Point Dependabot at dev, and sync main back into dev

[erikdarlingdata]

Fixes a mistake in the Dependabot config I added in #399, and repairs its consequence.

What went wrong

.github/dependabot.yml did not set target-branch. Dependabot therefore defaults to the repository's default branch, which here is main.

So its first two PRs (#407, #408) were opened against main, not dev. I merged them without checking the base, which:

• put dependency bumps directly onto main, bypassing the dev -> main release flow
• left dev behind main, which would have surfaced later as a confusing conflict on the next release PR

That is on me - the base branch is right there in the PR and I did not look at it.

Fix

Both ecosystem entries now set target-branch: dev, with a comment explaining why it has to stay. Future Dependabot PRs will target dev and follow the normal flow.

Sync

This branch also merges main back into dev, so dev is no longer missing the two bumps:

• SQLitePCLRaw.bundle_e_sqlite3 3.0.4
• Meziantou.Framework.Win32.CredentialManager 3.0.1

The merge was clean - no conflicts.

What was not affected

Both bumps were verified before merging, and that work stands:

• CredentialManager 3.0.1 - full round-trip against Windows Credential Manager (write, enumerate, read-back, delete, confirm-gone). Worth noting SaveCredential/DeleteCredential swallow exceptions, so a broken major would have compiled and then silently failed to save credentials; the round-trip is what rules that out.
• SQLitePCLRaw 3.0.4 - PlanShare run locally and exercised end-to-end (stats aggregates, insert, select round-trip, parameterized delete, 404-after-delete), and it bundles SQLite 3.53.3, so CVE-2025-6965 stays fixed.

And the accidental merge to main did have one genuinely good outcome: it triggered the new PlanShare auto-deploy for real. Production is now on SQLite 3.53.3, service active, api/stats returning 200, binary timestamped 21:49 UTC. The deploy automation is validated end-to-end on its first real trigger.

Test plan

• dependabot.yml parses; both entries report target-branch: dev
• Clean Debug build: 0 warnings
• 288/288 tests pass
• Verified on the live server that the deployed SQLite is 3.53.3 and the service is healthy

🤖 Generated with Claude Code

[claude]

Reviewed. This is a small, config-only PR (dependabot fix + sync of two already-shipped dependency bumps) — none of the usual plan-XML / T-SQL / PlanViewer.Ssms-version concerns apply here since no code paths for that were touched.

Checked and looks correct:

• Both dependabot.yml entries (nuget and github-actions) now set target-branch: dev, with a comment explaining why — fixes the root cause (Dependabot PRs were landing on main, the repo's default branch).
• Meziantou.Framework.Win32.CredentialManager 3.0.1 is bumped consistently in both projects that reference it (PlanViewer.App, PlanViewer.Core) — no strays left on 2.0.1.
• SQLitePCLRaw.bundle_e_sqlite3 3.0.4 is only referenced from server/PlanShare/PlanShare.csproj, and it's updated there; the inline comment explaining the pin is updated to match the new version/rationale (CVE-2025-6965 fix, SQLite 3.53.3).
• src/Directory.Build.props version correctly stays untouched — this isn't a feature/release PR, just a dependency-floor bump + CI config fix, so no version bump is expected here.
• No NoWarn additions, no new T-SQL, no PlanViewer.Web linked-file changes needed — out of scope for this diff.

No issues found. The one soft risk (skipped version verification round-trips for the two bumps) is addressed in the PR description rather than in code, which is fine for a config-only change like this.