[PM-28727] Upgrade to .NET 10

Directory.Build.props

@@ -1,7 +1,7 @@
 <Project>
 
   <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
 
     <Version>2026.2.1</Version>
 
@@ -11,6 +11,11 @@
     <Nullable Condition="'$(Nullable)' == '' and '$(IsTestProject)' == 'true'">annotations</Nullable>
     <Nullable Condition="'$(Nullable)' == '' and '$(IsTestProject)' != 'true'">enable</Nullable>
     <TreatWarningsAsErrors Condition="'$(TreatWarningsAsErrors)' == ''">true</TreatWarningsAsErrors>
+    <!--
+      Pomelo.EntityFrameworkCore.MySql 9.0.0 pins EF Core 9.x; suppress until Pomelo releases EF 10 support.
+      Another suppression exists in src/Infrastructure.EntityFramework/Infrastructure.EntityFramework.csproj
+    -->
+    <NoWarn>$(NoWarn);NU1608</NoWarn>
   </PropertyGroup>
 
   <PropertyGroup>

bitwarden_license/src/Scim/Dockerfile

@@ -1,7 +1,7 @@
 ###############################################
 #                 Build stage                 #
 ###############################################
-FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0-alpine3.21 AS build
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0-alpine AS build
 
 # Docker buildx supplies the value for this arg
 ARG TARGETPLATFORM
@@ -37,7 +37,7 @@ RUN . /tmp/rid.txt && dotnet publish \
 ###############################################
 #                  App stage                  #
 ###############################################
-FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.21
+FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine
 
 ARG TARGETPLATFORM
 LABEL com.bitwarden.product="bitwarden"

bitwarden_license/src/Sso/Dockerfile

@@ -1,7 +1,7 @@
 ###############################################
 #                 Build stage                 #
 ###############################################
-FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0-alpine3.21 AS build
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0-alpine AS build
 
 # Docker buildx supplies the value for this arg
 ARG TARGETPLATFORM
@@ -37,7 +37,7 @@ RUN . /tmp/rid.txt && dotnet publish \
 ###############################################
 #                  App stage                  #
 ###############################################
-FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.21
+FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine
 
 ARG TARGETPLATFORM
 LABEL com.bitwarden.product="bitwarden"

bitwarden_license/src/Sso/Sso.csproj

@@ -8,9 +8,6 @@
   <PropertyGroup Condition=" '$(RunConfiguration)' == 'Sso' " />
   <PropertyGroup Condition=" '$(RunConfiguration)' == 'Sso-SelfHost' " />
   <ItemGroup>
-    <!-- This is a transitive dependency to Sustainsys.Saml2.AspNetCore2 -->
-    <PackageReference Include="Microsoft.AspNetCore.Http" Version="2.2.2" />
-
     <PackageReference Include="Sustainsys.Saml2.AspNetCore2" Version="2.11.0" />
   </ItemGroup>
 

bitwarden_license/src/Sso/Utilities/DynamicAuthenticationSchemeProvider.cs

@@ -406,7 +406,7 @@ private DynamicAuthenticationScheme GetSaml2AuthenticationScheme(string name, Ss
         if (!string.IsNullOrWhiteSpace(config.IdpX509PublicCert))
         {
             var cert = CoreHelpers.Base64UrlDecode(config.IdpX509PublicCert);
-            idp.SigningKeys.AddConfiguredKey(new X509Certificate2(cert));
+            idp.SigningKeys.AddConfiguredKey(X509CertificateLoader.LoadCertificate(cert));
         }
         idp.ArtifactResolutionServiceUrls.Clear();
         // This must happen last since it calls Validate() internally.

bitwarden_license/test/Commercial.Core.Test/SecretsManager/Queries/ServiceAccounts/ServiceAccountSecretsDetailsQueryTests.cs

