diff --git a/.azurepipelines/ci.yml b/.azurepipelines/ci.yml
index ecb0544f64..0491383254 100644
--- a/.azurepipelines/ci.yml
+++ b/.azurepipelines/ci.yml
@@ -56,7 +56,7 @@ jobs:
     displayName: 'Install .NET 10.0'
     inputs:
       packageType: 'sdk'
-      version: '10.0.x'
+      version: '10.0.401'
   - task: PowerShell@2
     displayName: Versioning
     inputs:
diff --git a/.azurepipelines/coverage.yml b/.azurepipelines/coverage.yml
index 30a85fc157..5fc0813162 100644
--- a/.azurepipelines/coverage.yml
+++ b/.azurepipelines/coverage.yml
@@ -98,7 +98,7 @@ stages:
       displayName: 'Install .NET 10.0'
       inputs:
         packageType: 'sdk'
-        version: '10.0.x'
+        version: '10.0.401'
     - task: DownloadPipelineArtifact@2
       displayName: 'Download code coverage'
       inputs:
diff --git a/.azurepipelines/onefuzz.yml b/.azurepipelines/onefuzz.yml
index d2f1cf2238..4e2add0905 100644
--- a/.azurepipelines/onefuzz.yml
+++ b/.azurepipelines/onefuzz.yml
@@ -40,7 +40,7 @@ steps:
     displayName: Set up the repository .NET SDK
     inputs:
       packageType: sdk
-      version: '10.0.x'
+      version: '10.0.401'
 
   - ${{ parameters.prepareSteps }}
 
diff --git a/.azurepipelines/preview.yml b/.azurepipelines/preview.yml
index 4c3dfb91fe..8957d27244 100644
--- a/.azurepipelines/preview.yml
+++ b/.azurepipelines/preview.yml
@@ -51,7 +51,7 @@ jobs:
     displayName: 'Install .NET 10.0'
     inputs:
       packageType: 'sdk'
-      version: '10.0.x'
+      version: '10.0.401'
       includePreviewVersions: false
   - task: DownloadSecureFile@1
     name: strongnamefile
diff --git a/.azurepipelines/sample-ha-longhaul.yml b/.azurepipelines/sample-ha-longhaul.yml
index e0b9c944a3..5382d10df9 100644
--- a/.azurepipelines/sample-ha-longhaul.yml
+++ b/.azurepipelines/sample-ha-longhaul.yml
@@ -40,7 +40,7 @@ steps:
   displayName: 'Install .NET 10 SDK'
   inputs:
     packageType: sdk
-    version: '10.0.x'
+    version: '10.0.401'
 
 - pwsh: ./.azurepipelines/set-version.ps1
   displayName: 'Set Cloud Version'
diff --git a/.azurepipelines/sln.yml b/.azurepipelines/sln.yml
index 57941a398a..e6bfb3d92b 100644
--- a/.azurepipelines/sln.yml
+++ b/.azurepipelines/sln.yml
@@ -77,7 +77,7 @@ jobs:
     displayName: 'Install .NET 10.0'
     inputs:
       packageType: 'sdk'
-      version: '10.0.x'
+      version: '10.0.401'
   - task: NuGetToolInstaller@1
     inputs:
       versionSpec: '>=7.0.x'
diff --git a/.azurepipelines/test-aot.yml b/.azurepipelines/test-aot.yml
index d6fa1e7606..141fde755f 100644
--- a/.azurepipelines/test-aot.yml
+++ b/.azurepipelines/test-aot.yml
@@ -69,7 +69,7 @@ jobs:
     displayName: 'Install .NET 10.0'
     inputs:
       packageType: 'sdk'
-      version: '10.0.x'
+      version: '10.0.401'
   - task: NuGetToolInstaller@1
     inputs:
       versionSpec: '>=7.0.x'
diff --git a/.azurepipelines/test.yml b/.azurepipelines/test.yml
index 91008b5e95..0aa4123462 100644
--- a/.azurepipelines/test.yml
+++ b/.azurepipelines/test.yml
@@ -163,7 +163,7 @@ jobs:
     displayName: 'Install .NET 10.0'
     inputs:
       packageType: 'sdk'
-      version: '10.0.x'
+      version: '10.0.401'
   - task: NuGetToolInstaller@1
     inputs:
       versionSpec: '>=7.0.x'
diff --git a/.github/workflows/buildandtest.yml b/.github/workflows/buildandtest.yml
index 03ad6b5890..a38838238a 100644
--- a/.github/workflows/buildandtest.yml
+++ b/.github/workflows/buildandtest.yml
@@ -167,8 +167,7 @@ jobs:
         if ($includeMac -and $relevantChanges) {
             $testOs += 'macOS-latest'
             $aotMatrix += @{ os = 'macos-15-intel'; rid = 'osx-x64'  }
-            # ARM64 NativeAOT hits Apple's "too many large addends" linker assertion.
-            # Re-enable macos-latest/osx-arm64 once dotnet/runtime#132171 ships; see #4443.
+            $aotMatrix += @{ os = 'macos-latest'; rid = 'osx-arm64' }
         }
         Write-Host "Event=$($env:EVENT_NAME); include_macos=$includeMac"
         Write-Host "test_os=$($testOs -join ', ')"
@@ -203,7 +202,7 @@ jobs:
         csproj: ${{ fromJSON(needs.discover.outputs.csprojs) }}
         include:
           - framework: 'net10.0'
-            dotnet-version: '10.0.x'
+            dotnet-version: '10.0.401'
             configuration: 'Release'
             customtesttarget: net10.0
 
