Upgrade DMT to .NET 10 LTS and refresh build, packaging, documentation, and releases #258

Goal and timing

Upgrade DMT from .NET 8 to the latest serviced .NET 10 LTS release, including the application, every extension, tests, CI, packaging, documentation, and the published distribution artifacts.

.NET 8 support ends November 10, 2026. .NET 10 LTS is supported through November 14, 2028. .NET 9 also ends support on November 10, 2026, so it is not a useful intermediate target. See Microsoft's .NET support policy.

Start implementation only after the current PR batch below has been merged and integrated into a green main, per the maintainer's direction. This issue tracks the work; it does not authorize immediate framework changes or publication. Aim to complete the upgrade and publish supported artifacts before the .NET 8 support deadline.

Prerequisite PR batch

Resolve overlaps, preserve each fix, and revalidate against updated main rather than relying on checks from the separate original branches.

• Document multiple Cosmos DB sink accounts support with tests and examples #224 — multi-account documentation and regression coverage.
• Pin GitHub Actions to full-length commit SHAs #247 — action SHA pinning and valid Dependabot configuration.
• docs: clarify macOS setup and cross-platform migration tutorial #248 — macOS setup and cross-platform tutorial.
• Fix unreadable-source success reporting and JSON parse diagnostics #249 — unreadable-source failure reporting and JSON diagnostics.
• Fix global array item indices in streamed JSON errors #253 — accurate global indices in streamed JSON errors.
• Honor Cosmos service-directed 429 retries for regular and stream writes #254 — service-directed 429 retries for regular and stream writes.
• Fix Cosmos stream-write and delete partition-key type fidelity #255 — partition-key fidelity and explicit preview-emulator coverage.
• docs: add bundled JSON-to-SQL Server import sample #256 — bundled JSON-to-SQL sample and walkthrough.
• Fix Cosmos HTTP client lifecycle across sources, sinks and Operations #257 — Cosmos HTTP-client lifetime and offline credential isolation in tests.

Known integration concerns: #249/#253 overlap in JSON parsing; #254/#255/#257 overlap in Cosmos code/tests/docs. Preserve offline token credentials in all RBAC Cosmos constructor tests, including any added by #224: Cosmos SDK construction can acquire tokens in the background. Tests must not use a maintainer's signed-in Azure identity. Recheck these prerequisites when implementation begins; update this checklist if maintainers change the merge plan.

1. Establish the upgraded baseline

• Inventory all framework/runtime references after the prerequisite merges, including new documentation and helper scripts.
• Retarget core, shared interfaces/common libraries, every extension, and test projects together from net8.0 to net10.0. The current inventory has 26 project files; verify the count again after integration.
• Update publish profiles, extension output/discovery paths, build scripts, and any framework-specific test/tool paths. Current publish profiles explicitly name net8.0 directories.
• Make local and CI SDK selection reproducible using the repository's chosen SDK policy; avoid unintentionally building with a preview SDK.
• Review .NET 9 and .NET 10 breaking changes that affect this application's actual code paths, rather than only changing target-framework strings.

2. Dependencies and extension compatibility

• Review Directory.Packages.props and transitive dependencies for .NET 10 compatibility; update packages as needed without bundling unrelated feature upgrades.
• Resolve incompatible dependency constraints or document a maintainer-approved disposition. In particular, the current Cosmos Encryption 2.0.4 dependency declares Cosmos SDK <=3.37.0 while the repository selects 3.49.0 and emits NU1608; do not suppress the warning as a substitute for establishing compatibility.
• Verify MEF discovery and loading of every bundled extension under the new runtime, including JSON, Cosmos, MongoDB and its legacy/vector variants, SQL Server, PostgreSQL, Azure Table/Blob, AWS S3, CSV, Parquet, and Cognitive Search as applicable to each distribution.
• Check native dependencies and supported OS/architecture requirements, especially legacy MongoDB, database drivers, and platform-specific libraries. Do not silently drop a supported extension or operating system to make the build pass.
• Document any external/custom-extension rebuild or compatibility requirements arising from the shared-library/runtime upgrade.