@@ -38,13 +38,13 @@ public async Task GetManyByOrganizationId_CallsDifferentRepoMethods(
         if (includeAccessToSecrets)
         {
             await sutProvider.GetDependency<IServiceAccountRepository>().Received(1)
-                .GetManyByOrganizationIdWithSecretsDetailsAsync(Arg.Is(AssertHelper.AssertPropertyEqual(mockSaDetails.ServiceAccount.OrganizationId)),
+                .GetManyByOrganizationIdWithSecretsDetailsAsync(Arg.Is(AssertHelper.AssertPropertyEqual(organizationId)),
                     Arg.Any<Guid>(), Arg.Any<AccessClientType>());
         }
         else
         {
             await sutProvider.GetDependency<IServiceAccountRepository>().Received(1)
-                .GetManyByOrganizationIdAsync(Arg.Is(AssertHelper.AssertPropertyEqual(mockSa.OrganizationId)),
+                .GetManyByOrganizationIdAsync(Arg.Is(AssertHelper.AssertPropertyEqual(organizationId)),
                     Arg.Any<Guid>(), Arg.Any<AccessClientType>());
             Assert.Equal(0, result.First().AccessToSecrets);
         }

bitwarden_license/test/SSO.Test/SSO.Test.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
-        <TargetFramework>net8.0</TargetFramework>
+        <TargetFramework>net10.0</TargetFramework>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
 

bitwarden_license/test/Scim.IntegrationTest/Scim.IntegrationTest.csproj

@@ -11,7 +11,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkVersion)" />
     <PackageReference Include="NSubstitute" Version="$(NSubstituteVersion)" />
     <PackageReference Include="xunit" Version="$(XUnitVersion)" />

bitwarden_license/test/Sso.IntegrationTest/Sso.IntegrationTest.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
 
@@ -14,7 +14,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkVersion)" />
     <PackageReference Include="NSubstitute" Version="$(NSubstituteVersion)" />
     <PackageReference Include="xunit" Version="$(XUnitVersion)" />

global.json

@@ -1,11 +1,11 @@
 {
   "sdk": {
-    "version": "8.0.100",
+    "version": "10.0.103",
     "rollForward": "latestFeature"
   },
   "msbuild-sdks": {
     "Microsoft.Build.Traversal": "4.1.0",
-    "Microsoft.Build.Sql": "1.0.0",
+    "Microsoft.Build.Sql": "2.1.0",
     "Bitwarden.Server.Sdk": "1.4.0"
   }
 }

src/Admin/Dockerfile

@@ -12,7 +12,7 @@ RUN npm run build
 ###############################################
 #                 Build stage                 #
 ###############################################
-FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0-alpine3.21 AS build
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0-alpine AS build
 
 # Docker buildx supplies the value for this arg
 ARG TARGETPLATFORM
@@ -47,7 +47,7 @@ RUN . /tmp/rid.txt && dotnet publish \
 ###############################################
 #                  App stage                  #
 ###############################################
-FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.21
+FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine
 
 ARG TARGETPLATFORM
 LABEL com.bitwarden.product="bitwarden"

src/Api/Auth/Models/Request/OrganizationSsoRequestModel.cs

@@ -147,7 +147,7 @@ public IEnumerable<ValidationResult> Validate(ValidationContext context)
                 try
                 {
                     var certData = CoreHelpers.Base64UrlDecode(StripPemCertificateElements(IdpX509PublicCert));
-                    new X509Certificate2(certData);
+                    X509CertificateLoader.LoadCertificate(certData);
                 }
                 catch (FormatException)
                 {

src/Api/Dockerfile

@@ -1,7 +1,7 @@
 ###############################################
 #                 Build stage                 #
 ###############################################
-FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0-alpine3.21 AS build
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0-alpine AS build
 
 # Docker buildx supplies the value for this arg
 ARG TARGETPLATFORM
@@ -37,7 +37,7 @@ RUN . /tmp/rid.txt && dotnet publish \
 ###############################################
 #                  App stage                  #
 ###############################################
-FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.21
+FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine
 
 ARG TARGETPLATFORM
 LABEL com.bitwarden.product="bitwarden"

src/Billing/Dockerfile

@@ -1,7 +1,7 @@
 ###############################################
 #                 Build stage                 #
 ###############################################
-FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:8.0-alpine3.21 AS build
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0-alpine AS build
 
 # Docker buildx supplies the value for this arg
 ARG TARGETPLATFORM
@@ -37,7 +37,7 @@ RUN . /tmp/rid.txt && dotnet publish \
 ###############################################
 #                  App stage                  #
 ###############################################
-FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.21
+FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine
 
