DEFRA · dependabot · Nov 28, 2025 · Nov 28, 2025 · Nov 28, 2025 · Nov 28, 2025
diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "swashbuckle.aspnetcore.cli": {
-      "version": "8.1.1",
+      "version": "10.0.1",
       "commands": [
         "swagger"
       ],

diff --git a/Directory.Build.props b/Directory.Build.props
@@ -5,7 +5,7 @@
     <Nullable>enable</Nullable>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="SonarAnalyzer.CSharp" Version="10.15.0.120848">
+    <PackageReference Include="SonarAnalyzer.CSharp" Version="10.16.0.128591">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>

diff --git a/Makefile b/Makefile
@@ -1,14 +1,15 @@
-dependencies:
-	dotnet tool restore
-
-generate-openapi-spec: dependencies
-	dotnet build src/Api/Api.csproj -c Release
-	cp ./src/Api/bin/Release/net9.0/appsettings.json .
-	dotnet swagger tofile --output openapi.json ./src/Api/bin/Release/net9.0/Defra.TradeImportsDataApi.Api.dll v1
-	rm appsettings.json
-
-lint-openapi-spec: generate-openapi-spec
-	docker run --rm -v "$(PWD):/work:ro" dshanley/vacuum lint -d -r .vacuum.yml openapi.json
-
-lint-openapi-spec-errors: generate-openapi-spec
-	docker run --rm -v "$(PWD):/work:ro" dshanley/vacuum lint -d -e -r .vacuum.yml openapi.json
+dependencies:
+	dotnet tool restore
+
+generate-openapi-spec: dependencies
+	dotnet build src/Api/Api.csproj -c Release
+	cp ./src/Api/bin/Release/net9.0/appsettings.json .
+	dotnet build src/Api/Api.csproj -c Release -o publish
+	dotnet swagger tofile --output openapi.json ./src/Api/bin/Release/net9.0/Defra.TradeImportsDataApi.Api.dll v1
+	rm appsettings.json
+
+lint-openapi-spec: generate-openapi-spec
+	docker run --rm -v "$(PWD):/work:ro" dshanley/vacuum lint -d -r .vacuum.yml openapi.json
+
+lint-openapi-spec-errors: generate-openapi-spec
+	docker run --rm -v "$(PWD):/work:ro" dshanley/vacuum lint -d -e -r .vacuum.yml openapi.json
diff --git a/src/Api/Api.csproj b/src/Api/Api.csproj
@@ -15,23 +15,25 @@
     </Content>
   </ItemGroup>
   <ItemGroup>
+    <PackageReference Include="AWSSDK.Core" Version="4.0.3.3" />
     <PackageReference Include="Amazon.CloudWatch.EMF" Version="2.2.0" />
     <PackageReference Include="AspNetCore.HealthChecks.MongoDb" Version="9.0.0" />
-    <PackageReference Include="AWSSDK.Extensions.NETCore.Setup" Version="3.7.400" />
-    <PackageReference Include="AWSSDK.SimpleNotificationService" Version="3.7.400.147" />
+    <PackageReference Include="AWSSDK.Extensions.NETCore.Setup" Version="4.0.3.14" />
+    <PackageReference Include="AWSSDK.SecurityToken" Version="4.0.5.1" />
+    <PackageReference Include="AWSSDK.SimpleNotificationService" Version="4.0.2.7" />
     <PackageReference Include="Elastic.CommonSchema.Serilog" Version="9.0.0" />
     <PackageReference Include="Elastic.Serilog.Enrichers.Web" Version="9.0.0" />
     <PackageReference Include="FluentValidation" Version="12.1.0" />
-    <PackageReference Include="Microsoft.AspNetCore.HeaderPropagation" Version="9.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="9.10.0" />
-    <PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />
-    <PackageReference Include="Serilog.Enrichers.ClientInfo" Version="2.6.0" />
+    <PackageReference Include="Microsoft.AspNetCore.HeaderPropagation" Version="9.0.11" />
+    <PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.0.0" />
+    <PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
+    <PackageReference Include="Serilog.Enrichers.ClientInfo" Version="2.7.0" />
     <PackageReference Include="Serilog.Enrichers.Environment" Version="3.0.1" />
     <PackageReference Include="Serilog.Enrichers.Thread" Version="4.0.0" />
-    <PackageReference Include="Serilog.Settings.Configuration" Version="9.0.0" />
+    <PackageReference Include="Serilog.Settings.Configuration" Version="10.0.0" />
     <PackageReference Include="Serilog.Sinks.Async" Version="2.1.0" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.6" />
-    <PackageReference Include="Swashbuckle.AspNetCore.ReDoc" Version="9.0.6" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.0.1" />
+    <PackageReference Include="Swashbuckle.AspNetCore.ReDoc" Version="10.0.1" />
     <PackageReference Include="JsonPath.Net" Version="2.1.1" />
     <PackageReference Include="JsonPatch.Net" Version="3.3.0" />
   </ItemGroup>

diff --git a/src/Api/OpenApi/JsonConverterSchemaFilter.cs b/src/Api/OpenApi/JsonConverterSchemaFilter.cs
@@ -1,18 +1,23 @@
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 
 namespace Defra.TradeImportsDataApi.Api.OpenApi;
 
 public class JsonConverterSchemaFilter : ISchemaFilter
 {
-    public void Apply(OpenApiSchema schema, SchemaFilterContext context)
+    public void Apply(IOpenApiSchema schema, SchemaFilterContext context)
     {
-        foreach (var property in schema.Properties)
+        var properties = schema.Properties ?? new Dictionary<string, IOpenApiSchema>();
+        foreach (var property in properties)
         {
-            if (context.Type == typeof(Domain.CustomsDeclaration.ImportDocument) && property.Key == "documentReference")
+            if (
+                property.Value is OpenApiSchema openApiSchema
+                && context.Type == typeof(Domain.CustomsDeclaration.ImportDocument)
+                && property.Key == "documentReference"
+            )
             {
-                property.Value.Type = "string";
-                property.Value.AllOf.Clear();
+                openApiSchema.Type = JsonSchemaType.String;
+                openApiSchema.AllOf?.Clear();
             }
         }
     }

diff --git a/src/Api/OpenApi/PossibleValueOperationFilter.cs b/src/Api/OpenApi/PossibleValueOperationFilter.cs
@@ -1,7 +1,7 @@
 using System.Reflection;
 using Defra.TradeImportsDataApi.Domain.Attributes;
 using Defra.TradeImportsDataApi.Domain.Ipaffs;
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 
 namespace Defra.TradeImportsDataApi.Api.OpenApi;
@@ -46,7 +46,7 @@ private static void HandleNotificationUpdatesStatusQueryParam(OpenApiOperation o
         AppendPossibleValues(typeof(ImportPreNotification).GetMember(nameof(ImportPreNotification.Status)), parameter);
     }
 
-    private static void AppendPossibleValues(MemberInfo[] member, OpenApiParameter parameter)
+    private static void AppendPossibleValues(MemberInfo[] member, IOpenApiParameter parameter)
     {
         var possibleValues =
             member

diff --git a/src/Api/OpenApi/PossibleValueSchemaFilter.cs b/src/Api/OpenApi/PossibleValueSchemaFilter.cs
@@ -1,6 +1,5 @@
 using Defra.TradeImportsDataApi.Domain.Attributes;
-using Microsoft.OpenApi.Any;
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 using Swashbuckle.AspNetCore.SwaggerGen;
 
 namespace Defra.TradeImportsDataApi.Api.OpenApi;
@@ -15,7 +14,7 @@ public class PossibleValueSchemaFilter : ISchemaFilter
         { "GVMS", "v1.0 (private beta)" },
     };
 
-    public void Apply(OpenApiSchema schema, SchemaFilterContext context)
+    public void Apply(IOpenApiSchema schema, SchemaFilterContext context)
     {
         var possibleValues =
             context.MemberInfo?.CustomAttributes.Where(x => x.AttributeType == typeof(PossibleValueAttribute)).ToList()
@@ -38,14 +37,5 @@ public void Apply(OpenApiSchema schema, SchemaFilterContext context)
             schema.Description += " ";
 