@@ -449,7 +448,7 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v6
       with:
-        dotnet-version: '10.0.x'
+        dotnet-version: '10.0.401'
 
     - name: Download test results
       uses: actions/download-artifact@v8
@@ -611,7 +610,7 @@ jobs:
       # binary is published and run on every AOT platform.
       AOTPROJECT_HISTORIAN: './tests/Opc.Ua.Aot.Tests.Historian/Opc.Ua.Aot.Tests.Historian.csproj'
       AOTPROJECT_MCP: './tests/Opc.Ua.Aot.Tests.Mcp/Opc.Ua.Aot.Tests.Mcp.csproj'
-      DOTNET_VERSION: '10.0.x'
+      DOTNET_VERSION: '10.0.401'
       CONFIGURATION: 'Release'
 
     steps:
@@ -694,7 +693,7 @@ jobs:
         dotnet-version: |
           8.0.x
           9.0.x
-          10.0.x
+          10.0.401
 
     - name: Set Cloud Version
       shell: pwsh
@@ -741,7 +740,7 @@ jobs:
         dotnet-version: |
           8.0.x
           9.0.x
-          10.0.x
+          10.0.401
 
     - name: Set Cloud Version
       shell: pwsh
@@ -783,7 +782,7 @@ jobs:
         fetch-depth: 0
     - uses: actions/setup-dotnet@v6
       with:
-        dotnet-version: 10.0.x
+        dotnet-version: 10.0.401
     - name: Validate manifest and negative controls
       shell: pwsh
       run: ./fuzzing/Scripts/validate-fuzz-manifest.ps1 -SelfTest
@@ -839,7 +838,7 @@ jobs:
         dotnet-version: |
           8.0.x
           9.0.x
-          10.0.x
+          10.0.401
     - name: Run fuzz regressions
       shell: pwsh
       run: ./fuzzing/Scripts/test-fuzzing.ps1 -Framework '${{ matrix.framework }}' -ResultsDirectory '${{ runner.temp }}/fuzz-results'
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 5f26cf3916..61ff6eeefc 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -53,7 +53,7 @@ jobs:
     - name: Set up .NET
       uses: actions/setup-dotnet@v6
       with:
-        dotnet-version: '10.x'
+        dotnet-version: '10.0.401'
     # https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#c-compiler-flags-injected-by-codeql-for-manual-builds
     #
     # CustomTestTarget pins the build to a single target framework (see
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index fd225b7818..444ab7c310 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -63,10 +63,10 @@ jobs:
       with:
         fetch-depth: 0
 
-    - name: Set up .NET 8
+    - name: Set up .NET 10
       uses: actions/setup-dotnet@v6
       with:
-        dotnet-version: '8.x'
+        dotnet-version: '10.0.401'
 
     - name: Set Version
       shell: pwsh
diff --git a/.github/workflows/mcpgrade.yml b/.github/workflows/mcpgrade.yml
index 04e0612f5b..7c7853e82e 100644
--- a/.github/workflows/mcpgrade.yml
+++ b/.github/workflows/mcpgrade.yml
@@ -38,7 +38,7 @@ jobs:
     - name: Setup .NET 10
       uses: actions/setup-dotnet@v6
       with:
-        dotnet-version: '10.0.x'
+        dotnet-version: '10.0.401'
 
