chore(deps): bump Microsoft.AspNetCore.Server.Kestrel.Core to 2.3.6

[jpnurmi]

See Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability.

D:\a\sentry-dotnet\sentry-dotnet\test\Sentry.AspNetCore.TestUtils\Sentry.AspNetCore.TestUtils.csproj : error NU1904: Warning As Error: Package 'Microsoft.AspNetCore.Server.Kestrel.Core' 2.1.25 has a known critical severity vulnerability, https://github.com/advisories/GHSA-5rrx-jjjq-q2r5 [D:\a\sentry-dotnet\sentry-dotnet\Sentry-CI-Build-Windows.slnf]

https://github.com/getsentry/sentry-dotnet/actions/runs/18529128444/job/52807115247

#skip-changelog (only used in tests)

[cursor]

Bug: Kestrel Update Causes Compatibility Issues

Updating Microsoft.AspNetCore.Server.Kestrel.Core to 2.3.6 for net48 creates a version mismatch with other 2.1.* ASP.NET Core packages in the same ItemGroup. This goes against the documented policy for .NET Framework compatibility and could cause runtime issues.

 

[jpnurmi]

According to the comment above, we deliberately chose to test with 2.1:

sentry-dotnet/test/Sentry.AspNetCore.TestUtils/Sentry.AspNetCore.TestUtils.csproj

Lines 18 to 31 in fd73ec4

	<!--
	ASP.NET Core on .NET Framework is supported by Microsoft indefinitely on version 2.1 only.
	Indeed, version 2.1 has newer nuget packages than version 2.2 (which is out of support).
	Thus, we will test on 2.1.*, not 2.*.
	See https://dotnet.microsoft.com/platform/support/policy/aspnet
	And https://github.com/dotnet/aspnetcore/issues/3753#issuecomment-438046364
	Also, JetBrains Rider (via Checkmarx) may report the following security vulnerabilities:
	CVE-2019-0815
	CVE-2020-1045
	CVE-2020-1597
	These are safe to ignore for our tests. A real project would resolve them by installing
	an updated version of the ASP.NET Core runtime on their hosting server.
	See https://github.com/dotnet/aspnetcore/issues/15423
	-->

However, all Microsoft.AspNetCore.Server.Kestrel.Core versions <= 2.3.0 are affected by CVE-2025-55315. The vulnerability has only been patched in version 2.3.6. The latest version in the 2.1.x series is the previously pinned version 2.1.25 from 2021.

Either we need to accept the mismatch or bump the others too...?

[Flash0ver]

If the tests complete successfully, I prefer just bumping the vulnerable versions, and keeping everything else as "2.1.*"-y as possible.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.51%. Comparing base (04c932b) to head (fd73ec4).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4639   +/-   ##
=======================================
  Coverage   73.51%   73.51%           
=======================================
  Files         483      483           
  Lines       17692    17692           
  Branches     3492     3492           
=======================================
  Hits        13007    13007           
  Misses       3796     3796           
  Partials      889      889           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.