Fix all Snyk NuGet vulnerabilities: move to .NET 8 LTS and patched packages

[devin-ai-integration]

Summary

Clears every open-source vulnerability Snyk reported (snyk test --all-projects: 10 issues / 19 vulnerable paths in Infrastructure + 9 / 24 in WebApi.Tests → 0 across all 6 projects) with manifest-only changes — no source code changes were needed.

Three moves:

1. net7.0 → net8.0 in all 6 csproj files, with .NET 7/8 base images in the Dockerfile and dotnet-version: 8.0.x in CI (was 6.0.x, which never matched the net7.0 target). .NET 7 is EOL; this is what makes the 8.x patched package versions installable and removes the EOL sdk:7.0 / aspnet:7.0 OS vuln surface (35 crit / 184 high and 14 crit / 96 high respectively).
2. Dropped Microsoft.EntityFrameworkCore.SqlServer from Infrastructure.csproj. The app is PostgreSQL-only (grep -rn SqlServer --include=*.cs → no hits); the package was unused and was the sole source of 6 findings via Microsoft.Data.SqlClient@5.0.2 (Azure.Identity RCE, Microsoft.Data.SqlClient credential exposure, System.Drawing.Common RCE, System.IdentityModel.Tokens.Jwt / Microsoft.IdentityModel.JsonWebTokens DoS, System.Formats.Asn1).
3. Version bumps to the lowest patched 8.x lines: EF Core 7.0.10 → 8.0.10, Npgsql 7.0.4 → 8.0.5, Npgsql EF provider + NodaTime 7.0.4 → 8.0.10, AspNetCore.HealthChecks.NpgSql 7.0.0 → 8.0.1, Microsoft.AspNetCore.OpenApi 7.0.9 → 8.0.10, and the test stack (FakeItEasy 7.4.0 → 8.3.0, Microsoft.NET.Test.Sdk 17.5.0 → 17.11.1, xunit 2.4.2 → 2.9.2, xunit.runner.visualstudio 2.4.5 → 2.8.2, coverlet.collector 3.2.0 → 6.0.2) which removed the System.Formats.Asn1 path via FakeItEasy > Castle.Core > NETStandard.Library.

Vulnerabilities fixed

Snyk ID	Severity	Package (was → now)	Source
SNYK-DOTNET-NPGSQL-6825563 (SQL Injection)	High	Npgsql 7.0.4 → 8.0.5	src/Infrastructure/Infrastructure.csproj, transitively src/WebApi via HealthChecks.NpgSql
SNYK-DOTNET-AZUREIDENTITY-6009155 (RCE)	High	Azure.Identity 1.6.0 → removed	src/Infrastructure/Infrastructure.csproj (EFCore.SqlServer → Microsoft.Data.SqlClient)
SNYK-DOTNET-AZUREIDENTITY-6597976 (Info exposure)	Medium	Azure.Identity 1.6.0 → removed	same
SNYK-DOTNET-AZUREIDENTITY-7246762 (Race condition)	Medium	Azure.Identity 1.6.0 → removed	same
SNYK-DOTNET-MICROSOFTDATASQLCLIENT-6149434 (Unprotected credential storage)	High	Microsoft.Data.SqlClient 5.0.2 → removed	same
SNYK-DOTNET-SYSTEMDRAWINGCOMMON-3063427 (RCE)	High	System.Drawing.Common 5.0.0 → removed	same
SNYK-DOTNET-SYSTEMIDENTITYMODELTOKENSJWT-6148655 (DoS)	Medium	System.IdentityModel.Tokens.Jwt 6.21.0 → removed	same
SNYK-DOTNET-MICROSOFTIDENTITYMODELJSONWEBTOKENS-6148656 (DoS)	Medium	Microsoft.IdentityModel.JsonWebTokens 6.21.0 → removed	same
SNYK-DOTNET-SYSTEMFORMATSASN1-7443633 (Improper input validation)	Medium	System.Formats.Asn1 5.0.0 → patched transitive	src/Infrastructure, tests/* via FakeItEasy/Castle.Core
SNYK-DOTNET-SYSTEMTEXTJSON-7433719 (DoS)	High	System.Text.Json 7.0.0 → 8.0.x (via EFCore.Design 8.0.10)	src/Infrastructure/Infrastructure.csproj

Verification

• Before: Tested 6 projects, 3 contained vulnerable paths — 28 high / 35 medium per the dashboard scan.
• After: Tested 6 projects, no vulnerable paths were found. (0 critical / 0 high / 0 medium / 0 low)
• dotnet restore && dotnet build → succeeded, 0 errors (3 pre-existing nullability warnings unchanged); dotnet test → 20/20 passing (6 Application + 14 WebApi).

No lockfiles exist in this repo, so there is no manifest churn beyond the csproj edits. Nothing was suppressed or ignored, and no tests were modified.

Not fixed

Nothing outstanding on the NuGet side. Note that CI's actions/setup-dotnet version was bumped to 8.0.x as part of the retarget; if the deployment pipeline pins .NET 7 runtimes elsewhere (outside this repo), it needs the same move to 8.0.

Link to Devin session: https://app.devin.ai/sessions/a9d79b584e454267922a9c093a8454ef
Open in Devin Desktop: https://app.devin.ai/desktop/session/a9d79b584e454267922a9c093a8454ef?variant=devin
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring