From c9c856e244c3c65880338c7c72fc25fdf16d45e7 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Tue, 21 Jul 2026 14:26:48 -0700
Subject: [PATCH 01/40] AB#33787 - Updated Scriban

---
 applications/Unity.GrantManager/common.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/applications/Unity.GrantManager/common.props b/applications/Unity.GrantManager/common.props
index bdf9a7442f..e28f59fbc5 100644
--- a/applications/Unity.GrantManager/common.props
+++ b/applications/Unity.GrantManager/common.props
@@ -19,7 +19,7 @@
   <ItemGroup>
     <!-- Add direct reference to the patched Scriban to ensure all projects importing common.props
          use the safe version (pins transitive consumers that do not specify a version). -->
-    <PackageReference Include="Scriban" Version="7.2.0" />
+    <PackageReference Include="Scriban" Version="7.2.5" />
   </ItemGroup>
 
 </Project>
\ No newline at end of file

From b862f6e034f176a91537f0eea66373556471deb9 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Tue, 21 Jul 2026 14:56:32 -0700
Subject: [PATCH 02/40] AB#33787 - Updated System.Security.Cryptography.Xml

---
 .../src/Unity.AI.Application/Unity.AI.Application.csproj        | 2 +-
 .../test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
index 2be3ad05e5..571becfad1 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
@@ -21,7 +21,7 @@
     <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.3.0" />
     <!-- Explicit references to fix vulnerable transitive dependencies -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.7" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
     <ProjectReference Include="..\..\..\..\modules\Unity.Flex\src\Unity.Flex.Application\Unity.Flex.Application.csproj" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Application.Contracts\Unity.GrantManager.Application.Contracts.csproj" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Domain\Unity.GrantManager.Domain.csproj" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
index ce4d41158a..6851591341 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
@@ -27,7 +27,7 @@
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.7" />
     <PackageReference Include="System.IO.Packaging" Version="10.0.7" />
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.7" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>

From cd790247da23992515f8176440a1f971b4e0baaa Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Tue, 21 Jul 2026 15:35:27 -0700
Subject: [PATCH 03/40] AB#33787 - Overrided transitive Swashbuckle.AspNetCore
 package

---
 .../Unity.GrantManager.Web/Unity.GrantManager.Web.csproj    | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
index f44d2fc836..35cedc801b 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
@@ -76,6 +76,12 @@
     <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.3.0" />
     <PackageReference Include="Volo.Abp.Swashbuckle" Version="10.3.0" />
+
+    <!-- Override transitive Swashbuckle.AspNetCore (pulled at 10.0.1 by Volo.Abp.Swashbuckle 10.3.0),
+         which resolves a vulnerable Microsoft.OpenApi 2.3.0 (GHSA-v5pm-xwqc-g5wc). 10.2.3 depends on
+         Microsoft.OpenApi 2.7.5+, which fixes it. Remove this once Volo.Abp.Swashbuckle depends on
+         Swashbuckle.AspNetCore >= 10.2.3 natively. -->
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.2.3" />
   </ItemGroup>
 
   <!-- Static Assets Copy -->

From 0fef750d04c92b0081d1296a45855ff98bc271a0 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Tue, 21 Jul 2026 16:20:50 -0700
Subject: [PATCH 04/40] AB#33787 - Pinned to a HtmlSanitizer prerelease

---
 .../Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj               | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj b/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj
index fdab8629aa..3f7f19547a 100644
--- a/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj
@@ -21,7 +21,12 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="HtmlSanitizer" Version="9.0.892" />
+    <!-- Pinned to a HtmlSanitizer prerelease because AngleSharp.Css has no stable 1.0 release compatible
+         with AngleSharp 1.x (see github.com/mganss/HtmlSanitizer#491). The stable 9.0.x line hard-pins
+         AngleSharp 0.17.1, which has a known moderate vulnerability (GHSA-pgww-w46g-26qg). The maintainer
+         has pointed users to the prerelease line for this exact issue for 2+ years; move to the first
+         stable HtmlSanitizer release that depends on AngleSharp >= 1.5 once one ships. -->
+    <PackageReference Include="HtmlSanitizer" Version="9.1.968-beta" />
     <PackageReference Include="Markdig.Signed" Version="0.44.0" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />

From 39c875002555c740d76af19474ecd04e5825c09e Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Wed, 22 Jul 2026 14:19:05 -0700
Subject: [PATCH 05/40] AB#33787 - Updated ABP and Microsoft packages

---
 .../Unity.GrantManager/Directory.Build.props  |  2 +-
 .../Unity.AI.Application.Contracts.csproj     |  8 +-
 .../Unity.AI.Application.csproj               | 16 ++--
 .../Unity.AI.Shared.csproj                    |  6 +-
 .../src/Unity.AI.Web/Unity.AI.Web.csproj      |  8 +-
 .../Unity.Flex.Application.Contracts.csproj   | 14 ++--
 .../Unity.Flex.Application.csproj             | 20 ++---
 .../Unity.Flex.Shared.csproj                  | 10 +--
 .../src/Unity.Flex.Web/Unity.Flex.Web.csproj  |  6 +-
 .../Unity.Flex.Application.Tests.csproj       | 12 +--
 .../Unity.Flex.TestBase.csproj                | 12 +--
 .../Unity.Flex.Web.Tests.csproj               |  8 +-
 .../src/Unity.Identity.Web.csproj             | 12 +--
 ...Notifications.Application.Contracts.csproj | 68 ++++++++---------
 .../Unity.Notifications.Application.csproj    | 20 ++---
 .../Unity.Notifications.Domain.Shared.csproj  | 10 +--
 .../Unity.Notifications.Domain.csproj         |  8 +-
 ...y.Notifications.EntityFrameworkCore.csproj |  8 +-
 .../Unity.Notifications.HttpApi.Client.csproj |  6 +-
 .../Unity.Notifications.HttpApi.csproj        |  6 +-
 .../Unity.Notifications.Installer.csproj      |  4 +-
 .../Unity.Notifications.Web.csproj            | 14 ++--
 ...ity.Notifications.Application.Tests.csproj |  4 +-
 .../Unity.Notifications.Domain.Tests.csproj   |  6 +-
 ...fications.EntityFrameworkCore.Tests.csproj | 10 +--
 .../Unity.Notifications.TestBase.csproj       | 12 +--
 ...nity.Payments.Application.Contracts.csproj | 20 ++---
 .../Unity.Payments.Application.csproj         | 32 ++++----
 .../Unity.Payments.Shared.csproj              | 14 ++--
 .../Unity.Payments.Web.csproj                 | 14 ++--
 .../Unity.Payments.Application.Tests.csproj   | 10 +--
 .../Unity.Payments.TestBase.csproj            | 38 +++++-----
 ...ity.Reporting.Application.Contracts.csproj |  4 +-
 .../Unity.Reporting.Application.csproj        | 12 +--
 .../Unity.Reporting.Shared.csproj             |  6 +-
 .../Unity.Reporting.Web.csproj                | 12 +--
 .../Unity.Reporting.Application.Tests.csproj  |  2 +-
 .../Unity.Reporting.TestBase.csproj           |  8 +-
 .../Unity.SharedKernel.csproj                 | 18 ++---
 ...antManagement.Application.Contracts.csproj | 12 +--
 .../Unity.TenantManagement.Application.csproj | 20 ++---
 ...ity.TenantManagement.HttpApi.Client.csproj |  6 +-
 .../Unity.TenantManagement.HttpApi.csproj     |  8 +-
 .../Unity.TenantManagement.Web.csproj         |  6 +-
 ....TenantManagement.Application.Tests.csproj |  8 +-
 ...anagement.EntityFrameworkCore.Tests.csproj | 12 +--
 .../Unity.TenantManagement.TestBase.csproj    | 14 ++--
 .../Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj  |  8 +-
 ....GrantManager.Application.Contracts.csproj | 12 +--
 .../Unity.GrantManager.Application.csproj     | 32 ++++----
 .../Unity.GrantManager.DbMigrator.csproj      | 10 +--
 .../Unity.GrantManager.Domain.Shared.csproj   | 74 +++++++++----------
 .../GrantManagerSettingDefinitionProvider.cs  |  2 +-
 .../Unity.GrantManager.Domain.csproj          | 24 +++---
 ...ty.GrantManager.EntityFrameworkCore.csproj | 24 +++---
 .../Unity.GrantManager.HttpApi.Client.csproj  | 10 +--
 .../Unity.GrantManager.HttpApi.csproj         |  8 +-
 .../Unity.GrantManager.Web.csproj             | 20 ++---
 ...nity.GrantManager.Application.Tests.csproj |  2 +-
 .../Unity.GrantManager.Domain.Tests.csproj    |  2 +-
 ...ntManager.EntityFrameworkCore.Tests.csproj |  8 +-
 .../Unity.GrantManager.TestBase.csproj        | 18 ++---
 .../Unity.GrantManager.Web.Tests.csproj       | 10 +--
 63 files changed, 425 insertions(+), 425 deletions(-)

diff --git a/applications/Unity.GrantManager/Directory.Build.props b/applications/Unity.GrantManager/Directory.Build.props
index 4239024ce7..0e9f5007d6 100644
--- a/applications/Unity.GrantManager/Directory.Build.props
+++ b/applications/Unity.GrantManager/Directory.Build.props
@@ -10,7 +10,7 @@
   
   <ItemGroup>
     <!-- Explicitly reference compatible version to avoid transitive dependency warnings -->
-    <PackageReference Include="Microsoft.Extensions.Compliance.Abstractions" Version="10.1.0" />
+    <PackageReference Include="Microsoft.Extensions.Compliance.Abstractions" Version="10.8.0" />
 
   </ItemGroup>
   
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Unity.AI.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Unity.AI.Application.Contracts.csproj
index d086c0cf1d..2253875073 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Unity.AI.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Unity.AI.Application.Contracts.csproj
@@ -6,10 +6,10 @@
     <RootNamespace>Unity.AI</RootNamespace>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Volo.Abp.Authorization" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Features" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application.Contracts" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application.Contracts" Version="10.5.0" />
     <ProjectReference Include="..\Unity.AI.Domain.Shared\Unity.AI.Shared.csproj" />
   </ItemGroup>
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
index 571becfad1..3f4039d4bf 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
@@ -6,19 +6,19 @@
     <RootNamespace>Unity.AI</RootNamespace>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Azure.AI.OpenAI" Version="2.1.0" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="NPOI" Version="2.7.5" />
     <PackageReference Include="PdfPig" Version="0.1.13" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.DistributedLocking" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Features" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.DistributedLocking" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
     <!-- Explicit references to fix vulnerable transitive dependencies -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
     <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Domain.Shared/Unity.AI.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Domain.Shared/Unity.AI.Shared.csproj
index f094575dec..fbf25b71b3 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Domain.Shared/Unity.AI.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Domain.Shared/Unity.AI.Shared.csproj
@@ -10,12 +10,12 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Validation" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Validation" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj
index b37df03bc2..779130a52c 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj
@@ -12,16 +12,16 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application.Contracts/Unity.Flex.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application.Contracts/Unity.Flex.Application.Contracts.csproj
index 259d86d1c9..fe6188cfdf 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application.Contracts/Unity.Flex.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application.Contracts/Unity.Flex.Application.Contracts.csproj
@@ -9,13 +9,13 @@
 	</PropertyGroup>
 
 	<ItemGroup>
-		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-		<PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
-		<PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-		<PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.Authorization" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.UI" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.Validation" Version="10.3.0" />
+		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+		<PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
+		<PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+		<PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.UI" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.Validation" Version="10.5.0" />
 	</ItemGroup>
 
 	<ItemGroup>	  
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application/Unity.Flex.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application/Unity.Flex.Application.csproj
index 331e21863e..c103557f1f 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application/Unity.Flex.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application/Unity.Flex.Application.csproj
@@ -9,17 +9,17 @@
 	</PropertyGroup>
 
 	<ItemGroup>
-		<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-		<PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-		<PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+		<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+		<PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+		<PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
 		<PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-		<PackageReference Include="Volo.Abp.Ddd.Application" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.Http.Client" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.3.0" />
+		<PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.Http.Client" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
 		<ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Application.Contracts\Unity.GrantManager.Application.Contracts.csproj" />
 		<ProjectReference Include="..\Unity.Flex.Application.Contracts\Unity.Flex.Application.Contracts.csproj" />
 	</ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj
index 9963d2d2bd..5538a1c455 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj
@@ -10,15 +10,15 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Validation" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Validation" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Unity.Flex.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Unity.Flex.Web.csproj
index 1b9333d47f..ca25e1274e 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Unity.Flex.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Unity.Flex.Web.csproj
@@ -12,13 +12,13 @@
 	</PropertyGroup>
 
 	<ItemGroup>
-		<PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+		<PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
 		<PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-		<PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.3.0" />
+		<PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.5.0" />
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+		<PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
 	</ItemGroup>
 
 	<ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
index fbe7add032..8baec14ac4 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
@@ -12,13 +12,13 @@
     <ProjectReference Include="..\..\src\Unity.Flex.Application\Unity.Flex.Application.csproj" />
     <ProjectReference Include="..\..\src\Unity.Flex.Web\Unity.Flex.Web.csproj" />
     <ProjectReference Include="..\Unity.Flex.TestBase\Unity.Flex.TestBase.csproj" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-	  <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
+	  <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
   </ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
index bc1afd5896..c28f61155a 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
@@ -9,7 +9,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="NSubstitute" Version="5.3.0" />
     <PackageReference Include="NSubstitute.Analyzers.CSharp" Version="1.0.17">
@@ -17,17 +17,17 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
     <PackageReference Include="Shouldly" Version="4.3.0" />
-    <PackageReference Include="Volo.Abp.Features" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.extensibility.execution" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Authorization" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Guids" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TestBase" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Guids" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TestBase" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
index 6851591341..9129e01a0c 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
@@ -14,10 +14,10 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="Npgsql" Version="10.0.2" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
       <PrivateAssets>all</PrivateAssets>
@@ -25,8 +25,8 @@
     </PackageReference>
     <!-- Explicit references to fix vulnerable transitive dependencies -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.7" />
-    <PackageReference Include="System.IO.Packaging" Version="10.0.7" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.10" />
+    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Unity.Identity.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Unity.Identity.Web.csproj
index ac7d62ebe2..6eb1991955 100644
--- a/applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Unity.Identity.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Unity.Identity.Web.csproj
@@ -31,17 +31,17 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.PermissionManagement.Web" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.PermissionManagement.Web" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="System.IO.Packaging" Version="10.0.7" />
+    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj
index 0e41f2f1c4..509a3937de 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj
@@ -1,34 +1,34 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <Import Project="..\..\common.props" />
-
-  <PropertyGroup>
-    <TargetFrameworks>netstandard2.1;net10.0</TargetFrameworks>
-    <Nullable>enable</Nullable>
-    <RootNamespace>Unity.Notifications</RootNamespace>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="RestSharp" Version="112.1.0" />
-    <PackageReference Include="System.Text.Json" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Authorization" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Features" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application.Contracts" Version="10.3.0" />
-    <ProjectReference Include="..\Unity.Notifications.Domain.Shared\Unity.Notifications.Domain.Shared.csproj" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
-      <PrivateAssets>all</PrivateAssets>
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
-    </PackageReference>
-  </ItemGroup>
-
-  <ItemGroup>
-    <Folder Include="EmailNotifications\" />
-  </ItemGroup>
-
-</Project>
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <Import Project="..\..\common.props" />
+
+  <PropertyGroup>
+    <TargetFrameworks>netstandard2.1;net10.0</TargetFrameworks>
+    <Nullable>enable</Nullable>
+    <RootNamespace>Unity.Notifications</RootNamespace>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="RestSharp" Version="112.1.0" />
+    <PackageReference Include="System.Text.Json" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application.Contracts" Version="10.5.0" />
+    <ProjectReference Include="..\Unity.Notifications.Domain.Shared\Unity.Notifications.Domain.Shared.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
+    <PackageReference Update="Fody" Version="6.9.2">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
+    </PackageReference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <Folder Include="EmailNotifications\" />
+  </ItemGroup>
+
+</Project>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
index 0e50decfcd..e6d15e2738 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
@@ -9,19 +9,19 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
 	<PackageReference Include="AWSSDK.S3" Version="4.0.0.5" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.3.0" />    
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />    
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Volo.Abp.BackgroundJobs" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundJobs.Abstractions" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Http.Client" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.BackgroundJobs" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundJobs.Abstractions" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Http.Client" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Application.Contracts\Unity.GrantManager.Application.Contracts.csproj" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain.Shared/Unity.Notifications.Domain.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain.Shared/Unity.Notifications.Domain.Shared.csproj
index 2eb1af44f6..c802d900b6 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain.Shared/Unity.Notifications.Domain.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain.Shared/Unity.Notifications.Domain.Shared.csproj
@@ -10,14 +10,14 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="System.Text.Json" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Validation" Version="10.3.0" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="System.Text.Json" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Validation" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain/Unity.Notifications.Domain.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain/Unity.Notifications.Domain.csproj
index a4cf76b437..460c66f22c 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain/Unity.Notifications.Domain.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain/Unity.Notifications.Domain.csproj
@@ -9,10 +9,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="System.Text.Json" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.Ddd.Domain" Version="10.3.0" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="System.Text.Json" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.Ddd.Domain" Version="10.5.0" />
     <ProjectReference Include="..\Unity.Notifications.Domain.Shared\Unity.Notifications.Domain.Shared.csproj" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.EntityFrameworkCore/Unity.Notifications.EntityFrameworkCore.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.EntityFrameworkCore/Unity.Notifications.EntityFrameworkCore.csproj
index 35443ef745..62d4cb2fc6 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.EntityFrameworkCore/Unity.Notifications.EntityFrameworkCore.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.EntityFrameworkCore/Unity.Notifications.EntityFrameworkCore.csproj
@@ -9,10 +9,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.3.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.5.0" />
     <ProjectReference Include="..\Unity.Notifications.Domain\Unity.Notifications.Domain.csproj" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi.Client/Unity.Notifications.HttpApi.Client.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi.Client/Unity.Notifications.HttpApi.Client.csproj
index 451ddaea79..016294f3dc 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi.Client/Unity.Notifications.HttpApi.Client.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi.Client/Unity.Notifications.HttpApi.Client.csproj
@@ -9,9 +9,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="System.Text.Json" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.Http.Client" Version="10.3.0" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="System.Text.Json" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.Http.Client" Version="10.5.0" />
     <ProjectReference Include="..\Unity.Notifications.Application.Contracts\Unity.Notifications.Application.Contracts.csproj" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi/Unity.Notifications.HttpApi.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi/Unity.Notifications.HttpApi.csproj
index 4c17656712..6289dc3abe 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi/Unity.Notifications.HttpApi.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi/Unity.Notifications.HttpApi.csproj
@@ -9,9 +9,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.3.0" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
     <ProjectReference Include="..\Unity.Notifications.Application.Contracts\Unity.Notifications.Application.Contracts.csproj" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Installer/Unity.Notifications.Installer.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Installer/Unity.Notifications.Installer.csproj
index a6e97532ec..f0612eb724 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Installer/Unity.Notifications.Installer.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Installer/Unity.Notifications.Installer.csproj
@@ -10,8 +10,8 @@
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-        <PackageReference Include="Volo.Abp.VirtualFileSystem" Version="10.3.0" />
+        <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+        <PackageReference Include="Volo.Abp.VirtualFileSystem" Version="10.5.0" />
     </ItemGroup>
 
     <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj
index 3e110d2d7d..1c272030b4 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj
@@ -12,13 +12,13 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundJobs" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundJobs.Quartz" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundJobs" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundJobs.Quartz" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
   </ItemGroup>
@@ -29,7 +29,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
index 94784c7e73..fdfa3b787e 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
@@ -11,8 +11,8 @@
   <ItemGroup>
     <ProjectReference Include="..\..\src\Unity.Notifications.Application\Unity.Notifications.Application.csproj" />
     <ProjectReference Include="..\Unity.Notifications.Domain.Tests\Unity.Notifications.Domain.Tests.csproj" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj
index 721959b2a2..fde388c659 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj
@@ -9,9 +9,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <ProjectReference Include="..\Unity.Notifications.EntityFrameworkCore.Tests\Unity.Notifications.EntityFrameworkCore.Tests.csproj" />
   </ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
index 1c140ce8e0..d08dd55bac 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
@@ -9,14 +9,14 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Proxies" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Proxies" Version="10.0.10" />
     <ProjectReference Include="..\..\src\Unity.Notifications.EntityFrameworkCore\Unity.Notifications.EntityFrameworkCore.csproj" />
     <ProjectReference Include="..\Unity.Notifications.TestBase\Unity.Notifications.TestBase.csproj" />
-    <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
   </ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
index 2969eb286a..a362639dc9 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
@@ -9,8 +9,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="NSubstitute" Version="5.3.0" />
     <PackageReference Include="NSubstitute.Analyzers.CSharp" Version="1.0.17">
@@ -18,16 +18,16 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
     <PackageReference Include="Shouldly" Version="4.3.0" />
-    <PackageReference Include="Volo.Abp.Features" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.extensibility.execution" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Authorization" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TestBase" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TestBase" Version="10.5.0" />
     <ProjectReference Include="..\..\src\Unity.Notifications.Domain\Unity.Notifications.Domain.csproj" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application.Contracts/Unity.Payments.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application.Contracts/Unity.Payments.Application.Contracts.csproj
index d8a8029060..e1d552c6b5 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application.Contracts/Unity.Payments.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application.Contracts/Unity.Payments.Application.Contracts.csproj
@@ -9,16 +9,16 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Bootstrap" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Authorization" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.UI" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Validation" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Bootstrap" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.UI" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Validation" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
index 86f2b532cf..693f4794b6 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
@@ -10,28 +10,28 @@
 
   <ItemGroup>
     <PackageReference Include="ClosedXML" Version="0.104.1" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.1.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.8.0" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="Stateless" Version="5.17.0" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.3.0" />    
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />    
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Http.Client" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundJobs" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundJobs.Abstractions" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.PermissionManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.Application" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Http.Client" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundJobs" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundJobs.Abstractions" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.PermissionManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.Application" Version="10.5.0" />
     
-    <PackageReference Include="Volo.Abp.TenantManagement.Application" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Application" Version="10.5.0" />
     <!-- Explicit references to fix vulnerable transitive dependencies -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
-    <PackageReference Include="System.IO.Packaging" Version="10.0.7" />
+    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Domain\Unity.GrantManager.Domain.csproj" />
     <ProjectReference Include="..\Unity.Payments.Application.Contracts\Unity.Payments.Application.Contracts.csproj" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Shared/Unity.Payments.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Shared/Unity.Payments.Shared.csproj
index 03b6952acd..9400cb0d9d 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Shared/Unity.Payments.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Shared/Unity.Payments.Shared.csproj
@@ -10,16 +10,16 @@
 	</PropertyGroup>
 
 	<ItemGroup>
-        <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-        <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-        <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.3.0" />
-        <PackageReference Include="Volo.Abp.Validation" Version="10.3.0" />
-        <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
-        <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
+        <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+        <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+        <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.5.0" />
+        <PackageReference Include="Volo.Abp.Validation" Version="10.5.0" />
+        <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
+        <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+		<PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
 	</ItemGroup>
 
