Skip to content

[PM-28727] Upgrade to .NET 10#7171

Open
dereknance wants to merge 60 commits intomainfrom
pm-28727-dotnet-10
Open

[PM-28727] Upgrade to .NET 10#7171
dereknance wants to merge 60 commits intomainfrom
pm-28727-dotnet-10

Conversation

@dereknance
Copy link
Copy Markdown
Contributor

@dereknance dereknance commented Mar 7, 2026

🎟️ Tracking

PM-28727

📔 Objective

This PR upgrades from .NET 8 to 10.

I left most dependencies at their current versions so they can go through the usual Renovate process.

Notable Changes

  • [PM-33499] Permissive base64 decoder #7207 With .NET 9, Base64.IsValid enforces canonical padding.
  • Update to IHostBuilder style #6843 WebHostBuilder is obsolete
  • X509Certificate2 constructors are obsolete
    • ❗ The now-obsolete constructors allowed X.509, PKCS7, or PKCS12/PFX certs to be passed in. I now attempt to detect PKCS12 or X.509 and call the appropriate loader. I would appreciate a close eye on those changes.
  • NuGetAuditLevel defaults to low with .NET 10, resulting in any dependency with a known vulnerability to block when running dotnet restore. I elected to set it to critical to only block builds for vulns at that severity, and let the existing Renovate process take care of the rest. ❗ I can be convinced to disable this entirely.
  • System.Text.Json 8.0.5 pin removed because package pruning emits NU1510
  • Microsoft.Extensions.Caching.Memory 8.0.1 pin removed as Microsoft.Data.SqlClient requires >=9 and was resulting in a package downgrade
  • Microsoft.AspNetCore.HttpOverrides.IPNetwork and KnownNetworks have been marked as obsolete
  • .NET 10's configuration binder now preserves null values instead of coercing them to empty strings, causing NullReferenceException in .Trim() calls. Added null-conditional operators in property setters in GlobalSettings.cs
  • Upgraded SignalR packages, notably MessagePack from 2.x to 3.x. The wire format appears compatible for our use case
  • New lints required, mostly whitespace

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 7, 2026

Logo
Checkmarx One – Scan Summary & Detailsba1d7b85-72f0-4377-b6ed-f4e7d8f7a46c


New Issues (2) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 MEDIUM CSRF src/Api/Vault/Controllers/CiphersController.cs: 1558
detailsMethod at line 1558 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector
2 MEDIUM CSRF src/Api/Vault/Controllers/CiphersController.cs: 1385
detailsMethod at line 1385 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
Attack Vector

mimartin12
mimartin12 previously approved these changes Apr 27, 2026
Copy link
Copy Markdown
Contributor

@mimartin12 mimartin12 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dockerfiles LGTM

BTreston
BTreston previously approved these changes Apr 27, 2026
Copy link
Copy Markdown
Contributor

@BTreston BTreston left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good for AC owned files

prograhamming
prograhamming previously approved these changes Apr 28, 2026
dani-garcia
dani-garcia previously approved these changes Apr 28, 2026
enmande
enmande previously approved these changes Apr 28, 2026
Copy link
Copy Markdown
Contributor

@enmande enmande left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auth changes LGTM 😻

Comment thread bitwarden_license/src/Sso/Sso.csproj
@sonarqubecloud
Copy link
Copy Markdown

@djsmith85 djsmith85 removed the request for review from cyprain-okeke April 29, 2026 12:50
@coroiu coroiu removed their request for review April 29, 2026 13:36
Copy link
Copy Markdown
Contributor

@djsmith85 djsmith85 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving for platform

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai-review Request a Claude code review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants