From fa703c3b34c62e895f209b88f07d0668803c8843 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 5 Oct 2026 15:01:09 +0000
Subject: [PATCH] chore(deps): Bump Microsoft.AspNetCore.SignalR.Client from
 10.0.5 to 10.0.12

---
updated-dependencies:
- dependency-name: Microsoft.AspNetCore.SignalR.Client
  dependency-version: 10.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Directory.Packages.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 0158ce47..04ebb523 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -117,7 +117,7 @@
          walking-skeleton harness for ADR-0022 Phase A.5 exactly-once verification).
          Reflection-based — incompatible with Native AOT, but the harness itself is
          NO-AOT per ADR-0023; deliverables (Api + Realtime images) remain AOT-clean. -->
-    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.5" />
+    <PackageVersion Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.12" />
     <!-- Transitive-pin override (CentralPackageTransitivePinningEnabled=true): SignalR's
          MessagePack protocol pulls MessagePack transitively into Realtime + Realtime.Tests.
          The version it would otherwise resolve (2.5.187) carries CVE-2026-48109 — a HIGH