 	<ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Web/Unity.Payments.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Web/Unity.Payments.Web.csproj
index 35a005262d..f5bcee4e05 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Web/Unity.Payments.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Web/Unity.Payments.Web.csproj
@@ -12,17 +12,17 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
index b935efb804..a9e2595d0d 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
@@ -13,14 +13,14 @@
     <ProjectReference Include="..\..\src\Unity.Payments.Shared\Unity.Payments.Shared.csproj" />
     <ProjectReference Include="..\..\src\Unity.Payments.Web\Unity.Payments.Web.csproj" />
     <ProjectReference Include="..\Unity.Payments.TestBase\Unity.Payments.TestBase.csproj" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
     <PackageReference Include="Autofac.Extensions.DependencyInjection" Version="11.0.0" />
     <ProjectReference Include="..\..\..\Unity.SharedKernel\Unity.SharedKernel.csproj" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
   </ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
index 5ed17173ab..b02cf36a28 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
@@ -9,8 +9,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="NSubstitute" Version="5.3.0" />
     <PackageReference Include="NSubstitute.Analyzers.CSharp" Version="1.0.17">
@@ -18,31 +18,31 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
     <PackageReference Include="Shouldly" Version="4.3.0" />
-    <PackageReference Include="Volo.Abp.Features" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.extensibility.execution" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Authorization" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TestBase" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundJobs" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundJobs.Abstractions" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.EntityFrameworkCore" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.EntityFrameworkCore" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TestBase" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundJobs" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundJobs.Abstractions" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.EntityFrameworkCore" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.EntityFrameworkCore" Version="10.5.0" />
     <!-- Explicit references to fix vulnerable transitive dependencies -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
-    <PackageReference Include="System.IO.Packaging" Version="10.0.7" />
+    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     <ProjectReference Include="..\..\src\Unity.Payments.Application\Unity.Payments.Application.csproj" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application.Contracts/Unity.Reporting.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application.Contracts/Unity.Reporting.Application.Contracts.csproj
index c5e4928327..b9ce5c6cd6 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application.Contracts/Unity.Reporting.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application.Contracts/Unity.Reporting.Application.Contracts.csproj
@@ -9,8 +9,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Authorization" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
     <ProjectReference Include="..\Unity.Reporting.Domain.Shared\Unity.Reporting.Shared.csproj" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/Unity.Reporting.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/Unity.Reporting.Application.csproj
index d9f72545c4..608b417494 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/Unity.Reporting.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/Unity.Reporting.Application.csproj
@@ -9,13 +9,13 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.3.0" />
-	<PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.5.0" />
+	<PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Application.Contracts\Unity.GrantManager.Application.Contracts.csproj" />
     <ProjectReference Include="..\..\..\Unity.Flex\src\Unity.Flex.Application.Contracts\Unity.Flex.Application.Contracts.csproj" />
     <ProjectReference Include="..\..\..\Unity.SharedKernel\Unity.SharedKernel.csproj" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Domain.Shared/Unity.Reporting.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Domain.Shared/Unity.Reporting.Shared.csproj
index aa2aa2c826..45813dafa1 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Domain.Shared/Unity.Reporting.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Domain.Shared/Unity.Reporting.Shared.csproj
@@ -10,12 +10,12 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Validation" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Validation" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Web/Unity.Reporting.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Web/Unity.Reporting.Web.csproj
index 4798a9d065..746afcd03c 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Web/Unity.Reporting.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Web/Unity.Reporting.Web.csproj
@@ -12,16 +12,16 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
   </ItemGroup>
 
 <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj
index c7c03b191a..70d2945fc3 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj
@@ -11,7 +11,7 @@
   <ItemGroup>
     <ProjectReference Include="..\..\src\Unity.Reporting.Application\Unity.Reporting.Application.csproj" />
     <ProjectReference Include="..\Unity.Reporting.TestBase\Unity.Reporting.TestBase.csproj" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
index 8cd7e3b79e..d5d61620c3 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
@@ -22,10 +22,10 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Authorization" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Guids" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TestBase" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Guids" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TestBase" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj b/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
index 9a51a4f477..83594e09b2 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
@@ -14,17 +14,17 @@
 			<PrivateAssets>all</PrivateAssets>
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
 		</PackageReference>
-		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-		<PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+		<PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
 		<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-		<PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.Ddd.Application" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.3.0" />
+		<PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
 		<PackageReference Include="RabbitMQ.Client" Version="6.8.1" />
-		<PackageReference Include="Volo.Abp.Http.Client" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
-		<PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.1.0" />
+		<PackageReference Include="Volo.Abp.Http.Client" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
+		<PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.8.0" />
 		<PackageReference Include="Polly" Version="8.6.3" />
 	</ItemGroup>
 </Project>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Application.Contracts/Unity.TenantManagement.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Application.Contracts/Unity.TenantManagement.Application.Contracts.csproj
index 46ef69fa14..df12318742 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Application.Contracts/Unity.TenantManagement.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Application.Contracts/Unity.TenantManagement.Application.Contracts.csproj
@@ -9,12 +9,12 @@
     <RootNamespace />
   </PropertyGroup> 
  <ItemGroup>
-   <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-   <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-   <PackageReference Include="System.Text.Json" Version="10.0.3" />
-   <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.3.0" />
-   <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.3.0" />
-   <PackageReference Include="Volo.Abp.TenantManagement.Domain.Shared" Version="10.3.0" />
+   <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+   <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+   <PackageReference Include="System.Text.Json" Version="10.0.10" />
+   <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
+   <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.5.0" />
+   <PackageReference Include="Volo.Abp.TenantManagement.Domain.Shared" Version="10.5.0" />
  </ItemGroup>
 
 </Project>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Application/Unity.TenantManagement.Application.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Application/Unity.TenantManagement.Application.csproj
index 37aa38e406..b97d7e1b7e 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Application/Unity.TenantManagement.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Application/Unity.TenantManagement.Application.csproj
@@ -9,17 +9,17 @@
     <RootNamespace />
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Authorization" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Authorization" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.HttpApi.Client/Unity.TenantManagement.HttpApi.Client.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.HttpApi.Client/Unity.TenantManagement.HttpApi.Client.csproj
index 0be2b80c6a..1015353b47 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.HttpApi.Client/Unity.TenantManagement.HttpApi.Client.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.HttpApi.Client/Unity.TenantManagement.HttpApi.Client.csproj
@@ -11,9 +11,9 @@
     <RootNamespace />
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.Http.Client" Version="10.3.0" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.Http.Client" Version="10.5.0" />
   </ItemGroup>
   <ItemGroup>
     <EmbeddedResource Include="**\*generate-proxy.json" />
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.HttpApi/Unity.TenantManagement.HttpApi.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.HttpApi/Unity.TenantManagement.HttpApi.csproj
index 4be4c28fee..18f4d145bb 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.HttpApi/Unity.TenantManagement.HttpApi.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.HttpApi/Unity.TenantManagement.HttpApi.csproj
@@ -12,12 +12,12 @@
 
   <ItemGroup>
 
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
 
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
 
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.FeatureManagement.HttpApi" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.FeatureManagement.HttpApi" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Web/Unity.TenantManagement.Web.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Web/Unity.TenantManagement.Web.csproj
index c4e99d3d6c..8b033bd1ce 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Web/Unity.TenantManagement.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/src/Unity.TenantManagement.Web/Unity.TenantManagement.Web.csproj
@@ -28,14 +28,14 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Volo.Abp.FeatureManagement.Web" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.FeatureManagement.Web" Version="10.5.0" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Application.Contracts\Unity.GrantManager.Application.Contracts.csproj" />
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
   </ItemGroup>
 
 </Project>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.Application.Tests/Unity.TenantManagement.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.Application.Tests/Unity.TenantManagement.Application.Tests.csproj
index 48b9e1753a..2f13c04175 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.Application.Tests/Unity.TenantManagement.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.Application.Tests/Unity.TenantManagement.Application.Tests.csproj
@@ -18,12 +18,12 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="NSubstitute" Version="5.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.5.0" />
   </ItemGroup>
 
 </Project>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
index 75e6846d56..46915c93a4 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
@@ -13,18 +13,18 @@
 
   <ItemGroup>
     <ProjectReference Include="..\Unity.TenantManagement.TestBase\Unity.TenantManagement.TestBase.csproj" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.3.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
   </ItemGroup>
 
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Proxies" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.3.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Proxies" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.5.0" />
   </ItemGroup>
 
 </Project>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj
index 3980e31fd6..94d3c13470 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj
@@ -12,16 +12,16 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="NSubstitute" Version="5.3.0" />
     <PackageReference Include="Shouldly" Version="4.3.0" />
-    <PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TestBase" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TestBase" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.extensibility.core" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
diff --git a/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj b/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj
index 3f7f19547a..16cfdb0d57 100644
--- a/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj
@@ -28,10 +28,10 @@
          stable HtmlSanitizer release that depends on AngleSharp >= 1.5 once one ships. -->
     <PackageReference Include="HtmlSanitizer" Version="9.1.968-beta" />
     <PackageReference Include="Markdig.Signed" Version="0.44.0" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.MultiTenancy" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.3.0" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.MultiTenancy" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/Unity.GrantManager.Application.Contracts.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/Unity.GrantManager.Application.Contracts.csproj
index 7b1c8dcad2..8dbddfb6c7 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/Unity.GrantManager.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/Unity.GrantManager.Application.Contracts.csproj
@@ -16,12 +16,12 @@
   </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageReference Include="Volo.Abp.ObjectExtending" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.Application.Contracts" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.PermissionManagement.Application.Contracts" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Application.Contracts" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.FeatureManagement.Application.Contracts" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application.Contracts" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.ObjectExtending" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.Application.Contracts" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.PermissionManagement.Application.Contracts" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Application.Contracts" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.FeatureManagement.Application.Contracts" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application.Contracts" Version="10.5.0" />
     <SonarQubeSetting Include="sonar.exclusions">
       <Value>**/Assessments/AssessmentListItemDto.cs, **/Assessments/AssessmentScoresDto.cs</Value>
     </SonarQubeSetting>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
index b5a7b1a9ca..8f5c87d9ea 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
@@ -34,9 +34,9 @@
   <!-- Package References -->
   <ItemGroup>
     <PackageReference Include="DistributedLock.Redis" Version="1.0.3" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="10.0.10" />
 
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="NPOI" Version="2.7.5" />
@@ -46,20 +46,20 @@
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
 
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="System.IO.Packaging" Version="10.0.7" />
+    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
 
-    <PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BlobStoring" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Caching" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Caching.StackExchangeRedis" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.DistributedLocking" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.FeatureManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.PermissionManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Application" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BlobStoring" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Caching" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Caching.StackExchangeRedis" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.DistributedLocking" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.FeatureManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.PermissionManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Application" Version="10.5.0" />
   </ItemGroup>
 
 </Project>
\ No newline at end of file
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
index 8ade8482cb..b8cdebf294 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -17,7 +17,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.3">
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>    
@@ -28,13 +28,13 @@
     <PackageReference Include="Serilog.Sinks.Async" Version="2.1.0" />
     <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
     <PackageReference Include="Serilog.Sinks.Console" Version="6.0.0" />
-    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="System.IO.Packaging" Version="10.0.7" />
+    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
     <ProjectReference Include="..\..\modules\Unity.AI\src\Unity.AI.Application\Unity.AI.Application.csproj" />
     <ProjectReference Include="..\..\modules\Unity.Reporting\src\Unity.Reporting.Application\Unity.Reporting.Application.csproj" />
     <ProjectReference Include="..\..\modules\Unity.TenantManagement\src\Unity.TenantManagement.Application\Unity.TenantManagement.Application.csproj" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Unity.GrantManager.Domain.Shared.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Unity.GrantManager.Domain.Shared.csproj
index dea88fd8ef..d1525490ca 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Unity.GrantManager.Domain.Shared.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Unity.GrantManager.Domain.Shared.csproj
@@ -1,37 +1,37 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <Import Project="..\..\common.props" />
-
-  <PropertyGroup>
-    <TargetFrameworks>net10.0</TargetFrameworks>
-    <Nullable>enable</Nullable>
-    <RootNamespace>Unity.GrantManager</RootNamespace>
-    <GenerateEmbeddedFilesManifest>true</GenerateEmbeddedFilesManifest>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Stateless" Version="5.17.0" />
-    <PackageReference Include="Volo.Abp.Identity.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundJobs.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.AuditLogging.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.FeatureManagement.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.PermissionManagement.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Domain.Shared" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.OpenIddict.Domain.Shared" Version="10.3.0" />
-    <ProjectReference Include="..\..\modules\Unity.Flex\src\Unity.Flex.Shared\Unity.Flex.Shared.csproj" />
-    <ProjectReference Include="..\..\modules\Unity.Notifications\src\Unity.Notifications.Domain.Shared\Unity.Notifications.Domain.Shared.csproj" />
-    <ProjectReference Include="..\..\modules\Unity.Payments\src\Unity.Payments.Application.Contracts\Unity.Payments.Application.Contracts.csproj" />
-    <ProjectReference Include="..\..\modules\Unity.Payments\src\Unity.Payments.Shared\Unity.Payments.Shared.csproj" />
-    <ProjectReference Include="..\..\modules\Unity.Reporting\src\Unity.Reporting.Domain.Shared\Unity.Reporting.Shared.csproj" /></ItemGroup>
-
-  <ItemGroup>
-    <EmbeddedResource Include="Localization\GrantManager\*.json" />
-    <Content Remove="Localization\GrantManager\*.json" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.3" />
-  </ItemGroup>
-
-</Project>
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <Import Project="..\..\common.props" />
+
+  <PropertyGroup>
+    <TargetFrameworks>net10.0</TargetFrameworks>
+    <Nullable>enable</Nullable>
+    <RootNamespace>Unity.GrantManager</RootNamespace>
+    <GenerateEmbeddedFilesManifest>true</GenerateEmbeddedFilesManifest>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Stateless" Version="5.17.0" />
+    <PackageReference Include="Volo.Abp.Identity.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundJobs.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.AuditLogging.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.FeatureManagement.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.PermissionManagement.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Domain.Shared" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.OpenIddict.Domain.Shared" Version="10.5.0" />
+    <ProjectReference Include="..\..\modules\Unity.Flex\src\Unity.Flex.Shared\Unity.Flex.Shared.csproj" />
+    <ProjectReference Include="..\..\modules\Unity.Notifications\src\Unity.Notifications.Domain.Shared\Unity.Notifications.Domain.Shared.csproj" />
+    <ProjectReference Include="..\..\modules\Unity.Payments\src\Unity.Payments.Application.Contracts\Unity.Payments.Application.Contracts.csproj" />
+    <ProjectReference Include="..\..\modules\Unity.Payments\src\Unity.Payments.Shared\Unity.Payments.Shared.csproj" />
+    <ProjectReference Include="..\..\modules\Unity.Reporting\src\Unity.Reporting.Domain.Shared\Unity.Reporting.Shared.csproj" /></ItemGroup>
+
+  <ItemGroup>
+    <EmbeddedResource Include="Localization\GrantManager\*.json" />
+    <Content Remove="Localization\GrantManager\*.json" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.10" />
+  </ItemGroup>
+
+</Project>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Settings/GrantManagerSettingDefinitionProvider.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Settings/GrantManagerSettingDefinitionProvider.cs
index 9eb1d5451f..93a7f65f06 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Settings/GrantManagerSettingDefinitionProvider.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Settings/GrantManagerSettingDefinitionProvider.cs
@@ -92,7 +92,7 @@ private static void AddSettingDefinition(ISettingDefinitionContext currentContex
                 description,
                 isVisibleToClients: true,
                 isInherited: false,
-                isEncrypted: false).WithProviders(TenantSettingValueProvider.ProviderName)
+                isEncrypted: false).WithProviders(TenantSettingValueProvider.ProviderName, DefaultValueSettingValueProvider.ProviderName)
         );
     }
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
index f1610fd590..608b975396 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
@@ -15,20 +15,20 @@
     <ProjectReference Include="..\..\modules\Unity.Notifications\src\Unity.Notifications.Domain\Unity.Notifications.Domain.csproj" /></ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="AWSSDK.S3" Version="4.0.0.5" />
-    <PackageReference Include="Volo.Abp.Emailing" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.PermissionManagement.Domain.Identity" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BackgroundJobs.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.AuditLogging.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.FeatureManagement.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.OpenIddict.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.PermissionManagement.Domain.OpenIddict" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Emailing" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.PermissionManagement.Domain.Identity" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BackgroundJobs.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.AuditLogging.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.FeatureManagement.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.OpenIddict.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.PermissionManagement.Domain.OpenIddict" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
 	  <SonarQubeSetting Include="sonar.exclusions">
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
index e8383a75d5..f5e533ee50 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
@@ -75,23 +75,23 @@
 		<ProjectReference Include="..\Unity.GrantManager.Domain.Shared\Unity.GrantManager.Domain.Shared.csproj" />
 		<ProjectReference Include="..\Unity.GrantManager.Domain\Unity.GrantManager.Domain.csproj" />
 		<PackageReference Include="AppAny.Quartz.EntityFrameworkCore.Migrations.PostgreSQL" Version="0.5.1" />
-		<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.3">
+		<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
 			<PrivateAssets>all</PrivateAssets>
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
 		</PackageReference>
-		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.3" />
+		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
 		<PackageReference Include="Npgsql" Version="10.0.2" />
-		<PackageReference Include="Volo.Abp.EntityFrameworkCore.PostgreSql" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.PermissionManagement.EntityFrameworkCore" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.SettingManagement.EntityFrameworkCore" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.Identity.EntityFrameworkCore" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.BackgroundJobs.EntityFrameworkCore" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.AuditLogging.EntityFrameworkCore" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.FeatureManagement.EntityFrameworkCore" Version="10.3.0" />
-		<PackageReference Include="Volo.Abp.OpenIddict.EntityFrameworkCore" Version="10.3.0" />
+		<PackageReference Include="Volo.Abp.EntityFrameworkCore.PostgreSql" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.PermissionManagement.EntityFrameworkCore" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.SettingManagement.EntityFrameworkCore" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.Identity.EntityFrameworkCore" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.BackgroundJobs.EntityFrameworkCore" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.AuditLogging.EntityFrameworkCore" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.FeatureManagement.EntityFrameworkCore" Version="10.5.0" />
+		<PackageReference Include="Volo.Abp.OpenIddict.EntityFrameworkCore" Version="10.5.0" />
 		<!-- Explicit reference to fix vulnerable transitive dependency -->
-		<PackageReference Include="System.IO.Packaging" Version="10.0.7" />
+		<PackageReference Include="System.IO.Packaging" Version="10.0.10" />
 		<ProjectReference Include="..\..\modules\Unity.Notifications\src\Unity.Notifications.EntityFrameworkCore\Unity.Notifications.EntityFrameworkCore.csproj" /></ItemGroup>
 
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi.Client/Unity.GrantManager.HttpApi.Client.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi.Client/Unity.GrantManager.HttpApi.Client.csproj
index f530096675..6ed03b7432 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi.Client/Unity.GrantManager.HttpApi.Client.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi.Client/Unity.GrantManager.HttpApi.Client.csproj
@@ -14,11 +14,11 @@
     <ProjectReference Include="..\..\modules\Unity.Notifications\src\Unity.Notifications.HttpApi.Client\Unity.Notifications.HttpApi.Client.csproj" /></ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Volo.Abp.Identity.HttpApi.Client" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.PermissionManagement.HttpApi.Client" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TenantManagement.HttpApi.Client" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.FeatureManagement.HttpApi.Client" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.HttpApi.Client" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Identity.HttpApi.Client" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.PermissionManagement.HttpApi.Client" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TenantManagement.HttpApi.Client" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.FeatureManagement.HttpApi.Client" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.HttpApi.Client" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
index d174f23920..9401310cdb 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
@@ -17,10 +17,10 @@
   <ItemGroup>
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="RestSharp" Version="112.1.0" />    
-    <PackageReference Include="Volo.Abp.Identity.HttpApi" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.PermissionManagement.HttpApi" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.FeatureManagement.HttpApi" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.HttpApi" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.Identity.HttpApi" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.PermissionManagement.HttpApi" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.FeatureManagement.HttpApi" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.HttpApi" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
   </ItemGroup>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
index 35cedc801b..038fa858ae 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
@@ -47,8 +47,8 @@
 
   <!-- Package References -->
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection.StackExchangeRedis" Version="10.0.3" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.3">
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection.StackExchangeRedis" Version="10.0.10" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>
         runtime;
@@ -68,14 +68,14 @@
     <PackageReference Include="Serilog.Settings.Configuration" Version="9.0.0" />
     <PackageReference Include="Serilog.Sinks.Async" Version="2.1.0" />
 
-    <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Serilog" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.BlobStoring" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Http.Client.IdentityModel.Web" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Mapperly" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Swashbuckle" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Serilog" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.BlobStoring" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Http.Client.IdentityModel.Web" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Swashbuckle" Version="10.5.0" />
 
     <!-- Override transitive Swashbuckle.AspNetCore (pulled at 10.0.1 by Volo.Abp.Swashbuckle 10.3.0),
          which resolves a vulnerable Microsoft.OpenApi 2.3.0 (GHSA-v5pm-xwqc-g5wc). 10.2.3 depends on
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj
index 8361545053..33a3ec8483 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj
@@ -22,7 +22,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="Npgsql" Version="10.0.2" />
-    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
   </ItemGroup>
 
 </Project>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
index c2230656c3..e79ea5e854 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
@@ -16,7 +16,7 @@
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="Npgsql" Version="10.0.2" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="System.IO.Packaging" Version="10.0.7" />
+    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
index 0b86c87488..829d20fa44 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
@@ -12,11 +12,11 @@
 		<ProjectReference Include="..\..\src\Unity.GrantManager.EntityFrameworkCore\Unity.GrantManager.EntityFrameworkCore.csproj" />
 		<ProjectReference Include="..\Unity.GrantManager.TestBase\Unity.GrantManager.TestBase.csproj" />
 		<PackageReference Include="Npgsql" Version="10.0.2" />
-		<PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.3.0" />		
-		<PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.3" />
-		<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
+		<PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />		
+		<PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
+		<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
 		<!-- Explicit reference to fix vulnerable transitive dependency -->
-		<PackageReference Include="System.IO.Packaging" Version="10.0.7" />
+		<PackageReference Include="System.IO.Packaging" Version="10.0.10" />
 		<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
 	</ItemGroup>
 
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
index bf28c1e6ac..b5b976b660 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
@@ -9,15 +9,15 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.3" />
-    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.EntityFrameworkCore" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.Application.Contracts" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Localization" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.TestBase" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Autofac" Version="10.3.0" />
-    <PackageReference Include="Volo.Abp.Authorization" Version="10.3.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
+    <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.EntityFrameworkCore" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.Application.Contracts" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Localization" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.TestBase" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
+    <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
     <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
     <ProjectReference Include="..\..\src\Unity.GrantManager.Domain\Unity.GrantManager.Domain.csproj" />
   </ItemGroup>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
index e3e22f4e0a..1664f656da 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
@@ -21,17 +21,17 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.3" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="HtmlAgilityPack" Version="1.12.1" />
     <PackageReference Include="Npgsql" Version="10.0.2" />
-    <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />
     <!-- Explicit references to fix vulnerable transitive dependencies -->
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.7" />
-    <PackageReference Include="System.IO.Packaging" Version="10.0.7" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.10" />
+    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     <ProjectReference Include="..\Unity.GrantManager.TestBase\Unity.GrantManager.TestBase.csproj" />
     <ProjectReference Include="..\..\src\Unity.GrantManager.Web\Unity.GrantManager.Web.csproj" />
-    <PackageReference Include="Volo.Abp.AspNetCore.TestBase" Version="10.3.0" />
+    <PackageReference Include="Volo.Abp.AspNetCore.TestBase" Version="10.5.0" />
   </ItemGroup>
 
   <ItemGroup>

From c89347aeed51cae61610fba8de42bbb384122ddd Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Wed, 22 Jul 2026 14:57:52 -0700
Subject: [PATCH 06/40] AB#33787 - Updated Data/EF-adjacent libs

