Add .NET 10 support and security dependency floors for v0

[plskbc]

v0: additive .NET 10 support + security dependency floors (0.86)

Why

Applications stuck on the v0 line (v1 is a breaking rewrite) are now moving to .NET 10. The published 0.85.5 packages run on net10 via their netcoreapp3.1/netstandard2.0 assets, but two things block real-world upgrades:

1. EventFlow.Sql pins the ecosystem to dbup-core 5.x. DbUpUpgradeLog implements the dbup-core 5.x IUpgradeLog; dbup-core 6.x reshaped that interface, so any application that needs DbUp 6.x anywhere else in its dependency graph gets a TypeLoadException. No consumer-side override can fix this — it is a code-level pin.
2. EventFlow.AspNetCore drags the legacy ASP.NET Core 2.2/3.1 package tree into modern apps (restore warnings, security-audit noise), and several netstandard2.0 dependency graphs carry known-vulnerable transitives.

What (design rule: strictly additive — no existing consumer changes)

Every pre-existing TFM keeps its dependency group byte-identical to 0.85.5 (verified by diffing packed nuspecs of all 16 packages against the published 0.85.5 nupkgs), with the sole exception of the explicitly listed security floors below. A new net10.0 TFM is added to five packages; only apps targeting net10.0+ that opt into 0.86 pick up the new assets.

net10.0 TFM added (EventFlow, EventFlow.Sql, EventFlow.MsSql, EventFlow.AspNetCore, EventFlow.DependencyInjection)

• EventFlow.Sql (net10.0): dbup-core 6.1.1, with DbUpUpgradeLog implementing the 6.x IUpgradeLog behind #if NET8_0_OR_GREATER (the old shape is preserved verbatim for all other TFMs)
• EventFlow.MsSql (net10.0): dbup-sqlserver 7.2.0, Microsoft.Data.SqlClient 6.1.4
• EventFlow.AspNetCore (net10.0): FrameworkReference Microsoft.AspNetCore.App + Microsoft.AspNetCore.Mvc.NewtonsoftJson 10.0.0 — no legacy 2.2/3.1 packages in the net10 graph (same pattern the v1 branch uses)
• EventFlow.DependencyInjection (net10.0): Microsoft.Extensions.DependencyInjection 10.0.0
• Newtonsoft.Json stays 13.0.3 on every TFM — event/snapshot serialization is treated as a durable contract
• Small #if fixes so the net10 build compiles the modern branches: (NETCOREAPP3_0 || NETCOREAPP3_1) → NETCOREAPP3_0_OR_GREATER (netcoreapp3.x output unchanged), NETSTANDARD2_0_OR_GREATER → … || NET5_0_OR_GREATER in EventFlow.MsSql (netstandard symbols are not defined on net TFMs), Assembly.CodeBase → Assembly.Location on net5+ (SYSLIB0012)
• Build infra: global.json (SDK 10.0.100, rollForward latestFeature — mirrors v1), NuGetAudit=false + RestoreEnablePackagePruning=false in Source/Common.props (pruning would silently drop framework packages like Microsoft.CSharp from the existing netcoreapp3.x nuspec groups), workflows bumped to 0.86.* and given a pinned Bake install step; develop-v0's release-v0.yml synced with the fix that currently lives only on release-v0 (expect a trivial version-line conflict on the release merge)

Security floors (modern graphs only; net452/netstandard1.6 graphs intentionally untouched)

Package	Change	Advisory
EventFlow.PostgreSql	+ System.Text.Encodings.Web 4.7.2	GHSA-ghhp-997w-qr28 (Critical, via Npgsql → System.Text.Json)
EventFlow.MongoDB	+ Snappier 1.3.1	GHSA-pggp-6c3x-2xmx (High, via MongoDB.Driver)
EventFlow.Hangfire	Hangfire.Core 1.6.20 → 1.7.37 (netstandard2.0 only; net452/ns1.6 keep 1.6.20)	GHSA-xcvr-qv8h-m7xw (High, via the 1.6 netstandard chain)
EventFlow.EventStores.EventStore	+ System.Text.RegularExpressions 4.3.1	GHSA-cmhx-cq75-c4mj (High, via EventStore.Client → protobuf-net)
EventFlow.SQLite / EventFlow.MsSql (ns2.0)	+ System.Text.RegularExpressions 4.3.1	GHSA-cmhx-cq75-c4mj (via dbup-sqlserver 5.0.40 chain)
EventFlow.MsSql (ns2.0) / EventFlow.TestHelpers	Microsoft.Data.SqlClient → 5.2.2	Azure.Identity / IdentityModel advisories (5.2.2 floors Azure.Identity 1.11.4); MDS 6.x was NOT used because it drops netstandard2.0 entirely

Breaking (flagged in RELEASE_NOTES): consumers of EventFlow.Hangfire using Hangfire 1.6.x storage packages (e.g. Hangfire.SqlServer) must move them to 1.7.x together — 1.6.x storage packages pin Hangfire.Core exactly and fail restore with NU1107 otherwise. Hangfire 1.6→1.7 is forward-compatible for stored jobs per the official upgrade guide, and EventFlow.Hangfire uses none of the 1.7-changed APIs.

