Skip to content

Upgrade application to .NET 10 and update dependencies #461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jSylvestre merged 3 commits into from
Jun 10, 2026
Merged

Upgrade application to .NET 10 and update dependencies #461

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2d65627
Upgrade application to .NET 10 and update dependencies
jSylvestre Jun 5, 2026
b8c098e
Update Azure Pipeline .NET SDK to 10.0.x
jSylvestre Jun 5, 2026
a8bca6a
Remove legacy SqlClient dependency from Sloth.Core
jSylvestre Jun 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 12 additions & 11 deletions Sloth.Api/Sloth.Api.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<Project Sdk="Microsoft.NET.Sdk.Web">

<PropertyGroup>
<TargetFramework>net6.0</TargetFramework>
<TargetFramework>net10.0</TargetFramework>
<UserSecretsId>738f155f-718e-45d3-aceb-cb0b5d4a04f8</UserSecretsId>
<GenerateDocumentationFile>true</GenerateDocumentationFile>
<Version>1.0.0.0</Version>
Expand All @@ -20,16 +20,17 @@

<ItemGroup>
<PackageReference Include="ietws" Version="0.2.12" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="6.0.6" />
<PackageReference Include="Serilog" Version="2.11.0" />
<PackageReference Include="Serilog.AspNetCore" Version="5.0.0" />
<PackageReference Include="Serilog.Enrichers.ClientInfo" Version="1.2.0" />
<PackageReference Include="Serilog.Exceptions" Version="8.3.0" />
<PackageReference Include="Serilog.Extensions.Logging" Version="3.1.0" />
<PackageReference Include="Serilog.Sinks.Console" Version="4.0.1" />
<PackageReference Include="Serilog.Sinks.Elasticsearch" Version="8.4.1" />
<PackageReference Include="Serilog.Sinks.MSSqlServer" Version="5.7.1" />
<PackageReference Include="Serilog.Sinks.Stackify" Version="2.0.2" />
<PackageReference Include="Azure.Core" Version="1.47.1" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="10.0.8" />
<PackageReference Include="Serilog" Version="4.3.1" />
<PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
<PackageReference Include="Serilog.Enrichers.ClientInfo" Version="2.9.0" />
<PackageReference Include="Serilog.Exceptions" Version="8.4.0" />
<PackageReference Include="Serilog.Extensions.Logging" Version="10.0.0" />
<PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
<PackageReference Include="Serilog.Sinks.Elasticsearch" Version="10.0.0" />
<PackageReference Include="Serilog.Sinks.MSSqlServer" Version="10.0.0" />
<PackageReference Include="Serilog.Sinks.Stackify" Version="3.0.2" />
<PackageReference Include="StackifyLib" Version="2.2.13" />
<PackageReference Include="Swashbuckle.AspNetCore" Version="6.3.1" />
</ItemGroup>
Expand Down
2 changes: 1 addition & 1 deletion Sloth.Api/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"ConnectionStrings": {
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true"
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true;TrustServerCertificate=True"

@coderabbitai coderabbitai Bot Jun 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚖️ Poor tradeoff

Critical: TrustServerCertificate=True disables certificate validation.

Adding TrustServerCertificate=True disables SSL/TLS certificate validation, making the connection vulnerable to man-in-the-middle attacks. This setting should never be used in production environments.

Recommended approach:

  • Use environment-specific configuration (appsettings.Development.json vs appsettings.Production.json)
  • Only enable this in development environments with self-signed certificates
  • In production, ensure SQL Server has valid certificates or use Encrypt=False if the network is trusted and isolated
  • Consider using Azure Key Vault or similar for production connection strings
🔐 Proposed fix for environment-specific configuration

Move this setting to appsettings.Development.json:

appsettings.Development.json:

{
  "ConnectionStrings": {
    "DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true;TrustServerCertificate=True"
  }
}

appsettings.json (base):

-    "DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true;TrustServerCertificate=True"
+    "DefaultConnection": "Server=[ProductionServer];Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true;Encrypt=True"

appsettings.Production.json:

{
  "ConnectionStrings": {
    "DefaultConnection": "[Override from environment variables or Key Vault]"
  }
}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Sloth.Api/appsettings.json` at line 3, The connection string value for
"DefaultConnection" currently includes TrustServerCertificate=True which
disables certificate validation; remove that flag from the base appsettings.json
DefaultConnection entry and move the TrustServerCertificate=True setting only
into an appsettings.Development.json connection string (used for local/dev
only), add an appsettings.Production.json that does not contain
TrustServerCertificate and instead expects the production connection string to
be provided via environment variables or a secret store (e.g., Key Vault), and
ensure configuration loading uses environment-specific files so Production never
uses TrustServerCertificate=True.