---
 .../src/Unity.AI.Application/Unity.AI.Application.csproj    | 6 +++---
 .../src/Unity.Flex.Shared/Unity.Flex.Shared.csproj          | 2 +-
 .../test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj   | 2 +-
 .../Unity.Notifications.Application.csproj                  | 2 +-
 .../Unity.Payments.Application.csproj                       | 4 ++--
 .../modules/Unity.SharedKernel/Unity.SharedKernel.csproj    | 2 +-
 .../Unity.GrantManager.Application.Contracts.csproj         | 2 +-
 .../Unity.GrantManager.Application.csproj                   | 6 +++---
 .../Unity.GrantManager.DbMigrator.csproj                    | 2 +-
 .../Unity.GrantManager.Domain.csproj                        | 2 +-
 .../Unity.GrantManager.EntityFrameworkCore.csproj           | 2 +-
 .../Unity.GrantManager.HttpApi.csproj                       | 2 +-
 .../Unity.GrantManager.Web/Unity.GrantManager.Web.csproj    | 4 ++--
 .../Unity.GrantManager.Application.Tests.csproj             | 2 +-
 .../Unity.GrantManager.Domain.Tests.csproj                  | 2 +-
 .../Unity.GrantManager.EntityFrameworkCore.Tests.csproj     | 2 +-
 .../Unity.GrantManager.Web.Tests.csproj                     | 2 +-
 17 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
index 3f4039d4bf..155d46bbfe 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
@@ -8,9 +8,9 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Azure.AI.OpenAI" Version="2.1.0" />
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageReference Include="NPOI" Version="2.7.5" />
-    <PackageReference Include="PdfPig" Version="0.1.13" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
+    <PackageReference Include="NPOI" Version="2.8.0" />
+    <PackageReference Include="PdfPig" Version="0.1.15" />
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj
index 5538a1c455..405c469ff1 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj
@@ -12,7 +12,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="Volo.Abp.Ddd.Domain.Shared" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Validation" Version="10.5.0" />
   </ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
index 9129e01a0c..9e96fdd7c7 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
@@ -16,7 +16,7 @@
     </PackageReference>
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="Npgsql" Version="10.0.2" />
+    <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
index e6d15e2738..ad902c43a3 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
@@ -10,7 +10,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
 	<PackageReference Include="AWSSDK.S3" Version="4.0.0.5" />
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />    
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
index 693f4794b6..6f02fbe050 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
@@ -9,11 +9,11 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="ClosedXML" Version="0.104.1" />
+    <PackageReference Include="ClosedXML" Version="0.105.0" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.8.0" />
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="Stateless" Version="5.17.0" />
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />    
     <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj b/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
index 83594e09b2..614af69039 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
@@ -16,7 +16,7 @@
 		</PackageReference>
 		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
 		<PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-		<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+		<PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
 		<PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
 		<PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
 		<PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/Unity.GrantManager.Application.Contracts.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/Unity.GrantManager.Application.Contracts.csproj
index 8dbddfb6c7..8b5977867e 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/Unity.GrantManager.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/Unity.GrantManager.Application.Contracts.csproj
@@ -15,7 +15,7 @@
     <ProjectReference Include="..\..\modules\Unity.Reporting\src\Unity.Reporting.Application.Contracts\Unity.Reporting.Application.Contracts.csproj" />
   </ItemGroup>
   <ItemGroup>
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="Volo.Abp.ObjectExtending" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Identity.Application.Contracts" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.PermissionManagement.Application.Contracts" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
index 8f5c87d9ea..6d53193074 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
@@ -38,9 +38,9 @@
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="10.0.10" />
 
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageReference Include="NPOI" Version="2.7.5" />
-    <PackageReference Include="PdfPig" Version="0.1.13" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
+    <PackageReference Include="NPOI" Version="2.8.0" />
+    <PackageReference Include="PdfPig" Version="0.1.15" />
     <PackageReference Include="Quartz.Serialization.Json" Version="3.14.0" />
     <PackageReference Include="RestSharp" Version="112.1.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
index b8cdebf294..3986931f3c 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
@@ -21,7 +21,7 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>    
-    <PackageReference Include="Npgsql" Version="10.0.2" />    
+    <PackageReference Include="Npgsql" Version="10.0.3" />    
     <PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />    
     <PackageReference Include="Serilog.Extensions.Logging" Version="9.0.1" />    
     <PackageReference Include="Serilog.Settings.Configuration" Version="9.0.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
index 608b975396..94990a6e7f 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
@@ -17,7 +17,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="AWSSDK.S3" Version="4.0.0.5" />
     <PackageReference Include="Volo.Abp.Emailing" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
index f5e533ee50..34c11f4a1a 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
@@ -80,7 +80,7 @@
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
 		</PackageReference>
 		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
-		<PackageReference Include="Npgsql" Version="10.0.2" />
+		<PackageReference Include="Npgsql" Version="10.0.3" />
 		<PackageReference Include="Volo.Abp.EntityFrameworkCore.PostgreSql" Version="10.5.0" />
 		<PackageReference Include="Volo.Abp.PermissionManagement.EntityFrameworkCore" Version="10.5.0" />
 		<PackageReference Include="Volo.Abp.SettingManagement.EntityFrameworkCore" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
index 9401310cdb..dc7c2ffd99 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
@@ -15,7 +15,7 @@
     <ProjectReference Include="..\..\modules\Unity.Notifications\src\Unity.Notifications.HttpApi\Unity.Notifications.HttpApi.csproj" /></ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="RestSharp" Version="112.1.0" />    
     <PackageReference Include="Volo.Abp.Identity.HttpApi" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.PermissionManagement.HttpApi" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
index 038fa858ae..62a6d74e9d 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
@@ -61,8 +61,8 @@
     </PackageReference>
     <PackageReference Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
     <PackageReference Include="MiniProfiler.EntityFrameworkCore" Version="4.5.4" />
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageReference Include="Npgsql" Version="10.0.2" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
+    <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
     <PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />
     <PackageReference Include="Serilog.Settings.Configuration" Version="9.0.0" />
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj
index 33a3ec8483..f64f768ab6 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj
@@ -21,7 +21,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="Npgsql" Version="10.0.2" />
+    <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
index e79ea5e854..88a7991aaa 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
@@ -14,7 +14,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="Npgsql" Version="10.0.2" />
+    <PackageReference Include="Npgsql" Version="10.0.3" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
index 829d20fa44..ba305ae514 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
@@ -11,7 +11,7 @@
 	<ItemGroup>
 		<ProjectReference Include="..\..\src\Unity.GrantManager.EntityFrameworkCore\Unity.GrantManager.EntityFrameworkCore.csproj" />
 		<ProjectReference Include="..\Unity.GrantManager.TestBase\Unity.GrantManager.TestBase.csproj" />
-		<PackageReference Include="Npgsql" Version="10.0.2" />
+		<PackageReference Include="Npgsql" Version="10.0.3" />
 		<PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />		
 		<PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
 		<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
index 1664f656da..c38bd30954 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
@@ -24,7 +24,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="HtmlAgilityPack" Version="1.12.1" />
-    <PackageReference Include="Npgsql" Version="10.0.2" />
+    <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />
     <!-- Explicit references to fix vulnerable transitive dependencies -->
     <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.10" />

From b400dead414e93873afea7b88a55d9c3e66d1a6a Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Wed, 22 Jul 2026 15:30:54 -0700
Subject: [PATCH 07/40] AB#33787 - Updated infra/build tooling

---
 .../Unity.AI.Application.Contracts.csproj                 | 4 ++--
 .../src/Unity.AI.Application/Unity.AI.Application.csproj  | 6 +++---
 .../src/Unity.AI.Domain.Shared/Unity.AI.Shared.csproj     | 4 ++--
 .../modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj | 6 +++---
 .../Unity.Flex.Application.Contracts.csproj               | 4 ++--
 .../Unity.Flex.Application/Unity.Flex.Application.csproj  | 4 ++--
 .../src/Unity.Flex.Shared/Unity.Flex.Shared.csproj        | 4 ++--
 .../Unity.Flex/src/Unity.Flex.Web/Unity.Flex.Web.csproj   | 4 ++--
 .../Unity.Flex.Application.Tests.csproj                   | 4 ++--
 .../test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj   | 4 ++--
 .../test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj | 2 +-
 .../Unity.Notifications.Application.Contracts.csproj      | 4 ++--
 .../Unity.Notifications.Application.csproj                | 8 ++++----
 .../Unity.Notifications.Domain.Shared.csproj              | 4 ++--
 .../Unity.Notifications.Domain.csproj                     | 4 ++--
 .../Unity.Notifications.EntityFrameworkCore.csproj        | 4 ++--
 .../Unity.Notifications.HttpApi.Client.csproj             | 4 ++--
 .../Unity.Notifications.HttpApi.csproj                    | 4 ++--
 .../Unity.Notifications.Installer.csproj                  | 4 ++--
 .../Unity.Notifications.Web.csproj                        | 6 +++---
 .../Unity.Notifications.Application.Tests.csproj          | 6 +++---
 .../Unity.Notifications.Domain.Tests.csproj               | 4 ++--
 .../Unity.Notifications.EntityFrameworkCore.Tests.csproj  | 4 ++--
 .../Unity.Notifications.TestBase.csproj                   | 4 ++--
 .../Unity.Payments.Application.Contracts.csproj           | 4 ++--
 .../Unity.Payments.Application.csproj                     | 8 ++++----
 .../Unity.Payments.Shared/Unity.Payments.Shared.csproj    | 4 ++--
 .../src/Unity.Payments.Web/Unity.Payments.Web.csproj      | 4 ++--
 .../Unity.Payments.Application.Tests.csproj               | 6 +++---
 .../Unity.Payments.TestBase.csproj                        | 6 +++---
 .../Unity.Reporting.Application.Contracts.csproj          | 4 ++--
 .../Unity.Reporting.Application.csproj                    | 4 ++--
 .../Unity.Reporting.Shared.csproj                         | 4 ++--
 .../src/Unity.Reporting.Web/Unity.Reporting.Web.csproj    | 4 ++--
 .../Unity.Reporting.Application.Tests.csproj              | 4 ++--
 .../Unity.Reporting.TestBase.csproj                       | 4 ++--
 .../modules/Unity.SharedKernel/Unity.SharedKernel.csproj  | 6 +++---
 .../Unity.GrantManager.Application.csproj                 | 4 ++--
 .../Unity.GrantManager.Domain.Shared.csproj               | 2 +-
 .../Unity.GrantManager.Domain.csproj                      | 4 ++--
 .../Unity.GrantManager.EntityFrameworkCore.csproj         | 2 +-
 .../Unity.GrantManager.HttpApi.csproj                     | 2 +-
 .../Unity.GrantManager.TestBase.csproj                    | 2 +-
 .../Unity.GrantManager.Web.Tests.csproj                   | 2 +-
 44 files changed, 93 insertions(+), 93 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Unity.AI.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Unity.AI.Application.Contracts.csproj
index 2253875073..2222c49ef6 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Unity.AI.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/Unity.AI.Application.Contracts.csproj
@@ -13,8 +13,8 @@
     <ProjectReference Include="..\Unity.AI.Domain.Shared\Unity.AI.Shared.csproj" />
   </ItemGroup>
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
index 155d46bbfe..29bf1acc8c 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
@@ -20,7 +20,7 @@
     <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
     <!-- Explicit references to fix vulnerable transitive dependencies -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
     <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
     <ProjectReference Include="..\..\..\..\modules\Unity.Flex\src\Unity.Flex.Application\Unity.Flex.Application.csproj" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Application.Contracts\Unity.GrantManager.Application.Contracts.csproj" />
@@ -29,8 +29,8 @@
     <ProjectReference Include="..\Unity.AI.Application.Contracts\Unity.AI.Application.Contracts.csproj" />
   </ItemGroup>
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Domain.Shared/Unity.AI.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Domain.Shared/Unity.AI.Shared.csproj
index fbf25b71b3..30508215fd 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Domain.Shared/Unity.AI.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Domain.Shared/Unity.AI.Shared.csproj
@@ -24,8 +24,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj
index 779130a52c..b9304b2656 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj
@@ -17,7 +17,7 @@
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
   </ItemGroup>
 
   <ItemGroup>
@@ -40,8 +40,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application.Contracts/Unity.Flex.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application.Contracts/Unity.Flex.Application.Contracts.csproj
index fe6188cfdf..0b0a20199a 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application.Contracts/Unity.Flex.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application.Contracts/Unity.Flex.Application.Contracts.csproj
@@ -23,8 +23,8 @@
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-		<PackageReference Update="Fody" Version="6.9.2">
+		<PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+		<PackageReference Update="Fody" Version="6.9.3">
 			<PrivateAssets>all</PrivateAssets>
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
 		</PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application/Unity.Flex.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application/Unity.Flex.Application.csproj
index c103557f1f..43505d8f82 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application/Unity.Flex.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Application/Unity.Flex.Application.csproj
@@ -25,8 +25,8 @@
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-		<PackageReference Update="Fody" Version="6.9.2">
+		<PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+		<PackageReference Update="Fody" Version="6.9.3">
 			<PrivateAssets>all</PrivateAssets>
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
 		</PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj
index 405c469ff1..7da95766a1 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Unity.Flex.Shared.csproj
@@ -30,8 +30,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Unity.Flex.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Unity.Flex.Web.csproj
index ca25e1274e..f51c9ebdb9 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Unity.Flex.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Unity.Flex.Web.csproj
@@ -55,8 +55,8 @@
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-		<PackageReference Update="Fody" Version="6.9.2">
+		<PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+		<PackageReference Update="Fody" Version="6.9.3">
 			<PrivateAssets>all</PrivateAssets>
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
 		</PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
index 8baec14ac4..6716d94fb1 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
@@ -24,8 +24,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
index c28f61155a..ae5c5e732e 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
@@ -31,8 +31,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
index 9e96fdd7c7..be60f13edf 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
@@ -24,7 +24,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
     <!-- Explicit references to fix vulnerable transitive dependencies -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.10" />
     <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj
index 509a3937de..6cbf23c23a 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj
@@ -20,8 +20,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
index ad902c43a3..d2f3d7d150 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
@@ -12,7 +12,7 @@
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
-	<PackageReference Include="AWSSDK.S3" Version="4.0.0.5" />
+	<PackageReference Include="AWSSDK.S3" Version="4.0.101.3" />
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />    
     <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
@@ -23,7 +23,7 @@
     <PackageReference Include="Volo.Abp.Http.Client" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Application.Contracts\Unity.GrantManager.Application.Contracts.csproj" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Domain\Unity.GrantManager.Domain.csproj" />
     <ProjectReference Include="..\Unity.Notifications.Application.Contracts\Unity.Notifications.Application.Contracts.csproj" />
@@ -31,8 +31,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain.Shared/Unity.Notifications.Domain.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain.Shared/Unity.Notifications.Domain.Shared.csproj
index c802d900b6..5dcad10b53 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain.Shared/Unity.Notifications.Domain.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain.Shared/Unity.Notifications.Domain.Shared.csproj
@@ -26,8 +26,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain/Unity.Notifications.Domain.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain/Unity.Notifications.Domain.csproj
index 460c66f22c..926f8cad23 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain/Unity.Notifications.Domain.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Domain/Unity.Notifications.Domain.csproj
@@ -17,8 +17,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.EntityFrameworkCore/Unity.Notifications.EntityFrameworkCore.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.EntityFrameworkCore/Unity.Notifications.EntityFrameworkCore.csproj
index 62d4cb2fc6..02618456b9 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.EntityFrameworkCore/Unity.Notifications.EntityFrameworkCore.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.EntityFrameworkCore/Unity.Notifications.EntityFrameworkCore.csproj
@@ -17,8 +17,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi.Client/Unity.Notifications.HttpApi.Client.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi.Client/Unity.Notifications.HttpApi.Client.csproj
index 016294f3dc..c8c944ee7e 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi.Client/Unity.Notifications.HttpApi.Client.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi.Client/Unity.Notifications.HttpApi.Client.csproj
@@ -21,8 +21,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi/Unity.Notifications.HttpApi.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi/Unity.Notifications.HttpApi.csproj
index 6289dc3abe..7e309f547b 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi/Unity.Notifications.HttpApi.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.HttpApi/Unity.Notifications.HttpApi.csproj
@@ -16,8 +16,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Installer/Unity.Notifications.Installer.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Installer/Unity.Notifications.Installer.csproj
index f0612eb724..f9bdac728d 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Installer/Unity.Notifications.Installer.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Installer/Unity.Notifications.Installer.csproj
@@ -23,8 +23,8 @@
     </ItemGroup>
 
     <ItemGroup>
-      <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-      <PackageReference Update="Fody" Version="6.9.2">
+      <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+      <PackageReference Update="Fody" Version="6.9.3">
         <PrivateAssets>all</PrivateAssets>
         <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
       </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj
index 1c272030b4..bbef964873 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj
@@ -20,7 +20,7 @@
     <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
   </ItemGroup>
 
   <ItemGroup>
@@ -56,8 +56,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
index fdfa3b787e..7c5ca6b772 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
@@ -15,12 +15,12 @@
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj
index fde388c659..d84183d4e5 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj
@@ -17,8 +17,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
index d08dd55bac..8543696b79 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
@@ -22,8 +22,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
index a362639dc9..39162e7efc 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
@@ -32,8 +32,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application.Contracts/Unity.Payments.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application.Contracts/Unity.Payments.Application.Contracts.csproj
index e1d552c6b5..751dba9260 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application.Contracts/Unity.Payments.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application.Contracts/Unity.Payments.Application.Contracts.csproj
@@ -27,8 +27,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
index 6f02fbe050..76997247e3 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
@@ -14,7 +14,7 @@
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.8.0" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
-    <PackageReference Include="Stateless" Version="5.17.0" />
+    <PackageReference Include="Stateless" Version="5.20.1" />
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />    
     <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
@@ -30,7 +30,7 @@
     
     <PackageReference Include="Volo.Abp.TenantManagement.Application" Version="10.5.0" />
     <!-- Explicit references to fix vulnerable transitive dependencies -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
     <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Domain\Unity.GrantManager.Domain.csproj" />
@@ -40,8 +40,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Shared/Unity.Payments.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Shared/Unity.Payments.Shared.csproj
index 9400cb0d9d..8042585bb1 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Shared/Unity.Payments.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Shared/Unity.Payments.Shared.csproj
@@ -31,8 +31,8 @@
 	</ItemGroup>
 
 	<ItemGroup>
-	  <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-	  <PackageReference Update="Fody" Version="6.9.2">
+	  <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+	  <PackageReference Update="Fody" Version="6.9.3">
 	    <PrivateAssets>all</PrivateAssets>
 	    <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
 	  </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Web/Unity.Payments.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Web/Unity.Payments.Web.csproj
index f5bcee4e05..3c081bf602 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Web/Unity.Payments.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Web/Unity.Payments.Web.csproj
@@ -66,8 +66,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
index a9e2595d0d..c952656d8f 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
@@ -17,7 +17,7 @@
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
-    <PackageReference Include="Autofac.Extensions.DependencyInjection" Version="11.0.0" />
+    <PackageReference Include="Autofac.Extensions.DependencyInjection" Version="11.0.2" />
     <ProjectReference Include="..\..\..\Unity.SharedKernel\Unity.SharedKernel.csproj" />
     <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
@@ -26,8 +26,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
index b02cf36a28..83b43990fe 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
@@ -41,14 +41,14 @@
     <PackageReference Include="Volo.Abp.Identity.Application" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Identity.EntityFrameworkCore" Version="10.5.0" />
     <!-- Explicit references to fix vulnerable transitive dependencies -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
     <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     <ProjectReference Include="..\..\src\Unity.Payments.Application\Unity.Payments.Application.csproj" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application.Contracts/Unity.Reporting.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application.Contracts/Unity.Reporting.Application.Contracts.csproj
index b9ce5c6cd6..6680bdf353 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application.Contracts/Unity.Reporting.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application.Contracts/Unity.Reporting.Application.Contracts.csproj
@@ -15,8 +15,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/Unity.Reporting.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/Unity.Reporting.Application.csproj
index 608b417494..12e53e814e 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/Unity.Reporting.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/Unity.Reporting.Application.csproj
@@ -23,8 +23,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Domain.Shared/Unity.Reporting.Shared.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Domain.Shared/Unity.Reporting.Shared.csproj
index 45813dafa1..2640f8a1fc 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Domain.Shared/Unity.Reporting.Shared.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Domain.Shared/Unity.Reporting.Shared.csproj
@@ -24,8 +24,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Web/Unity.Reporting.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Web/Unity.Reporting.Web.csproj
index 746afcd03c..c1ea57222d 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Web/Unity.Reporting.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Web/Unity.Reporting.Web.csproj
@@ -55,8 +55,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj
index 70d2945fc3..86a824bc4c 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj
@@ -16,8 +16,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
index d5d61620c3..05476781cc 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
@@ -29,8 +29,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-    <PackageReference Update="Fody" Version="6.9.2">
+    <PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+    <PackageReference Update="Fody" Version="6.9.3">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj b/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
index 614af69039..bece7d1dba 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
@@ -9,8 +9,8 @@
 	</PropertyGroup>
 
 	<ItemGroup>
-		<PackageReference Update="ConfigureAwait.Fody" Version="3.3.2" />
-		<PackageReference Update="Fody" Version="6.8.0">
+		<PackageReference Update="ConfigureAwait.Fody" Version="3.4.1" />
+		<PackageReference Update="Fody" Version="6.9.3">
 			<PrivateAssets>all</PrivateAssets>
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
 		</PackageReference>
@@ -25,6 +25,6 @@
 		<PackageReference Include="Volo.Abp.Http.Client" Version="10.5.0" />
 		<PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
 		<PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.8.0" />
-		<PackageReference Include="Polly" Version="8.6.3" />
+		<PackageReference Include="Polly" Version="8.7.0" />
 	</ItemGroup>
 </Project>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
index 6d53193074..b7f2867813 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
@@ -33,7 +33,7 @@
 
   <!-- Package References -->
   <ItemGroup>
-    <PackageReference Include="DistributedLock.Redis" Version="1.0.3" />
+    <PackageReference Include="DistributedLock.Redis" Version="1.1.1" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="10.0.10" />
@@ -41,7 +41,7 @@
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="NPOI" Version="2.8.0" />
     <PackageReference Include="PdfPig" Version="0.1.15" />
-    <PackageReference Include="Quartz.Serialization.Json" Version="3.14.0" />
+    <PackageReference Include="Quartz.Serialization.Json" Version="3.18.2" />
     <PackageReference Include="RestSharp" Version="112.1.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Unity.GrantManager.Domain.Shared.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Unity.GrantManager.Domain.Shared.csproj
index d1525490ca..3647cb4840 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Unity.GrantManager.Domain.Shared.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Unity.GrantManager.Domain.Shared.csproj
@@ -10,7 +10,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Stateless" Version="5.17.0" />
+    <PackageReference Include="Stateless" Version="5.20.1" />
     <PackageReference Include="Volo.Abp.Identity.Domain.Shared" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.BackgroundJobs.Domain.Shared" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.AuditLogging.Domain.Shared" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
index 94990a6e7f..ed28ac4c33 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
@@ -18,7 +18,7 @@
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
-    <PackageReference Include="AWSSDK.S3" Version="4.0.0.5" />
+    <PackageReference Include="AWSSDK.S3" Version="4.0.101.3" />
     <PackageReference Include="Volo.Abp.Emailing" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.PermissionManagement.Domain.Identity" Version="10.5.0" />
@@ -30,7 +30,7 @@
     <PackageReference Include="Volo.Abp.OpenIddict.Domain" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.PermissionManagement.Domain.OpenIddict" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
 	  <SonarQubeSetting Include="sonar.exclusions">
 		  <Value>**/Assessments/Assessment.cs, **/Assessments/AssessmentWithAssessorQueryResultItem.cs</Value>
 	  </SonarQubeSetting>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
index 34c11f4a1a..5960b6d621 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
@@ -74,7 +74,7 @@
 		<ProjectReference Include="..\..\modules\Unity.AI\src\Unity.AI.Application\Unity.AI.Application.csproj" />
 		<ProjectReference Include="..\Unity.GrantManager.Domain.Shared\Unity.GrantManager.Domain.Shared.csproj" />
 		<ProjectReference Include="..\Unity.GrantManager.Domain\Unity.GrantManager.Domain.csproj" />
-		<PackageReference Include="AppAny.Quartz.EntityFrameworkCore.Migrations.PostgreSQL" Version="0.5.1" />
+		<PackageReference Include="AppAny.Quartz.EntityFrameworkCore.Migrations.PostgreSQL" Version="0.6.0" />
 		<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
 			<PrivateAssets>all</PrivateAssets>
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
index dc7c2ffd99..cbff55dd53 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
@@ -22,7 +22,7 @@
     <PackageReference Include="Volo.Abp.FeatureManagement.HttpApi" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.HttpApi" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
   </ItemGroup>
 
 </Project>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
index b5b976b660..56f8decff3 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
@@ -18,7 +18,7 @@
     <PackageReference Include="Volo.Abp.TestBase" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
-    <PackageReference Include="AWSSDK.Core" Version="4.0.5" />
+    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
     <ProjectReference Include="..\..\src\Unity.GrantManager.Domain\Unity.GrantManager.Domain.csproj" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
index c38bd30954..b150e0ca21 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
@@ -23,7 +23,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="HtmlAgilityPack" Version="1.12.1" />
+    <PackageReference Include="HtmlAgilityPack" Version="1.12.4" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />
     <!-- Explicit references to fix vulnerable transitive dependencies -->

From 3f56031c70fba768d95c0780779347c98e3e5bf5 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Wed, 22 Jul 2026 16:10:31 -0700
Subject: [PATCH 08/40] AB#33787 - Updated Serilog

