Dependencies: Update server dependencies #20385
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Implicit global usings were made opt-in (SixLabors/ImageSharp.Web#391)
…ions are no longer vulnerable
Global.json was showing as invalid due to a pre-release version being referenced while 'allowPrerelease' was set to 'false'. This can be set to 'false' again later on.
…ly referenced versions are no longer vulnerable
… referenced versions are no longer vulnerable
…licitly referenced versions are no longer vulnerable
…enced versions are no longer vulnerable
…ed versions are no longer vulnerable
lauraneto
added
dependencies
There was a problem hiding this comment.
Pull Request Overview
This PR updates Umbraco CMS's server dependencies, focusing on major updates to OpenIddict (v6.2.1 → v7.1.0), Serilog.Sinks.File (v6.0.0 → v7.0.0), and Swashbuckle.AspNetCore (v8.1.1 → v9.0.6), along with minor and patch updates to various Microsoft packages and third-party libraries.
- Added database migration support for OpenIddict v7 upgrade with required schema changes
- Removed transitive security vulnerability workarounds that are no longer needed
- Added missing ImageSharp using statements due to breaking changes in SixLabors.ImageSharp.Web v3.2.0
Reviewed Changes
Copilot reviewed 25 out of 27 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| Directory.Packages.props | Updated package versions across Microsoft, OpenIddict, Serilog, and other dependencies; removed transitive vulnerability workarounds |
| global.json | Enabled prerelease packages for .NET 10 RC |
| src/Umbraco.Infrastructure/Migrations/EFCoreMigration.cs | Added UpdateOpenIddictToV7 migration enum value |
| src/Umbraco.Infrastructure/Migrations/Upgrade/V_17_0_0/UpdateToOpenIddictV7.cs | New migration class to handle OpenIddict v7 database updates |
| src/Umbraco.Infrastructure/Migrations/Upgrade/UmbracoPremigrationPlan.cs | Registered OpenIddict v7 migration in the upgrade plan |
| src/Umbraco.Cms.Persistence.EFCore.*/Migrations/ | EF Core migrations and model snapshots for OpenIddict v7 schema changes |
| src/Umbraco.Cms.Imaging.ImageSharp/ | Added missing SixLabors.ImageSharp using statements due to breaking changes |
| Multiple .csproj files | Removed transitive security vulnerability package references |
Files not reviewed (2)
- src/Umbraco.Cms.Persistence.EFCore.SqlServer/Migrations/20251006140751_UpdateOpenIddictToV7.Designer.cs: Language not supported
- src/Umbraco.Cms.Persistence.EFCore.Sqlite/Migrations/20251006140958_UpdateOpenIddictToV7.Designer.cs: Language not supported
src/Umbraco.Cms.Persistence.EFCore.Sqlite/Migrations/20251006140958_UpdateOpenIddictToV7.cs
Outdated
Show resolved
Hide resolved
kjac
reviewed
Oct 7, 2025
src/Umbraco.Cms.Persistence.EFCore.Sqlite/Migrations/20251006140958_UpdateOpenIddictToV7.cs
Outdated
Show resolved
Hide resolved
Cosmetic update: Removed blank line as suggested by Copilot
kjac
reviewed
Oct 7, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
📦 Package Updates Summary
🔴 Major Updates (5)
Updating OpenIddict to v7 required an EF Core database migration as described in https://documentation.openiddict.com/guides/migration/60-to-70.html#add-and-apply-migrations-if-applicable.
🟡 Minor Updates (6)
Updating SixLabors.ImageSharp.Web required adding missing using statements as the ImageSharp package references stopped being added automatically to the global usings in SixLabors/ImageSharp.Web#391
🟢 Patch Updates (22)
🗑️ Removed (9)
Removed all transitive pinned packages (security vulnerability workarounds no longer needed)
Total: 33 packages updated • 9 packages removed • 28 unchanged
Notes: Also updated
NJsonSchemafrom 11.0.2 to 11.5.1 and some of the packages referenced by the Tests projects, except for NUnit which is a major upgrade and isn't necessarily needed for now.