[iammukeshm]

This is the backend and infrastructure half of #1453. The React apps (clients/**) are left alone; a separate PR will handle them.

What changed

Area	From	To
ASP.NET Core / EF Core / Microsoft.Extensions.*, Cryptography.Xml/Pkcs pins	10.0.13	10.0.14
Caching.Hybrid, Http.Resilience	10.10.0	10.11.0
Aspire hosting packages + AppHost SDK	13.5.4	13.6.4
Finbuckle.MultiTenant.*	10.1.0	10.1.6
FluentValidation	12.1.1	12.2.0
OpenTelemetry (stable)	1.19.x	1.20.1
OTel EF Core / StackExchange.Redis instrumentation (beta-only)	1.19.x-beta.1	1.20.1-beta.1
StackExchange.Redis	3.3.1	3.4.31
Scalar.AspNetCore	2.17.10	2.18.7
MailKit / MimeKit	4.18.0 / 4.18.1	4.18.2
AWSSDK.S3	4.0.103.4	4.0.104.8
QuestPDF	2026.9.0	2026.9.1
Spectre.Console.Cli	0.55.0	0.57.2
Microsoft.OpenApi (stays on 2.x)	2.12.2	2.13.0
MessagePack (security pin)	2.5.305	2.5.307
SonarAnalyzer, SourceLink, Test SDK, coverlet, xunit.runner.visualstudio, Testcontainers		10.35.0.4138, 10.0.403, 18.11.0, 10.1.0, 4.0.1, 4.16.0
global.json SDK floor (still latestFeature)	10.0.100	10.0.400
Postgres (Testcontainers, CI migrator smoke)	17-alpine	18-alpine
Valkey / RustFS / Mailpit / aws-cli	9.1.0 / 1.0.0 / v1.31.3 / 2.37.3	9.1.3 / 1.0.4 / v1.33.0 / 2.39.3
RedisInsight (AppHost)	latest	3.8.0
Actions: codeql-action, setup-node, setup-dotnet, checkout, cache, paths-filter	v3, v4, v5, v6, v5, v3	v4, v7, v6, v7, v6, v4
Terraform AWS / random providers	~> 6.46 / ~> 3.6	~> 6.71 / ~> 3.9

Code changes the upgrades forced

• Spectre.Console.Cli 0.57 made AsyncCommand.ExecuteAsync public, so the four fsh commands now override it as public.
• Aspire.Hosting.JavaScript 13.6.4 needs MessagePack >= 2.5.307, so the transitive security pin moved up (still 2.x, which is what the SignalR backplane uses).
• AWS provider 6.71 deprecates data.aws_region.*.id, so the network module now uses .region. Both lock files were regenerated for linux/windows/darwin.

Decisions and exceptions

• CodeQL. The weekly run had failed since 2026-10-19 because its Release build hit NuGet audit errors (new Cryptography.Pkcs/Xml and SignalR.Common advisories) under TreatWarningsAsErrors. fix(deps): bump the .NET 10 patch line to 10.0.13 and pin Cryptography.Pkcs #1447 fixed the packages, but the next advisory would break the scan again. The CodeQL build now passes -p:NuGetAudit=false; Backend CI still gates advisories on every PR. The workflow also runs on pushes to main now, which CodeQL needs to populate alerts for the default branch.
• Postgres 18 everywhere. Docker Compose was already on 18, and Aspire 13.6.4 still defaults to postgres:18.3, so no volume wipe is needed coming from 13.5. Testcontainers and the CI service are ephemeral.
• Terraform core floor stays at 1.15.4. 1.17.1 is out, but I could only validate with a 1.15.4 CLI. .terraform-version said 1.14.0, below the floor, so it now says 1.15.4.
• xUnit v3 is deferred to Move the test projects from xUnit v2 to xUnit v3 #1457. The integration factories implement v2's IAsyncLifetime alongside WebApplicationFactory's ValueTask DisposeAsync, and the v3 analyzers (xUnit1051) would flag most of the suite under warnings-as-errors. That isn't a mechanical swap.
• Node versions in the workflows and the client Dockerfiles are untouched; they belong to the frontend half.

Verification

• dotnet build src/FSH.Starter.slnx --no-incremental: 0 warnings, 0 errors.
• dotnet list package --outdated: empty. With --include-prerelease it lists only .NET 11 RCs and other previews.
• dotnet list package --vulnerable --include-transitive: no vulnerable packages in any of the 51 projects.
• dotnet test src/FSH.Starter.slnx, full suite including Testcontainers:
  • Before, on main at the branch point: 2146/2146 across 15 assemblies.
  • After the upgrade: 2146/2146.
  • After merging the latest main (the i18n series and Tickets.Tests): 2222/2222 across 16 assemblies. No tests were added or removed by this PR.
• Template smoke, the create new project build error #1451 check: I packed and installed the template from the repo, then scaffolded both --aspire true --frontend true and --aspire false --frontend false. Both build with -warnaserror with 0 warnings and 0 errors, and Architecture.Tests on the scaffolded project passes 55/55.
• AppHost: it ran on Aspire 13.6.4 with postgres:18.3, valkey 9.1.3, rustfs 1.0.4 and aws-cli 2.39.3 (the init job exited 0). /health/ready reported Healthy on all 14 checks, including db:tenants-migrations, and /scalar loaded. I didn't sign in through the React apps; that belongs to the frontend PR.
• terraform validate is clean (no deprecation warnings) for app_stack and bootstrap, and terraform fmt -check passes.

Docs: fullstackhero/docs#279

Part of #1453