testing
• Microsoft.EntityFrameworkCore.InMemory
• Microsoft.EntityFrameworkCore.Sqlite

Merging #128 on its own would therefore have left Design/Tools on 10.0.10 against SqlServer 10.0.9.

To be precise: Dependabot defers these to a later run once slots free up rather than dropping them permanently. The problem is that the deferral is silent — nothing reports that an update is waiting.

2. Test SDK drift between the two test projects

Web.Tests was on 18.6.0 while E2ETests was on 18.7.0. #123 would have closed that gap, but it was resolved as "Superseded by #129" — and #129 only touches E2ETests.

3. Nothing was watching dotnet-ef

The tool manifest still pinned dotnet-ef to 10.0.9, drifting away from EF Core itself.

Dependabot does support dotnet-tools.json — discovery landed in dependabot-core#8889 and update analysis in dependabot-core#10269. The actual cause is that the current scan directories are only /src/** and /tests/**, which do not cover the repository root where the manifest lives. Widening the scan is handled in #135.

Changes

Target	Change
Web	Six ASP.NET Core / EF Core packages 10.0.9 → 10.0.10
Web.Tests	Mvc.Testing / InMemory / Sqlite → 10.0.10, Test SDK 18.6.0 → 18.8.1
E2ETests	Mvc.Testing / InMemory → 10.0.10, Test SDK 18.7.0 → 18.8.1
dotnet-tools.json	dotnet-ef 10.0.9 → 10.0.10
Workflows (5 files)	actions/setup-dotnet@v5 → @v6

Every edit is a version string and nothing else. dotnet add package wants to attach PrivateAssets metadata to EFCore.Design and Tools; that was deliberately reverted, since it is a behavioral change unrelated to this PR's purpose.

Verification

Run locally, matching what CI does:

• scripts/build.ps1 — 0 warnings, 0 errors
• scripts/test.ps1 — 240 passed, 0 failed
• scripts/test-e2e.ps1 -InstallBrowsers — 8 passed, 0 failed
• scripts/format.ps1 — OK

After merging

• Close the superseded Dependabot PRs (deps: Bump Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore from 10.0.9 to 10.0.10 #124, deps: Bump Microsoft.AspNetCore.Identity.EntityFrameworkCore from 10.0.9 to 10.0.10 #125, deps: Bump Microsoft.AspNetCore.Identity.UI from 10.0.9 to 10.0.10 #126, deps: Bump Microsoft.EntityFrameworkCore.Design and Microsoft.EntityFrameworkCore.Tools #128, deps: Bump Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1 #129, deps(deps): bump actions/setup-dotnet from 5 to 6 #130). Some may close themselves once this lands; only the leftovers need @dependabot close.
• Watch the CD run. Pushing to main triggers a production deploy, and setup-dotnet@v6 has only been exercised by ci.yml so far — the deployment workflows run it for the first time here.
• full-regression is a strict required check, so build: prevent version drift with CPM and Dependabot grouping #135 needs to be re-based onto the updated main and re-run afterwards.

Out of scope

dotnet list package --outdated reports three more updates. They differ in kind and are left for separate PRs:

• SixLabors.ImageSharp 3.1.12 → 4.0.0 — major version. Image handling falls under the human-review-required areas in AGENTS.md §3.
• Azure.Monitor.OpenTelemetry.AspNetCore 1.5.0 → 1.6.0 — minor version.
• SQLitePCLRaw.bundle_e_sqlite3 3.0.3 → 3.0.5 — native dependency, with the history from fix: remediate vulnerable SQLite native dependency #120.

🤖 Generated with Claude Code