[sfmskywalker]

Purpose

Dependency bumps for 3.10.1.

---

Scope

Select one primary concern:

• Bug fix (behavior change)
• Refactor (no behavior change)
• Documentation update
• Formatting / code cleanup
• Dependency / build update
• New feature

---

Description

Problem

Patch-line package pins on release/3.10.0 need the 3.10.1 dependency updates.

Solution

This PR carries main commit c3c621636718390d915de2573e03b42f51339dcb (#9004) via git cherry-pick -x, plus the root pin bumps. build/_build.csproj already has the System.Security.Cryptography.Xml 10.0.13 pin in the same form as main.

Packages and versions:

• Microsoft.AspNetCore.Components.WebAssembly.Server: 8.0.32 / 9.0.21 / 10.0.13 (matching major)
• AutoMapper: 16.0.0 -> 16.1.1
• MailKit: 4.14.1 -> 4.16.0
• NuGet.Protocol: 7.0.1 -> 7.0.3
• System.Security.Cryptography.Xml: 10.0.13 (already pinned on this branch)
• System.Security.Cryptography.Pkcs: 8.0.2 (net8), 9.0.21 (net9), 10.0.13 (net10), added as a direct package dependency on the projects that already close over it. Elsa.DropIns net8 uses 9.0.21 because NuGet.Packaging 7.0.3 requires a 9.x line.

No API changes.

---

Verification

Steps:

1. Restore Elsa.sln.
2. Build build/_build.csproj, Elsa.Email, Elsa.DropIns, and the WebAssembly.Server hosts.
3. Run Elsa.Workflows.Core.UnitTests, Elsa.Common.UnitTests, Elsa.Http.UnitTests, and Elsa.Studio.Core.Tests.
4. Pack the affected IDs and confirm System.Security.Cryptography.Pkcs is a direct nuspec dependency at the per-TFM versions above.

Expected outcome: restore, build, and the listed unit tests succeed.

---

Commit Convention

• Cherry-pick of Bump WebAssembly.Server to 8.0.32, 9.0.21, and 10.0.13 #9004 plus chore(deps) for the root pins.
• Follow-up commit pins the transitive crypto package to patched versions.

---

Checklist

• The PR is focused on a single concern
• Commit messages follow the recommended convention
• Tests added or updated (if applicable)
• Documentation updated (if applicable)
• No unrelated cleanup included
• All tests pass

  

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: a0a7d2bd-2a4b-495b-8f26-74e2c5d17177

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

@elsa-workflows-bot review

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The package updates reach dependency resolution across Elsa projects, apps, and Studio.

The central package requirement must be satisfied before merging: the .NET 8 package overrides in Elsa.DropIns.csproj remain outside the central package settings.

Findings

1.  Package versions bypass central settings ▶

Fix with agent prompt

### Issue 1
extensions/src/dropins/Elsa.DropIns/Elsa.DropIns.csproj:17
`Elsa.DropIns.csproj` now hard-codes .NET 8 versions for `System.Security.Cryptography.Pkcs` here and `System.Formats.Asn1` on line 20. The repository guide requires versions in `Directory.Packages.props` unless project-level versions already exist for that package; neither package had that pattern. These overrides bypass subsequent central version updates for the .NET 8 build. Move these exceptions into central package settings before merging to satisfy the repository requirement.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Updates package pins for the 3.10.1 release.

• WebAssembly hosts resolve the updated server package versions.
• Persistence and extension projects declare Pkcs directly.
• Projects using the shared catalog resolve newer AutoMapper, MailKit, and NuGet.Protocol versions.

The full solution build and listed test suites have not been verified.

_{Reviews (2) · Last reviewed commit: "Pin transitive crypto package to patched..." · Reviewed by Greptile}

[sfmskywalker]

@greptileai

[elsa-workflows-review-bot]

Elsa 3 Code Review: APPROVE + HIGH @ 1ae581a

Code Review, Round 1/6

These are dependency bumps for the 3.10.1 line on release/3.10.0, in three commits, none of which changes code. All three are clean.

Cherry-pick of #9004 (b3876d7)

• git range-diff against c3c62163 shows an identical patch. The only addition is the (cherry picked from commit ...) trailer.
• Every Microsoft.AspNetCore.Components.WebAssembly.Server pin and reference resolves to 8.0.32, 9.0.21 or 10.0.13 in the root, apps/, extensions/src/, studio/src/ and the template hosts. No older version remains in any restored project.assets.json.

Root pin bumps (2c15eea)

Package	Before	After
AutoMapper	16.0.0	16.1.1
MailKit	4.14.1	4.16.0
NuGet.Protocol	7.0.1	7.0.3

None of these crosses a major version, and none changes a resolved package on this branch:

• No project references AutoMapper.
• MailKit and NuGet.Protocol are consumed only by Elsa.Email and Elsa.DropIns, which take their versions from extensions/src/Directory.Packages.props. That file already pins 4.16.0 and 7.0.3.

The bumps only keep the root file in line with the extensions scope.

Transitive crypto pin (1ae581a)

• git range-diff against #9124 @ c12a87b2 shows the patches are identical (1: c12a87b2c = 1: 1ae581a42), and the same 19 projects change.
• I ran dotnet pack -c Release on this head for all 19 projects. Every .nuspec lists Pkcs directly in each TFM group, with the same versions as on main:
  • 18 packages: 8.0.2 / 9.0.21 / 10.0.13 (net8.0 / net9.0 / net10.0).
  • Elsa.DropIns: 9.0.21 on net8.0 (with System.Formats.Asn1 9.0.21), 9.0.21 on net9.0, 10.0.13 on net10.0.
• In project.assets.json, the 19 projects resolve exactly those versions, with no NU1605/NU1608 or other restore warnings. Their full resolved package sets are identical to the #9124 head, so the two branches stay in step.
• The Elsa.DropIns net8.0 VersionOverride is the smallest way to express what NuGet.Packaging 7.0.3 requires there (Pkcs >= 9.0.6). I'm fine keeping it local, as on #9124.

Non-blocking

1. Same notes as #9124: a one-line comment on the Elsa.DropIns override would keep later bumps in step, and the netstandard entries are unused.
2. The root AutoMapper, MailKit and NuGet.Protocol pins are unused (from 2c15eea5). main removes them in #9122. If that cleanup is ever picked onto 3.10, these lines will conflict trivially.

Bot threads

• Greptile P2 (Elsa.DropIns.csproj:17, project-level versions): replied on the thread. No action needed, for the same reasons as on #9124. Resolved.
• CodeRabbit skipped this PR (non-default base branch).

CI

All checks on this head are green. This is approve-only: it targets a release branch and merges after 3.10.0 is tagged.

— Code Review (Elsa 3), via Elsa Review