|
| 1 | +# Feature 093: NuGet Package Updates (Non-EF Core) |
| 2 | + |
| 3 | +> **Status:** Done |
| 4 | +> **Priority:** Medium |
| 5 | +> **Dependencies:** None |
| 6 | +
|
| 7 | +## Overview |
| 8 | + |
| 9 | +Update all outdated NuGet packages across the solution to their latest stable versions. Entity Framework Core packages are explicitly excluded because `Npgsql.EntityFrameworkCore.PostgreSQL` is at 10.0.0 (its latest release) and has not yet published a version compatible with EF Core 10.0.3. Upgrading EF Core packages without a matching Npgsql provider would break the PostgreSQL integration. |
| 10 | + |
| 11 | +## Problem Statement |
| 12 | + |
| 13 | +### Current State |
| 14 | + |
| 15 | +As of 2026-03-07, 17 non-EF packages across 13 projects have updates available. Two packages have major version bumps (MinVer 6→7, coverlet.collector 6→8) that may include breaking changes. The remaining packages are minor or patch updates. |
| 16 | + |
| 17 | +### Excluded Packages (EF Core — Blocked by Npgsql) |
| 18 | + |
| 19 | +| Package | Current | Latest | Project | Reason | |
| 20 | +|---|---|---|---|---| |
| 21 | +| Microsoft.EntityFrameworkCore.Design | 10.0.0-rc.2 | 10.0.3 | Api | Npgsql 10.0.0 requires EF Core 10.0.x compat | |
| 22 | +| Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore | 10.0.0 | 10.0.3 | Api | Tied to EF Core version | |
| 23 | +| Microsoft.EntityFrameworkCore.InMemory | 10.0.0-rc.2 | 10.0.3 | Api.Tests | Tied to EF Core version | |
| 24 | +| Microsoft.EntityFrameworkCore.Sqlite | 10.0.1 | 10.0.3 | Infrastructure.Tests | Tied to EF Core version | |
| 25 | + |
| 26 | +> These will be updated together in a separate feature once Npgsql publishes a compatible release. |
| 27 | +
|
| 28 | +### Target State |
| 29 | + |
| 30 | +All non-EF packages at their latest stable versions. All tests passing. No regressions. |
| 31 | + |
| 32 | +--- |
| 33 | + |
| 34 | +## Packages to Update |
| 35 | + |
| 36 | +### Phase 1 — Microsoft Patch Updates (Low Risk) |
| 37 | + |
| 38 | +ASP.NET Core and Microsoft.Extensions packages, all 10.0.0 → 10.0.3 patch updates. |
| 39 | + |
| 40 | +| Package | Current | Latest | Project | |
| 41 | +|---|---|---|---| |
| 42 | +| Microsoft.AspNetCore.Authentication.JwtBearer | 10.0.0 | 10.0.3 | Api | |
| 43 | +| Microsoft.AspNetCore.Components.WebAssembly.Server | 10.0.0 | 10.0.3 | Api | |
| 44 | +| Microsoft.AspNetCore.OpenApi | 10.0.0 | 10.0.3 | Api | |
| 45 | +| Microsoft.AspNetCore.Components.WebAssembly | 10.0.0 | 10.0.3 | Client | |
| 46 | +| Microsoft.AspNetCore.Components.WebAssembly.Authentication | 10.0.0 | 10.0.3 | Client | |
| 47 | +| Microsoft.AspNetCore.Components.WebAssembly.DevServer | 10.0.0 | 10.0.3 | Client | |
| 48 | +| Microsoft.Extensions.Http | 10.0.0 | 10.0.3 | Client | |
| 49 | +| Microsoft.Extensions.DependencyInjection.Abstractions | 10.0.0 | 10.0.3 | Domain | |
| 50 | +| Microsoft.AspNetCore.Mvc.Testing | 10.0.0 | 10.0.3 | Api.Tests | |
| 51 | + |
| 52 | +### Phase 2 — Third-Party Updates (Low–Medium Risk) |
| 53 | + |
| 54 | +| Package | Current | Latest | Project | Notes | |
| 55 | +|---|---|---|---|---| |
| 56 | +| Scalar.AspNetCore | 2.10.3 | 2.13.1 | Api | Minor bump, review changelog | |
| 57 | +| bunit | 2.5.3 | 2.6.2 | Client.Tests | Minor bump | |
| 58 | +| Deque.AxeCore.Playwright | 4.11.0 | 4.11.1 | E2E.Tests | Patch | |
| 59 | +| Microsoft.Playwright | 1.49.0 | 1.58.0 | E2E.Tests | Minor bump, may need `playwright install` | |
| 60 | +| Microsoft.Build.Tasks.Core | 18.0.2 | 18.3.3 | Infrastructure | Minor bump | |
| 61 | + |
| 62 | +### Phase 3 — Test Infrastructure Updates (Medium Risk) |
| 63 | + |
| 64 | +| Package | Current | Latest | Project | Notes | |
| 65 | +|---|---|---|---|---| |
| 66 | +| Microsoft.NET.Test.Sdk | 18.0.1 | 18.3.0 | All 6 test projects | Minor bump | |