---
 .../Unity.GrantManager.DbMigrator.csproj                  | 8 ++++----
 .../Unity.GrantManager.Web/Unity.GrantManager.Web.csproj  | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
index 3986931f3c..e365146f43 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
@@ -22,12 +22,12 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>    
     <PackageReference Include="Npgsql" Version="10.0.3" />    
-    <PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />    
-    <PackageReference Include="Serilog.Extensions.Logging" Version="9.0.1" />    
-    <PackageReference Include="Serilog.Settings.Configuration" Version="9.0.0" />
+    <PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />    
+    <PackageReference Include="Serilog.Extensions.Logging" Version="10.0.0" />    
+    <PackageReference Include="Serilog.Settings.Configuration" Version="10.0.1" />
     <PackageReference Include="Serilog.Sinks.Async" Version="2.1.0" />
     <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
-    <PackageReference Include="Serilog.Sinks.Console" Version="6.0.0" />
+    <PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
     <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
index 62a6d74e9d..2756e4ffac 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
@@ -64,8 +64,8 @@
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
-    <PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />
-    <PackageReference Include="Serilog.Settings.Configuration" Version="9.0.0" />
+    <PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
+    <PackageReference Include="Serilog.Settings.Configuration" Version="10.0.1" />
     <PackageReference Include="Serilog.Sinks.Async" Version="2.1.0" />
 
     <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />

From 71d6c91efc980da927a6a61cd541ab06c48857f0 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Wed, 22 Jul 2026 16:19:18 -0700
Subject: [PATCH 09/40] AB#33787 - Test-only tooling patch bumps

---
 .../Unity.Flex.Application.Tests.csproj                       | 2 +-
 .../test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj       | 2 +-
 .../test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj     | 4 ++--
 .../Unity.Identity.Web.Tests/Unity.Identity.Web.Tests.csproj  | 4 ++--
 .../Unity.Notifications.EntityFrameworkCore.Tests.csproj      | 2 +-
 .../Unity.Notifications.TestBase.csproj                       | 2 +-
 .../Unity.Payments.Application.Tests.csproj                   | 2 +-
 .../Unity.Payments.TestBase/Unity.Payments.TestBase.csproj    | 2 +-
 .../Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj  | 2 +-
 .../Unity.TenantManagement.EntityFrameworkCore.Tests.csproj   | 2 +-
 .../Unity.TenantManagement.TestBase.csproj                    | 2 +-
 .../Unity.AspNetCore.Mvc.UI.Theme.UX2.Tests.csproj            | 4 ++--
 .../Unity.GrantManager.Domain.Tests.csproj                    | 2 +-
 .../Unity.GrantManager.EntityFrameworkCore.Tests.csproj       | 2 +-
 .../Unity.GrantManager.TestBase.csproj                        | 2 +-
 15 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
index 6716d94fb1..1d76a5a24c 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
@@ -20,7 +20,7 @@
     <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
index ae5c5e732e..ecab7e18f3 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
@@ -20,7 +20,7 @@
     <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.extensibility.execution" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
index be60f13edf..f7a65b2569 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
@@ -10,7 +10,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="coverlet.collector" Version="6.0.4">
+    <PackageReference Include="coverlet.collector" Version="10.0.1">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
@@ -19,7 +19,7 @@
     <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Identity.Web/test/Unity.Identity.Web.Tests/Unity.Identity.Web.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Identity.Web/test/Unity.Identity.Web.Tests/Unity.Identity.Web.Tests.csproj
index 4f55729056..22e2028137 100644
--- a/applications/Unity.GrantManager/modules/Unity.Identity.Web/test/Unity.Identity.Web.Tests/Unity.Identity.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Identity.Web/test/Unity.Identity.Web.Tests/Unity.Identity.Web.Tests.csproj
@@ -12,14 +12,14 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="coverlet.collector" Version="6.0.4">
+    <PackageReference Update="coverlet.collector" Version="10.0.1">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
index 8543696b79..a65ece7e35 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
@@ -18,7 +18,7 @@
     <ProjectReference Include="..\Unity.Notifications.TestBase\Unity.Notifications.TestBase.csproj" />
     <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
index 39162e7efc..c091269834 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
@@ -21,7 +21,7 @@
     <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.extensibility.execution" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
index c952656d8f..3ae7d15ac6 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
@@ -22,7 +22,7 @@
     <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
index 83b43990fe..7faaad33e1 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
@@ -21,7 +21,7 @@
     <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.extensibility.execution" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
index 05476781cc..96f5c71afd 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
@@ -18,7 +18,7 @@
     <PackageReference Include="Shouldly" Version="4.3.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.extensibility.execution" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
index 46915c93a4..73eebde583 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
@@ -18,7 +18,7 @@
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj
index 94d3c13470..f1e1c2a9bc 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj
@@ -24,7 +24,7 @@
     <PackageReference Include="Volo.Abp.TestBase" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.extensibility.core" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/modules/Unity.Theme.UX2/test/Unity.Theme.UX2.Tests/Unity.AspNetCore.Mvc.UI.Theme.UX2.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Theme.UX2/test/Unity.Theme.UX2.Tests/Unity.AspNetCore.Mvc.UI.Theme.UX2.Tests.csproj
index 4f55729056..22e2028137 100644
--- a/applications/Unity.GrantManager/modules/Unity.Theme.UX2/test/Unity.Theme.UX2.Tests/Unity.AspNetCore.Mvc.UI.Theme.UX2.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Theme.UX2/test/Unity.Theme.UX2.Tests/Unity.AspNetCore.Mvc.UI.Theme.UX2.Tests.csproj
@@ -12,14 +12,14 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Update="coverlet.collector" Version="6.0.4">
+    <PackageReference Update="coverlet.collector" Version="10.0.1">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
index 88a7991aaa..9b85d252d9 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
@@ -17,7 +17,7 @@
     <PackageReference Include="Npgsql" Version="10.0.3" />
     <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
index ba305ae514..60c3bfb733 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
@@ -17,7 +17,7 @@
 		<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
 		<!-- Explicit reference to fix vulnerable transitive dependency -->
 		<PackageReference Include="System.IO.Packaging" Version="10.0.10" />
-		<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
+		<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
 	</ItemGroup>
 
 	<ItemGroup>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
index 56f8decff3..0324572e22 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
@@ -32,7 +32,7 @@
     <PackageReference Include="Shouldly" Version="4.3.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.extensibility.execution" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>

From 9daffb5bdb8eb9263c6a0ea0a0dbde90e7c1da6c Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Wed, 22 Jul 2026 17:12:22 -0700
Subject: [PATCH 10/40] AB#33787 - Cleanup

---
 .../src/Unity.AI.Application/Unity.AI.Application.csproj   | 3 +--
 .../modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj  | 2 --
 .../Unity.Flex.Application.Tests.csproj                    | 6 ++++--
 .../test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj  | 5 -----
 .../Unity.Identity.Web/src/Unity.Identity.Web.csproj       | 2 --
 .../Unity.Notifications.Application.csproj                 | 2 --
 .../Unity.Notifications.Web/Unity.Notifications.Web.csproj | 2 --
 .../Unity.Notifications.Application.Tests.csproj           | 2 --
 .../Unity.Notifications.EntityFrameworkCore.Tests.csproj   | 4 +++-
 .../Unity.Payments.Application.csproj                      | 3 ---
 .../Unity.Payments.Application.Tests.csproj                | 6 ++++--
 .../Unity.Payments.TestBase/Unity.Payments.TestBase.csproj | 3 ---
 ...Unity.TenantManagement.EntityFrameworkCore.Tests.csproj | 4 +++-
 .../Unity.GrantManager.Application.csproj                  | 2 --
 .../Unity.GrantManager.DbMigrator.csproj                   | 2 --
 .../Unity.GrantManager.Domain.csproj                       | 2 --
 .../Unity.GrantManager.EntityFrameworkCore.csproj          | 2 --
 .../Unity.GrantManager.HttpApi.csproj                      | 2 --
 .../Unity.GrantManager.Domain.Tests.csproj                 | 3 ---
 .../Unity.GrantManager.EntityFrameworkCore.Tests.csproj    | 7 ++++---
 .../Unity.GrantManager.Web.Tests.csproj                    | 3 ---
 21 files changed, 19 insertions(+), 48 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
index 29bf1acc8c..17678d22f3 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
@@ -19,8 +19,7 @@
     <PackageReference Include="Volo.Abp.EntityFrameworkCore" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Features" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
-    <!-- Explicit references to fix vulnerable transitive dependencies -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
+    <!-- Explicit reference to fix vulnerable transitive dependency -->
     <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
     <ProjectReference Include="..\..\..\..\modules\Unity.Flex\src\Unity.Flex.Application\Unity.Flex.Application.csproj" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Application.Contracts\Unity.GrantManager.Application.Contracts.csproj" />
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj
index b9304b2656..4b5d57bd20 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Web/Unity.AI.Web.csproj
@@ -16,8 +16,6 @@
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.5.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
index 1d76a5a24c..7002d03d83 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
@@ -17,10 +17,12 @@
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
 	  <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
+	  <!-- Explicit references to fix vulnerable transitive dependency. -->
+    <!-- Remove the SQLitePCLRaw pin once EF Core's Sqlite provider moves to SQLitePCLRaw.bundle_e_sqlite3 >= 3.x. -->
+	  <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
+	  <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
     <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
index f7a65b2569..865c27d8c9 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
@@ -23,11 +23,6 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <!-- Explicit references to fix vulnerable transitive dependencies -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.10" />
-    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Unity.Identity.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Unity.Identity.Web.csproj
index 6eb1991955..86d284e211 100644
--- a/applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Unity.Identity.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Unity.Identity.Web.csproj
@@ -36,8 +36,6 @@
     <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared" Version="10.5.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
index d2f3d7d150..7a8eacb9a4 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Unity.Notifications.Application.csproj
@@ -22,8 +22,6 @@
     <PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Http.Client" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Application.Contracts\Unity.GrantManager.Application.Contracts.csproj" />
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Domain\Unity.GrantManager.Domain.csproj" />
     <ProjectReference Include="..\Unity.Notifications.Application.Contracts\Unity.Notifications.Application.Contracts.csproj" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj
index bbef964873..b5223b81ad 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Unity.Notifications.Web.csproj
@@ -19,8 +19,6 @@
     <PackageReference Include="Volo.Abp.BackgroundJobs.Quartz" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Web" Version="10.5.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
index 7c5ca6b772..c1379fb8e5 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
@@ -14,8 +14,6 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
index a65ece7e35..67eef66cc0 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
@@ -17,7 +17,9 @@
     <ProjectReference Include="..\..\src\Unity.Notifications.EntityFrameworkCore\Unity.Notifications.EntityFrameworkCore.csproj" />
     <ProjectReference Include="..\Unity.Notifications.TestBase\Unity.Notifications.TestBase.csproj" />
     <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
+    <!-- Explicit references to fix vulnerable transitive dependency. -->
+    <!-- Remove the SQLitePCLRaw pin once EF Core's Sqlite provider moves to SQLitePCLRaw.bundle_e_sqlite3 >= 3.x. -->
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
index 76997247e3..35971f1145 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Unity.Payments.Application.csproj
@@ -29,9 +29,6 @@
     <PackageReference Include="Volo.Abp.Identity.Application" Version="10.5.0" />
     
     <PackageReference Include="Volo.Abp.TenantManagement.Application" Version="10.5.0" />
-    <!-- Explicit references to fix vulnerable transitive dependencies -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
-    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     
     <ProjectReference Include="..\..\..\..\src\Unity.GrantManager.Domain\Unity.GrantManager.Domain.csproj" />
     <ProjectReference Include="..\Unity.Payments.Application.Contracts\Unity.Payments.Application.Contracts.csproj" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
index 3ae7d15ac6..90a6883084 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
@@ -17,12 +17,14 @@
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
+    <!-- Explicit references to fix vulnerable transitive dependency. -->
+    <!-- Remove the SQLitePCLRaw pin once EF Core's Sqlite provider moves to SQLitePCLRaw.bundle_e_sqlite3 >= 3.x. -->
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
     <PackageReference Include="Autofac.Extensions.DependencyInjection" Version="11.0.2" />
     <ProjectReference Include="..\..\..\Unity.SharedKernel\Unity.SharedKernel.csproj" />
     <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
index 7faaad33e1..92646dcaf4 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
@@ -40,9 +40,6 @@
     <PackageReference Include="Volo.Abp.Identity.Domain" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Identity.Application" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Identity.EntityFrameworkCore" Version="10.5.0" />
-    <!-- Explicit references to fix vulnerable transitive dependencies -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
-    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     <ProjectReference Include="..\..\src\Unity.Payments.Application\Unity.Payments.Application.csproj" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
index 73eebde583..e69e12d938 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
@@ -17,7 +17,9 @@
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
+    <!-- Explicit references to fix vulnerable transitive dependency. -->
+    <!-- Remove the SQLitePCLRaw pin once EF Core's Sqlite provider moves to SQLitePCLRaw.bundle_e_sqlite3 >= 3.x. -->
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
index b7f2867813..6a07fadb56 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
@@ -45,8 +45,6 @@
     <PackageReference Include="RestSharp" Version="112.1.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
 
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
 
     <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
index e365146f43..11ae6d5466 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.DbMigrator/Unity.GrantManager.DbMigrator.csproj
@@ -29,8 +29,6 @@
     <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
     <PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
     <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
index ed28ac4c33..8def4f7e90 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Unity.GrantManager.Domain.csproj
@@ -29,8 +29,6 @@
     <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.OpenIddict.Domain" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.PermissionManagement.Domain.OpenIddict" Version="10.5.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
 	  <SonarQubeSetting Include="sonar.exclusions">
 		  <Value>**/Assessments/Assessment.cs, **/Assessments/AssessmentWithAssessorQueryResultItem.cs</Value>
 	  </SonarQubeSetting>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
index 5960b6d621..de42a71770 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.EntityFrameworkCore/Unity.GrantManager.EntityFrameworkCore.csproj
@@ -90,8 +90,6 @@
 		<PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.5.0" />
 		<PackageReference Include="Volo.Abp.FeatureManagement.EntityFrameworkCore" Version="10.5.0" />
 		<PackageReference Include="Volo.Abp.OpenIddict.EntityFrameworkCore" Version="10.5.0" />
-		<!-- Explicit reference to fix vulnerable transitive dependency -->
-		<PackageReference Include="System.IO.Packaging" Version="10.0.10" />
 		<ProjectReference Include="..\..\modules\Unity.Notifications\src\Unity.Notifications.EntityFrameworkCore\Unity.Notifications.EntityFrameworkCore.csproj" /></ItemGroup>
 
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
index cbff55dd53..c8ef1682da 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
@@ -21,8 +21,6 @@
     <PackageReference Include="Volo.Abp.PermissionManagement.HttpApi" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.FeatureManagement.HttpApi" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.HttpApi" Version="10.5.0" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="AWSSDK.Core" Version="4.0.100.7" />
   </ItemGroup>
 
 </Project>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
index 9b85d252d9..5bf9a91957 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
@@ -15,9 +15,6 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
-    <!-- Explicit reference to fix vulnerable transitive dependency -->
-    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
index 60c3bfb733..bd979db04e 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
@@ -13,11 +13,12 @@
 		<ProjectReference Include="..\Unity.GrantManager.TestBase\Unity.GrantManager.TestBase.csproj" />
 		<PackageReference Include="Npgsql" Version="10.0.3" />
 		<PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />		
+		<!-- Explicit references to fix vulnerable transitive dependency. -->
+		<!-- Remove the SQLitePCLRaw pin once EF Core's Sqlite provider moves to SQLitePCLRaw.bundle_e_sqlite3 >= 3.x. -->
+		<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
+		<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
 		<PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
 		<PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
-		<!-- Explicit reference to fix vulnerable transitive dependency -->
-		<PackageReference Include="System.IO.Packaging" Version="10.0.10" />
-		<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
 	</ItemGroup>
 
 	<ItemGroup>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
index b150e0ca21..5e310f62cc 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
@@ -26,9 +26,6 @@
     <PackageReference Include="HtmlAgilityPack" Version="1.12.4" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />
-    <!-- Explicit references to fix vulnerable transitive dependencies -->
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.10" />
-    <PackageReference Include="System.IO.Packaging" Version="10.0.10" />
     <ProjectReference Include="..\Unity.GrantManager.TestBase\Unity.GrantManager.TestBase.csproj" />
     <ProjectReference Include="..\..\src\Unity.GrantManager.Web\Unity.GrantManager.Web.csproj" />
     <PackageReference Include="Volo.Abp.AspNetCore.TestBase" Version="10.5.0" />

From feae7cd8f6ebe79574d94464ef5d3b4bcc46c67a Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Wed, 22 Jul 2026 17:52:36 -0700
Subject: [PATCH 11/40] AB#33787 - Updated comment

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../Unity.GrantManager.Web/Unity.GrantManager.Web.csproj    | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
index 06358ba2ed..c1366b7ee4 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Unity.GrantManager.Web.csproj
@@ -78,10 +78,8 @@
     <PackageReference Include="Volo.Abp.Swashbuckle" Version="10.5.0" />
     <PackageReference Include="prometheus-net.AspNetCore" Version="8.2.1" />
 
-    <!-- Override transitive Swashbuckle.AspNetCore (pulled at 10.0.1 by Volo.Abp.Swashbuckle 10.3.0),
-         which resolves a vulnerable Microsoft.OpenApi 2.3.0 (GHSA-v5pm-xwqc-g5wc). 10.2.3 depends on
-         Microsoft.OpenApi 2.7.5+, which fixes it. Remove this once Volo.Abp.Swashbuckle depends on
-         Swashbuckle.AspNetCore >= 10.2.3 natively. -->
+    <!-- Override transitive Swashbuckle.AspNetCore to ensure Microsoft.OpenApi >= 2.7.5 (fixes GHSA-v5pm-xwqc-g5wc).
+         Remove this once Volo.Abp.Swashbuckle depends on Swashbuckle.AspNetCore >= 10.2.3 transitively. -->
     <PackageReference Include="Swashbuckle.AspNetCore" Version="10.2.3" />
   </ItemGroup>
 

From 4d2634eb69ede4937d3140329d43e2406cf8a4c7 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Thu, 23 Jul 2026 12:17:13 -0700
Subject: [PATCH 12/40] AB#33787 - Rollbacked to the previous NPOI version due
 to unknown licensing situation

---
 .../src/Unity.AI.Application/Unity.AI.Application.csproj        | 2 +-
 .../Unity.GrantManager.Application.csproj                       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
index 17678d22f3..91c741e446 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/Unity.AI.Application.csproj
@@ -9,7 +9,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Azure.AI.OpenAI" Version="2.1.0" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
-    <PackageReference Include="NPOI" Version="2.8.0" />
+    <PackageReference Include="NPOI" Version="2.7.5" />
     <PackageReference Include="PdfPig" Version="0.1.15" />
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Mapperly" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
index 6a07fadb56..d73a90573d 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
@@ -39,7 +39,7 @@
     <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="10.0.10" />
 
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
-    <PackageReference Include="NPOI" Version="2.8.0" />
+    <PackageReference Include="NPOI" Version="2.7.5" />
     <PackageReference Include="PdfPig" Version="0.1.15" />
     <PackageReference Include="Quartz.Serialization.Json" Version="3.18.2" />
     <PackageReference Include="RestSharp" Version="112.1.0" />

From e8985c4f2fc2e7ea1e05091875c23b9d3c5be19a Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Thu, 23 Jul 2026 13:23:26 -0700
Subject: [PATCH 13/40] AB#33787 - Swap obsolete Stateless API to async

---
 .../Domain/Services/PaymentsManager.cs                    | 2 +-
 .../Domain/Workflow/WorkflowExtensions.cs                 | 5 +++--
 .../Assessments/AssessmentAppService.cs                   | 2 +-
 .../Workflow/UnityWorkflowExtensions.cs                   | 5 +++--
 .../Applications/ApplicationManager.cs                    | 8 ++++----
 .../Applications/IApplicationManager.cs                   | 2 +-
 .../Applications/OnboardingApplicationManager.cs          | 6 +++---
 .../Assessments/AssessmentManager.cs                      | 2 +-
 8 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs
index ddefff28db..a10121e4e8 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs
@@ -79,7 +79,7 @@ public async Task<List<PaymentActionResultItem>> GetActions(Guid paymentRequests
                 s => paymentRequest.SetPaymentRequestStatus(s), ConfigureWorkflow);
 
             var allActions = Workflow.GetAllActions().Distinct().ToList();
-            var permittedActions = Workflow.GetPermittedActions().ToList();
+            var permittedActions = (await Workflow.GetPermittedActions()).ToList();
 
             var actionsList = allActions
                 .Select(trigger =>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/WorkflowExtensions.cs b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/WorkflowExtensions.cs
index 607d7c6f2b..3ef2ba25b7 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/WorkflowExtensions.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/WorkflowExtensions.cs
@@ -3,6 +3,7 @@
 using Stateless.Graph;
 using System.Collections.Generic;
 using System.Linq;
+using System.Threading.Tasks;
 
 namespace Unity.Payments.Domain.Workflow;
 public static class UnityWorkflowExtensions
@@ -10,9 +11,9 @@ public static class UnityWorkflowExtensions
     /// <summary>
     /// The currently permitted actions allowed by the workflow state machine.
     /// </summary>
-    public static IEnumerable<TTriggers> GetPermittedActions<TStates, TTriggers>(this PaymentsWorkflow<TStates, TTriggers> workflow)
+    public static async Task<IEnumerable<TTriggers>> GetPermittedActions<TStates, TTriggers>(this PaymentsWorkflow<TStates, TTriggers> workflow)
     {
-        return workflow._stateMachine.GetPermittedTriggers();
+        return await workflow._stateMachine.GetPermittedTriggersAsync();
     }
 
     /// <summary>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Assessments/AssessmentAppService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Assessments/AssessmentAppService.cs
index ae1a206917..98a95a47b7 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Assessments/AssessmentAppService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Assessments/AssessmentAppService.cs
@@ -262,7 +262,7 @@ public List<AssessmentAction> GetAllActions()
         public async Task<List<AssessmentAction>> GetPermittedActions(Guid assessmentId)
         {
             var assessment = await _assessmentRepository.GetAsync(assessmentId);
-            var workflowActions = assessment.Workflow.GetPermittedActions();
+            var workflowActions = await assessment.Workflow.GetPermittedActions();
 
             List<AssessmentAction> permittedActions = new();
             foreach (var triggerAction in workflowActions)
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflowExtensions.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflowExtensions.cs
index f6572df6f6..2afd849392 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflowExtensions.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflowExtensions.cs
@@ -1,6 +1,7 @@
 using Stateless.Graph;
 using System.Collections.Generic;
 using System.Linq;
+using System.Threading.Tasks;
 
 namespace Unity.GrantManager.Workflow;
 public static class UnityWorkflowExtensions
@@ -8,9 +9,9 @@ public static class UnityWorkflowExtensions
     /// <summary>
     /// The currently permitted actions allowed by the workflow state machine.
     /// </summary>
-    public static IEnumerable<TTriggers> GetPermittedActions<TStates, TTriggers>(this UnityWorkflow<TStates, TTriggers> workflow)
+    public static async Task<IEnumerable<TTriggers>> GetPermittedActions<TStates, TTriggers>(this UnityWorkflow<TStates, TTriggers> workflow)
     {
-        return workflow._stateMachine.GetPermittedTriggers();
+        return await workflow._stateMachine.GetPermittedTriggersAsync();
     }
 
     /// <summary>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs
index 1c92533519..36408a71eb 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs
@@ -178,7 +178,7 @@ public async Task<List<ApplicationActionResultItem>> GetActions(Guid application
             });
 
         var allActions = Workflow.GetAllActions().Distinct().ToList();
-        var permittedActions = Workflow.GetPermittedActions().ToList();
+        var permittedActions = (await Workflow.GetPermittedActions()).ToList();
 
         var actionsList = allActions
             .Select(trigger =>
@@ -194,7 +194,7 @@ public async Task<List<ApplicationActionResultItem>> GetActions(Guid application
         return actionsList;
     }
 
-    public bool IsActionAllowed(Application application, GrantApplicationAction triggerAction)
+    public async Task<bool> IsActionAllowed(Application application, GrantApplicationAction triggerAction)
     {
         var Workflow = new UnityWorkflow<GrantApplicationState, GrantApplicationAction>(
             () => application.ApplicationStatus.StatusCode,
@@ -203,7 +203,7 @@ public bool IsActionAllowed(Application application, GrantApplicationAction trig
                 ConfigureWorkflow(sm, application.ApplicationForm.IsDirectApproval);
             });
 
-        return Workflow.GetPermittedActions().Contains(triggerAction);
+        return (await Workflow.GetPermittedActions()).Contains(triggerAction);
     }
 
