datadot · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,11 +1,20 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+# See https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 
 version: 2
 updates:
-  - package-ecosystem: "dotnet-sdk" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  # Acts on global.json. Without that file this ecosystem errors every run.
+  - package-ecosystem: "dotnet-sdk"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # The package manifests live under src/, where Directory.Packages.props is.
+  - package-ecosystem: "nuget"
+    directory: "/src"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
     schedule:
       interval: "weekly"
diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
@@ -21,7 +21,7 @@ jobs:
         with:
           dotnet-version: |
             8.0.x
-            9.0.x
+            10.0.x
 
       - name: Restore dependencies
         run: dotnet restore src/dbup-cli.sln

diff --git a/.github/workflows/on_semver_tag.yml b/.github/workflows/on_semver_tag.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           dotnet-version: |
             8.0.x
-            9.0.x
+            10.0.x
 
       - name: pwd
         run: pwd

diff --git a/global.json b/global.json
@@ -0,0 +1,6 @@
+{
+  "sdk": {
+    "version": "8.0.100",
+    "rollForward": "latestMajor"
+  }
+}
diff --git a/src/Directory.Build.props b/src/Directory.Build.props
@@ -1,7 +1,7 @@
 <Project>
 
     <PropertyGroup>
-        <TargetFrameworks>net8.0;net9.0</TargetFrameworks>
+        <TargetFrameworks>net8.0;net10.0</TargetFrameworks>
         <LangVersion>latest</LangVersion>
         <Nullable>enable</Nullable>
         <ImplicitUsings>enable</ImplicitUsings>

diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
@@ -11,34 +11,37 @@
     <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <ItemGroup>
-    <PackageVersion Include="CommandDotNet" Version="8.0.0" />
-    <PackageVersion Include="CommandDotNet.DataAnnotations" Version="4.0.0" />
-    <PackageVersion Include="CommandDotNet.NameCasing" Version="5.0.0" />
-    <PackageVersion Include="CommandDotNet.TestTools" Version="7.0.0" />
-    <PackageVersion Include="dbup-core" Version="6.0.4" />
-    <PackageVersion Include="dbup-mysql" Version="6.0.4" />
-    <PackageVersion Include="dbup-postgresql" Version="6.0.0-beta.44" />
-    <PackageVersion Include="dbup-sqlserver" Version="6.0.0" />
+    <PackageVersion Include="Azure.Identity" Version="1.21.0" />
+    <PackageVersion Include="CommandDotNet" Version="8.1.1" />
+    <PackageVersion Include="CommandDotNet.DataAnnotations" Version="4.1.0" />
+    <PackageVersion Include="CommandDotNet.NameCasing" Version="5.1.0" />
+    <PackageVersion Include="CommandDotNet.TestTools" Version="7.1.0" />
+    <PackageVersion Include="dbup-core" Version="6.1.1" />
+    <PackageVersion Include="dbup-mysql" Version="6.1.0" />
+    <PackageVersion Include="dbup-postgresql" Version="6.1.5" />
+    <PackageVersion Include="dbup-sqlserver" Version="6.0.16" />
     <PackageVersion Include="DotNetEnv" Version="3.1.1" />
-    <PackageVersion Include="JetBrains.Annotations" Version="2024.3.0" />
-    <PackageVersion Include="Microsoft.Azure.KeyVault" Version="3.0.5" />
-    <PackageVersion Include="Microsoft.Azure.Services.AppAuthentication" Version="1.6.2" />
-    <PackageVersion Include="Npgsql" Version="9.0.2" />
-    <PackageVersion Include="System.Text.Encoding.CodePages" Version="9.0.0" />
-    <PackageVersion Include="YamlDotNet" Version="16.2.1" />
+    <PackageVersion Include="JetBrains.Annotations" Version="2025.2.2" />
+    <PackageVersion Include="Npgsql" Version="9.0.4" />
+    <PackageVersion Include="System.Text.Encoding.CodePages" Version="10.0.0" />
+    <PackageVersion Include="YamlDotNet" Version="16.3.0" />
   </ItemGroup>
   <ItemGroup Label="test packages">
     <PackageVersion Include="FakeItEasy" Version="8.3.0" />
-    <PackageVersion Include="FluentAssertions" Version="7.0.0" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
-    <PackageVersion Include="MySql.Data" Version="9.1.0" />
-    <PackageVersion Include="Testcontainers" Version="4.1.0" />
-    <PackageVersion Include="Testcontainers.MsSql" Version="4.1.0" />
-    <PackageVersion Include="Testcontainers.MySql" Version="4.1.0" />
-    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.1.0" />
+    <PackageVersion Include="FluentAssertions" Version="8.8.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
+    <PackageVersion Include="MySql.Data" Version="9.5.0" />
+    <!-- Pinned transitively: Testcontainers resolves SSH.NET 2024.2.0, which is
+         GHSA-q939-rpr3-3284 (high). Test-only, but the .NET 10 SDK audits it
+         and TreatWarningsAsErrors turns it into a build failure. -->
+    <PackageVersion Include="SSH.NET" Version="2026.0.0" />
+    <PackageVersion Include="Testcontainers" Version="4.8.1" />
+    <PackageVersion Include="Testcontainers.MsSql" Version="4.8.1" />
+    <PackageVersion Include="Testcontainers.MySql" Version="4.8.1" />
+    <PackageVersion Include="Testcontainers.PostgreSql" Version="4.8.1" />
     <PackageVersion Include="Verify.DiffPlex" Version="3.1.2" />
-    <PackageVersion Include="Verify.XunitV3" Version="28.7.0" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.0" />
-    <PackageVersion Include="xunit.v3" Version="1.0.0" />
+    <PackageVersion Include="Verify.XunitV3" Version="31.7.2" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
+    <PackageVersion Include="xunit.v3" Version="3.2.0" />
   </ItemGroup>
 </Project>
diff --git a/src/dbup-cli.integration-tests/ContainerTest.cs b/src/dbup-cli.integration-tests/ContainerTest.cs
@@ -61,7 +61,7 @@ private string GetConfigPath(string subPath = "Default")
     public async ValueTask InitializeAsync()
     {
         dbName = $"DbUp_{TestContext.Current.TestMethod!.MethodName}";
-        dbName.Length.Should().BeLessOrEqualTo(DbNameLengthLimit);
+        dbName.Length.Should().BeLessThanOrEqualTo(DbNameLengthLimit);
 