},
"Stackify": {
"AppName": "Sloth.Api",
Expand Down
23 changes: 11 additions & 12 deletions Sloth.Core/Sloth.Core.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,37 +1,36 @@
<Project Sdk="Microsoft.NET.Sdk.Razor">
<Project Sdk="Microsoft.NET.Sdk.Razor">

<PropertyGroup>
<TargetFramework>net6</TargetFramework>
<TargetFramework>net10.0</TargetFramework>
<LangVersion>latest</LangVersion>
<AddRazorSupportForMvc>true</AddRazorSupportForMvc>
</PropertyGroup>
<ItemGroup>
<FrameworkReference Include="Microsoft.AspNetCore.App" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="AggieEnterpriseApi" Version="0.2.247" />
<PackageReference Include="AggieEnterpriseApi" Version="0.3.19" />
<PackageReference Include="Azure.Storage.Blobs" Version="12.13.0" />
<PackageReference Include="AzureActiveDirectorySearcher" Version="1.0.0" />
<PackageReference Include="ietws" Version="0.2.12" />
<PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="5.2.9" />
<PackageReference Include="Microsoft.Azure.KeyVault" Version="3.0.5" />
<PackageReference Include="Microsoft.Data.SqlClient" Version="4.1.0" />
<PackageReference Include="Microsoft.Data.SqlClient" Version="6.1.1" />
Comment thread
coderabbitai[bot] marked this conversation as resolved.

<PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="6.0.6" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="6.0.6">
<PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.8" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.8">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="6.0.6" />
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="6.0.6" />
<PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="6.0.1" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="6.0.0" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.8" />
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.8" />
<PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.8" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="10.0.8" />
<PackageReference Include="Microsoft.IdentityModel.Clients.ActiveDirectory" Version="5.2.9" />
<PackageReference Include="Mjml.Net" Version="1.23.0" />
<PackageReference Include="Razor.Templating.Core" Version="1.7.0" />
<PackageReference Include="Serilog" Version="2.11.0" />
<PackageReference Include="Serilog" Version="4.3.1" />
<PackageReference Include="SSH.NET" Version="2020.0.2" />
<PackageReference Include="System.Data.SqlClient" Version="4.8.5" />
<PackageReference Include="System.Net.Http" Version="4.3.4" />
<PackageReference Include="System.Net.NameResolution" Version="4.3.0" />
</ItemGroup>
Expand Down
6 changes: 5 additions & 1 deletion ....Jobs.AggieEnterprise.JournalProcessor/Sloth.Jobs.AggieEnterprise.JournalProcessor.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net6.0</TargetFramework>
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<UserSecretsId>738f155f-718e-45d3-aceb-cb0b5d4a04f8</UserSecretsId>
Expand All @@ -15,6 +15,10 @@
</Content>
</ItemGroup>

<ItemGroup>
<PackageReference Include="Azure.Core" Version="1.47.1" />
</ItemGroup>

<ItemGroup>
<ProjectReference Include="..\Sloth.Core\Sloth.Core.csproj" />
<ProjectReference Include="..\Sloth.Jobs.Core\Sloth.Jobs.Core.csproj" />
Expand Down
2 changes: 1 addition & 1 deletion Sloth.Jobs.AggieEnterprise.JournalProcessor/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"ConnectionStrings": {
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true"
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true;TrustServerCertificate=True"

@coderabbitai coderabbitai Bot Jun 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚖️ Poor tradeoff

Critical: TrustServerCertificate=True disables certificate validation.

