From 9b1066d0eaa8196b77f1bd897d5feb3bff644b9e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 20:43:32 +0000
Subject: [PATCH] Bump AWSSDK.S3 and 36 others

Bumps AWSSDK.S3 from 4.0.23.4 to 4.0.101.6
Bumps Azure.Extensions.AspNetCore.DataProtection.Keys from 1.2.4 to 1.6.3
Bumps Azure.Storage.Blobs from 12.27.0 to 12.29.1
Bumps BCrypt.Net-Next from 4.0.3 to 4.2.0
Bumps dotnet-reportgenerator-globaltool from 5.5.9 to 5.5.11
Bumps FluentAssertions from 8.4.0 to 8.10.0
Bumps FluentValidation from 11.11.0 to 11.12.0
Bumps FluentValidation.DependencyInjectionExtensions from 11.11.0 to 11.12.0
Bumps ITfoxtec.Identity.Saml2 from 4.18.0 to 4.20.1
Bumps MailKit from 4.16.0 to 4.17.0
Bumps Mapster from 10.0.0 to 10.0.11
Bumps Mapster.DependencyInjection from 10.0.0 to 10.0.11
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.8 to 10.0.10
Bumps Microsoft.AspNetCore.Authentication.OpenIdConnect from 10.0.8 to 10.0.10
Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.8 to 10.0.10
Bumps Microsoft.AspNetCore.OutputCaching.StackExchangeRedis from 10.0.1 to 10.0.10
Bumps Microsoft.EntityFrameworkCore from 10.0.8 to 10.0.10
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.8 to 10.0.10
Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.8 to 10.0.10
Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.8 to 10.0.10
Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.8 to 10.0.10
Bumps Microsoft.Extensions.Options from 10.0.8 to 10.0.10
Bumps Microsoft.Extensions.Options.DataAnnotations from 10.0.8 to 10.0.10
Bumps Npgsql.EntityFrameworkCore.PostgreSQL from 10.0.1 to 10.0.3
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.15.3 to 1.17.0
Bumps OpenTelemetry.Extensions.Hosting from 1.15.3 to 1.17.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.15.2 to 1.17.0
Bumps OpenTelemetry.Instrumentation.Http from 1.15.1 to 1.17.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.10.0 to 1.17.0
Bumps Otp.NET from 1.4.0 to 1.4.1
Bumps Serilog.Sinks.Grafana.Loki from 8.3.0 to 8.3.2
Bumps SonarAnalyzer.CSharp from 10.25.0.139117 to 10.31.0.145097
Bumps SQLitePCLRaw.bundle_e_sqlite3 from 3.0.3 to 3.0.5
Bumps StackExchange.Redis from 2.12.14 to 2.13.17
Bumps System.IdentityModel.Tokens.Jwt from 8.18.0 to 8.22.0
Bumps System.Security.Cryptography.Xml from 10.0.8 to 10.0.10
Bumps xunit.runner.visualstudio from 3.1.4 to 3.1.5

---
updated-dependencies:
- dependency-name: AWSSDK.S3
  dependency-version: 4.0.101.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Azure.Extensions.AspNetCore.DataProtection.Keys
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: Azure.Storage.Blobs
  dependency-version: 12.29.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: BCrypt.Net-Next
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: dotnet-reportgenerator-globaltool
  dependency-version: 5.5.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: FluentAssertions
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: FluentAssertions
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: FluentAssertions
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: FluentAssertions
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: FluentAssertions
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: FluentValidation
  dependency-version: 11.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: FluentValidation.DependencyInjectionExtensions
  dependency-version: 11.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: ITfoxtec.Identity.Saml2
  dependency-version: 4.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: ITfoxtec.Identity.Saml2
  dependency-version: 4.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: MailKit
  dependency-version: 4.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: Mapster
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Mapster.DependencyInjection
  dependency-version: 10.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.AspNetCore.Authentication.OpenIdConnect
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.AspNetCore.OutputCaching.StackExchangeRedis
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Design
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.Extensions.Logging.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.Extensions.Options
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Microsoft.Extensions.Options.DataAnnotations
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Npgsql.EntityFrameworkCore.PostgreSQL
  dependency-version: 10.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: Otp.NET
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: Serilog.Sinks.Grafana.Loki
  dependency-version: 8.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.31.0.145097
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: SQLitePCLRaw.bundle_e_sqlite3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: SQLitePCLRaw.bundle_e_sqlite3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: StackExchange.Redis
  dependency-version: 2.13.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: System.IdentityModel.Tokens.Jwt
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-minor-and-patch
- dependency-name: System.Security.Cryptography.Xml
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: System.Security.Cryptography.Xml
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: System.Security.Cryptography.Xml
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .config/dotnet-tools.json                     |  2 +-
 Directory.Build.props                         |  2 +-
 .../SmoothOperator.Api.csproj                 | 12 +++---
 .../SmoothOperator.Application.csproj         | 18 ++++----
 .../SmoothOperator.Infrastructure.csproj      | 42 ++++++++++---------
 .../SmoothOperator.Api.Tests.csproj           | 16 +++----
 .../SmoothOperator.Application.Tests.csproj   |  4 +-
 .../SmoothOperator.ArchitectureTests.csproj   |  4 +-
 .../SmoothOperator.Domain.Tests.csproj        |  4 +-
 ...SmoothOperator.Infrastructure.Tests.csproj | 12 +++---
 10 files changed, 60 insertions(+), 56 deletions(-)

diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
index c62edc8c..074c30eb 100644
--- a/.config/dotnet-tools.json
+++ b/.config/dotnet-tools.json
@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "dotnet-reportgenerator-globaltool": {
-      "version": "5.5.9",
+      "version": "5.5.11",
       "commands": [
         "reportgenerator"
       ],
diff --git a/Directory.Build.props b/Directory.Build.props
index d93fd403..5537d958 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -18,7 +18,7 @@
 
   <!-- SonarAnalyzer applied to all projects for code-smell detection at build time. -->
   <ItemGroup>
-    <PackageReference Include="SonarAnalyzer.CSharp" Version="10.25.0.139117">
+    <PackageReference Include="SonarAnalyzer.CSharp" Version="10.31.0.145097">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
diff --git a/backend/src/SmoothOperator.Api/SmoothOperator.Api.csproj b/backend/src/SmoothOperator.Api/SmoothOperator.Api.csproj
index 143998d3..f459e9d1 100644
--- a/backend/src/SmoothOperator.Api/SmoothOperator.Api.csproj
+++ b/backend/src/SmoothOperator.Api/SmoothOperator.Api.csproj
@@ -21,13 +21,13 @@
 
   <ItemGroup>
     <PackageReference Include="AspNetCore.HealthChecks.NpgSql" Version="9.0.0" />
-    <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Keys" Version="1.2.4" />
+    <PackageReference Include="Azure.Extensions.AspNetCore.DataProtection.Keys" Version="1.6.3" />
     <PackageReference Include="AspNetCore.HealthChecks.Redis" Version="9.0.0" />
-    <PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="11.11.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.8" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.8" />
-    <PackageReference Include="Microsoft.AspNetCore.OutputCaching.StackExchangeRedis" Version="10.0.1" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.8">
+    <PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="11.12.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.10" />
+    <PackageReference Include="Microsoft.AspNetCore.OutputCaching.StackExchangeRedis" Version="10.0.10" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
diff --git a/backend/src/SmoothOperator.Application/SmoothOperator.Application.csproj b/backend/src/SmoothOperator.Application/SmoothOperator.Application.csproj
index 9dbda796..12d312f6 100644
--- a/backend/src/SmoothOperator.Application/SmoothOperator.Application.csproj
+++ b/backend/src/SmoothOperator.Application/SmoothOperator.Application.csproj
@@ -14,20 +14,20 @@
 
   <!-- Options classes use DataAnnotations for validation -->
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.8" />
-    <PackageReference Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.8" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options.DataAnnotations" Version="10.0.10" />
   </ItemGroup>
 
   <!-- CQRS / Validation / Mapping -->
   <ItemGroup>
     <PackageReference Include="MediatR" Version="12.5.0" />
-    <PackageReference Include="FluentValidation" Version="11.11.0" />
-    <PackageReference Include="Mapster" Version="10.0.0" />
-    <PackageReference Include="Mapster.DependencyInjection" Version="10.0.0" />
-    <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
-    <PackageReference Include="Otp.NET" Version="1.4.0" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.8" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.8" />
+    <PackageReference Include="FluentValidation" Version="11.12.0" />
+    <PackageReference Include="Mapster" Version="10.0.11" />
+    <PackageReference Include="Mapster.DependencyInjection" Version="10.0.11" />
+    <PackageReference Include="BCrypt.Net-Next" Version="4.2.0" />
+    <PackageReference Include="Otp.NET" Version="1.4.1" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.10" />
   </ItemGroup>
 