| 67 | +| coverlet.collector | 6.0.4 | 8.0.0 | All 6 test projects | **Major** — review breaking changes | |
| 68 | + |
| 69 | +### Phase 4 — MinVer Major Update (Medium Risk) |
| 70 | + |
| 71 | +| Package | Current | Latest | Project | Notes | |
| 72 | +|---|---|---|---|---| |
| 73 | +| MinVer | 6.0.0 | 7.0.0 | All 13 projects | **Major** — review migration guide for config changes | |
| 74 | + |
| 75 | +--- |
| 76 | + |
| 77 | +## User Stories |
| 78 | + |
| 79 | +### US-093-001: Update Microsoft Patch Packages |
| 80 | +**As a** developer |
| 81 | +**I want to** update all Microsoft ASP.NET Core and Extensions packages to 10.0.3 |
| 82 | +**So that** the solution picks up security patches and bug fixes. |
| 83 | + |
| 84 | +**Acceptance Criteria:** |
| 85 | +- [x] All 9 Microsoft packages updated to 10.0.3 |
| 86 | +- [x] All unit tests pass |
| 87 | +- [ ] API starts and serves Blazor client correctly |
| 88 | +- [ ] Authentication flow works |
| 89 | + |
| 90 | +### US-093-002: Update Third-Party Packages |
| 91 | +**As a** developer |
| 92 | +**I want to** update Scalar, bunit, Playwright, and MSBuild packages |
| 93 | +**So that** tooling stays current and benefits from fixes. |
| 94 | + |
| 95 | +**Acceptance Criteria:** |
| 96 | +- [x] Scalar.AspNetCore updated to 2.13.1; Scalar UI accessible at `/scalar` |
| 97 | +- [x] bunit updated to 2.6.2; client tests pass |
| 98 | +- [x] Playwright updated to 1.58.0; `playwright install` run if needed; E2E tests pass |
| 99 | +- [x] Microsoft.Build.Tasks.Core updated to 18.3.3; build succeeds |
| 100 | + |
| 101 | +### US-093-003: Update Test Infrastructure |
| 102 | +**As a** developer |
| 103 | +**I want to** update Microsoft.NET.Test.Sdk and coverlet.collector |
| 104 | +**So that** test execution and coverage collection use current tooling. |
| 105 | + |
| 106 | +**Acceptance Criteria:** |
| 107 | +- [x] Microsoft.NET.Test.Sdk updated to 18.3.0 in all 6 test projects |
| 108 | +- [x] coverlet.collector updated to 8.0.0 in all 6 test projects |
| 109 | +- [x] All tests pass; coverage collection works with `coverlet.runsettings` |
| 110 | + |
| 111 | +### US-093-004: Update MinVer |
| 112 | +**As a** developer |
| 113 | +**I want to** update MinVer from 6.x to 7.x |
| 114 | +**So that** versioning tooling is current. |
| 115 | + |
| 116 | +**Acceptance Criteria:** |
| 117 | +- [x] MinVer updated to 7.0.0 in all 13 projects (centrally in Directory.Build.props) |
| 118 | +- [x] Review MinVer 7.0 migration guide for any configuration changes |
| 119 | +- [x] Build produces correct version output |
| 120 | +- [x] All tests pass |
| 121 | + |
| 122 | +--- |
| 123 | + |
| 124 | +## Implementation Plan |
| 125 | + |
| 126 | +### Phase 1: Microsoft Patch Updates |
| 127 | + |
| 128 | +**Objective:** Update all Microsoft 10.0.0 → 10.0.3 packages. |
| 129 | + |
| 130 | +**Tasks:** |
| 131 | +- [ ] Update 5 Api packages (JwtBearer, WebAssembly.Server, OpenApi, Mvc.Testing indirectly) |
| 132 | +- [ ] Update 4 Client packages (WebAssembly, WebAssembly.Authentication, WebAssembly.DevServer, Extensions.Http) |
| 133 | +- [ ] Update Domain package (DependencyInjection.Abstractions) |
| 134 | +- [ ] Update Api.Tests package (Mvc.Testing) |
| 135 | +- [ ] Run full test suite |
| 136 | +- [ ] Smoke test API + Client startup |
| 137 | + |
| 138 | +**Commit:** |
| 139 | +``` |
| 140 | +chore(deps): update Microsoft packages to 10.0.3 |
| 141 | +
|
| 142 | +- ASP.NET Core packages 10.0.0 → 10.0.3 (Api, Client) |
| 143 | +- Microsoft.Extensions packages 10.0.0 → 10.0.3 (Domain, Client) |
| 144 | +- Microsoft.AspNetCore.Mvc.Testing 10.0.0 → 10.0.3 (Api.Tests) |
| 145 | +
|
| 146 | +Refs: #093 |
| 147 | +``` |
| 148 | + |
| 149 | +--- |
| 150 | + |
