build: pin the .NET SDK and add Dependabot

.github/dependabot.yml

@@ -0,0 +1,36 @@
+version: 2
+
+updates:
+  # global.json pins the SDK exactly, so security patches to the runtime bundled in the executable
+  # arrive only through this update. Each update also changes the implicit ILLink.Tasks reference:
+  # run `dotnet restore DaxLib.Mcp.slnx --force-evaluate` on the branch and commit the lock files.
+  - package-ecosystem: "dotnet-sdk"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    ignore:
+      # The project targets .NET 10 (LTS); a new major SDK is a deliberate migration.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "build"
+      include: "scope"
+
+  - package-ecosystem: "nuget"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      nuget:
+        patterns: ["*"]
+    commit-message:
+      prefix: "build"
+      include: "scope"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "ci"
+      include: "scope"

AGENTS.md

@@ -30,6 +30,14 @@ project can also be run directly with:
 dotnet run --project tests/DaxLib.Mcp.Core.Tests
 ```
 
+## .NET SDK and lock files
+
+`global.json` pins the SDK to an exact version (`"rollForward": "disable"`), and CI restores in
+locked mode. The SDK adds an implicit `Microsoft.NET.ILLink.Tasks` reference whose version follows
+the runtime bundled with the SDK, so every SDK update changes `packages.lock.json`. Update the SDK
+on purpose: change `global.json`, run `dotnet restore DaxLib.Mcp.slnx --force-evaluate` with that
+SDK, and commit both together.
+
 ## Release process
 
 Releases are launched manually with the `release.yml` workflow (`workflow_dispatch`), only from

global.json

@@ -1,8 +1,8 @@
 {
   "sdk": {
-    "version": "10.0.300",
+    "version": "10.0.401",
     "allowPrerelease": false,
-    "rollForward": "latestFeature"
+    "rollForward": "disable"
   },
   "test": {
     "runner": "Microsoft.Testing.Platform"

src/DaxLib.Mcp/packages.lock.json

@@ -47,9 +47,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[10.0.11, )",
-        "resolved": "10.0.11",
-        "contentHash": "IBf7lbovvjGWVWXZX5cJ/cO0WXbId0Zq4BuSeT94mGZuOAP66oMeH9PTBZ9Jpp3Jb6jtK0qm/NyUbPRo1gC/wQ=="
+        "requested": "[10.0.12, )",
+        "resolved": "10.0.12",
+        "contentHash": "xi+BDjFpW+Sb+MHFHaH6Y/gV9I8BluFwRXc1QyCdoZbIK26eNiBeFuMTe/FMwc33G1wdHCyDg7CVTmb8OdQrMQ=="
       },
       "Nerdbank.GitVersioning": {
         "type": "Direct",