     /// <summary>
@@ -326,7 +326,7 @@ public async Task RemoveAssigneeAsync(Guid applicationId, Guid assigneeId)
         using var uow = _unitOfWorkManager.Begin();
         var person = await _personRepository.FindAsync(assigneeId) ?? throw new BusinessException("Tenant User Missing!");
         var application = await _applicationRepository.GetAsync(applicationId, true);
-        IQueryable<ApplicationAssignment> queryableAssignment = _applicationAssignmentRepository.GetQueryableAsync().Result;
+        IQueryable<ApplicationAssignment> queryableAssignment = await _applicationAssignmentRepository.GetQueryableAsync();
         List<ApplicationAssignment> assignments = queryableAssignment
             .Where(a => a.ApplicationId.Equals(applicationId))
             .Where(b => b.AssigneeId.Equals(person.Id)).ToList();
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/IApplicationManager.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/IApplicationManager.cs
index ce61915c33..73b4d7f2d0 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/IApplicationManager.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/IApplicationManager.cs
@@ -12,6 +12,6 @@ public interface IApplicationManager
     Task<List<ApplicationActionResultItem>> GetActions(Guid applicationId);    
     Task<Application> TriggerAction(Guid applicationId, GrantApplicationAction triggerAction);
     Task SetAssigneesAsync(Guid applicationId, List<(Guid? assigneeId, string? fullName)> assigneeSubs);
-    bool IsActionAllowed(Application application, GrantApplicationAction triggerAction);
+    Task<bool> IsActionAllowed(Application application, GrantApplicationAction triggerAction);
     string? GetWorkflowDiagram(bool isDirectApproval);
 }
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/OnboardingApplicationManager.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/OnboardingApplicationManager.cs
index aae3a375aa..751e9b0a1a 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/OnboardingApplicationManager.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/OnboardingApplicationManager.cs
@@ -40,7 +40,7 @@ public async Task<List<ApplicationActionResultItem>> GetActions(Guid application
             ConfigureWorkflow);
 
         var allActions = workflow.GetAllActions().Distinct().ToList();
-        var permittedActions = workflow.GetPermittedActions().ToList();
+        var permittedActions = (await workflow.GetPermittedActions()).ToList();
 
         return allActions
             .Select(trigger => new ApplicationActionResultItem
@@ -53,7 +53,7 @@ public async Task<List<ApplicationActionResultItem>> GetActions(Guid application
             .ToList();
     }
 
-    public bool IsActionAllowed(Application application, GrantApplicationAction triggerAction)
+    public static async Task<bool> IsActionAllowed(Application application, GrantApplicationAction triggerAction)
     {
         var statusCode = application.ApplicationStatus.StatusCode;
         var workflow = new UnityWorkflow<GrantApplicationState, GrantApplicationAction>(
@@ -61,7 +61,7 @@ public bool IsActionAllowed(Application application, GrantApplicationAction trig
             s => statusCode = s,
             ConfigureWorkflow);
 
-        return workflow.GetPermittedActions().Contains(triggerAction);
+        return (await workflow.GetPermittedActions()).Contains(triggerAction);
     }
 
     public async Task<Application> TriggerAction(Guid applicationId, GrantApplicationAction triggerAction)
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Assessments/AssessmentManager.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Assessments/AssessmentManager.cs
index 977b656151..ec38d5d30d 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Assessments/AssessmentManager.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Assessments/AssessmentManager.cs
@@ -71,7 +71,7 @@ public async Task<Assessment> CreateAsync(
                 assessorUser.Id),
             autoSave: true);
 
-        var isTransitionToAssessmentAllowed = _applicationManager.IsActionAllowed(application, GrantApplicationAction.Internal_StartAssessment);
+        var isTransitionToAssessmentAllowed = await _applicationManager.IsActionAllowed(application, GrantApplicationAction.Internal_StartAssessment);
         if (!hasOtherAssessments && isTransitionToAssessmentAllowed)
         {
             await _applicationManager.TriggerAction(application.Id, GrantApplicationAction.Internal_StartAssessment);

From b6937955c4b57b8b18db8074c882ab7cb3ab174b Mon Sep 17 00:00:00 2001
From: Jacob Smith <jacob.smith@gov.bc.ca>
Date: Tue, 21 Jul 2026 16:07:16 -0700
Subject: [PATCH 14/40] AB#33866 add AI worksheet field review

---
 .../IApplicationFormVersionService.cs         |   5 +-
 .../Mapping/AiWorksheetReviewDto.cs           |  27 +++
 .../Mapping/ConfirmAiWorksheetDto.cs          |  10 +
 .../ApplicationFormVersionAppService.cs       | 130 +++++++++++-
 .../GenerateFormWorksheetJob.cs               | 190 +++++++++++-------
 .../Pages/ApplicationForms/Mapping.js         | 183 ++++++++++++++++-
 .../Properties/launchSettings.json            |   8 +-
 .../CustomFields/CustomFieldsViewComponent.cs |   7 +-
 .../CustomFields/CustomFieldsViewModel.cs     |   4 +-
 .../Components/CustomFields/Default.cshtml    |  35 +++-
 .../Components/CustomFields/Default.css       | 163 +++++++++++++++
 .../ApplicationFormVersionAppServiceTests.cs  | 156 +++++++++++++-
 12 files changed, 827 insertions(+), 91 deletions(-)
 create mode 100644 applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetReviewDto.cs
 create mode 100644 applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/ConfirmAiWorksheetDto.cs

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormVersionService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormVersionService.cs
index 3cc7e220d4..03107b9988 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormVersionService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormVersionService.cs
@@ -22,7 +22,10 @@ public interface IApplicationFormVersionAppService : ICrudAppService<
         Task<ApplicationFormVersionDto?> TryInitializeApplicationFormVersion(string? formId, int version, Guid applicationFormId, string formVersionId, bool published);
         Task<ApplicationFormVersionDto?> GetByChefsFormVersionId(Guid chefsFormVersionId);
         Task<int> GetFormVersionByApplicationIdAsync(Guid applicationId);
-        Task DeleteWorkSheetMappingByFormName(string formName, Guid formVersionId);
+        Task DeleteWorkSheetMappingByFormName(string formName, Guid formVersionId);
         Task<ApplicationFormMappingDto> GenerateMappingAsync(Guid id);
+        Task<AiWorksheetReviewDto?> GetPendingAiWorksheetAsync(Guid formVersionId);
+        Task ConfirmAiWorksheetAsync(Guid formVersionId, ConfirmAiWorksheetDto input);
+        Task CancelAiWorksheetAsync(Guid formVersionId);
     }
 }
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetReviewDto.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetReviewDto.cs
new file mode 100644
index 0000000000..76e9f05e46
--- /dev/null
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetReviewDto.cs
@@ -0,0 +1,27 @@
+using System;
+using System.Collections.Generic;
+
+namespace Unity.GrantManager.ApplicationForms.Mapping;
+
+public class AiWorksheetReviewDto
+{
+    public Guid WorksheetId { get; set; }
+    public string WorksheetName { get; set; } = string.Empty;
+    public string WorksheetTitle { get; set; } = string.Empty;
+    public List<AiWorksheetReviewSectionDto> Sections { get; set; } = [];
+}
+
+public class AiWorksheetReviewSectionDto
+{
+    public string Name { get; set; } = string.Empty;
+    public List<AiWorksheetReviewFieldDto> Fields { get; set; } = [];
+}
+
+public class AiWorksheetReviewFieldDto
+{
+    public Guid Id { get; set; }
+    public string Key { get; set; } = string.Empty;
+    public string Label { get; set; } = string.Empty;
+    public string Type { get; set; } = string.Empty;
+    public bool Selected { get; set; } = true;
+}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/ConfirmAiWorksheetDto.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/ConfirmAiWorksheetDto.cs
new file mode 100644
index 0000000000..de0ff5485f
--- /dev/null
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/ConfirmAiWorksheetDto.cs
@@ -0,0 +1,10 @@
+using System;
+using System.Collections.Generic;
+
+namespace Unity.GrantManager.ApplicationForms.Mapping;
+
+public class ConfirmAiWorksheetDto
+{
+    public Guid WorksheetId { get; set; }
+    public List<Guid> SelectedFieldIds { get; set; } = [];
+}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs
index d09c3bb30c..db0efc4266 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs
@@ -1,4 +1,5 @@
 using Microsoft.Extensions.Logging;
+using Microsoft.AspNetCore.Mvc;
 using Newtonsoft.Json.Linq;
 using System;
 using System.Linq;
@@ -27,6 +28,10 @@
 using Volo.Abp;
 using Volo.Abp.Uow;
 using Unity.GrantManager.Intakes.Mapping;
+using Unity.Flex.Domain.WorksheetLinks;
+using Unity.Flex.Domain.Worksheets;
+using Unity.GrantManager.Flex;
+using Unity.Modules.Shared.Correlation;
 
 namespace Unity.GrantManager.ApplicationForms
 {
@@ -41,7 +46,10 @@ public class ApplicationFormVersionAppService(
         IFeatureChecker featureChecker,
         IApplicationFormVersionMappingReadService mappingReadService,
         IAICooldownService aiCooldownService,
-        IFormMappingService aiService) :
+        IFormMappingService aiService,
+        IWorksheetRepository worksheetRepository,
+        IRepository<CustomField, Guid> customFieldRepository,
+        IWorksheetLinkRepository worksheetLinkRepository) :
         CrudAppService<
             ApplicationFormVersion,
             ApplicationFormVersionDto,
@@ -353,6 +361,126 @@ public virtual async Task<ApplicationFormMappingDto> GenerateMappingAsync(Guid i
             };
         }
 
+        [HttpGet("api/app/application-form-version/pending-ai-worksheet")]
+        public virtual async Task<AiWorksheetReviewDto?> GetPendingAiWorksheetAsync(Guid formVersionId)
+        {
+            await CheckPolicyAsync(AIPermissions.Analysis.ViewFormWorksheet);
+
+            var worksheet = await GetPendingAiWorksheetEntityAsync(formVersionId);
+            return worksheet == null ? null : MapAiWorksheetReview(worksheet);
+        }
+
+        [HttpPost("api/app/application-form-version/confirm-ai-worksheet")]
+        public virtual async Task ConfirmAiWorksheetAsync(Guid formVersionId, ConfirmAiWorksheetDto input)
+        {
+            await CheckPolicyAsync(AIPermissions.Analysis.GenerateFormWorksheet);
+
+            var worksheet = await GetPendingAiWorksheetEntityAsync(formVersionId);
+            if (worksheet == null || worksheet.Id != input.WorksheetId)
+            {
+                throw new UserFriendlyException("The AI worksheet is no longer available for review.");
+            }
+
+            var selectedFieldIds = input.SelectedFieldIds.ToHashSet();
+            var fields = worksheet.Sections.SelectMany(section => section.Fields).ToList();
+            var unknownFieldIds = selectedFieldIds.Except(fields.Select(field => field.Id)).ToList();
+            if (unknownFieldIds.Count > 0)
+            {
+                throw new UserFriendlyException("The AI worksheet selection is invalid.");
+            }
+
+            foreach (var field in fields.Where(field => !selectedFieldIds.Contains(field.Id)))
+            {
+                field.Section.RemoveField(field);
+                await customFieldRepository.DeleteAsync(field.Id);
+            }
+
+            worksheet.SetPublished(true);
+            await worksheetRepository.UpdateAsync(worksheet, true);
+            await UpsertAiWorksheetLinkAsync(worksheet.Id, formVersionId);
+        }
+
+        [HttpPost("api/app/application-form-version/cancel-ai-worksheet")]
+        public virtual async Task CancelAiWorksheetAsync(Guid formVersionId)
+        {
+            await CheckPolicyAsync(AIPermissions.Analysis.GenerateFormWorksheet);
+
+            var worksheet = await GetPendingAiWorksheetEntityAsync(formVersionId);
+            if (worksheet != null)
+            {
+                await worksheetRepository.DeleteAsync(worksheet, true);
+            }
+        }
+
+        private async Task<Worksheet?> GetPendingAiWorksheetEntityAsync(Guid formVersionId)
+        {
+            var formVersion = await formVersionRepository.GetAsync(formVersionId);
+            var worksheetName = BuildAiWorksheetName(formVersion.ApplicationFormId, formVersion.Id);
+            var worksheet = await worksheetRepository.GetByNameAsync(worksheetName, true);
+
+            if (worksheet == null)
+            {
+                return null;
+            }
+
+            if (worksheet.Published)
+            {
+                return null;
+            }
+
+            return worksheet;
+        }
+
+        private static AiWorksheetReviewDto MapAiWorksheetReview(Worksheet worksheet) => new()
+        {
+            WorksheetId = worksheet.Id,
+            WorksheetName = worksheet.Name,
+            WorksheetTitle = worksheet.Title,
+            Sections = worksheet.Sections
+                .OrderBy(section => section.Order)
+                .Select(section => new AiWorksheetReviewSectionDto
+                {
+                    Name = section.Name,
+                    Fields = section.Fields
+                        .OrderBy(field => field.Order)
+                        .Select(field => new AiWorksheetReviewFieldDto
+                        {
+                            Id = field.Id,
+                            Key = field.Key,
+                            Label = field.Label,
+                            Type = field.Type.ToString()
+                        })
+                        .ToList()
+                })
+                .ToList()
+        };
+
+        private async Task UpsertAiWorksheetLinkAsync(Guid worksheetId, Guid formVersionId)
+        {
+            var existingLink = await worksheetLinkRepository.GetExistingLinkAsync(
+                worksheetId,
+                formVersionId,
+                CorrelationConsts.FormVersion);
+
+            if (existingLink != null)
+            {
+                existingLink.SetAnchor(FlexConsts.CustomTab).SetOrder(1);
+                await worksheetLinkRepository.UpdateAsync(existingLink, true);
+                return;
+            }
+
+            await worksheetLinkRepository.InsertAsync(new WorksheetLink(
+                Guid.NewGuid(),
+                worksheetId,
+                formVersionId,
+                CorrelationConsts.FormVersion,
+                FlexConsts.CustomTab,
+                1), true);
+        }
+
+        private static string BuildAiWorksheetName(Guid formId, Guid formVersionId) =>
+            $"ai-form-{formId}-version-{formVersionId}-worksheet";
+
         private async Task<int> GetVersion(Guid formVersionId)
         {
             var formVersion = await formVersionRepository.GetByChefsFormVersionAsync(formVersionId);
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
index 50b105898a..e4a39019aa 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
@@ -1,6 +1,6 @@
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Logging;
 using System;
-using System.Collections.Generic;
 using System.Linq;
 using System.Text.Json;
 using System.Threading.Tasks;
@@ -8,10 +8,10 @@
 using Unity.AI.Cooldown;
 using Unity.AI.Operations;
 using Unity.AI.Requests;
+using Unity.AI.Responses;
 using Unity.GrantManager.ApplicationForms;
 using Unity.GrantManager.ApplicationForms.Mapping;
 using Unity.GrantManager.Applications;
-using Unity.GrantManager.Flex;
 using Unity.Flex.Domain.WorksheetLinks;
 using Unity.Flex.Domain.Worksheets;
 using Unity.Flex.Worksheets;
@@ -35,6 +35,7 @@ public class GenerateFormWorksheetJob(
     ICurrentTenant currentTenant,
     IUnitOfWorkManager unitOfWorkManager,
     IAICooldownService aiCooldownService,
+    IConfiguration configuration,
     ILogger<GenerateFormWorksheetJob> logger) : AsyncBackgroundJob<GenerateFormWorksheetBackgroundJobArgs>, ITransientDependency
 {
     private static readonly JsonSerializerOptions CaseInsensitiveJsonOptions = new()
@@ -67,72 +68,96 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
                 var worksheetName = BuildWorksheetName(formVersion.Id, applicationForm.Id);
                 var existingWorksheet = await worksheetRepository.GetByNameAsync(worksheetName, true);
                 var mappingReadModel = await mappingReadService.GetAsync(formVersion.Id);
-
                 List<Worksheet> worksheetSnapshots = [];
                 if (existingWorksheet != null)
                 {
                     worksheetSnapshots.Add(existingWorksheet);
                 }
-                var promptData = new
+
+                if (existingWorksheet == null || existingWorksheet.Published)
                 {
-                    applicationFormVersionId = formVersion.Id,
-                    chefsFormVersionGuid = formVersion.ChefsFormVersionGuid,
-                    applicationFormId = applicationForm.Id,
-                    formName = applicationForm.ApplicationFormName,
-                    scoresheetId = applicationForm.ScoresheetId,
-                    chefsFields = mappingReadModel.ChefsFields,
-                    unityCoreFields = mappingReadModel.UnityCoreFields,
-                    existingMapping = formVersion.SubmissionHeaderMapping,
-                    formSchema = formVersion.FormSchema,
-                    existingWorksheets = worksheetSnapshots.Select(worksheet => new
+                    var promptData = new
+                    var promptData = new
                     {
-                        worksheet.Id,
-                        worksheet.Name,
-                        worksheet.Title,
-                        worksheet.Version,
-                        worksheet.Published,
-                        worksheet.ReportViewName,
-                        sections = worksheet.Sections.Select(section => new
+                        applicationFormVersionId = formVersion.Id,
+                        chefsFormVersionGuid = formVersion.ChefsFormVersionGuid,
+                        applicationFormId = applicationForm.Id,
+                        formName = applicationForm.ApplicationFormName,
+                        scoresheetId = applicationForm.ScoresheetId,
+                        chefsFields = mappingReadModel.ChefsFields,
+                        unityCoreFields = mappingReadModel.UnityCoreFields,
+                        existingMapping = formVersion.SubmissionHeaderMapping,
+                        formSchema = formVersion.FormSchema,
+                        existingWorksheets = worksheetSnapshots.Select(worksheet => new
                         {
-                            section.Name,
-                            section.Order,
-                            fields = section.Fields.Select(field => new
+                            worksheet.Id,
+                            worksheet.Name,
+                            worksheet.Title,
+                            worksheet.Version,
+                            worksheet.Published,
+                            worksheet.ReportViewName,
+                            sections = worksheet.Sections.Select(section => new
                             {
-                                field.Name,
-                                field.Key,
-                                field.Label,
-                                field.Type,
-                                field.Order,
-                                field.Enabled,
-                                field.Definition
+                                section.Name,
+                                section.Order,
+                                fields = section.Fields.Select(field => new
+                                {
+                                    field.Name,
+                                    field.Key,
+                                    field.Label,
+                                    field.Type,
+                                    field.Order,
+                                    field.Enabled,
+                                    field.Definition
+                                })
                             })
                         })
-                    })
-                };
+                    };
 
-                var worksheetResponse = await aiService.GenerateFormWorksheetAsync(new FormWorksheetRequest
-                {
-                    Data = JsonSerializer.SerializeToElement(promptData),
-                    PromptVersion = args.PromptVersion
-                });
+                    var useMock = configuration.GetValue<bool>("AI:FormWorksheet:UseMock");
+                    var worksheetResponse = useMock
+                        ? CreateMockWorksheetResponse()
+                        : await aiService.GenerateFormWorksheetAsync(new FormWorksheetRequest
+                        {
+                            Data = JsonSerializer.SerializeToElement(promptData),
+                            PromptVersion = args.PromptVersion
+                        });
 
-                var worksheetJson = worksheetResponse.Worksheet;
-                var createDto = ParseWorksheetDefinition(worksheetJson);
-                var worksheet = existingWorksheet == null
-                    ? BuildWorksheet(createDto, worksheetName)
-                    : RebuildWorksheet(existingWorksheet, createDto);
-                worksheet.SetPublished(true);
-                if (existingWorksheet == null)
-                {
-                    await worksheetRepository.InsertAsync(worksheet);
+                    if (useMock)
+                    {
+                        logger.LogWarning("Using mock AI worksheet data for form version {FormVersionId}.", formVersion.Id);
+                    }
+
+                    var createDto = ParseWorksheetDefinition(worksheetResponse.Worksheet);
+                    if (existingWorksheet == null)
+                    {
+                        var worksheet = BuildWorksheet(createDto, worksheetName);
+                        worksheet.SetPublished(false);
+                        await worksheetRepository.InsertAsync(worksheet);
+                    }
+                    else
+                    {
+                        var existingLink = await worksheetLinkRepository.GetExistingLinkAsync(
+                            existingWorksheet.Id,
+                            formVersion.Id,
+                            CorrelationConsts.FormVersion);
+                        if (existingLink != null)
+                        {
+                            await worksheetLinkRepository.DeleteAsync(existingLink, true);
+                        }
+
+                        RebuildWorksheet(existingWorksheet, createDto);
+                        existingWorksheet.SetPublished(false);
+                        await worksheetRepository.UpdateAsync(existingWorksheet);
+                    }
                 }
                 else
                 {
-                    await worksheetRepository.UpdateAsync(worksheet);
+                    logger.LogInformation(
+                        "An unpublished AI worksheet already exists for form version {FormVersionId}; leaving it available for review.",
+                        formVersion.Id);
                 }
 
-                await UpsertWorksheetLinkAsync(worksheet.Id, formVersion.Id);
-
                 await AIGenerationRequestJobHelper.StampCooldownBestEffortAsync(aiCooldownService, logger, args.RequestedByUserId, args.ApplicationId, AIGenerationRequestKeyHelper.FormWorksheetOperationType);
                 await AIGenerationRequestJobHelper.MarkCompletedInNewUowAsync(
                     unitOfWorkManager,
@@ -177,6 +202,46 @@ private static string BuildWorksheetName(Guid formVersionId, Guid formId)
         return $"ai-form-{formId}-version-{formVersionId}-worksheet";
     }
 
+    private static FormWorksheetResponse CreateMockWorksheetResponse() => new()
+    {
+        Worksheet = """
+        {
+          "title": "AI Suggested Worksheet (Mock)",
+          "version": 1,
+          "published": false,
+          "sections": [
+            {
+              "name": "Suggested Fields",
+              "order": 1,
+              "fields": [
+                {
+                  "key": "projectName",
+                  "label": "Project Name",
+                  "type": 2,
+                  "order": 1,
+                  "definition": { "required": false }
+                },
+                {
+                  "key": "projectSummary",
+                  "label": "Project Summary",
+                  "type": 14,
+                  "order": 2,
+                  "definition": { "required": false }
+                },
+                {
+                  "key": "requestedAmount",
+                  "label": "Requested Amount",
+                  "type": 5,
+                  "order": 3,
+                  "definition": { "required": false }
+                }
+              ]
+            }
+          ]
+        }
+        """
+    };
+
     private static Worksheet BuildWorksheet(CreateWorksheetDto dto, string worksheetName)
     {
         var worksheet = new Worksheet(Guid.NewGuid(), worksheetName, dto.Title)
@@ -212,14 +277,11 @@ private static Worksheet BuildWorksheet(CreateWorksheetDto dto, string worksheet
         return worksheet;
     }
 
-    private static Worksheet RebuildWorksheet(Worksheet worksheet, CreateWorksheetDto dto)
+    private static void RebuildWorksheet(Worksheet worksheet, CreateWorksheetDto dto)
     {
-        worksheet.SetName(worksheet.Name);
         worksheet.SetTitle(dto.Title);
         worksheet.SetVersion(dto.Version);
-        worksheet.SetPublished(dto.Published);
         worksheet.SetReportingFields(dto.ReportKeys, dto.ReportColumns, dto.ReportViewName);
-
         worksheet.Sections.Clear();
 
         foreach (var section in dto.Sections.OrderBy(s => s.Order))
@@ -241,26 +303,6 @@ private static Worksheet RebuildWorksheet(Worksheet worksheet, CreateWorksheetDt
                 worksheetSection.AddField(customField);
             }
         }
-
-        return worksheet;
     }
 