Same security concern as in Sloth.Api/appsettings.json. This setting disables SSL/TLS certificate validation and should only be used in development environments, never in production.

Ensure this configuration is environment-specific and production deployments use properly validated certificates.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Sloth.Jobs.AggieEnterprise.JournalProcessor/appsettings.json` at line 3, The
DefaultConnection string currently includes TrustServerCertificate=True which
disables TLS certificate validation; remove or avoid setting
TrustServerCertificate=True in production by moving the development-only
connection string into an environment-specific config (e.g.,
appsettings.Development.json) or override it via environment variables/secrets
so production uses a connection string without TrustServerCertificate (or with
it explicitly false) and ensure production SQL Server uses valid certificates;
look for the DefaultConnection entry and the TrustServerCertificate flag in the
connection string to make this change.

},
"Logging": {
"IncludeScopes": false,
Expand Down
24 changes: 12 additions & 12 deletions Sloth.Jobs.Core/Sloth.Jobs.Core.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,18 +7,18 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.Extensions.Configuration" Version="6.0.1" />
<PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="6.0.1" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="6.0.0" />
<PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="6.0.1" />
<PackageReference Include="Microsoft.Extensions.Options" Version="6.0.0" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="6.0.0" />
<PackageReference Include="Serilog" Version="2.11.0" />
<PackageReference Include="Serilog.Exceptions" Version="8.3.0" />
<PackageReference Include="Serilog.Sinks.Console" Version="4.0.1" />
<PackageReference Include="Serilog.Sinks.Elasticsearch" Version="8.4.1" />
<PackageReference Include="Serilog.Sinks.MSSqlServer" Version="5.7.1" />
<PackageReference Include="Serilog.Sinks.Stackify" Version="2.0.2" />
<PackageReference Include="Microsoft.Extensions.Configuration" Version="10.0.8" />
<PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.8" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="10.0.8" />
<PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.8" />
<PackageReference Include="Microsoft.Extensions.Options" Version="10.0.8" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.8" />
<PackageReference Include="Serilog" Version="4.3.1" />
<PackageReference Include="Serilog.Exceptions" Version="8.4.0" />
<PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
<PackageReference Include="Serilog.Sinks.Elasticsearch" Version="10.0.0" />
<PackageReference Include="Serilog.Sinks.MSSqlServer" Version="10.0.0" />
<PackageReference Include="Serilog.Sinks.Stackify" Version="3.0.2" />
<PackageReference Include="StackifyLib" Version="2.2.13" />
</ItemGroup>

Expand Down
6 changes: 5 additions & 1 deletion Sloth.Jobs.CyberSource.BankReconcile/Sloth.Jobs.CyberSource.BankReconcile.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net6.0</TargetFramework>
<TargetFramework>net10.0</TargetFramework>
<UserSecretsId>738f155f-718e-45d3-aceb-cb0b5d4a04f8</UserSecretsId>
</PropertyGroup>

Expand All @@ -13,6 +13,10 @@
</Content>
</ItemGroup>

<ItemGroup>
<PackageReference Include="Azure.Core" Version="1.47.1" />
</ItemGroup>

<ItemGroup>
<ProjectReference Include="..\Sloth.Core\Sloth.Core.csproj" />
<ProjectReference Include="..\Sloth.Integrations.Cybersource\Sloth.Integrations.Cybersource.csproj" />
Expand Down
2 changes: 1 addition & 1 deletion Sloth.Jobs.CyberSource.BankReconcile/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"ConnectionStrings": {
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true"
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true;TrustServerCertificate=True"

@coderabbitai coderabbitai Bot Jun 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚖️ Poor tradeoff

Critical: TrustServerCertificate=True disables certificate validation.

Same security concern as in other appsettings.json files. This setting should only be used in development environments with self-signed certificates, never in production.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Sloth.Jobs.CyberSource.BankReconcile/appsettings.json` at line 3, The
connection string under the "DefaultConnection" setting currently includes
"TrustServerCertificate=True", which disables TLS certificate validation; update
the configuration so production never sets TrustServerCertificate=True (set it
to False or remove it) and ensure environment-specific settings are used (e.g.,
separate appsettings.Development.json for local dev with
TrustServerCertificate=True and appsettings.Production.json or an environment
variable for production with it disabled), and document or validate this in
startup so the connection string used by the application does not bypass
certificate validation in production.