Known residual: SharpCompress (GHSA-6c8g-7p36-r338, transitive of MongoDB.Driver) has no patched release yet; EventFlow never calls the affected archive-extraction path. Noted in RELEASE_NOTES to revisit when a fix ships.

Verification done

• Full solution builds on SDK 10 (all TFMs including net452/netstandard1.6/net472)
• Nuspec dependency groups of all 16 packages diffed against the published 0.85.5 nupkgs: pre-existing groups identical except the floors listed above; the 5 net10-enabled packages gain exactly one new net10.0 group each
• Public API of the rebuilt legacy assets compared member-by-member against the published 0.85.5 binaries (EventFlow netcoreapp3.1, EventFlow.Sql netstandard2.0): identical
• Test suites green on both the old and new TFMs (test projects multi-target netcoreapp3.1;net10.0 with the old TFM keeping its existing test-infra versions). Two new tests added: a DbUpUpgradeLog unit test covering both IUpgradeLog shapes, and an MsSqlDatabaseMigrator integration test exercising the DbUp UpgradeEngine/LogTo path end-to-end on both dbup major versions (that path previously had no direct coverage).

Test runs (local, SDK 10.0.102; ~1,360 executions, 0 failures)

Integration services: SQL Server (LocalDB), Postgres 10, RabbitMQ 3, EventStore 4.1.3, Elasticsearch 6.8.3 (docker), MongoDB via Mongo2Go. netcoreapp3.1 legs ran via runtime roll-forward (no 3.1 runtime on the dev machine) — worth re-confirming on the v0 runner's real 3.1 runtime.

Suite	netcoreapp3.1	net10.0	Notes
EventFlow.Tests	466 ✅ (1 skip, pre-existing)	466 ✅ (1 skip)	includes serialization literal-output tests
EventFlow.Sql.Tests	8 ✅	11 ✅	incl. new DbUpUpgradeLogTests (5.x shape / 6.x shape)
EventFlow.MsSql.Tests (integration, live SQL Server)	60 ✅	60 ✅	net10.0 leg = dbup-core 6.1.1 + SqlClient 6.1.4 live migration incl. new migrator test; nc3.1 leg = unchanged dbup 5.x path
EventFlow.AspNetCore.Tests (TestServer)	7 ✅	7 ✅	net10.0 leg exercises the NewtonsoftJson MVC options wiring on the new TFM
EventFlow.DependencyInjection.Tests	29 ✅	29 ✅
EventFlow.PostgreSql.Tests (live Postgres)	52 ✅	n/a	validates the Encodings.Web 4.7.2 floor in the live graph
EventFlow.Hangfire.Tests (live SQL Server)	4 ✅	n/a	Hangfire.Core + Hangfire.SqlServer 1.7.37 at runtime
EventFlow.MongoDB.Tests (Mongo2Go)	50 ✅	n/a	driver runtime with Snappier 1.3.1 in graph
EventFlow.SQLite.Tests	37 ✅	n/a
EventFlow.EventStores.EventStore.Tests (live EventStore)	17 ✅	n/a
EventFlow.RabbitMQ.Tests (live RabbitMQ)	4 ✅	n/a
EventFlow.Elasticsearch.Tests (live ES 6.8.3)	21 ✅	n/a
EventFlow.Autofac.Tests	27 ✅	n/a
EventFlow.Owin.Tests	3 ✅ (net472)	n/a
EventFlow.Examples.Shipping.Tests	5 ✅	n/a
EventFlow.EntityFramework.Tests	not runnable locally	n/a	EF Core 3.1 internals break under runtime roll-forward (known EF 3.1 issue, unrelated to this change); project untouched — needs the runner's real 3.1 runtime
EventFlow.CodeStyle.Tests	pre-existing orphan		not part of EventFlow.sln, missing its analyzer ProjectReference since before this PR — untouched

• dotnet list package --vulnerable --include-transitive: every netstandard2.0/net462/net472/net10.0 graph of every shipped package is clean (except the documented SharpCompress residual)

Notes for maintainers

• The self-hosted v0 runner needs the .NET 10 SDK (plus the existing netcoreapp3.1 runtime and Framework targeting packs); the workflows now install Bake pinned (0.37.51, the version the v1 pipeline uses)
• First 0.86 release number will follow github.run_number (so not exactly 0.86.0)
• Happy to split the security floors into a separate PR if you prefer the net10 change isolated

[CLAassistant]

All committers have signed the CLA.