-    private async Task UpsertWorksheetLinkAsync(Guid worksheetId, Guid correlationId)
-    {
-        var existingLink = await worksheetLinkRepository.GetExistingLinkAsync(worksheetId, correlationId, CorrelationConsts.FormVersion);
-        if (existingLink != null)
-        {
-            existingLink.SetAnchor(FlexConsts.CustomTab).SetOrder(1);
-            await worksheetLinkRepository.UpdateAsync(existingLink);
-            return;
-        }
-
-        await worksheetLinkRepository.InsertAsync(new WorksheetLink(
-            Guid.NewGuid(),
-            worksheetId,
-            correlationId,
-            CorrelationConsts.FormVersion,
-            FlexConsts.CustomTab,
-            1));
-    }
 }
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
index d722b2ce1b..e8db85ca6a 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
@@ -60,6 +60,11 @@
         btnGenerate: $('#btn-generate'),
         btnGenerateWorksheet: $('#btn-generate-worksheet'),
         btnGenerateScoresheet: $('#btn-generate-scoresheet'),
+        worksheetReviewModal: $('#aiWorksheetReviewModal'),
+        worksheetReviewFields: $('#aiWorksheetReviewFields'),
+        worksheetReviewEmpty: $('#aiWorksheetReviewEmpty'),
+        btnConfirmWorksheet: $('#btn-confirm-ai-worksheet'),
+        btnCancelWorksheet: $('#btn-cancel-ai-worksheet'),
         btnSync: $('#btn-sync'),
         btnReset: $('#btn-reset'),
         btnClose: $('.btn-close'),
@@ -103,6 +108,10 @@
         UIElements.btnGenerate.on('click', queueFormMapping);
         UIElements.btnGenerateWorksheet.on('click', queueFormWorksheet);
         UIElements.btnGenerateScoresheet.on('click', queueFormScoresheet);
+        UIElements.btnConfirmWorksheet.on('click', confirmAiWorksheet);
+        UIElements.btnCancelWorksheet.on('click', cancelAiWorksheet);
+        UIElements.worksheetReviewModal.on('hidden.bs.modal', cancelAiWorksheetIfNeeded);
+        UIElements.worksheetReviewFields.on('change', 'input[data-field-id]', updateAiWorksheetReviewCount);
         UIElements.btnReset.on('click', handleReset);
         UIElements.btnCancel.on('click', handleCancelMapping);
         UIElements.btnClose.on('click', handleCancelMapping);
@@ -217,6 +226,12 @@
 
         const buttonElement = triggerButton?.currentTarget || triggerButton?.target || triggerButton || UIElements.btnGenerateWorksheet?.get?.(0);
         const $button = $(buttonElement);
+
+        if (isAiWorksheetPending()) {
+            loadAiWorksheetReview();
+            return;
+        }
+
         const existingHtml = $button.html();
 
         if ($button.prop('disabled')) {
@@ -338,10 +353,168 @@
     }
 
     function refreshWorksheetAfterGeneration() {
-        abp.notify.success('', 'Worksheet generated and assigned successfully. Reloading page.');
-        setTimeout(function () {
-            globalThis.location.reload();
-        }, 500);
+        setAiWorksheetPending(true);
+        abp.notify.success('', 'Worksheet generated. Review the suggested fields before confirming.');
+        loadAiWorksheetReview();
+    }
+
+    function isAiWorksheetPending() {
+        return UIElements.btnGenerateWorksheet.attr('data-ai-pending') === 'true';
+    }
+
+    function setAiWorksheetPending(isPending) {
+        UIElements.btnGenerateWorksheet.attr('data-ai-pending', isPending ? 'true' : 'false');
+        UIElements.btnGenerateWorksheet.find('span').last().text(isPending ? 'Review Worksheet' : 'Generate Worksheet');
+    }
+
+    function loadAiWorksheetReview() {
+        const formVersion = String(document.getElementById('formVersionId')?.value ?? '').trim();
+        if (!validateGuid(formVersion)) {
+            abp.notify.error('', 'Unable to review the worksheet because the Form Version ID is invalid.');
+            return;
+        }
+
+        abp.ajax({
+            url: `/api/app/application-form-version/pending-ai-worksheet?formVersionId=${encodeURIComponent(formVersion)}`,
+            type: 'GET'
+        })
+            .done(function (worksheet) {
+                if (!worksheet) {
+                    setAiWorksheetPending(false);
+                    abp.notify.error('', 'The pending AI worksheet is no longer available.');
+                    return;
+                }
+
+                renderAiWorksheetReview(worksheet);
+                UIElements.worksheetReviewModal.modal('show');
+            })
+            .fail(function () {
+                abp.notify.error('', 'Unable to load the pending AI worksheet.');
+            });
+    }
+
+    function renderAiWorksheetReview(worksheet) {
+        UIElements.worksheetReviewFields.empty();
+
+        let fieldCount = 0;
+        (worksheet.sections || []).forEach(function (section) {
+            const fields = section.fields || [];
+            const $section = $('<section class="ai-worksheet-review__section"></section>');
+            const $sectionHeader = $('<div class="ai-worksheet-review__section-header"></div>');
+            $('<h6 class="ai-worksheet-review__section-title"></h6>').text(section.name).appendTo($sectionHeader);
+            $('<span class="ai-worksheet-review__section-count"></span>')
+                .text(`0 of ${fields.length} selected`)
+                .appendTo($sectionHeader);
+            $sectionHeader.appendTo($section);
+
+            fields.forEach(function (field) {
+                fieldCount++;
+                const fieldId = `ai-worksheet-field-${field.id}`;
+                const $row = $('<div class="ai-worksheet-review__field"></div>');
+                $('<span class="ai-worksheet-review__field-name"></span>')
+                    .attr('data-field-role', 'CHEFS')
+                    .text(field.key || '—')
+                    .appendTo($row);
+                $('<i class="fa-solid fa-arrow-right ai-worksheet-review__arrow" aria-hidden="true"></i>').appendTo($row);
+                $('<span class="ai-worksheet-review__field-name"></span>')
+                    .attr('data-field-role', 'Unity')
+                    .text(field.label || field.key || '—')
+                    .appendTo($row);
+                const $switch = $('<div class="ai-worksheet-review__switch"></div>');
+                const $switchContainer = $('<div class="form-check unt-form-switch form-switch mb-0"></div>');
+                $('<input class="form-check-input" type="checkbox" checked>')
+                    .attr('id', fieldId)
+                    .attr('data-field-id', field.id)
+                    .attr('aria-label', `Include ${field.label || field.key || 'field'}`)
+                    .appendTo($switchContainer);
+                $switchContainer.appendTo($switch);
+                $switch.appendTo($row);
+                $row.appendTo($section);
+            });
+
+            $section.appendTo(UIElements.worksheetReviewFields);
+        });
+
+        UIElements.worksheetReviewFields.attr('data-worksheet-id', worksheet.worksheetId);
+        UIElements.worksheetReviewEmpty.toggleClass('d-none', fieldCount > 0);
+        updateAiWorksheetReviewCount();
+    }
+
+    function updateAiWorksheetReviewCount() {
+        UIElements.worksheetReviewFields.find('.ai-worksheet-review__section').each(function () {
+            const $section = $(this);
+            const $sectionFields = $section.find('input[data-field-id]');
+            const sectionSelectedCount = $sectionFields.filter(':checked').length;
+            $section.find('.ai-worksheet-review__section-count')
+                .text(`${sectionSelectedCount} of ${$sectionFields.length} selected`);
+        });
+    }
+
+    function confirmAiWorksheet() {
+        const formVersion = String(document.getElementById('formVersionId')?.value ?? '').trim();
+        const worksheetId = UIElements.worksheetReviewFields.attr('data-worksheet-id');
+        const selectedFieldIds = UIElements.worksheetReviewFields
+            .find('input[data-field-id]:checked')
+            .map(function () { return $(this).attr('data-field-id'); })
+            .get();
+
+        if (!validateGuid(formVersion) || !validateGuid(worksheetId)) {
+            abp.notify.error('', 'Unable to confirm the AI worksheet because its identifiers are invalid.');
+            return;
+        }
+
+        UIElements.btnConfirmWorksheet.prop('disabled', true);
+        UIElements.btnCancelWorksheet.prop('disabled', true);
+
+        abp.ajax({
+            url: `/api/app/application-form-version/confirm-ai-worksheet?formVersionId=${encodeURIComponent(formVersion)}`,
+            type: 'POST',
+            contentType: 'application/json',
+            data: JSON.stringify({ worksheetId, selectedFieldIds })
+        })
+            .done(function () {
+                UIElements.worksheetReviewModal.data('ai-confirmed', true).modal('hide');
+                setAiWorksheetPending(false);
+                abp.notify.success('', 'Worksheet confirmed and published successfully. Reloading page.');
+                setTimeout(function () { globalThis.location.reload(); }, 500);
+            })
+            .fail(function () {
+                abp.notify.error('', 'Unable to confirm the AI worksheet.');
+            })
+            .always(function () {
+                UIElements.btnConfirmWorksheet.prop('disabled', false);
+                UIElements.btnCancelWorksheet.prop('disabled', false);
+            });
+    }
+
+    function cancelAiWorksheet() {
+        if (UIElements.worksheetReviewModal.data('ai-confirmed') === true) {
+            return;
+        }
+
+        const formVersion = String(document.getElementById('formVersionId')?.value ?? '').trim();
+        if (!validateGuid(formVersion) || !isAiWorksheetPending()) {
+            return;
+        }
+
+        UIElements.worksheetReviewModal.data('ai-confirmed', true);
+        abp.ajax({
+            url: `/api/app/application-form-version/cancel-ai-worksheet?formVersionId=${encodeURIComponent(formVersion)}`,
+            type: 'POST'
+        })
+            .done(function () {
+                setAiWorksheetPending(false);
+                abp.notify.success('', 'Pending AI worksheet discarded.');
+            })
+            .fail(function () {
+                UIElements.worksheetReviewModal.data('ai-confirmed', false);
+                abp.notify.error('', 'Unable to discard the pending AI worksheet.');
+            });
+    }
+
+    function cancelAiWorksheetIfNeeded() {
+        cancelAiWorksheet();
+        UIElements.worksheetReviewModal.removeData('ai-confirmed');
     }
 
     function refreshScoresheetAfterGeneration() {
@@ -424,7 +597,7 @@
 
         globalThis.AIGenerationButtonState?.restore($button);
         $button.html(existingHtml).prop('disabled', false);
-        $button.find('span').last().text('Generate Worksheet');
+        $button.find('span').last().text(isAiWorksheetPending() ? 'Review Worksheet' : 'Generate Worksheet');
     }
 
     function restoreGenerateScoresheetButton($button, existingHtml) {
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Properties/launchSettings.json b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Properties/launchSettings.json
index 0fd5cc8908..3e73825314 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Properties/launchSettings.json
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Properties/launchSettings.json
@@ -13,7 +13,8 @@
       "launchBrowser": true,
       "launchUrl": "https://localhost:44342/",
       "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
+        "ASPNETCORE_ENVIRONMENT": "Development",
+        "AI__FormWorksheet__UseMock": "true"
       }
     },
     "Unity.GrantManager.Web": {
@@ -21,8 +22,9 @@
       "launchBrowser": true,
       "applicationUrl": "https://localhost:44342/",
       "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
+        "ASPNETCORE_ENVIRONMENT": "Development",
+        "AI__FormWorksheet__UseMock": "true"
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewComponent.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewComponent.cs
index 5510427687..c2417ff1b3 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewComponent.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewComponent.cs
@@ -43,7 +43,12 @@ public async Task<IViewComponentResult> InvokeAsync(string? formVersionId, strin
             model.ChefsFormPublished = formVersion?.Published;
             model.WorksheetLinks = await worksheetLinkAppService.GetListByCorrelationAsync(formVersion?.Id ?? Guid.Empty, CorrelationConsts.FormVersion);
 
-            model.PublishedWorksheets = [.. (await worksheetListAppService.GetListAsync())
+            var aiWorksheetName = $"ai-form-{formVersion?.ApplicationFormId}-version-{formVersion?.Id}-worksheet";
+            var worksheets = await worksheetListAppService.GetListAsync();
+            model.HasPendingAiWorksheet = worksheets
+                .Any(worksheet => !worksheet.Published && worksheet.Name == aiWorksheetName);
+
+            model.PublishedWorksheets = [.. worksheets
                 .Where(s => s.Published && !model.WorksheetLinks.Select(s => s.WorksheetId).Contains(s.Id))
                 .OrderBy(s => s.Title)];
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewModel.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewModel.cs
index 95169c2de8..c0e544c163 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewModel.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewModel.cs
@@ -37,7 +37,9 @@ public class CustomFieldsViewModel
         public List<WorksheetLinkDto>? FundingAgreementInfoLinks { get; set; }
         public List<WorksheetLinkDto>? CustomTabLinks { get; set; }
 
+        public bool HasPendingAiWorksheet { get; set; }
+
         [Display(Name = "")]
         public Guid? ScoresheetId { get; set; }
     }
-}
\ No newline at end of file
+}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
index 2a4d1a37f2..6ba10aaec8 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
@@ -24,11 +24,11 @@
         @if (await PermissionChecker.IsGrantedAsync(AIPermissions.FormWorksheet.Generate))
         {
             <button type="button" id="btn-generate-worksheet" class="btn ai-generate-btn unt-btn-outline-primary btn-outline-primary"
-                    data-ai-cooldown-checking="1" data-ai-rate-limit-disabled="1" disabled
+                    data-ai-cooldown-checking="1" data-ai-rate-limit-disabled="1" data-ai-pending="@(Model.HasPendingAiWorksheet.ToString().ToLowerInvariant())" disabled
                     title="Generate a worksheet for the current form version">
                 <span class="ai-button-content">
                     <i class="unt-icon-sm fa-solid fa-wand-magic-sparkles"></i>
-                    <span>Generate Worksheet</span>
+                    <span>@(Model.HasPendingAiWorksheet ? "Review Worksheet" : "Generate Worksheet")</span>
                 </span>
             </button>
         }
@@ -182,3 +182,34 @@
         </div>
     </form>
 </div>
+
+<div class="modal fade" id="aiWorksheetReviewModal" tabindex="-1" aria-labelledby="aiWorksheetReviewModalLabel" aria-hidden="true">
+    <div class="modal-dialog modal-xl modal-dialog-centered">
+        <div class="modal-content ai-worksheet-review">
+            <div class="modal-header ai-worksheet-review__header">
+                <div>
+                    <div class="ai-worksheet-review__eyebrow">AI worksheet draft</div>
+                    <h5 class="modal-title" id="aiWorksheetReviewModalLabel">Choose fields for your worksheet</h5>
+                </div>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <div class="ai-worksheet-review__intro">
+                    <span>Keep the suggestions you want to include. You can update the field details later.</span>
+                </div>
+                <div class="ai-worksheet-review__table-header">
+                    <span>CHEFS field</span>
+                    <span aria-hidden="true"></span>
+                    <span>Unity field</span>
+                    <span class="text-center">Include</span>
+                </div>
+                <div id="aiWorksheetReviewFields"></div>
+                <div id="aiWorksheetReviewEmpty" class="ai-worksheet-review__empty d-none">No custom fields were suggested.</div>
+            </div>
+            <div class="modal-footer ai-worksheet-review__footer">
+                <button type="button" id="btn-cancel-ai-worksheet" class="btn btn-outline-secondary" data-bs-dismiss="modal">Discard draft</button>
+                <button type="button" id="btn-confirm-ai-worksheet" class="btn btn-primary">Publish selected fields</button>
+            </div>
+        </div>
+    </div>
+</div>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css
index b401b9d45c..0c89a2b85f 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css
@@ -111,3 +111,166 @@
     overflow: auto;
     height: calc(100vh - 250px);
 }
+
+.ai-worksheet-review {
+    border: 0;
+    border-radius: 12px;
+    overflow: hidden;
+}
+
+.ai-worksheet-review__header {
+    align-items: flex-start;
+    border-bottom: 1px solid #d8e1eb;
+    padding: 1.5rem 1.75rem 1.25rem;
+}
+
+.ai-worksheet-review__header .btn-close {
+    margin-top: 0.25rem;
+}
+
+.ai-worksheet-review__eyebrow {
+    color: var(--bc-colors-blue-primary, #255a90);
+    font-size: 0.75rem;
+    font-weight: 700;
+    letter-spacing: 0.08em;
+    margin-bottom: 0.25rem;
+    text-transform: uppercase;
+}
+
+.ai-worksheet-review__intro {
+    align-items: center;
+    color: #4a5563;
+    display: flex;
+    font-size: 0.9375rem;
+    justify-content: space-between;
+    margin-bottom: 1.25rem;
+}
+
+.ai-worksheet-review__section {
+    border: 1px solid #d8e1eb;
+    border-radius: 8px;
+    margin-bottom: 1rem;
+    overflow: hidden;
+}
+
+.ai-worksheet-review__section-header {
+    align-items: center;
+    background: #f4f7fa;
+    display: flex;
+    justify-content: space-between;
+    padding: 0.75rem 1rem;
+}
+
+.ai-worksheet-review__section-title {
+    font-size: 1rem;
+    font-weight: 700;
+    margin: 0;
+}
+
+.ai-worksheet-review__section-count {
+    background: #e8f1fa;
+    border-radius: 999px;
+    color: #255a90;
+    font-size: 0.8125rem;
+    font-weight: 600;
+    padding: 0.25rem 0.625rem;
+    white-space: nowrap;
+}
+
+.ai-worksheet-review__table-header,
+.ai-worksheet-review__field {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) 2rem minmax(0, 1fr) 4.5rem;
+}
+
+.ai-worksheet-review__table-header {
+    border-bottom: 1px solid #d8e1eb;
+    color: #596777;
+    font-size: 0.75rem;
+    font-weight: 700;
+    letter-spacing: 0.05em;
+    padding: 0.65rem 1rem;
+    text-transform: uppercase;
+}
+
+.ai-worksheet-review__field {
+    align-items: center;
+    background: #fff;
+    min-height: 4rem;
+    padding: 0.75rem 1rem;
+}
+
+.ai-worksheet-review__field + .ai-worksheet-review__field {
+    border-top: 1px solid #edf1f5;
+}
+
+.ai-worksheet-review__field-name {
+    color: #1f2933;
+    font-weight: 600;
+    overflow-wrap: anywhere;
+}
+
+.ai-worksheet-review__arrow {
+    color: #52789d;
+    justify-self: center;
+}
+
+.ai-worksheet-review__switch {
+    justify-self: center;
+}
+
+.ai-worksheet-review__empty {
+    background: #f4f7fa;
+    border: 1px dashed #9fb3c8;
+    border-radius: 8px;
+    color: #486581;
+    padding: 1.5rem;
+    text-align: center;
+}
+
+.ai-worksheet-review__footer {
+    border-top: 1px solid #d8e1eb;
+    padding: 1rem 1.75rem;
+}
+
+@media (max-width: 767.98px) {
+    .ai-worksheet-review__intro {
+        align-items: flex-start;
+        flex-direction: column;
+        gap: 0.75rem;
+    }
+
+    .ai-worksheet-review__field {
+        grid-template-columns: minmax(0, 1fr) 1.5rem auto;
+        row-gap: 0.5rem;
+    }
+
+    .ai-worksheet-review__field-name:first-child {
+        grid-column: 1 / 2;
+    }
+
+    .ai-worksheet-review__field-name:nth-child(3) {
+        grid-column: 1 / 2;
+    }
+
+    .ai-worksheet-review__field-name::before {
+        color: #596777;
+        content: attr(data-field-role);
+        display: block;
+        font-size: 0.6875rem;
+        font-weight: 700;
+        letter-spacing: 0.05em;
+        margin-bottom: 0.125rem;
+        text-transform: uppercase;
+    }
+
+    .ai-worksheet-review__arrow {
+        grid-column: 2 / 3;
+        grid-row: 1 / 3;
+    }
+
+    .ai-worksheet-review__switch {
+        grid-column: 3 / 4;
+        grid-row: 1 / 3;
+    }
+}
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs
index ea1b8d3468..81dde1df22 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs
@@ -12,6 +12,7 @@
 using Unity.AI.Requests;
 using Unity.AI.Responses;
 using Unity.Flex.Domain.Worksheets;
+using Unity.Flex.Domain.WorksheetLinks;
 using Unity.Flex.Worksheets;
 using Unity.GrantManager.ApplicationForms;
 using Unity.GrantManager.ApplicationForms.Mapping;
@@ -96,6 +97,148 @@ public void FormMappingPromptData_Should_UseEmptyObject_When_NoExistingMappingIs
         promptData.GetProperty("existingMapping").GetRawText().ShouldBe("{}");
     }
 
+    [Fact]
+    public async Task GetPendingAiWorksheetAsync_Should_Return_Unpublished_Worksheet_Fields()
+    {
+        var formVersionId = Guid.NewGuid();
+        var formId = Guid.NewGuid();
+        var formVersion = new ApplicationFormVersion
+        {
+            ApplicationFormId = formId
+        };
+        var worksheet = BuildAiWorksheet(formId, formVersionId, published: false);
+        var formVersionRepository = Substitute.For<IApplicationFormVersionRepository>();
+        formVersionRepository.GetAsync(formVersionId).Returns(formVersion);
+        var worksheetRepository = Substitute.For<IWorksheetRepository>();
+        worksheetRepository.GetByNameAsync(Arg.Any<string>(), true).Returns(worksheet);
+
+        var service = CreateService(
+            Substitute.For<IRepository<ApplicationFormVersion, Guid>>(),
+            Substitute.For<IApplicationFormVersionMappingReadService>(),
+            Substitute.For<IFormMappingService>(),
+            formVersionRepository,
+            worksheetRepository);
+        service.LazyServiceProvider = GetRequiredService<IAbpLazyServiceProvider>();
+
+        var result = await service.GetPendingAiWorksheetAsync(formVersionId);
+
+        result.ShouldNotBeNull();
+        result!.WorksheetId.ShouldBe(worksheet.Id);
+        result.WorksheetTitle.ShouldBe("AI Worksheet");
+        result.Sections.Single().Fields.Single().Label.ShouldBe("Project Name");
+        result.Sections.Single().Fields.Single().Selected.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task ConfirmAiWorksheetAsync_Should_Delete_Unselected_Fields_Publish_And_Link_Worksheet()
+    {
+        var formVersionId = Guid.NewGuid();
+        var formId = Guid.NewGuid();
+        var formVersion = new ApplicationFormVersion
+        {
+            ApplicationFormId = formId
+        };
+        var worksheet = BuildAiWorksheet(formId, formVersionId, published: false, fieldCount: 2);
+        var formVersionRepository = Substitute.For<IApplicationFormVersionRepository>();
+        formVersionRepository.GetAsync(formVersionId).Returns(formVersion);
+        var worksheetRepository = Substitute.For<IWorksheetRepository>();
+        worksheetRepository.GetByNameAsync(Arg.Any<string>(), true).Returns(worksheet);
+        var customFieldRepository = Substitute.For<IRepository<CustomField, Guid>>();
+        var worksheetLinkRepository = Substitute.For<IWorksheetLinkRepository>();
+
+        var service = CreateService(
+            Substitute.For<IRepository<ApplicationFormVersion, Guid>>(),
+            Substitute.For<IApplicationFormVersionMappingReadService>(),
+            Substitute.For<IFormMappingService>(),
+            formVersionRepository,
+            worksheetRepository,
+            customFieldRepository,
+            worksheetLinkRepository);
+        service.LazyServiceProvider = GetRequiredService<IAbpLazyServiceProvider>();
+
+        var selectedFieldId = worksheet.Sections.Single().Fields.First().Id;
+        await service.ConfirmAiWorksheetAsync(formVersionId, new ConfirmAiWorksheetDto
+        {
+            WorksheetId = worksheet.Id,
+            SelectedFieldIds = [selectedFieldId]
+        });
+
+        worksheet.Published.ShouldBeTrue();
+        worksheet.Sections.Single().Fields.Select(field => field.Id).ShouldBe([selectedFieldId]);
+        await customFieldRepository.Received(1).DeleteAsync(Arg.Is<Guid>(id => id != selectedFieldId));
+        await worksheetRepository.Received(1).UpdateAsync(worksheet, true);
+        await worksheetLinkRepository.Received(1).InsertAsync(Arg.Any<WorksheetLink>(), true);
+    }
+
+    [Fact]
+    public async Task ConfirmAiWorksheetAsync_Should_Allow_All_Suggested_Fields_To_Be_Deselected()
+    {
+        var formVersionId = Guid.NewGuid();
+        var formId = Guid.NewGuid();
+        var formVersion = new ApplicationFormVersion
+        {
+            ApplicationFormId = formId
+        };
+        var worksheet = BuildAiWorksheet(formId, formVersionId, published: false, fieldCount: 2);
+        var formVersionRepository = Substitute.For<IApplicationFormVersionRepository>();
+        formVersionRepository.GetAsync(formVersionId).Returns(formVersion);
+        var worksheetRepository = Substitute.For<IWorksheetRepository>();
+        worksheetRepository.GetByNameAsync(Arg.Any<string>(), true).Returns(worksheet);
+        var customFieldRepository = Substitute.For<IRepository<CustomField, Guid>>();
+        var worksheetLinkRepository = Substitute.For<IWorksheetLinkRepository>();
+
+        var service = CreateService(
+            Substitute.For<IRepository<ApplicationFormVersion, Guid>>(),
+            Substitute.For<IApplicationFormVersionMappingReadService>(),
+            Substitute.For<IFormMappingService>(),
+            formVersionRepository,
+            worksheetRepository,
+            customFieldRepository,
+            worksheetLinkRepository);
+        service.LazyServiceProvider = GetRequiredService<IAbpLazyServiceProvider>();
+
+        await service.ConfirmAiWorksheetAsync(formVersionId, new ConfirmAiWorksheetDto
+        {
+            WorksheetId = worksheet.Id,
+            SelectedFieldIds = []
+        });
+
+        worksheet.Published.ShouldBeTrue();
+        worksheet.Sections.Single().Fields.ShouldBeEmpty();
+        await customFieldRepository.Received(2).DeleteAsync(Arg.Any<Guid>());
+        await worksheetLinkRepository.Received(1).InsertAsync(Arg.Any<WorksheetLink>(), true);
+    }
+
+    private static Worksheet BuildAiWorksheet(Guid formId, Guid formVersionId, bool published, int fieldCount = 1)
+    {
+        var worksheet = new Worksheet(
+            Guid.NewGuid(),
+            $"ai-form-{formId}-version-{formVersionId}-worksheet",
+            "AI Worksheet");
+        worksheet.SetPublished(published);
+
+        var section = new WorksheetSection(Guid.NewGuid(), "Suggested Fields")
+        {
+            Worksheet = worksheet
+        };
+        worksheet.AddSection(section);
+
+        for (var index = 0; index < fieldCount; index++)
+        {
+            var field = new CustomField(
+                Guid.NewGuid(),
+                $"Field{index}",
+                worksheet.Name,
+                index == 0 ? "Project Name" : $"Field {index}",
+                CustomFieldType.Text,
+                "{}");
+            field.Section = section;
+            section.Fields.Add(field);
+        }
+
+        return worksheet;
+    }
+
     [Fact]
     public void MappingReadService_Should_Use_Canonical_CustomField_Name_For_Worksheet_Field_Name()
     {
@@ -157,7 +300,11 @@ public void MappingReadService_Should_Exclude_System_Fields_From_Unity_Core_Fiel
     private static ApplicationFormVersionAppService CreateService(
         IRepository<ApplicationFormVersion, Guid> repository,
         IApplicationFormVersionMappingReadService mappingReadService,
-        IFormMappingService aiService)
+        IFormMappingService aiService,
+        IApplicationFormVersionRepository? formVersionRepository = null,
+        IWorksheetRepository? worksheetRepository = null,
+        IRepository<CustomField, Guid>? customFieldRepository = null,
+        IWorksheetLinkRepository? worksheetLinkRepository = null)
     {
         var featureChecker = Substitute.For<IFeatureChecker>();
         featureChecker.IsEnabledAsync(AIFeatures.FormMapping).Returns(true);
@@ -171,13 +318,16 @@ private static ApplicationFormVersionAppService CreateService(
             Substitute.For<IIntakeFormSubmissionMapper>(),
             Substitute.For<IUnitOfWorkManager>(),
             Substitute.For<IFormsApiService>(),
-            Substitute.For<IApplicationFormVersionRepository>(),
+            formVersionRepository ?? Substitute.For<IApplicationFormVersionRepository>(),
             Substitute.For<IApplicationFormSubmissionRepository>(),
             Substitute.For<IReportingFieldsGeneratorService>(),
             featureChecker,
             mappingReadService,
             cooldownService,
-            aiService);
+            aiService,
+            worksheetRepository ?? Substitute.For<IWorksheetRepository>(),
+            customFieldRepository ?? Substitute.For<IRepository<CustomField, Guid>>(),
+            worksheetLinkRepository ?? Substitute.For<IWorksheetLinkRepository>());
         return service;
     }
 }