3. CI, containers, and packaging

• Update .NET SDK setup and SDK container references in build/test/validation, Linux and Windows emulator, package, and release workflows.
• Update the Dockerfile's build and runtime-dependencies images, plus related container documentation/configuration. Verify native dependencies and base-OS compatibility rather than assuming a newer image tag is equivalent.
• Verify the shared build-with-plugins action and all six self-contained release targets: Windows, Linux, and macOS on x64 and ARM64.
• Preserve full-SHA action pinning and the corrected Dependabot policy from Pin GitHub Actions to full-length commit SHAs #247. If a build action must change for SDK support, verify its official commit and compatibility.
• Audit stale framework-specific artifact paths, including the existing net6.0 paths in the NuGet tool-packaging workflow. If that obsolete workflow is retained, bring it into alignment; otherwise seek an explicit decision to retire it. This upgrade must not silently resurrect .NET-tool distribution, which was deferred under TODO: Package as a .NET tool #6.
• Keep release/publishing workflows separate from validation. Do not publish packages, images, or releases while merely testing the upgrade.

4. Required validation

• Run the repository's complete applicable tests and GitHub Actions against the final upgraded commit. Update tests for intentional framework changes, not to conceal regressions.
• Exercise the recently added source-failure, JSON serialization/indexing, Cosmos retry-after, typed/missing/null/hierarchical partition-key, and HTTP-client lifetime regressions on .NET 10.
• Run Windows and stable Linux Cosmos emulator coverage with real integration tests confirmed executed. Retain the explicit, narrowly scoped vNext capability exclusions approved in Fix Cosmos stream-write and delete partition-key type fidelity #255; report pass/fail/skip counts, and do not introduce new exclusions without a decision.
• Preserve offline authentication test isolation. No live Entra consent/login attempts, real customer credentials, or production migrations during unit/integration validation.
• Smoke-test extension discovery and at least a local JSON-to-JSON migration from published outputs, not just source builds.
• Verify all six release artifacts are produced and inspect their bundled runtime/dependencies. A newer SDK installed on the build machine alone does not prove the executable contains the intended runtime.
• Build and smoke-test the Docker image with mounted configuration/data and extension discovery. Run native-platform smoke tests where available; distinguish cross-compilation from actual Windows/Linux/macOS execution.
• State live-service validation limits explicitly, including SQL Server imports and enterprise proxy/RBAC negotiation where no safe test environment is available.

5. Documentation and rollout

• Update README prerequisites, contributor/extension-authoring instructions, source-build commands, sample walkthroughs, and framework-specific paths, including the docs added by docs: clarify macOS setup and cross-platform migration tutorial #248 and docs: add bundled JSON-to-SQL Server import sample #256.
• Document supported operating systems/architectures, source-build SDK requirements, external extension compatibility, and any behavior changes users must account for.
• Explain that existing self-contained DMT downloads and containers embed their runtime: installing .NET 10 on the host does not upgrade an old DMT executable/image.
• Prepare release notes and agree the DMT release version with maintainers; keep runtime migration separate from unrelated features.
• After code review and release approval, build and publish new self-contained release archives and supported container tags through the normal release process.
• Verify the published artifacts/image contain the intended serviced .NET 10 runtime and that installation/download documentation points to them. Communicate the upgrade path to users of older releases.
• Establish ongoing runtime servicing for these bundled distributions so future .NET 10 security patches reach users through rebuilt DMT releases/images.

Completion criteria

The upgrade is not complete merely when a framework-retargeting PR merges. Application/extension compatibility, CI and distribution validation, documentation, and the approved publication/verification of .NET 10-based artifacts must all be accounted for. Track any separately scheduled rollout steps explicitly before closing this issue.

No implementation or release work has started under this issue.