 ARG TARGETPLATFORM
 LABEL com.bitwarden.product="bitwarden"

src/Core/Billing/Services/Implementations/LicensingService.cs

@@ -62,7 +62,7 @@ public LicensingService(
             "‎B34876439FCDA2846505B2EFBBA6C4A951313EBE";
         if (_globalSettings.SelfHosted)
         {
-            _certificate = CoreHelpers.GetEmbeddedCertificateAsync(environment.IsDevelopment() ? "licensing_dev.cer" : "licensing.cer", null)
+            _certificate = CoreHelpers.GetEmbeddedCertificateAsync(environment.IsDevelopment() ? "licensing_dev.cer" : "licensing.cer")
                 .GetAwaiter().GetResult();
         }
         else if (CoreHelpers.SettingHasValue(_globalSettings.Storage?.ConnectionString) &&

src/Core/Core.csproj

@@ -29,7 +29,7 @@
     <PackageReference Include="AWSSDK.SQS" Version="4.0.2.5" />
     <PackageReference Include="Azure.Data.Tables" Version="12.11.0" />
     <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Blobs" Version="1.3.4" />
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="8.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.3" />
     <PackageReference Include="Azure.Messaging.ServiceBus" Version="7.20.1" />
     <PackageReference Include="Azure.Storage.Blobs" Version="12.26.0" />
     <PackageReference Include="Azure.Storage.Queues" Version="12.24.0" />
@@ -38,19 +38,19 @@
     <PackageReference Include="DnsClient" Version="1.8.0" />
     <PackageReference Include="Fido2.AspNet" Version="3.0.1" />
     <PackageReference Include="Handlebars.Net" Version="2.1.6" />
-    <PackageReference Include="MailKit" Version="4.14.1" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.10" />
+    <PackageReference Include="MailKit" Version="4.15.1" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.3" />
     <PackageReference Include="Microsoft.Azure.Cosmos" Version="3.52.0" />
     <PackageReference Include="Microsoft.Azure.NotificationHubs" Version="4.2.0" />
     <PackageReference Include="Microsoft.Bot.Builder" Version="4.23.0" />
     <PackageReference Include="Microsoft.Bot.Builder.Integration.AspNet.Core" Version="4.23.0" />
     <PackageReference Include="Microsoft.Bot.Connector" Version="4.23.0" />
     <PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.2" />
     <PackageReference Include="Microsoft.Extensions.Caching.Cosmos" Version="1.8.0" />
-    <PackageReference Include="Microsoft.Extensions.Caching.SqlServer" Version="8.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="8.0.0" />
-    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="8.0.0" />
-    <PackageReference Include="Microsoft.Extensions.Identity.Stores" Version="8.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.SqlServer" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Identity.Stores" Version="10.0.3" />
     <PackageReference Include="OneOf" Version="3.0.271" />
     <PackageReference Include="SendGrid" Version="9.29.3" />
     <PackageReference Include="Serilog.Extensions.Logging.File" Version="3.0.0" />
@@ -61,7 +61,7 @@
     <PackageReference Include="Stripe.net" Version="48.5.0" />
     <PackageReference Include="Otp.NET" Version="1.4.0" />
     <PackageReference Include="YubicoDotNetClient" Version="1.2.0" />
-    <PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="8.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.3" />
     <PackageReference Include="LaunchDarkly.ServerSdk" Version="8.11.0" />
     <PackageReference Include="Quartz" Version="3.15.1" />
     <PackageReference Include="Quartz.Extensions.Hosting" Version="3.15.1" />
@@ -73,8 +73,7 @@
   </ItemGroup>
 
   <ItemGroup Label="Pinned transitive dependencies">
-    <PackageReference Include="System.Text.Json" Version="8.0.5" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
   </ItemGroup>
 
   <ItemGroup>

src/Core/Settings/GlobalSettings.cs

@@ -105,7 +105,7 @@
         {
             return null;
         }
         return string.Format("{0}/{1}", BaseServiceUri.Vault, name);
     }
 
     public string BuildInternalUri(string explicitValue, string name)
@@ -118,7 +118,7 @@
         {
             return null;
         }
         return string.Format("http://{0}:5000", name);
     }
 
     public string BuildDirectory(string explicitValue, string appendedPath)
@@ -259,21 +259,21 @@
                     _readOnlyConnectionString = null;
                 }
 