From fd71be88830748e69366e1bdf8b2fa2473689c5d Mon Sep 17 00:00:00 2001
From: Jacob Smith <jacob.smith@gov.bc.ca>
Date: Tue, 21 Jul 2026 16:51:01 -0700
Subject: [PATCH 15/40] AB#33866 keep worksheet review available during
 cooldown

---
 .../Pages/ApplicationForms/Mapping.js                | 12 ++++++++++--
 .../Shared/Components/CustomFields/Default.cshtml    | 11 +++++++++--
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
index e8db85ca6a..ebd88fcb5f 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
@@ -60,6 +60,7 @@
         btnGenerate: $('#btn-generate'),
         btnGenerateWorksheet: $('#btn-generate-worksheet'),
         btnGenerateScoresheet: $('#btn-generate-scoresheet'),
+        btnReviewWorksheet: $('#btn-review-worksheet'),
         worksheetReviewModal: $('#aiWorksheetReviewModal'),
         worksheetReviewFields: $('#aiWorksheetReviewFields'),
         worksheetReviewEmpty: $('#aiWorksheetReviewEmpty'),
@@ -108,6 +109,7 @@
         UIElements.btnGenerate.on('click', queueFormMapping);
         UIElements.btnGenerateWorksheet.on('click', queueFormWorksheet);
         UIElements.btnGenerateScoresheet.on('click', queueFormScoresheet);
+        UIElements.btnReviewWorksheet.on('click', loadAiWorksheetReview);
         UIElements.btnConfirmWorksheet.on('click', confirmAiWorksheet);
         UIElements.btnCancelWorksheet.on('click', cancelAiWorksheet);
         UIElements.worksheetReviewModal.on('hidden.bs.modal', cancelAiWorksheetIfNeeded);
@@ -363,8 +365,14 @@
     }
 
     function setAiWorksheetPending(isPending) {
-        UIElements.btnGenerateWorksheet.attr('data-ai-pending', isPending ? 'true' : 'false');
-        UIElements.btnGenerateWorksheet.find('span').last().text(isPending ? 'Review Worksheet' : 'Generate Worksheet');
+        UIElements.btnGenerateWorksheet
+            .attr('data-ai-pending', isPending ? 'true' : 'false')
+            .toggleClass('d-none', isPending);
+        UIElements.btnReviewWorksheet.toggleClass('d-none', !isPending);
+
+        if (!isPending) {
+            globalThis.syncAIRateLimitButtons?.();
+        }
     }
 
     function loadAiWorksheetReview() {
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
index 6ba10aaec8..93d2a2d2e6 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
@@ -23,12 +23,19 @@
                     form="worksheet-config-form" />
         @if (await PermissionChecker.IsGrantedAsync(AIPermissions.FormWorksheet.Generate))
         {
-            <button type="button" id="btn-generate-worksheet" class="btn ai-generate-btn unt-btn-outline-primary btn-outline-primary"
+            <button type="button" id="btn-generate-worksheet" class="btn ai-generate-btn unt-btn-outline-primary btn-outline-primary @(Model.HasPendingAiWorksheet ? "d-none" : string.Empty)"
                     data-ai-cooldown-checking="1" data-ai-rate-limit-disabled="1" data-ai-pending="@(Model.HasPendingAiWorksheet.ToString().ToLowerInvariant())" disabled
                     title="Generate a worksheet for the current form version">
                 <span class="ai-button-content">
                     <i class="unt-icon-sm fa-solid fa-wand-magic-sparkles"></i>
-                    <span>@(Model.HasPendingAiWorksheet ? "Review Worksheet" : "Generate Worksheet")</span>
+                    <span>Generate Worksheet</span>
+                </span>
+            </button>
+            <button type="button" id="btn-review-worksheet" class="btn unt-btn-outline-primary btn-outline-primary @(Model.HasPendingAiWorksheet ? string.Empty : "d-none")"
+                    title="Review the pending AI worksheet">
+                <span class="ai-button-content">
+                    <i class="unt-icon-sm fa-solid fa-wand-magic-sparkles"></i>
+                    <span>Review Worksheet</span>
                 </span>
             </button>
         }

From 1441a2d8e3a9eb593f7cf1ac50b8f0a79a4b29ef Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Thu, 23 Jul 2026 15:49:34 -0700
Subject: [PATCH 16/40] AB#33787 - Converted remaining Stateless sync guards to
 async

---
 .../Domain/Services/PaymentsManager.cs        | 30 +++++++++----------
 .../Domain/Workflow/Workflow.cs               |  3 +-
 .../Workflow/UnityWorkflow.cs                 |  3 +-
 .../Applications/ApplicationManager.cs        |  6 ++--
 4 files changed, 22 insertions(+), 20 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs
index a10121e4e8..fdd0b90074 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs
@@ -32,37 +32,37 @@ public class PaymentsManager(
         private void ConfigureWorkflow(StateMachine<PaymentRequestStatus, PaymentApprovalAction> paymentStateMachine)
         {
             paymentStateMachine.Configure(PaymentRequestStatus.L1Pending)
-                .PermitIf(PaymentApprovalAction.L1Approve, PaymentRequestStatus.L2Pending, () => HasPermissionAsync(PaymentsPermissions.Payments.L1ApproveOrDecline).GetAwaiter().GetResult())
-                .PermitIf(PaymentApprovalAction.L1Decline, PaymentRequestStatus.L1Declined, () => HasPermissionAsync(PaymentsPermissions.Payments.L1ApproveOrDecline).GetAwaiter().GetResult());
+                .PermitIfAsync(PaymentApprovalAction.L1Approve, PaymentRequestStatus.L2Pending, () => HasPermissionAsync(PaymentsPermissions.Payments.L1ApproveOrDecline))
+                .PermitIfAsync(PaymentApprovalAction.L1Decline, PaymentRequestStatus.L1Declined, () => HasPermissionAsync(PaymentsPermissions.Payments.L1ApproveOrDecline));
 
             paymentStateMachine.Configure(PaymentRequestStatus.L1Declined)
-                  .PermitIf(PaymentApprovalAction.L1Approve, PaymentRequestStatus.L2Pending, () => HasPermissionAsync(PaymentsPermissions.Payments.L1ApproveOrDecline).GetAwaiter().GetResult());
+                  .PermitIfAsync(PaymentApprovalAction.L1Approve, PaymentRequestStatus.L2Pending, () => HasPermissionAsync(PaymentsPermissions.Payments.L1ApproveOrDecline));
 
             paymentStateMachine.Configure(PaymentRequestStatus.L2Pending)
-                .PermitIf(PaymentApprovalAction.L2Approve, PaymentRequestStatus.L3Pending, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline).GetAwaiter().GetResult())
-                .PermitIf(PaymentApprovalAction.Submit, PaymentRequestStatus.Submitted, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline).GetAwaiter().GetResult())
-                .PermitIf(PaymentApprovalAction.L2Decline, PaymentRequestStatus.L2Declined, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline).GetAwaiter().GetResult());
+                .PermitIfAsync(PaymentApprovalAction.L2Approve, PaymentRequestStatus.L3Pending, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline))
+                .PermitIfAsync(PaymentApprovalAction.Submit, PaymentRequestStatus.Submitted, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline))
+                .PermitIfAsync(PaymentApprovalAction.L2Decline, PaymentRequestStatus.L2Declined, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline));
 
             paymentStateMachine.Configure(PaymentRequestStatus.L2Declined)
-                .PermitIf(PaymentApprovalAction.L2Approve, PaymentRequestStatus.L3Pending, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline).GetAwaiter().GetResult())
-                .PermitIf(PaymentApprovalAction.Submit, PaymentRequestStatus.Submitted, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline).GetAwaiter().GetResult());
+                .PermitIfAsync(PaymentApprovalAction.L2Approve, PaymentRequestStatus.L3Pending, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline))
+                .PermitIfAsync(PaymentApprovalAction.Submit, PaymentRequestStatus.Submitted, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline));
 
             paymentStateMachine.Configure(PaymentRequestStatus.L3Pending)
-                .PermitIf(PaymentApprovalAction.Submit, PaymentRequestStatus.Submitted, () => HasPermissionAsync(PaymentsPermissions.Payments.L3ApproveOrDecline).GetAwaiter().GetResult())
-                .PermitIf(PaymentApprovalAction.L3Decline, PaymentRequestStatus.L3Declined, () => HasPermissionAsync(PaymentsPermissions.Payments.L3ApproveOrDecline).GetAwaiter().GetResult())
-                .PermitIf(PaymentApprovalAction.Cancel, PaymentRequestStatus.Cancelled, () => HasPermissionAsync(PaymentsPermissions.Payments.CancelPayment).GetAwaiter().GetResult());
+                .PermitIfAsync(PaymentApprovalAction.Submit, PaymentRequestStatus.Submitted, () => HasPermissionAsync(PaymentsPermissions.Payments.L3ApproveOrDecline))
+                .PermitIfAsync(PaymentApprovalAction.L3Decline, PaymentRequestStatus.L3Declined, () => HasPermissionAsync(PaymentsPermissions.Payments.L3ApproveOrDecline))
+                .PermitIfAsync(PaymentApprovalAction.Cancel, PaymentRequestStatus.Cancelled, () => HasPermissionAsync(PaymentsPermissions.Payments.CancelPayment));
 
             paymentStateMachine.Configure(PaymentRequestStatus.L2Declined)
-                .PermitIf(PaymentApprovalAction.Submit, PaymentRequestStatus.Submitted, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline).GetAwaiter().GetResult());
+                .PermitIfAsync(PaymentApprovalAction.Submit, PaymentRequestStatus.Submitted, () => HasPermissionAsync(PaymentsPermissions.Payments.L2ApproveOrDecline));
 
             paymentStateMachine.Configure(PaymentRequestStatus.L1Pending)
-                .PermitIf(PaymentApprovalAction.Cancel, PaymentRequestStatus.Cancelled, () => HasPermissionAsync(PaymentsPermissions.Payments.CancelPayment).GetAwaiter().GetResult());
+                .PermitIfAsync(PaymentApprovalAction.Cancel, PaymentRequestStatus.Cancelled, () => HasPermissionAsync(PaymentsPermissions.Payments.CancelPayment));
 
             paymentStateMachine.Configure(PaymentRequestStatus.L2Pending)
-                .PermitIf(PaymentApprovalAction.Cancel, PaymentRequestStatus.Cancelled, () => HasPermissionAsync(PaymentsPermissions.Payments.CancelPayment).GetAwaiter().GetResult());
+                .PermitIfAsync(PaymentApprovalAction.Cancel, PaymentRequestStatus.Cancelled, () => HasPermissionAsync(PaymentsPermissions.Payments.CancelPayment));
 
             paymentStateMachine.Configure(PaymentRequestStatus.HistoricalPayment)
-                .PermitIf(PaymentApprovalAction.Cancel, PaymentRequestStatus.Cancelled, () => HasPermissionAsync(PaymentsPermissions.Payments.CancelPayment).GetAwaiter().GetResult());
+                .PermitIfAsync(PaymentApprovalAction.Cancel, PaymentRequestStatus.Cancelled, () => HasPermissionAsync(PaymentsPermissions.Payments.CancelPayment));
         }
 
         private async Task<bool> HasPermissionAsync(string permission)
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/Workflow.cs b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/Workflow.cs
index 6b977cdb2f..c5d83c9aba 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/Workflow.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/Workflow.cs
@@ -1,5 +1,6 @@
 using Stateless;
 using System;
+using System.Linq;
 using System.Threading.Tasks;
 using Volo.Abp;
 
@@ -40,7 +41,7 @@ public virtual TStates GetState()
 
     public virtual async Task ExecuteActionAsync(TTriggers action)
     {
-        if (_stateMachine.CanFire(action))
+        if ((await _stateMachine.GetPermittedTriggersAsync()).Contains(action))
         {
             await _stateMachine.FireAsync(action);
         }
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflow.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflow.cs
index 8db065c27b..0034ad6a26 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflow.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflow.cs
@@ -1,5 +1,6 @@
 using Stateless;
 using System;
+using System.Linq;
 using System.Threading.Tasks;
 using Volo.Abp;
 
@@ -40,7 +41,7 @@ public virtual TStates GetState()
 
     public virtual async Task ExecuteActionAsync(TTriggers action)
     {
-        if (_stateMachine.CanFire(action))
+        if ((await _stateMachine.GetPermittedTriggersAsync()).Contains(action))
         {
             await _stateMachine.FireAsync(action);
         }
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs
index 36408a71eb..8a2238a365 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs
@@ -135,7 +135,7 @@ public  void ConfigureWorkflow(StateMachine<GrantApplicationState, GrantApplicat
             .SubstateOf(GrantApplicationState.RESOLVED)
             .Permit(GrantApplicationAction.Withdraw, GrantApplicationState.WITHDRAWN)
             .Permit(GrantApplicationAction.Close, GrantApplicationState.CLOSED)
-            .PermitIf(GrantApplicationAction.Defer, GrantApplicationState.DEFER, () => HasPermission(GrantApplicationPermissions.Approvals.DeferAfterApproval))
+            .PermitIfAsync(GrantApplicationAction.Defer, GrantApplicationState.DEFER, () => HasPermissionAsync(GrantApplicationPermissions.Approvals.DeferAfterApproval))
             .PermitIf(GrantApplicationAction.Deny, GrantApplicationState.GRANT_NOT_APPROVED, () => isDirectApproval, DirectDenialDescription);
 
         stateMachine.Configure(GrantApplicationState.GRANT_NOT_APPROVED)
@@ -160,9 +160,9 @@ private static bool AllowDirectDecision(
         return isDirectApproval && stateMachine.State != targetState;
     }
 
-    private bool HasPermission(string permission)
+    private async Task<bool> HasPermissionAsync(string permission)
     {
-        return _permissionChecker.IsGrantedAsync(permission).Result;
+        return await _permissionChecker.IsGrantedAsync(permission);
     }
 
     public async Task<List<ApplicationActionResultItem>> GetActions(Guid applicationId)

From 7f1634c5090685c170be8a02b8cc59e23c9d85de Mon Sep 17 00:00:00 2001
From: aurelio-aot <aurelio.pascual.jr@gmail.com>
Date: Thu, 23 Jul 2026 16:49:51 -0700
Subject: [PATCH 17/40] AB#33414: Security Finding: Upload File Validation Uses
 Denylist

---
 applications/Unity.GrantManager/.env.example  |   2 +-
 .../NotificationsSettingGroup/Default.cshtml  |   2 +-
 .../NotificationsSettingGroup/Default.js      |   4 +-
 .../NotificationsSettingViewComponent.cs      |   2 +-
 .../NotificationsSettingViewModel.cs          |   2 +-
 .../Controllers/AttachmentController.cs       | 254 ++++++--
 .../Controllers/FileSignatureValidator.cs     |  75 +++
 .../Pages/Applicants/Details.cshtml           |   2 +-
 .../Pages/Applicants/Details.cshtml.cs        |   4 +-
 .../Pages/Applicants/Details.js               |   6 +-
 .../Pages/GrantApplications/Details.cshtml    |  18 +-
 .../Pages/GrantApplications/Details.cshtml.cs |   4 +-
 .../Pages/GrantApplications/Details.js        |   6 +-
 .../Shared/Components/EmailsWidget/Default.js |   4 +-
 .../Unity.GrantManager.Web/appsettings.json   |   2 +-
 .../Components/AttachmentControllerTests.cs   | 584 ++++++++++++++++++
 16 files changed, 894 insertions(+), 77 deletions(-)
 create mode 100644 applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/FileSignatureValidator.cs

diff --git a/applications/Unity.GrantManager/.env.example b/applications/Unity.GrantManager/.env.example
index c937e86596..8a96d4d6fd 100644
--- a/applications/Unity.GrantManager/.env.example
+++ b/applications/Unity.GrantManager/.env.example
@@ -54,7 +54,7 @@ AuthServer__OidcSignoutCallback="http://localhost:44342/signout-callback-oidc"
 ##S3__SecretAccessKey="******************"
 ##S3__ApplicationS3Folder="Unity/Application"
 ##S3__AssessmentS3Folder="Unity/Adjudication"
-##S3__DisallowedFileTypes="[ "exe" , "sh" , "ksh" , "bat" , "cmd" ]"
+##S3__AllowedFileTypes=["pdf","doc","docx","xls","xlsx","ppt","pptx","jpg","jpeg","png","gif","txt","csv","zip"]
 ##S3__MaxFileSize="25"
 ##S3__EmailAttachmentMaxFileSize="20"
 ##S3__EmailAttachmentsTotalMaxFileSize="25"
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.cshtml b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.cshtml
index 1fc31ed1c2..015e4a3e13 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.cshtml
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.cshtml
@@ -63,7 +63,7 @@
 
         <!-- Email Templates -->
         <div class="tab-pane fade" id="nav-template" role="tabpanel" aria-labelledby="nav-template-tab">
-            <input type="hidden" id="Extensions" value="@Model.Extensions" />
+            <input type="hidden" id="AllowedFileTypes" value="@Model.AllowedFileTypes" />
             <input type="hidden" id="MaxFileSize" value="@Model.MaxFileSize" />
             <input type="hidden" id="EmailAttachmentMaxFileSize" value="@Model.EmailAttachmentMaxFileSize" />
             <input type="hidden" id="TotalEmailAttachmentMaxFileSize" value="@Model.TotalEmailAttachmentMaxFileSize" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js
index 651fe52ea2..2643568b36 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js
@@ -853,7 +853,7 @@ $(function () {
         const input = document.getElementById(inputId);
         if (!input?.files?.length) return;
 
-        const disallowedTypes = JSON.parse(decodeURIComponent($('#Extensions').val()));
+        const allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
         const maxFileSize = decodeURIComponent($('#EmailAttachmentMaxFileSize').val());
 
         let isAllowedTypeError = false;
@@ -862,7 +862,7 @@ $(function () {
 
         for (let file of input.files) {
             const ext = file.name.slice(file.name.lastIndexOf('.') + 1).toLowerCase();
-            if (disallowedTypes.includes(ext)) {
+            if (!allowedTypes.includes(ext)) {
                 isAllowedTypeError = true;
             }
             if (file.size * 0.000001 > maxFileSize) {
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/NotificationsSettingViewComponent.cs b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/NotificationsSettingViewComponent.cs
index 1e3f2b7f71..0fc790c3ae 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/NotificationsSettingViewComponent.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/NotificationsSettingViewComponent.cs
@@ -31,7 +31,7 @@ public virtual async Task<IViewComponentResult> InvokeAsync()
             EnableEmailDelay = string.Equals(
                 await settingProvider.GetOrNullAsync(Notifications.Settings.NotificationsSettings.Mailing.EnableEmailDelay),
                 "true", System.StringComparison.OrdinalIgnoreCase),
-                Extensions = configuration["S3:DisallowedFileTypes"] ?? "",
+                AllowedFileTypes = configuration["S3:AllowedFileTypes"] ?? "",
                 MaxFileSize = configuration["S3:MaxFileSize"] ?? "",
                 EmailAttachmentMaxFileSize = configuration["S3:EmailAttachmentMaxFileSize"] ?? "",
                 TotalEmailAttachmentMaxFileSize = configuration["S3:EmailAttachmentsTotalMaxFileSize"] ?? "25"
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/NotificationsSettingViewModel.cs b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/NotificationsSettingViewModel.cs
index e9497f02ab..a54ae3529d 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/NotificationsSettingViewModel.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/NotificationsSettingViewModel.cs
@@ -18,7 +18,7 @@ public class NotificationsSettingViewModel
     [Display(Name = "Enable Schedule Email for Individual Application")]
     public bool EnableEmailDelay { get; set; }
 
-    public string Extensions { get; set; } = string.Empty;
+    public string AllowedFileTypes { get; set; } = string.Empty;
     public string MaxFileSize { get; set; } = string.Empty;
     public string EmailAttachmentMaxFileSize { get; set; } = string.Empty;
     public string TotalEmailAttachmentMaxFileSize { get; set; } = string.Empty;      
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs
index 54c5a6ebc8..e83ebe74d1 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs
@@ -1,5 +1,6 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.StaticFiles;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
@@ -472,54 +473,67 @@ public async Task<IActionResult> UploadEmailAttachments(Guid? emailLogId, Guid?
                 return BadRequest(fileProvidedError);
             }
 
-            List<ValidationResult> invalidFileTypes = GetInvalidFileTypes(files);
-            if (invalidFileTypes.Count > 0)
+            List<ValidationResult> invalidMetadata = GetInvalidFileMetadata(files);
+            if (invalidMetadata.Count > 0)
             {
-                throw new AbpValidationException(message: "ERROR: Invalid File Type.", validationErrors: invalidFileTypes);
+                throw new AbpValidationException(message: "ERROR: Invalid File Type.", validationErrors: invalidMetadata);
             }
 