},
"Stackify": {
"AppName": "Sloth.Jobs.CyberSource.BankReconcile",
Expand Down
6 changes: 5 additions & 1 deletion Sloth.Jobs.Notifications/Sloth.Jobs.Notifications.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net6.0</TargetFramework>
<TargetFramework>net10.0</TargetFramework>
<UserSecretsId>738f155f-718e-45d3-aceb-cb0b5d4a04f8</UserSecretsId>
</PropertyGroup>

Expand All @@ -13,6 +13,10 @@
</Content>
</ItemGroup>

<ItemGroup>
<PackageReference Include="Azure.Core" Version="1.47.1" />
</ItemGroup>

<ItemGroup>
<ProjectReference Include="..\Sloth.Core\Sloth.Core.csproj" />
<ProjectReference Include="..\Sloth.Jobs.Core\Sloth.Jobs.Core.csproj" />
Expand Down
2 changes: 1 addition & 1 deletion Sloth.Jobs.Notifications/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"ConnectionStrings": {
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true"
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true;TrustServerCertificate=True"

@coderabbitai coderabbitai Bot Jun 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚖️ Poor tradeoff

Critical: TrustServerCertificate=True disables certificate validation.

Same security concern as in other appsettings.json files. Ensure this is only used in development and not deployed to production environments.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Sloth.Jobs.Notifications/appsettings.json` at line 3, The connection string
value for DefaultConnection currently includes TrustServerCertificate=True which
disables TLS certificate validation; update configuration so
TrustServerCertificate is not set or is false in production by moving this
sensitive setting out of the shared appsettings.json and into
environment-specific configuration or secrets (e.g.,
appsettings.Development.json may keep TrustServerCertificate=True but
appsettings.Production.json must not), or read an environment variable to toggle
it at runtime; ensure the code that reads DefaultConnection (the configuration
key "DefaultConnection") uses the environment-specific configuration so
production connections validate server certificates or supply proper trusted
certificates instead.

},
"Sparkpost": {
"ApiKey": "[External]",
Expand Down
6 changes: 5 additions & 1 deletion Sloth.Jobs.WebHooks.Resend/Sloth.Jobs.WebHooks.Resend.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net6.0</TargetFramework>
<TargetFramework>net10.0</TargetFramework>
<UserSecretsId>738f155f-718e-45d3-aceb-cb0b5d4a04f8</UserSecretsId>
</PropertyGroup>

Expand All @@ -13,6 +13,10 @@
</Content>
</ItemGroup>

<ItemGroup>
<PackageReference Include="Azure.Core" Version="1.47.1" />
</ItemGroup>

<ItemGroup>
<ProjectReference Include="..\Sloth.Core\Sloth.Core.csproj" />
<ProjectReference Include="..\Sloth.Jobs.Core\Sloth.Jobs.Core.csproj" />
Expand Down
2 changes: 1 addition & 1 deletion Sloth.Jobs.WebHooks.Resend/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"ConnectionStrings": {
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true"
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true;TrustServerCertificate=True"

@coderabbitai coderabbitai Bot Jun 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚖️ Poor tradeoff

Critical: TrustServerCertificate=True disables certificate validation.

Same security concern applies here. This setting compromises connection security and must not be used in production deployments.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Sloth.Jobs.WebHooks.Resend/appsettings.json` at line 3, The connection string
under the "DefaultConnection" setting contains TrustServerCertificate=True which
disables TLS certificate validation; update the "DefaultConnection" value to
remove or set TrustServerCertificate=False and ensure Encrypt=True (or otherwise
configure a trusted server certificate) for production, and update any
deployment/config docs or secrets store where this connection string is defined
so production environments use a validated certificate rather than
TrustServerCertificate=True.