     - name: Setup Node.js
       uses: actions/setup-node@v7
diff --git a/.github/workflows/nuget-publish.yml b/.github/workflows/nuget-publish.yml
index c03c62b396..df7304fc12 100644
--- a/.github/workflows/nuget-publish.yml
+++ b/.github/workflows/nuget-publish.yml
@@ -66,7 +66,7 @@ jobs:
       - name: Setup .NET 10.0
         uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '10.0.x'
+          dotnet-version: '10.0.401'
 
       - name: Decode strong-name key
         shell: pwsh
@@ -336,7 +336,7 @@ jobs:
       - name: Setup .NET 10.0
         uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '10.0.x'
+          dotnet-version: '10.0.401'
 
       - name: Download signed package sets
         uses: actions/download-artifact@v8
diff --git a/.github/workflows/pump-device-integration-server-docker.yml b/.github/workflows/pump-device-integration-server-docker.yml
index de2e69a1eb..67614db073 100644
--- a/.github/workflows/pump-device-integration-server-docker.yml
+++ b/.github/workflows/pump-device-integration-server-docker.yml
@@ -35,10 +35,10 @@ jobs:
       with:
         fetch-depth: 0
 
-    - name: Set up .NET
+    - name: Set up .NET 10
       uses: actions/setup-dotnet@v6
       with:
-        dotnet-version: '8.x'
+        dotnet-version: '10.0.401'
 
     - name: Set Version
       shell: pwsh
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c4ee93ea6e..6bb53ea886 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
       - name: Setup .NET 10.0
         uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '10.0.x'
+          dotnet-version: '10.0.401'
 
       - name: Validate selected publish run
         id: source
diff --git a/.github/workflows/sample-ha-longhaul.yml b/.github/workflows/sample-ha-longhaul.yml
index f5066124e9..4d1258125f 100644
--- a/.github/workflows/sample-ha-longhaul.yml
+++ b/.github/workflows/sample-ha-longhaul.yml
@@ -37,7 +37,7 @@ jobs:
     timeout-minutes: 180
 
     env:
-      DOTNET_VERSION: '10.0.x'
+      DOTNET_VERSION: '10.0.401'
       TARGET_FRAMEWORK: 'net10.0'
       CONFIGURATION: 'Release'
       TESTPROJECT: './tests/Opc.Ua.Redundancy.Samples.Tests/Opc.Ua.Redundancy.Samples.Tests.csproj'
diff --git a/.github/workflows/stability-test.yml b/.github/workflows/stability-test.yml
index a643f6df64..ab9bafcea8 100644
--- a/.github/workflows/stability-test.yml
+++ b/.github/workflows/stability-test.yml
@@ -22,7 +22,7 @@ jobs:
     timeout-minutes: 120  # Allow extra time beyond test duration for setup/teardown
 
     env:
-      DOTNET_VERSION: '10.0.x'
+      DOTNET_VERSION: '10.0.401'
       TARGET_FRAMEWORK: 'net10.0'
       CONFIGURATION: 'Release'
       TEST_DURATION_MINUTES: ${{ github.event.inputs.duration || '90' }}
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
index 4f02186631..4d2aaf1434 100644
--- a/.github/workflows/stress-test.yml
+++ b/.github/workflows/stress-test.yml
@@ -27,7 +27,7 @@ jobs:
     timeout-minutes: 120
 