 </Project>
diff --git a/backend/src/SmoothOperator.Infrastructure/SmoothOperator.Infrastructure.csproj b/backend/src/SmoothOperator.Infrastructure/SmoothOperator.Infrastructure.csproj
index 32f17d28..949d9a58 100644
--- a/backend/src/SmoothOperator.Infrastructure/SmoothOperator.Infrastructure.csproj
+++ b/backend/src/SmoothOperator.Infrastructure/SmoothOperator.Infrastructure.csproj
@@ -19,54 +19,58 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
-    <PackageReference Include="Otp.NET" Version="1.4.0" />
+    <PackageReference Include="BCrypt.Net-Next" Version="4.2.0" />
+    <PackageReference Include="FluentValidation" Version="11.12.0" />
+    <PackageReference Include="Mapster" Version="10.0.11" />
+    <PackageReference Include="Mapster.DependencyInjection" Version="10.0.11" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
+    <PackageReference Include="Otp.NET" Version="1.4.1" />
     <PackageReference Include="Duende.IdentityModel" Version="8.1.0" />
-    <PackageReference Include="ITfoxtec.Identity.Saml2" Version="4.18.0" />
+    <PackageReference Include="ITfoxtec.Identity.Saml2" Version="4.20.1" />
     <!-- ITfoxtec.Identity.Saml2 pulls Microsoft.IdentityModel.Tokens 8.15.0 transitively
          while Microsoft.AspNetCore.Authentication.JwtBearer floors JsonWebTokens / Protocols
          at 8.0.1. The version split causes JsonWebTokens 8.0.1 to call a Base64UrlEncoder
          overload that doesn't exist in Tokens 8.15.0 (MissingMethodException -> every token
          is rejected as "invalid_token"). Pin the whole IdentityModel set to 8.15.0. -->
-    <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.18.0" />
+    <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.22.0" />
     <PackageReference Include="Microsoft.IdentityModel.Protocols" Version="8.18.0" />
     <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.18.0" />
-    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.18.0" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.22.0" />
     <!-- Pin EFCore.Relational to 10.0.7 to align with EFCore.InMemory used by tests
          and avoid MSB3277 version conflict against Npgsql.EntityFrameworkCore.PostgreSQL. -->
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.8" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.8">
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="MailKit" Version="4.16.0" />
-    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.1" />
-    <PackageReference Include="StackExchange.Redis" Version="2.12.14" />
+    <PackageReference Include="MailKit" Version="4.17.0" />
+    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
+    <PackageReference Include="StackExchange.Redis" Version="2.13.17" />
 
     <!-- Structured logging + Loki sink -->
     <PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />
     <PackageReference Include="Serilog.Enrichers.Environment" Version="3.0.1" />
     <PackageReference Include="Serilog.Enrichers.Thread" Version="4.0.0" />
-    <PackageReference Include="Serilog.Sinks.Grafana.Loki" Version="8.3.0" />
+    <PackageReference Include="Serilog.Sinks.Grafana.Loki" Version="8.3.2" />
 
     <!-- Prometheus metrics -->
     <PackageReference Include="prometheus-net.AspNetCore" Version="8.2.1" />
 
     <!-- OpenTelemetry distributed tracing -->
-    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.15.3" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.2" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.15.1" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.Runtime" Version="1.10.0" />
-    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
-  <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.8" />
+    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Runtime" Version="1.17.0" />
+    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
+  <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
     <!-- Azure Key Vault integration -->
     <PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.11.0" />
     <PackageReference Include="Azure.Identity" Version="1.21.0" />
 
     <!-- Session recording storage backends (v1.0.2) -->
-    <PackageReference Include="Azure.Storage.Blobs" Version="12.27.0" />
+    <PackageReference Include="Azure.Storage.Blobs" Version="12.29.1" />
     <!-- AWSSDK.S3 4.0.23+ pulls AWSSDK.Core >= 4.0.0.32, which patches GHSA-9cvc-h2w8-phrp -->
-    <PackageReference Include="AWSSDK.S3" Version="4.0.23.4" />
+    <PackageReference Include="AWSSDK.S3" Version="4.0.101.6" />
   </ItemGroup>
 