},
"Logging": {
"IncludeScopes": false,
Expand Down
2 changes: 2 additions & 0 deletions Sloth.Test/Api/Setup/SlothApi.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore.Infrastructure;
using Microsoft.EntityFrameworkCore.Storage;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
Expand Down Expand Up @@ -29,6 +30,7 @@ protected override IHost CreateHost(IHostBuilder builder)
builder.ConfigureServices(services =>
{
services.RemoveAll(typeof(DbContextOptions<SlothDbContext>));
services.RemoveAll(typeof(IDbContextOptionsConfiguration<SlothDbContext>));
services.AddIdentity<User, IdentityRole>()
.AddEntityFrameworkStores<SlothDbContext>()
.AddUserManager<TestApplicationUserManager>();
Expand Down
8 changes: 4 additions & 4 deletions Sloth.Test/Sloth.Test.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
<TargetFramework>net6.0</TargetFramework>
<TargetFramework>net10.0</TargetFramework>
</PropertyGroup>

<ItemGroup>
<PackageReference Include="AspNetCore.TestHelpers" Version="1.1.14"/>
<PackageReference Include="AspNetCore.TestHelpers" Version="1.1.14" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.2.0" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="6.0.6" />
<PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="6.0.6" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.8" />
<PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.8" />
<PackageReference Include="Shouldly" Version="4.0.3" />
<PackageReference Include="xunit" Version="2.4.1" />
<PackageReference Include="xunit.runner.console" Version="2.4.1">
Expand Down
29 changes: 15 additions & 14 deletions Sloth.Web/Sloth.Web.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<Project Sdk="Microsoft.NET.Sdk.Web">

<PropertyGroup>
<TargetFramework>net6.0</TargetFramework>
<TargetFramework>net10.0</TargetFramework>
Comment thread
coderabbitai[bot] marked this conversation as resolved.
<TypeScriptCompileBlocked>true</TypeScriptCompileBlocked>
<TypeScriptToolsVersion>Latest</TypeScriptToolsVersion>
<IsPackable>false</IsPackable>
Expand All @@ -15,27 +15,28 @@

<ItemGroup>
<PackageReference Include="AspNetCore.Security.CAS" Version="2.0.5" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="6.0.6" />
<PackageReference Include="Microsoft.AspNetCore.SpaServices.Extensions" Version="6.0.6" />
<PackageReference Include="Azure.Core" Version="1.47.1" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="10.0.8" />
<PackageReference Include="Microsoft.AspNetCore.SpaServices.Extensions" Version="10.0.8" />

<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="6.0.6">
<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.8">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>

<PackageReference Include="Serilog" Version="2.11.0" />
<PackageReference Include="Serilog.AspNetCore" Version="5.0.0" />
<PackageReference Include="Serilog.Enrichers.ClientInfo" Version="1.2.0" />
<PackageReference Include="Serilog.Exceptions" Version="8.3.0" />
<PackageReference Include="Serilog.Extensions.Logging" Version="3.1.0" />
<PackageReference Include="Serilog.Sinks.Console" Version="4.0.1" />
<PackageReference Include="Serilog.Sinks.Elasticsearch" Version="8.4.1" />
<PackageReference Include="Serilog.Sinks.MSSqlServer" Version="5.7.1" />
<PackageReference Include="Serilog" Version="4.3.1" />
<PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
<PackageReference Include="Serilog.Enrichers.ClientInfo" Version="2.9.0" />
<PackageReference Include="Serilog.Exceptions" Version="8.4.0" />
<PackageReference Include="Serilog.Extensions.Logging" Version="10.0.0" />
<PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
<PackageReference Include="Serilog.Sinks.Elasticsearch" Version="10.0.0" />
<PackageReference Include="Serilog.Sinks.MSSqlServer" Version="10.0.0" />

<PackageReference Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="6.0.6" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="10.0.8" />
<PackageReference Include="Humanizer" Version="2.14.1" />
<PackageReference Include="ietws" Version="0.2.12" />
<PackageReference Include="Serilog.Sinks.Stackify" Version="2.0.2" />
<PackageReference Include="Serilog.Sinks.Stackify" Version="3.0.2" />

<PackageReference Include="SSH.NET" Version="2020.0.2" />

Expand Down
2 changes: 1 addition & 1 deletion Sloth.Web/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"ConnectionStrings": {
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true"
"DefaultConnection": "Server=.\\sqlexpress;Database=sloth;Trusted_Connection=True;MultipleActiveResultSets=true;TrustServerCertificate=True"

@coderabbitai coderabbitai Bot Jun 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚖️ Poor tradeoff

Critical: TrustServerCertificate=True disables certificate validation.