     env:
-      DOTNET_VERSION: '10.0.x'
+      DOTNET_VERSION: '10.0.401'
       TARGET_FRAMEWORK: 'net10.0'
       CONFIGURATION: 'Release'
       CUSTOM_TEST_TARGET: 'net10.0'
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 81df9895c2..5961a87dea 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -16,11 +16,11 @@
     <PackageVersion Include="BenchmarkDotNet" Version="0.15.8" />
     <PackageVersion Include="BitFaster.Caching" Version="2.6.1" />
     <PackageVersion Include="BouncyCastle.Cryptography" Version="2.7.0" />
-    <PackageVersion Include="Confluent.Kafka" Version="2.15.0" />
+    <PackageVersion Include="Confluent.Kafka" Version="2.15.1" />
     <PackageVersion Include="coverlet.collector" Version="10.0.1" />
     <PackageVersion Include="Crdt" Version="1.1.2" />
     <PackageVersion Include="Crdt.Transport" Version="1.1.2" />
-    <PackageVersion Include="Dekaf" Version="1.14.4" />
+    <PackageVersion Include="Dekaf" Version="1.17.0" />
     <PackageVersion Include="RaftCs" Version="1.1.2" />
     <PackageVersion Include="RaftCs.Transport" Version="1.1.2" />
     <PackageVersion Include="RaftCs.Transport.NanoMsg" Version="1.1.2" />
@@ -37,49 +37,49 @@
     <PackageVersion Include="Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets" Version="2.3.12" />
     <PackageVersion Include="Microsoft.AspNetCore.WebSockets" Version="2.3.12" />
     <PackageVersion Include="Microsoft.Bcl.HashCode" Version="6.0.0" />
-    <PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Bcl.TimeProvider" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Bcl.TimeProvider" Version="10.0.12" />
     <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="4.14.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.Common" Version="$(RoslynApiVersionVS2026)" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="$(RoslynApiVersionVS2026)" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="$(RoslynApiVersionVS2026)" />
     <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.Common" Version="$(RoslynApiVersionVS2026)" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.9.0" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.9.0" />
-    <PackageVersion Include="ModelContextProtocol" Version="2.1.0" />
-    <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.1.0" />
-    <PackageVersion Include="ModelContextProtocol.Core" Version="2.1.0" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
-    <PackageVersion Include="Microsoft.SourceLink.AzureRepos.Git" Version="10.0.400" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.10.0" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.10.0" />
+    <PackageVersion Include="ModelContextProtocol" Version="2.2.0" />
+    <PackageVersion Include="ModelContextProtocol.AspNetCore" Version="2.2.0" />
+    <PackageVersion Include="ModelContextProtocol.Core" Version="2.2.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.10.1" />
+    <PackageVersion Include="Microsoft.SourceLink.AzureRepos.Git" Version="10.0.401" />
     <!-- AI Model Management. Microsoft.Extensions.AI is the inference
          abstraction: IChatClient is the contract that reaches a hosted service
          and an on-device runtime alike, which is the property the specification
-         asserts about where inference runs. It pins System.Text.Json 10.0.11,
+         asserts about where inference runs. It pins System.Text.Json 10.0.12,
          the version this repository already centralises on, so it costs nothing
          to take. No cloud-vendor SDK is referenced anywhere: workload identity
          is read from the token the platform projects, which is the mechanism
          every platform implements underneath its own SDK. -->
-    <PackageVersion Include="Microsoft.Extensions.AI" Version="10.9.0" />
-    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.400" />
-    <PackageVersion Include="System.CommandLine" Version="2.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.AI" Version="10.10.0" />
+    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.401" />
+    <PackageVersion Include="System.CommandLine" Version="2.0.12" />
     <PackageVersion Include="Microsoft.VisualStudio.DiagnosticsHub.BenchmarkDotNetDiagnosers" Version="18.7.37220.1" />
     <PackageVersion Include="Moq" Version="4.20.72" />
-    <PackageVersion Include="TUnit" Version="1.65.68" />
+    <PackageVersion Include="TUnit" Version="1.68.0" />
     <PackageVersion Include="Nerdbank.GitVersioning" Version="3.10.94" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
     <!--
@@ -99,7 +99,7 @@