| 151 | +### Phase 2: Third-Party Updates |
| 152 | + |
| 153 | +**Objective:** Update Scalar, bunit, Playwright, and MSBuild packages. |
| 154 | + |
| 155 | +**Tasks:** |
| 156 | +- [ ] Update Scalar.AspNetCore 2.10.3 → 2.13.1 |
| 157 | +- [ ] Update bunit 2.5.3 → 2.6.2 |
| 158 | +- [ ] Update Microsoft.Playwright 1.49.0 → 1.58.0 |
| 159 | +- [ ] Update Deque.AxeCore.Playwright 4.11.0 → 4.11.1 |
| 160 | +- [ ] Update Microsoft.Build.Tasks.Core 18.0.2 → 18.3.3 |
| 161 | +- [ ] Run `pwsh bin/Debug/net10.0/playwright.ps1 install` if Playwright version requires it |
| 162 | +- [ ] Run full test suite |
| 163 | + |
| 164 | +**Commit:** |
| 165 | +``` |
| 166 | +chore(deps): update third-party packages |
| 167 | +
|
| 168 | +- Scalar.AspNetCore 2.10.3 → 2.13.1 |
| 169 | +- bunit 2.5.3 → 2.6.2 |
| 170 | +- Microsoft.Playwright 1.49.0 → 1.58.0 |
| 171 | +- Deque.AxeCore.Playwright 4.11.0 → 4.11.1 |
| 172 | +- Microsoft.Build.Tasks.Core 18.0.2 → 18.3.3 |
| 173 | +
|
| 174 | +Refs: #093 |
| 175 | +``` |
| 176 | + |
| 177 | +--- |
| 178 | + |
| 179 | +### Phase 3: Test Infrastructure Updates |
| 180 | + |
| 181 | +**Objective:** Update test SDK and coverage collector across all test projects. |
| 182 | + |
| 183 | +**Tasks:** |
| 184 | +- [ ] Review coverlet.collector 8.0 changelog for breaking changes |
| 185 | +- [ ] Update Microsoft.NET.Test.Sdk 18.0.1 → 18.3.0 in 6 test projects |
| 186 | +- [ ] Update coverlet.collector 6.0.4 → 8.0.0 in 6 test projects |
| 187 | +- [ ] Verify `coverlet.runsettings` is still compatible |
| 188 | +- [ ] Run full test suite with coverage collection |
| 189 | + |
| 190 | +**Commit:** |
| 191 | +``` |
| 192 | +chore(deps): update test infrastructure packages |
| 193 | +
|
| 194 | +- Microsoft.NET.Test.Sdk 18.0.1 → 18.3.0 |
| 195 | +- coverlet.collector 6.0.4 → 8.0.0 |
| 196 | +- Applied across all 6 test projects |
| 197 | +
|
| 198 | +Refs: #093 |
| 199 | +``` |
| 200 | + |
| 201 | +--- |
| 202 | + |
| 203 | +### Phase 4: MinVer Major Update |
| 204 | + |
| 205 | +**Objective:** Update MinVer to 7.x across all projects. |
| 206 | + |
| 207 | +**Tasks:** |
| 208 | +- [ ] Review MinVer 7.0 release notes and migration guide |
| 209 | +- [ ] Update MinVer 6.0.0 → 7.0.0 in all 13 projects |
| 210 | +- [ ] Verify version output in build (`dotnet build` produces expected version) |
| 211 | +- [ ] Check for any `.csproj` property changes (e.g., `MinVerTagPrefix`, `MinVerMinimumMajorMinor`) |
| 212 | +- [ ] Run full test suite |
| 213 | + |
| 214 | +**Commit:** |
| 215 | +``` |
| 216 | +chore(deps): update MinVer 6.0.0 → 7.0.0 |
| 217 | +
|
| 218 | +- Major version update across all 13 projects |
| 219 | +- Reviewed migration guide; [note any config changes here] |
| 220 | +
|
| 221 | +Refs: #093 |
| 222 | +``` |
| 223 | + |
| 224 | +--- |
| 225 | + |
| 226 | +## Risk Assessment |
| 227 | + |
| 228 | +| Risk | Impact | Mitigation | |
| 229 | +|---|---|---| |
| 230 | +| MinVer 7.0 breaking changes | Build versioning breaks | Review migration guide before updating; test version output | |
| 231 | +| coverlet.collector 8.0 breaking changes | Coverage collection fails | Review changelog; verify runsettings compatibility | |
| 232 | +| Playwright browser version mismatch | E2E tests fail | Run `playwright install` after update | |
| 233 | +| Scalar API changes | Scalar UI breaks | Verify `/scalar` page loads after update | |
| 234 | + |
| 235 | +## Notes |
| 236 | + |
| 237 | +- EF Core packages (Design, InMemory, Sqlite, HealthChecks.EFCore) are intentionally excluded. They are pinned by `Npgsql.EntityFrameworkCore.PostgreSQL` 10.0.0, which has not yet released a version compatible with EF Core 10.0.3. Track separately. |
| 238 | +- All updates should use `dotnet add <project> package <name> --version <version>` per §33. |
0 commit comments