Background
Dockerfile currently pins:
FROM mcr.microsoft.com/dotnet/runtime-deps:11.0-preview-resolute-chiseled-extra
This was set in #406 as part of the net10.0 -> net11.0 upgrade. The -preview tag is the actively-patched channel while .NET 11 is pre-release (the SDK in global.json is currently 11.0.100-rc.1.26425.128).
The same situation previously caused a real problem: the Dockerfile was left pinned to 10.0-preview-noble-chiseled-extra after .NET 10 went GA. Once a release goes GA, Microsoft stops publishing security patches to the -preview channel tag, but continues patching the GA channel tag (bare X.0, e.g. 10.0-noble-chiseled-extra). That staleness is what caused PR #406's CI to fail Trivy's vulnerability scan (CVE-2026-45447, HIGH, OpenSSL heap use-after-free in libssl3t64) even though nothing in the app itself had changed.
Task
Once .NET 11 reaches GA, update Dockerfile to drop -preview from the tag:
FROM mcr.microsoft.com/dotnet/runtime-deps:11.0-resolute-chiseled-extra
(Confirm the exact GA tag name via https://mcr.microsoft.com/v2/dotnet/runtime-deps/tags/list at the time, in case the Ubuntu codename or tag naming changes.)
Also worth checking at that point whether global.json's SDK version needs bumping off the -rc.1 prerelease to a GA SDK version.
Background
Dockerfilecurrently pins:This was set in #406 as part of the net10.0 -> net11.0 upgrade. The
-previewtag is the actively-patched channel while .NET 11 is pre-release (the SDK inglobal.jsonis currently11.0.100-rc.1.26425.128).The same situation previously caused a real problem: the Dockerfile was left pinned to
10.0-preview-noble-chiseled-extraafter .NET 10 went GA. Once a release goes GA, Microsoft stops publishing security patches to the-previewchannel tag, but continues patching the GA channel tag (bareX.0, e.g.10.0-noble-chiseled-extra). That staleness is what caused PR #406's CI to fail Trivy's vulnerability scan (CVE-2026-45447, HIGH, OpenSSL heap use-after-free inlibssl3t64) even though nothing in the app itself had changed.Task
Once .NET 11 reaches GA, update
Dockerfileto drop-previewfrom the tag:(Confirm the exact GA tag name via
https://mcr.microsoft.com/v2/dotnet/runtime-deps/tags/listat the time, in case the Ubuntu codename or tag naming changes.)Also worth checking at that point whether
global.json's SDK version needs bumping off the-rc.1prerelease to a GA SDK version.