     <PackageVersion Include="Pkcs11Interop" Version="5.3.0" />
     <PackageVersion Include="SharpPcap" Version="6.3.1" />
     <PackageVersion Include="NUnit" Version="4.6.1" />
-    <PackageVersion Include="NUnit.Analyzers" Version="4.14.0" />
+    <PackageVersion Include="NUnit.Analyzers" Version="4.15.0" />
     <PackageVersion Include="NUnit.Console" Version="3.22.0" />
     <PackageVersion Include="NUnit3TestAdapter" Version="6.3.0" />
     <PackageVersion Include="ObjectLayoutInspector" Version="0.2.0" />
@@ -111,19 +111,19 @@
          - SSH.NET 2026.0.0 fixes GHSA-q939-rpr3-3284 -->
     <PackageVersion Include="SSH.NET" Version="2026.0.0" />
     <PackageVersion Include="Serilog" Version="4.4.0" />
-    <PackageVersion Include="Testcontainers" Version="4.14.0" />
-    <PackageVersion Include="Testcontainers.Kafka" Version="4.14.0" />
+    <PackageVersion Include="Testcontainers" Version="4.15.0" />
+    <PackageVersion Include="Testcontainers.Kafka" Version="4.15.0" />
     <PackageVersion Include="Serilog.Expressions" Version="5.0.0" />
     <PackageVersion Include="Serilog.Extensions.Logging" Version="10.0.0" />
     <PackageVersion Include="Serilog.Sinks.Console" Version="6.1.1" />
     <PackageVersion Include="Serilog.Sinks.Debug" Version="3.0.0" />
     <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
     <PackageVersion Include="System.Buffers" Version="4.6.1" />
-    <PackageVersion Include="System.Composition.AttributedModel" Version="10.0.11" />
+    <PackageVersion Include="System.Composition.AttributedModel" Version="10.0.12" />
     <PackageVersion Include="System.Runtime.CompilerServices.Unsafe" Version="6.1.2" />
-    <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="10.0.11" />
+    <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="10.0.12" />
     <PackageVersion Include="System.Memory" Version="4.6.3" />
-    <PackageVersion Include="System.Formats.Asn1" Version="10.0.11" />
+    <PackageVersion Include="System.Formats.Asn1" Version="10.0.12" />
     <PackageVersion Include="System.IO.Compression" Version="4.3.0" />
     <!-- Transitive vulnerability pins (consumed via Microsoft.AspNetCore.* 2.3.x on
          net8.0/net9.0/netstandard2.1 - default transitives are 4.3.0 with NU1903):
@@ -133,12 +133,12 @@
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
     <PackageVersion Include="System.Collections.Immutable" Version="$(RoslynRuntimeVersion)" />
     <PackageVersion Include="System.Reflection.Metadata" Version="$(RoslynRuntimeVersion)" />
-    <PackageVersion Include="System.Text.Json" Version="10.0.11" />
+    <PackageVersion Include="System.Text.Json" Version="10.0.12" />
     <PackageVersion Include="System.Private.Uri" Version="4.3.2" />
     <PackageVersion Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
     <PackageVersion Include="System.Security.Cryptography.Cng" Version="5.0.0" />
-    <PackageVersion Include="System.Threading.Channels" Version="10.0.11" />
-    <PackageVersion Include="System.Threading.RateLimiting" Version="10.0.11" />
+    <PackageVersion Include="System.Threading.Channels" Version="10.0.12" />
+    <PackageVersion Include="System.Threading.RateLimiting" Version="10.0.12" />
     <PackageVersion Include="System.Threading.Tasks.Extensions" Version="4.6.3" />
   </ItemGroup>
   <!-- OpenUSD rendering stack, consumed by the optional
@@ -160,8 +160,8 @@
     <PackageVersion Include="OpenUsd.Rendering.Silk.Vulkan" Version="0.12.0-alpha" />
     <PackageVersion Include="OpenUsd.Runtime.Core" Version="0.12.0-alpha" />
     <PackageVersion Include="OpenUsd.Runtime.Imaging" Version="0.12.0-alpha" />
-    <PackageVersion Include="Avalonia" Version="12.1.1" />
-    <PackageVersion Include="Avalonia.Desktop" Version="12.1.1" />
+    <PackageVersion Include="Avalonia" Version="12.1.2" />
+    <PackageVersion Include="Avalonia.Desktop" Version="12.1.2" />
   </ItemGroup>
   <!-- MQTTnet 5.x dropped net48/net472/netstandard2.1 support. Per-TFM pinning is
        required because CentralPackageTransitivePinningEnabled lets the central pin
@@ -201,9 +201,9 @@
     <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="9.0.19" />
   </ItemGroup>
   <ItemGroup Condition="'$(TargetFramework)' != 'net8.0' AND '$(TargetFramework)' != 'net9.0'">
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="10.0.12" />
   </ItemGroup>
 </Project>
diff --git a/global.json b/global.json
new file mode 100644
index 0000000000..1769bc165d
--- /dev/null
+++ b/global.json
@@ -0,0 +1,7 @@
+{
+  "sdk": {
+    "version": "10.0.401",
+    "rollForward": "disable",
+    "allowPrerelease": false
+  }
+}