Same security concern as in other appsettings.json files across the solution. All connection strings in this PR add TrustServerCertificate=True, which should be restricted to development environments only.

Consider creating a solution-wide strategy for managing connection strings across environments to prevent this setting from reaching production.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Sloth.Web/appsettings.json` at line 3, The DefaultConnection string in
appsettings.json contains TrustServerCertificate=True which disables TLS
validation; remove that flag from the DefaultConnection value and ensure any
code that constructs or loads connection strings (e.g., where DefaultConnection
is read in Program/Startup or configuration providers) only adds
TrustServerCertificate=True in development environments. Implement a
solution-wide strategy: move environment-specific overrides into
appsettings.Development.json or secrets/KeyVault, use ASPNETCORE_ENVIRONMENT to
select the dev-only connection string, and audit any other appsettings.json
connection keys to eliminate TrustServerCertificate from production configs.

},
"Sparkpost": {
"ApiKey": "[External]",
Expand Down
8 changes: 2 additions & 6 deletions Sloth.sln
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 17
VisualStudioVersion = 17.11.35327.3
# Visual Studio Version 18
VisualStudioVersion = 18.6.11822.322 stable
MinimumVisualStudioVersion = 10.0.40219.1
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Sloth.Core", "Sloth.Core\Sloth.Core.csproj", "{B2E2E365-565E-4A58-AFF2-EA468C89DE6B}"
EndProject
Expand All @@ -22,8 +22,6 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Sloth.Integrations.Cybersou
EndProject
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Sloth.Web", "Sloth.Web\Sloth.Web.csproj", "{1C25DDA5-6D1B-4DD1-B194-2938503F758E}"
EndProject
Project("{00D1A9C2-B5F0-4AF3-8072-F6C62B433612}") = "Sloth.Sql", "Sloth.Sql\Sloth.Sql.sqlproj", "{89F7C7D5-6BAA-48EC-9FE7-97D88EE4F20D}"
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Jobs", "Jobs", "{69F922A0-BE9E-4C89-AF91-51629451D3A0}"
EndProject
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Sloth.Jobs.CyberSource.BankReconcile", "Sloth.Jobs.CyberSource.BankReconcile\Sloth.Jobs.CyberSource.BankReconcile.csproj", "{609AE699-4CF5-46EF-A7C5-52F0290DCDDE}"
Expand Down Expand Up @@ -66,8 +64,6 @@ Global
{1C25DDA5-6D1B-4DD1-B194-2938503F758E}.Debug|Any CPU.Build.0 = Debug|Any CPU
{1C25DDA5-6D1B-4DD1-B194-2938503F758E}.Release|Any CPU.ActiveCfg = Release|Any CPU
{1C25DDA5-6D1B-4DD1-B194-2938503F758E}.Release|Any CPU.Build.0 = Release|Any CPU
{89F7C7D5-6BAA-48EC-9FE7-97D88EE4F20D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{89F7C7D5-6BAA-48EC-9FE7-97D88EE4F20D}.Release|Any CPU.ActiveCfg = Release|Any CPU
{609AE699-4CF5-46EF-A7C5-52F0290DCDDE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{609AE699-4CF5-46EF-A7C5-52F0290DCDDE}.Debug|Any CPU.Build.0 = Debug|Any CPU
{609AE699-4CF5-46EF-A7C5-52F0290DCDDE}.Release|Any CPU.ActiveCfg = Release|Any CPU
Expand Down
2 changes: 1 addition & 1 deletion azure-pipelines.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ steps:
- task: UseDotNet@2
inputs:
packageType: 'sdk'
version: '6.0.x'
version: '10.0.x'

- task: NodeTool@0
inputs:
Expand Down
Loading