Dependencies

A summary of the major external dependencies Bitwarden Server pulls in. Versions reflect main at commit 27ae3d54. Always check the actual .csproj for the source of truth.

Runtime

• .NET 8.0 (<TargetFramework>net8.0</TargetFramework> from Directory.Build.props).
• Bitwarden.Server.Sdk 1.5.2 — pinned in global.json as a build-time MSBuild SDK; provides shared aspect helpers, telemetry conventions, and packaging infra used across Bitwarden's .NET repos.
• Bitwarden.Server.Sdk.Features 1.0.7-rc.7 — feature-flag MSBuild SDK consumed in features-aware projects.

ASP.NET Core packages (8.0.x)

• Microsoft.AspNetCore.* — controllers, auth, hosting, SignalR.
• Microsoft.AspNetCore.SignalR.StackExchangeRedis 8.0.8 — Notifications backplane.
• Microsoft.AspNetCore.SignalR.Protocols.MessagePack 8.0.8 — compact wire format for SignalR.

Data access

Package	Version	Where
Dapper	2.1.66	src/Infrastructure.Dapper (SQL Server).
Microsoft.Data.SqlClient	7.0.0	SQL Server driver.
Microsoft.EntityFrameworkCore.SqlServer	8.0.8	EF for SQL Server.
Microsoft.EntityFrameworkCore.Sqlite	8.0.8	EF for SQLite.
Pomelo.EntityFrameworkCore.MySql	8.0.2	EF for MySQL / MariaDB.
Npgsql.EntityFrameworkCore.PostgreSQL	8.0.4	EF for PostgreSQL.
Microsoft.EntityFrameworkCore.Design	8.0.8	Migrations tooling per provider in util/<Provider>Migrations.
Microsoft.EntityFrameworkCore.Relational	8.0.8	Shared infra.
Microsoft.Azure.Cosmos	3.52.0	Audit-event sink (cloud).
Azure.Data.Tables	12.11.0	Audit-event sink (cloud).

Auth / IdentityServer

• Duende.IdentityServer 7.4.6 — token issuer in src/Identity/.
• Sustainsys.Saml2.AspNetCore2 2.11.0 — SAML 2.0 in the Sso host.
• fido2-net-lib — WebAuthn / FIDO2 (transitively).
• YubicoDotNetClient 1.2.0 — YubiKey OTP validation.

Storage / messaging

• Azure.Storage.Blobs 12.26.0, Azure.Storage.Blobs.Batch 12.23.0 — attachments, sends, data-protection keys.
• Azure.Storage.Queues 12.24.0 — events queue.
• Azure.Messaging.ServiceBus 7.20.1 — application-cache + push topics.
• Azure.Messaging.EventGrid 5.0.0 — Stripe webhook fanout (src/Api).
• Azure.Extensions.AspNetCore.DataProtection.Blobs 1.3.4 — persisted data-protection keys in cloud.
• Microsoft.Azure.NotificationHubs 4.2.0 — mobile push.
• RabbitMQ.Client 7.1.2 — self-host alternative to Service Bus.

Mail

• MailKit 4.16.0 — SMTP / IMAP client. Used by the Mail SMTP transport.
• Handlebars.Net 2.1.6 — templates for HandlebarsMailService and the Setup utility.
• SendGrid + Mailgun + Amazon SES SDK packages (transitively or directly per project).

Billing

• Stripe.net 48.5.0 — Stripe API + webhooks.
• Braintree 5.36.0 — PayPal / Braintree.
• BitPay.Light 1.0.1907 — BitPay.

Caching / rate limiting

• AspNetCoreRateLimit 5.0.0 + AspNetCoreRateLimit.Redis 2.0.0 — IP-based limits.
• StackExchange.Redis (transitive) — distributed cache backend.

Logging & observability

• Serilog family — structured logging. Serilog.Extensions.Logging.File 3.0.0 for self-host file sinks.
• Sentry / Application Insights are wired through globalSettings (cloud only).

Scheduling

• Quartz 3.15.1 + Quartz.Extensions.Hosting / DependencyInjection — every cron-style job in src/Api/Jobs, src/Notifications/Jobs, etc.

Test stack

• xUnit 2.6.6
• xunit.runner.visualstudio 2.5.6
• NSubstitute 5.1.0
• AutoFixture 4.18.1 + AutoFixture.Xunit2 + AutoFixture.AutoNSubstitute
• Coverlet.collector 6.0.0
• Microsoft.NET.Test.Sdk 18.0.1

Build / CI tooling

• dotnet-format — dotnet format runs in CI.
• gitversion — release versioning (BRE).
• Docker base images — mcr.microsoft.com/dotnet/aspnet:8.0 (runtime) and mcr.microsoft.com/dotnet/sdk:8.0 (build) per the per-service Dockerfiles.

Package locking

packages.lock.json is committed for every project (CODEOWNERS protects them). Restoring with --locked-mode is the default in CI; this is what makes the build reproducible.

Renovate / Dependabot

Dependency updates flow through Renovate with the config in .github/renovate.json5. Critical updates also have Dependabot fall-through. The release-engineering team (BRE) owns merge cadence.