         schema.Description += $"Possible values taken from {system} schema version {s_systemVersionMap[system]}.";
-
-        foreach (
-            var description in possibleValues
-                .Select(possibleValue => possibleValue.ConstructorArguments.FirstOrDefault().Value?.ToString())
-                .Where(description => !string.IsNullOrWhiteSpace(description))
-        )
-        {
-            schema.Enum.Add(new OpenApiString(description));
-        }
     }
 }
diff --git a/src/Api/OpenApi/ServiceCollectionExtensions.cs b/src/Api/OpenApi/ServiceCollectionExtensions.cs
@@ -1,7 +1,7 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Reflection;
 using Defra.TradeImportsDataApi.Domain.Ipaffs;
-using Microsoft.OpenApi.Models;
+using Microsoft.OpenApi;
 
 namespace Defra.TradeImportsDataApi.Api.OpenApi;
 
@@ -26,18 +26,10 @@ public static void AddOpenApi(this IServiceCollection services, IConfiguration c
                     Type = SecuritySchemeType.Http,
                 }
             );
-            c.AddSecurityRequirement(
-                new OpenApiSecurityRequirement
-                {
-                    {
-                        new OpenApiSecurityScheme
-                        {
-                            Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "Basic" },
-                        },
-                        []
-                    },
-                }
-            );
+            c.AddSecurityRequirement(document => new OpenApiSecurityRequirement
+            {
+                [new OpenApiSecuritySchemeReference("Basic", document)] = [],
+            });
             c.IncludeXmlComments(Assembly.GetExecutingAssembly());
             c.IncludeXmlComments(typeof(ImportPreNotification).Assembly);
             c.SchemaFilter<PossibleValueSchemaFilter>();

diff --git a/src/Data/Data.csproj b/src/Data/Data.csproj
@@ -7,14 +7,14 @@
     <Nullable>enable</Nullable>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="9.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="9.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="9.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="9.0.10" />
-    <PackageReference Include="Microsoft.Extensions.Options.DataAnnotations" Version="9.0.10" />
-    <PackageReference Include="MongoDB.Driver.Authentication.AWS" Version="3.5.0" />
-    <PackageReference Include="MongoDB.Driver" Version="3.5.0" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.0" />
+    <PackageReference Include="MongoDB.Driver.Authentication.AWS" Version="3.5.2" />
+    <PackageReference Include="MongoDB.Driver" Version="3.5.2" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\Domain\Domain.csproj" />

diff --git a/tests/Api.Client.Tests/Api.Client.Tests.csproj b/tests/Api.Client.Tests/Api.Client.Tests.csproj
@@ -11,7 +11,7 @@
     <PackageReference Include="FluentValidation" Version="12.1.0" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="9.0.11" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.6" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.0.1" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>

diff --git a/tests/Api.IntegrationTests/Api.IntegrationTests.csproj b/tests/Api.IntegrationTests/Api.IntegrationTests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <TargetFramework>net9.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
@@ -12,11 +12,11 @@
     </EmbeddedResource>
   </ItemGroup>
   <ItemGroup>
-    <PackageReference Include="AWSSDK.SQS" Version="3.7.400.147" />
+    <PackageReference Include="AWSSDK.SQS" Version="4.0.2.5" />
     <PackageReference Include="FluentValidation" Version="12.1.0" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="9.0.11" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.6" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.0.1" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>

diff --git a/tests/Api.IntegrationTests/Endpoints/SqsTestBase.cs b/tests/Api.IntegrationTests/Endpoints/SqsTestBase.cs
@@ -48,8 +48,9 @@ protected async Task DrainAllMessages()
             await AsyncWaiter.WaitForAsync(async () =>
             {
                 var response = await ReceiveMessage();
+                var messages = response.Messages ?? [];
 
-                foreach (var message in response.Messages)
+                foreach (var message in messages)
                 {
                     testOutputHelper?.WriteLine("Drain message: {0} {1}", message.MessageId, message.Body);
 

diff --git a/tests/Api.Tests/Api.Tests.csproj b/tests/Api.Tests/Api.Tests.csproj
@@ -9,10 +9,10 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="FluentValidation" Version="12.1.0" />
-    <PackageReference Include="Microsoft.Extensions.Diagnostics.Testing" Version="9.10.0" />
+    <PackageReference Include="Microsoft.Extensions.Diagnostics.Testing" Version="10.0.0" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="9.0.11" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.6" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.0.1" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>