         container = await GetContainer(() => NewBuilder);
         serverConnString = container.GetConnectionString();

diff --git a/src/dbup-cli/DbUpCustomization/AzureSqlDatabaseWithIntegratedSecurity.cs b/src/dbup-cli/DbUpCustomization/AzureSqlDatabaseWithIntegratedSecurity.cs
@@ -1,7 +1,8 @@
-using System.Data;
+using System.Data;
+using Azure.Core;
+using Azure.Identity;
 using DbUp.Engine.Output;
 using DbUp.SqlServer;
-using Microsoft.Azure.Services.AppAuthentication;
 using Microsoft.Data.SqlClient;
 
 namespace DbUp.Cli.DbUpCustomization;
@@ -179,10 +180,20 @@ private static bool DatabaseExistsIfConnectedToDirectly(IUpgradeLog logger, stri
         }
     }
 
-    private static string GetAccessToken(string resource = "https://database.windows.net/", string? tenantId = null, string azureAdInstance = "https://login.microsoftonline.com/") =>
-        new AzureServiceTokenProvider(azureAdInstance: azureAdInstance)
-            .GetAccessTokenAsync(resource, tenantId)
-            .ConfigureAwait(false)
-            .GetAwaiter()
-            .GetResult();
+    private static string GetAccessToken(string resource = "https://database.windows.net/", string? tenantId = null, string azureAdInstance = "https://login.microsoftonline.com/")
+    {
+        var credential = new DefaultAzureCredential(new DefaultAzureCredentialOptions
+        {
+            AuthorityHost = new Uri(azureAdInstance),
+            TenantId = tenantId
+        });
+
+        // AzureServiceTokenProvider took a resource; TokenCredential takes scopes.
+        // The conversion is resource + "/.default", which for the Azure SQL default
+        // above yields "https://database.windows.net//.default" - the doubled slash
+        // is expected and is what Azure SQL documents.
+        var context = new TokenRequestContext(new[] { $"{resource}/.default" });
+
+        return credential.GetToken(context, CancellationToken.None).Token;
+    }
 }
diff --git a/src/dbup-cli/dbup-cli.csproj b/src/dbup-cli/dbup-cli.csproj
@@ -42,6 +42,7 @@
 	</ItemGroup>
 
 	<ItemGroup>
+		<PackageReference Include="Azure.Identity" />
 		<PackageReference Include="CommandDotNet" />
 		<PackageReference Include="CommandDotNet.DataAnnotations" />
 		<PackageReference Include="CommandDotNet.NameCasing" />
@@ -51,8 +52,6 @@
 		<PackageReference Include="dbup-sqlserver" />
 		<PackageReference Include="DotNetEnv" />
 		<PackageReference Include="JetBrains.Annotations" />
-		<PackageReference Include="Microsoft.Azure.KeyVault" />
-		<PackageReference Include="Microsoft.Azure.Services.AppAuthentication" />
 		<PackageReference Include="Npgsql" />
 		<PackageReference Include="System.Text.Encoding.CodePages" />
 		<PackageReference Include="YamlDotNet" />
-Original file line number
+Diff line change
@@ Expand Up / @@ -21,7 +21,7 @@ jobs: @@
             with:
               dotnet-version: |
 .0.x
-.0.x
+.0.x
           - name: Restore dependencies
             run: dotnet restore src/dbup-cli.sln
@@ Expand Down @@