-                _connectionString = value.Trim('"');
+                _connectionString = value?.Trim('"');
             }
         }
 
         public string ReadOnlyConnectionString
         {
             get => string.IsNullOrWhiteSpace(_readOnlyConnectionString) ?
                 _connectionString : _readOnlyConnectionString;
-            set => _readOnlyConnectionString = value.Trim('"');
+            set => _readOnlyConnectionString = value?.Trim('"');
         }
 
         public string JobSchedulerConnectionString
         {
             get => _jobSchedulerConnectionString;
-            set => _jobSchedulerConnectionString = value.Trim('"');
+            set => _jobSchedulerConnectionString = value?.Trim('"');
         }
     }
 
@@ -325,19 +325,19 @@
             public string ConnectionString
             {
                 get => _connectionString;
-                set => _connectionString = value.Trim('"');
+                set => _connectionString = value?.Trim('"');
             }
 
             public string EventTopicName
             {
                 get => _eventTopicName;
-                set => _eventTopicName = value.Trim('"');
+                set => _eventTopicName = value?.Trim('"');
             }
 
             public string IntegrationTopicName
             {
                 get => _integrationTopicName;
-                set => _integrationTopicName = value.Trim('"');
+                set => _integrationTopicName = value?.Trim('"');
             }
         }
 
@@ -372,27 +372,27 @@
             public string HostName
             {
                 get => _hostName;
-                set => _hostName = value.Trim('"');
+                set => _hostName = value?.Trim('"');
             }
             public string Username
             {
                 get => _username;
-                set => _username = value.Trim('"');
+                set => _username = value?.Trim('"');
             }
             public string Password
             {
                 get => _password;
-                set => _password = value.Trim('"');
+                set => _password = value?.Trim('"');
             }
             public string EventExchangeName
             {
                 get => _eventExchangeName;
-                set => _eventExchangeName = value.Trim('"');
+                set => _eventExchangeName = value?.Trim('"');
             }
             public string IntegrationExchangeName
             {
                 get => _integrationExchangeName;
-                set => _integrationExchangeName = value.Trim('"');
+                set => _integrationExchangeName = value?.Trim('"');
             }
         }
     }
@@ -422,7 +422,7 @@
         public string ConnectionString
         {
             get => _connectionString;
-            set => _connectionString = value.Trim('"');
+            set => _connectionString = value?.Trim('"');
         }
     }
 
@@ -445,7 +445,7 @@
         public string ConnectionString
         {
             get => _connectionString;
-            set => _connectionString = value.Trim('"');
+            set => _connectionString = value?.Trim('"');
         }
 
         public string BaseDirectory

src/Core/Utilities/CoreHelpers.cs

@@ -32,7 +32,7 @@
     private static readonly long _baseDateTicks = new DateTime(1900, 1, 1).Ticks;
     private static readonly DateTime _epoc = new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc);
     private static readonly DateTime _max = new DateTime(9999, 1, 1, 0, 0, 0, DateTimeKind.Utc);
     private static readonly Random _random = new Random();
     private static readonly string RealConnectingIp = "X-Connecting-IP";
     private static readonly Regex _whiteSpaceRegex = new Regex(@"\s+");
     private static readonly JsonSerializerOptions _jsonSerializerOptions = new()
@@ -141,17 +141,17 @@
 
     public static X509Certificate2 GetCertificate(string file, string password)
     {
-        return new X509Certificate2(file, password);
+        return X509CertificateLoader.LoadPkcs12FromFile(file, password);
     }
 
-    public async static Task<X509Certificate2> GetEmbeddedCertificateAsync(string file, string password)
+    public async static Task<X509Certificate2> GetEmbeddedCertificateAsync(string file)
     {
         var assembly = typeof(CoreHelpers).GetTypeInfo().Assembly;
         using (var s = assembly.GetManifestResourceStream($"Bit.Core.{file}")!)
         using (var ms = new MemoryStream())
         {
             await s.CopyToAsync(ms);
-            return new X509Certificate2(ms.ToArray(), password);
+            return X509CertificateLoader.LoadCertificate(ms.ToArray());
         }
     }
 
@@ -176,7 +176,7 @@
 
             using var memStream = new MemoryStream();
             await blobRef.DownloadToAsync(memStream).ConfigureAwait(false);
-            return new X509Certificate2(memStream.ToArray(), password);
+            return X509CertificateLoader.LoadPkcs12(memStream.ToArray(), password);
         }
         catch (RequestFailedException ex)
         when (ex.ErrorCode == BlobErrorCode.ContainerNotFound || ex.ErrorCode == BlobErrorCode.BlobNotFound)