 </Project>
diff --git a/backend/tests/SmoothOperator.Api.Tests/SmoothOperator.Api.Tests.csproj b/backend/tests/SmoothOperator.Api.Tests/SmoothOperator.Api.Tests.csproj
index 6ad2a2c5..2d8d73fe 100644
--- a/backend/tests/SmoothOperator.Api.Tests/SmoothOperator.Api.Tests.csproj
+++ b/backend/tests/SmoothOperator.Api.Tests/SmoothOperator.Api.Tests.csproj
@@ -14,23 +14,23 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="FluentAssertions" Version="8.4.0" />
-    <PackageReference Include="ITfoxtec.Identity.Saml2" Version="4.18.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.8" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.8" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.8" />
+    <PackageReference Include="FluentAssertions" Version="8.10.0" />
+    <PackageReference Include="ITfoxtec.Identity.Saml2" Version="4.20.1" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
     <!-- Override the vulnerable SQLitePCLRaw 2.1.11 (GHSA-2m69-gcr7-jv3q, native SQLite
          < 3.50.2) pulled in via Microsoft.EntityFrameworkCore.Sqlite. The 2.1.x line has
          no patched release; the fix only exists in the 3.x line (bundles SQLite 3.50.2+). -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.5" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="Moq" Version="4.20.72" />
     <!-- Override the vulnerable System.Security.Cryptography.Xml 10.0.0 transitively
          pulled in via the backend's ITfoxtec.Identity.Saml2 dep (NU1903). The Web SDK
          auto-prunes this package, but the Test SDK does not, so we pin it here. -->
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.8" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/backend/tests/SmoothOperator.Application.Tests/SmoothOperator.Application.Tests.csproj b/backend/tests/SmoothOperator.Application.Tests/SmoothOperator.Application.Tests.csproj
index cc60392e..f3177a78 100644
--- a/backend/tests/SmoothOperator.Application.Tests/SmoothOperator.Application.Tests.csproj
+++ b/backend/tests/SmoothOperator.Application.Tests/SmoothOperator.Application.Tests.csproj
@@ -9,11 +9,11 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="FluentAssertions" Version="8.4.0" />
+    <PackageReference Include="FluentAssertions" Version="8.10.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="Moq" Version="4.20.72" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/backend/tests/SmoothOperator.ArchitectureTests/SmoothOperator.ArchitectureTests.csproj b/backend/tests/SmoothOperator.ArchitectureTests/SmoothOperator.ArchitectureTests.csproj
index 41411c23..df8adca6 100644
--- a/backend/tests/SmoothOperator.ArchitectureTests/SmoothOperator.ArchitectureTests.csproj
+++ b/backend/tests/SmoothOperator.ArchitectureTests/SmoothOperator.ArchitectureTests.csproj
@@ -9,11 +9,11 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="FluentAssertions" Version="8.4.0" />
+    <PackageReference Include="FluentAssertions" Version="8.10.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="NetArchTest.Rules" Version="1.3.2" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/backend/tests/SmoothOperator.Domain.Tests/SmoothOperator.Domain.Tests.csproj b/backend/tests/SmoothOperator.Domain.Tests/SmoothOperator.Domain.Tests.csproj
index b66c8b34..ce10aeac 100644
--- a/backend/tests/SmoothOperator.Domain.Tests/SmoothOperator.Domain.Tests.csproj
+++ b/backend/tests/SmoothOperator.Domain.Tests/SmoothOperator.Domain.Tests.csproj
@@ -9,10 +9,10 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="FluentAssertions" Version="8.4.0" />
+    <PackageReference Include="FluentAssertions" Version="8.10.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/backend/tests/SmoothOperator.Infrastructure.Tests/SmoothOperator.Infrastructure.Tests.csproj b/backend/tests/SmoothOperator.Infrastructure.Tests/SmoothOperator.Infrastructure.Tests.csproj
index 5854c35e..027cdb22 100644
--- a/backend/tests/SmoothOperator.Infrastructure.Tests/SmoothOperator.Infrastructure.Tests.csproj
+++ b/backend/tests/SmoothOperator.Infrastructure.Tests/SmoothOperator.Infrastructure.Tests.csproj
@@ -9,19 +9,19 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
-    <PackageReference Include="FluentAssertions" Version="8.4.0" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.8" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.8" />
+    <PackageReference Include="FluentAssertions" Version="8.10.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
     <!-- Override the vulnerable SQLitePCLRaw 2.1.11 (GHSA-2m69-gcr7-jv3q, native SQLite
          < 3.50.2) pulled in via Microsoft.EntityFrameworkCore.Sqlite. The 2.1.x line has
          no patched release; the fix only exists in the 3.x line (bundles SQLite 3.50.2+). -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.5" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="Moq" Version="4.20.72" />
     <!-- Override vulnerable System.Security.Cryptography.Xml 10.0.0 (NU1903) from ITfoxtec transitive dep. -->
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.8" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 
   <ItemGroup>