.NET 8 security support ends 2026-11-10; .NET 10 is LTS to Nov 2028.
- TargetFramework net8.0 -> net10.0 (Directory.Build.props)
- EF Core 8.0.4 -> 10.0.9; Npgsql provider 8.0.4 -> 10.0.2; Pgvector.EFCore
0.2.0 -> 0.3.0; ASP.NET/Extensions packages -> 10.0.9
- Dockerfile sdk/aspnet 8.0 -> 10.0; CI setup-dotnet -> 10.0.x
- Modernised deprecated APIs: X509CertificateLoader (SYSLIB0057),
KnownIPNetworks + System.Net.IPNetwork.Parse (ASPDEPR005)
- Adapted tests to Npgsql 10's eager connection-string validation (dummy conn
string in test factories; behaviour change from lazy 8.x)
Verified: 0 errors/0 warnings; all 54 tests green on net10; the 3 LiveDb tests
green against a real pgvector container on the new EF10/Npgsql10/Pgvector 0.3
stack; dotnet format clean; vulnerable-package scan clean; the .NET 10 API
Docker image builds successfully.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Phase 5 re-validation caught a functional regression: the V-10 clamp in
SearchService.SearchAsync also capped CleanupService's internal target resolution
(pageSize 10000 -> 200), silently limiting bulk cleanup-by-query to 200 emails.
The clamp belongs at the user-facing trust boundary, not the shared service: move
MaxPageSize (200) enforcement into SearchController (both the POST body and GET query
paths). Internal callers of ISearchService now request large pages unhindered, while
user requests are still bounded. Adds a regression test proving SearchService returns
a 250-row page uncapped. No security regressions per Phase 5. All 39 tests green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Defense-in-depth tenant isolation: every user-owned entity (Email, Sender,
MailThread, MailDomain, Attachment, Label, SyncState, AnalyticsAggregate,
WidgetLayout, UnsubscribeItem) gets a global query filter restricting reads to the
authenticated user. AppDbContext takes an optional ICurrentUser; CurrentUserId is
Guid.Empty for background workers / design-time, which DISABLES the filter so sync
and tooling (which already scope by an explicit userId) are unaffected. On the HTTP
attack surface a forgotten manual `WHERE UserId ==` can no longer leak another
tenant's rows.
Phase 1 confirmed no active IDOR; this is preventive, and prioritised now because the
upcoming automation engine will add many new queries.
Also: moved the Npgsql-only tsvector FTS mapping out of EmailConfiguration into
AppDbContext.OnModelCreating, guarded by Database.IsRelational() (Ignored otherwise),
so non-relational test providers work — honouring the existing Email.SearchVector
comment. Production (Npgsql) model is unchanged; no migration needed.
Adds 3 cross-user tenant-isolation integration tests. All 38 tests green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cesnimda
cesnimda