+            // Email-specific size checks are metadata-only (file.Length / a total-size lookup),
+            // so they run before any file is buffered into memory, same as GetInvalidFileMetadata.
+            // A missing OR malformed config value both fall back to the default and the check
+            // still runs - a parse failure must not silently disable enforcement.
             var emailAttachmentMaxFileSizeConfig = _configuration["S3:EmailAttachmentMaxFileSize"] ?? "20";
-            if (double.TryParse(emailAttachmentMaxFileSizeConfig, out double maxFileSizeMB))
+            if (!double.TryParse(emailAttachmentMaxFileSizeConfig, out double maxFileSizeMB) || maxFileSizeMB <= 0)
             {
-                var oversizedFiles = files.Where(f => f.Length * 0.000001 > maxFileSizeMB).ToList();
-                if (oversizedFiles.Count > 0)
-                {
-                    var sizeErrors = oversizedFiles.Select(f =>
-                        new ValidationResult($"File '{f.FileName}' exceeds the maximum allowed size of {maxFileSizeMB} MB for email attachments.", [f.FileName])
-                    ).ToList();
-                    throw new AbpValidationException("One or more files exceed the maximum allowed size for email attachments.", sizeErrors);
-                }
+                maxFileSizeMB = 20;
+            }
+
+            var oversizedFiles = files.Where(f => f.Length * 0.000001 > maxFileSizeMB).ToList();
+            if (oversizedFiles.Count > 0)
+            {
+                var sizeErrors = oversizedFiles.Select(f =>
+                    new ValidationResult($"File '{f.FileName}' exceeds the maximum allowed size of {maxFileSizeMB} MB for email attachments.", [f.FileName])
+                ).ToList();
+                throw new AbpValidationException("One or more files exceed the maximum allowed size for email attachments.", sizeErrors);
             }
 
             var totalMaxFileSizeConfig = _configuration["S3:EmailAttachmentsTotalMaxFileSize"] ?? "25";
-            if (double.TryParse(totalMaxFileSizeConfig, out double totalMaxSizeMB))
-            {                
-                long existingTotalBytes = await _emailLogAttachmentUploadService
-                    .GetTotalFileSizeByEmailLogIdAsync(emailLogId, templateId);
-                long newFilesBytes = files.Sum(f => f.Length);
-                double combinedMB = (existingTotalBytes + newFilesBytes) * 0.000001;
-
-                if (combinedMB > totalMaxSizeMB)
-                {
-                    throw new AbpValidationException(
-                        $"The total size of all attachments ({combinedMB:F1} MB) would exceed the maximum allowed {totalMaxSizeMB} MB for email attachments. Please remove existing attachments or select a smaller file.",
-                        [new ValidationResult("Total attachment size exceeds the allowed limit.")]);
-                }
+            if (!double.TryParse(totalMaxFileSizeConfig, out double totalMaxSizeMB) || totalMaxSizeMB <= 0)
+            {
+                totalMaxSizeMB = 25;
+            }
+
+            long existingTotalBytes = await _emailLogAttachmentUploadService
+                .GetTotalFileSizeByEmailLogIdAsync(emailLogId, templateId);
+            long newFilesBytes = files.Sum(f => f.Length);
+            double combinedMB = (existingTotalBytes + newFilesBytes) * 0.000001;
+
+            if (combinedMB > totalMaxSizeMB)
+            {
+                throw new AbpValidationException(
+                    $"The total size of all attachments ({combinedMB:F1} MB) would exceed the maximum allowed {totalMaxSizeMB} MB for email attachments. Please remove existing attachments or select a smaller file.",
+                    [new ValidationResult("Total attachment size exceeds the allowed limit.")]);
+            }
+
+            List<(IFormFile File, byte[] Content)> fileEntries = await ReadFilesAsync(files);
+            List<ValidationResult> invalidContent = GetInvalidFileContent(fileEntries);
+            if (invalidContent.Count > 0)
+            {
+                throw new AbpValidationException(message: "ERROR: Invalid File Type.", validationErrors: invalidContent);
             }
 
             var results = new List<object>();
-            foreach (var file in files)
+            foreach (var (file, content) in fileEntries)
             {
                 try
                 {
-                    using var ms = new MemoryStream();
-                    await file.CopyToAsync(ms);
                     var dto = await _emailLogAttachmentUploadService.UploadAsync(
                         emailLogId,
                         templateId,
                         _currentTenant.Id,
                         file.FileName,
-                        ms.ToArray(),
+                        content,
                         file.ContentType ?? "application/octet-stream");
                     results.Add(dto);
                 }
@@ -535,23 +549,28 @@ public async Task<IActionResult> UploadEmailAttachments(Guid? emailLogId, Guid?
 
         private async Task<IActionResult> UploadFiles(IList<IFormFile> files)
         {
-            List<ValidationResult> InvalidFileTypes = GetInvalidFileTypes(files);
-            if (InvalidFileTypes.Count > 0)
+            List<ValidationResult> invalidMetadata = GetInvalidFileMetadata(files);
+            if (invalidMetadata.Count > 0)
             {
-                throw new AbpValidationException(message: "ERROR: Invalid File Type.", validationErrors: InvalidFileTypes);
+                throw new AbpValidationException(message: "ERROR: Invalid File Type.", validationErrors: invalidMetadata);
+            }
+
+            List<(IFormFile File, byte[] Content)> fileEntries = await ReadFilesAsync(files);
+            List<ValidationResult> invalidContent = GetInvalidFileContent(fileEntries);
+            if (invalidContent.Count > 0)
+            {
+                throw new AbpValidationException(message: "ERROR: Invalid File Type.", validationErrors: invalidContent);
             }
             List<string> ErrorList = [];
-            foreach (IFormFile source in files)
+            foreach (var (source, content) in fileEntries)
             {
                 try
                 {
-                    using var memoryStream = new MemoryStream();
-                    await source.CopyToAsync(memoryStream);
                     await _fileAppService.SaveBlobAsync(
                         new SaveBlobInputDto
                         {
                             Name = source.FileName,
-                            Content = memoryStream.ToArray()
+                            Content = content
                         });
                 }
                 catch (Exception ex)
@@ -569,26 +588,165 @@ await _fileAppService.SaveBlobAsync(
             return Ok("All Files Are Successfully Uploaded!");
         }
 
-        private List<ValidationResult> GetInvalidFileTypes(IList<IFormFile> files)
+        private static async Task<List<(IFormFile File, byte[] Content)>> ReadFilesAsync(IList<IFormFile> files)
+        {
+            var fileEntries = new List<(IFormFile File, byte[] Content)>();
+            foreach (var file in files)
+            {
+                using var memoryStream = new MemoryStream();
+                await file.CopyToAsync(memoryStream);
+                fileEntries.Add((file, memoryStream.ToArray()));
+            }
+            return fileEntries;
+        }
+
+        // Extensions for which the browser-supplied ContentType and file signature (magic bytes)
+        // are reliable enough to validate; plain text formats (txt/csv) have no consistent signature
+        // or ContentType across browsers/OSes, so only the allowlist and size checks apply to them.
+        private static readonly HashSet<string> StrictlyValidatedExtensions = new(StringComparer.OrdinalIgnoreCase)
+        {
+            "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "jpg", "jpeg", "png", "gif", "zip"
+        };
+
+        private static string GetExtension(string fileName)
+        {
+            var extension = Path.GetExtension(fileName);
+            if (extension.StartsWith('.'))
+            {
+                extension = extension[1..];
+            }
+            return extension.ToLowerInvariant();
+        }
+
+        // Used when S3:AllowedFileTypes is missing or fails to parse, so a config gap degrades
+        // to this known-safe, already-reviewed set rather than silently rejecting every upload
+        // (fail-closed-to-nothing) or silently allowing anything (fail-open).
+        private static readonly string[] DefaultAllowedFileTypes =
+        [
+            "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "jpg", "jpeg", "png", "gif", "txt", "csv", "zip"
+        ];
+
+        private string[]? GetConfiguredFileTypesOrNull()
+        {
+            var allowedFileTypesConfig = _configuration["S3:AllowedFileTypes"];
+            if (string.IsNullOrWhiteSpace(allowedFileTypesConfig))
+            {
+                return null;
+            }
+
+            try
+            {
+                var allowedFileTypes = JsonConvert.DeserializeObject<string[]>(allowedFileTypesConfig);
+                if (allowedFileTypes == null || allowedFileTypes.Length == 0)
+                {
+                    Logger.LogWarning("AttachmentController: S3:AllowedFileTypes was empty; falling back to the default allowlist.");
+                    return null;
+                }
+                return allowedFileTypes;
+            }
+            catch (JsonException ex)
+            {
+                Logger.LogWarning(ex, "AttachmentController: S3:AllowedFileTypes could not be parsed as a JSON string array; falling back to the default allowlist.");
+                return null;
+            }
+        }
+
+        // S3:AllowedFileTypes can only ever narrow this controller's effective allowlist, never
+        // broaden it. DefaultAllowedFileTypes is exactly the set of extensions this controller
+        // knows how to validate at the content level (StrictlyValidatedExtensions' signature and
+        // content-type checks, plus txt/csv which are deliberately exempt since they're inert
+        // text with no reliable signature). Without this ceiling, an operator accidentally (or
+        // maliciously) adding e.g. "exe" to config would let it pass the extension check while
+        // still being skipped by the content-level checks - reintroducing CWE-434 via config
+        // alone, with no code change required.
+        private string[] GetAllowedFileTypes()
+        {
+            var configuredFileTypes = GetConfiguredFileTypesOrNull();
+            if (configuredFileTypes == null)
+            {
+                return DefaultAllowedFileTypes;
+            }
+
+            var normalizedConfiguredTypes = configuredFileTypes.Select(t => t.ToLowerInvariant()).ToArray();
+            var effectiveFileTypes = normalizedConfiguredTypes
+                .Where(t => DefaultAllowedFileTypes.Contains(t))
+                .Distinct()
+                .ToArray();
+
+            var rejectedFileTypes = normalizedConfiguredTypes.Except(effectiveFileTypes).ToList();
+            if (rejectedFileTypes.Count > 0)
+            {
+                Logger.LogWarning(
+                    "AttachmentController: S3:AllowedFileTypes configured extension(s) [{RejectedFileTypes}] are outside the validated safe set and were ignored.",
+                    string.Join(", ", rejectedFileTypes));
+            }
+
+            return effectiveFileTypes.Length > 0 ? effectiveFileTypes : DefaultAllowedFileTypes;
+        }
+
+        // Cheap, metadata-only checks (extension + declared size) that require no stream I/O.
+        // Run these before ever reading a file's bytes, so an oversized or disallowed file is
+        // rejected without being buffered into memory or scanned for a signature match.
+        private List<ValidationResult> GetInvalidFileMetadata(IList<IFormFile> files)
         {
             List<ValidationResult> ErrorList = [];
-            var InvalidFileTypes = _configuration["S3:DisallowedFileTypes"] ?? "";
-            var DisallowedFileTypes = JsonConvert.DeserializeObject<string[]>(InvalidFileTypes);
-            if (DisallowedFileTypes == null)
+            var AllowedFileTypes = GetAllowedFileTypes();
+
+            var maxFileSizeConfig = _configuration["S3:MaxFileSize"] ?? "25";
+            if (!double.TryParse(maxFileSizeConfig, out double maxFileSizeMB) || maxFileSizeMB <= 0)
             {
-                return ErrorList;
+                maxFileSizeMB = 25;
             }
-            foreach (var fileName in files.Where(file =>
+
+            foreach (var file in files)
             {
-                string FileType = Path.GetExtension(file.FileName);
-                if (FileType.StartsWith('.'))
+                var fileName = file.FileName;
+                var extension = GetExtension(fileName);
+
+                if (!AllowedFileTypes.Contains(extension))
                 {
-                    FileType = FileType[1..];
+                    ErrorList.Add(new ValidationResult("Invalid file type for " + fileName, [nameof(fileName)]));
+                    continue;
                 }
-                return DisallowedFileTypes.Contains(FileType.ToLower());
-            }).Select(source => source.FileName))
+
+                if (file.Length * 0.000001 > maxFileSizeMB)
+                {
+                    ErrorList.Add(new ValidationResult($"File '{fileName}' exceeds the maximum allowed size of {maxFileSizeMB} MB.", [nameof(fileName)]));
+                }
+            }
+            return ErrorList;
+        }
+
+        // Content-level checks (content-type consistency + magic-byte signature) that require
+        // the file's bytes. Only called for files that already passed GetInvalidFileMetadata.
+        private static List<ValidationResult> GetInvalidFileContent(List<(IFormFile File, byte[] Content)> fileEntries)
+        {
+            List<ValidationResult> ErrorList = [];
+            var contentTypeProvider = new FileExtensionContentTypeProvider();
+
+            foreach (var (file, content) in fileEntries)
             {
-                ErrorList.Add(new ValidationResult("Invalid file type for " + fileName, [nameof(fileName)]));
+                var fileName = file.FileName;
+                var extension = GetExtension(fileName);
+
+                if (!StrictlyValidatedExtensions.Contains(extension))
+                {
+                    continue;
+                }
+
+                if (contentTypeProvider.TryGetContentType(fileName, out var expectedContentType) &&
+                    !string.IsNullOrWhiteSpace(file.ContentType) &&
+                    !string.Equals(file.ContentType, "application/octet-stream", StringComparison.OrdinalIgnoreCase) &&
+                    !string.Equals(expectedContentType.Split('/')[0], file.ContentType.Split('/')[0], StringComparison.OrdinalIgnoreCase))
+                {
+                    ErrorList.Add(new ValidationResult("File content type does not match its extension for " + fileName, [nameof(fileName)]));
+                    continue;
+                }
+
+                if (!FileSignatureValidator.HasValidSignature(extension, content))
+                {
+                    ErrorList.Add(new ValidationResult("File content does not match its expected format for " + fileName, [nameof(fileName)]));
+                }
             }
             return ErrorList;
         }
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/FileSignatureValidator.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/FileSignatureValidator.cs
new file mode 100644
index 0000000000..fbb31f1f4d
--- /dev/null
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/FileSignatureValidator.cs
@@ -0,0 +1,75 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace Unity.GrantManager.Controllers
+{
+    internal static class FileSignatureValidator
+    {
+        private const int PdfHeaderScanWindow = 1024;
+
+        private static readonly byte[] Pdf = [0x25, 0x50, 0x44, 0x46];
+        private static readonly byte[] ZipLocal = [0x50, 0x4B, 0x03, 0x04];
+        private static readonly byte[] ZipEmpty = [0x50, 0x4B, 0x05, 0x06];
+        private static readonly byte[] ZipSpanned = [0x50, 0x4B, 0x07, 0x08];
+        private static readonly byte[] Ole = [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1];
+        private static readonly byte[] Jpeg = [0xFF, 0xD8, 0xFF];
+        private static readonly byte[] Png = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A];
+        private static readonly byte[] Gif = [0x47, 0x49, 0x46, 0x38];
+
+        private static readonly Dictionary<string, byte[][]> SignaturesByExtension = new()
+        {
+            ["docx"] = [ZipLocal, ZipEmpty, ZipSpanned],
+            ["xlsx"] = [ZipLocal, ZipEmpty, ZipSpanned],
+            ["pptx"] = [ZipLocal, ZipEmpty, ZipSpanned],
+            ["zip"] = [ZipLocal, ZipEmpty, ZipSpanned],
+            ["doc"] = [Ole],
+            ["xls"] = [Ole],
+            ["ppt"] = [Ole],
+            ["jpg"] = [Jpeg],
+            ["jpeg"] = [Jpeg],
+            ["png"] = [Png],
+            ["gif"] = [Gif],
+        };
+
+        public static bool HasValidSignature(string extension, byte[] content)
+        {
+            if (content.Length == 0)
+            {
+                return true;
+            }
+
+            var normalizedExtension = extension.ToLowerInvariant();
+
+            // ISO 32000 permits the "%PDF-" header to appear anywhere within the first
+            // 1024 bytes (e.g. a leading BOM or stray bytes some tools prepend), rather
+            // than requiring it at offset 0 like the other binary formats below.
+            if (normalizedExtension == "pdf")
+            {
+                return ContainsSignatureWithinWindow(content, Pdf, PdfHeaderScanWindow);
+            }
+
+            if (!SignaturesByExtension.TryGetValue(normalizedExtension, out var signatures))
+            {
+                return true;
+            }
+
+            return signatures.Any(signature =>
+                content.Length >= signature.Length &&
+                content.Take(signature.Length).SequenceEqual(signature));
+        }
+
+        private static bool ContainsSignatureWithinWindow(byte[] content, byte[] signature, int window)
+        {
+            var scanLength = Math.Min(content.Length, window);
+            for (var offset = 0; offset <= scanLength - signature.Length; offset++)
+            {
+                if (content.Skip(offset).Take(signature.Length).SequenceEqual(signature))
+                {
+                    return true;
+                }
+            }
+            return false;
+        }
+    }
+}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.cshtml b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.cshtml
index 5f8a17be6c..51a67ef65e 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.cshtml
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.cshtml
@@ -65,7 +65,7 @@
 <input type="hidden" id="ApplicantCurrentStatus" value="@Model.Status" />
 <input type="hidden" id="CurrentUserId" value="@Model.CurrentUserId" />
 <input type="hidden" id="CurrentUserName" value="@Model.CurrentUserName" />
-<input type="hidden" id="Extensions" value="@Model.Extensions" />
+<input type="hidden" id="AllowedFileTypes" value="@Model.AllowedFileTypes" />
 <input type="hidden" id="MaxFileSize" value="@Model.MaxFileSize" />
 
 @if (Model.ApplicantIsDeleted)
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.cshtml.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.cshtml.cs
index 998b75cc1c..bd48ebec63 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.cshtml.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.cshtml.cs
@@ -28,7 +28,7 @@ public class DetailsModel : GrantManagerPageModel
         public string Status { get; set; } = string.Empty;
         public Guid? CurrentUserId { get; set; }
         public string CurrentUserName { get; set; }
-        public string Extensions { get; set; } = string.Empty;
+        public string AllowedFileTypes { get; set; } = string.Empty;
         public string MaxFileSize { get; set; } = string.Empty;
 
         public DetailsModel(
@@ -41,7 +41,7 @@ public DetailsModel(
             _applicationRepository = applicationRepository;
             CurrentUserId = currentUser.Id;
             CurrentUserName = currentUser.SurName + ", " + currentUser.Name;
-            Extensions = configuration["S3:DisallowedFileTypes"] ?? "";
+            AllowedFileTypes = configuration["S3:AllowedFileTypes"] ?? "";
             MaxFileSize = configuration["S3:MaxFileSize"] ?? "";
         }
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js
index da939d3d9a..44942f7cf8 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js
@@ -396,8 +396,8 @@ function uploadFiles(inputId, urlStr, channel) {
     let input = document.getElementById(inputId);
     let files = input.files;
     let formData = new FormData();
-    const disallowedTypes = JSON.parse(
-        decodeURIComponent($('#Extensions').val())
+    const allowedTypes = JSON.parse(
+        decodeURIComponent($('#AllowedFileTypes').val())
     );
     const maxFileSize = decodeURIComponent($('#MaxFileSize').val());
 
@@ -409,7 +409,7 @@ function uploadFiles(inputId, urlStr, channel) {
 
     for (let file of files) {
         if (
-            disallowedTypes.includes(
+            !allowedTypes.includes(
                 file.name
                     .slice(file.name.lastIndexOf('.') + 1, file.name.length)
                     .toLowerCase()
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.cshtml b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.cshtml
index 7dee856075..cceadeda4c 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.cshtml
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.cshtml
@@ -37,7 +37,7 @@
 
     // View guards — control tab visibility and loading of existing AI results
     var aiApplicationAnalysisEnabled = await FeatureChecker.IsEnabledAsync("Unity.AI.ApplicationAnalysis")
-        && await PermissionChecker.IsGrantedAsync(AIPermissions.ApplicationAnalysis.View);
+        && await PermissionChecker.IsGrantedAsync(AIPermissions.ApplicationAnalysis.View);
 
     // Shared manual-generation guards
     var tenantManualEnabled = await SettingProvider.GetAsync<bool>(AISettings.ManualGenerationEnabled, defaultValue: false);
@@ -48,19 +48,19 @@
     var aiApplicationAnalysisGenerateEnabled = await FeatureChecker.IsEnabledAsync("Unity.AI.ApplicationAnalysis")
         && tenantManualEnabled
         && formManualEnabled
-        && await PermissionChecker.IsGrantedAsync(AIPermissions.ApplicationAnalysis.Generate);
+        && await PermissionChecker.IsGrantedAsync(AIPermissions.ApplicationAnalysis.Generate);
 }
 @section styles
 {
     <abp-style src="/libs/formiojs/formio.form.css" />
     <abp-style src="/Pages/GrantApplications/Details.css" />
 }
-@section scripts
-{
-    <abp-script src="/Pages/GrantApplications/ai-generation-api.js" />
-    <abp-script src="/Pages/GrantApplications/ai-generation-button-state.js" />
-    <abp-script src="/Pages/GrantApplications/ai-rate-limit.js" />
-    <abp-script src="/Pages/GrantApplications/Details.js" />
+@section scripts
+{
+    <abp-script src="/Pages/GrantApplications/ai-generation-api.js" />
+    <abp-script src="/Pages/GrantApplications/ai-generation-button-state.js" />
+    <abp-script src="/Pages/GrantApplications/ai-rate-limit.js" />
+    <abp-script src="/Pages/GrantApplications/Details.js" />
     <abp-script src="/libs/formiojs/formio.form.min.js" />
     <abp-script src="/Pages/GrantApplications/ai-analysis.js" />
 }
@@ -79,7 +79,7 @@
 <input type="hidden" id="ApplicationFormId" value="@Model.ApplicationFormId" />
 <input type="hidden" id="CurrentUserId" value="@Model.CurrentUserId" />
 <input type="hidden" id="CurrentUserName" value="@Model.CurrentUserName" />
-<input type="hidden" id="Extensions" value="@Model.Extensions" />
+<input type="hidden" id="AllowedFileTypes" value="@Model.AllowedFileTypes" />
 <input type="hidden" id="MaxFileSize" value="@Model.MaxFileSize" />
 <input type="hidden" id="EmailAttachmentMaxFileSize" value="@Model.EmailAttachmentMaxFileSize" />
 <input type="hidden" id="TotalEmailAttachmentMaxFileSize" value="@Model.TotalEmailAttachmentMaxFileSize" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.cshtml.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.cshtml.cs
index 9181e20437..f01f08326a 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.cshtml.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.cshtml.cs
@@ -74,7 +74,7 @@ public class DetailsModel : AbpPageModel
 
         [BindProperty(SupportsGet = true)]
         public string? CurrentUserName { get; set; }
-        public string Extensions { get; set; }
+        public string AllowedFileTypes { get; set; }
         public string MaxFileSize { get; set; }
         public string EmailAttachmentMaxFileSize { get; set; }
         public string TotalEmailAttachmentMaxFileSize { get; set; }
@@ -107,7 +107,7 @@ public DetailsModel(
 
             CurrentUserId = currentUser.Id;
             CurrentUserName = currentUser.SurName + ", " + currentUser.Name;
-            Extensions = configuration["S3:DisallowedFileTypes"] ?? "";
+            AllowedFileTypes = configuration["S3:AllowedFileTypes"] ?? "";
             MaxFileSize = configuration["S3:MaxFileSize"] ?? "";
             EmailAttachmentMaxFileSize = configuration["S3:EmailAttachmentMaxFileSize"] ?? "20";
             TotalEmailAttachmentMaxFileSize = configuration["S3:EmailAttachmentsTotalMaxFileSize"] ?? "25";
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js
index 8cd3ee2d88..8c118cfc74 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js
@@ -982,8 +982,8 @@ function uploadFiles(inputId, urlStr, channel) {
     let input = document.getElementById(inputId);
     let files = input.files;
     let formData = new FormData();
-    const disallowedTypes = JSON.parse(
-        decodeURIComponent($('#Extensions').val())
+    const allowedTypes = JSON.parse(
+        decodeURIComponent($('#AllowedFileTypes').val())
     );
     const maxFileSize = decodeURIComponent($('#MaxFileSize').val());
 
@@ -995,7 +995,7 @@ function uploadFiles(inputId, urlStr, channel) {
 
     for (let file of files) {
         if (
-            disallowedTypes.includes(
+            !allowedTypes.includes(
                 file.name
                     .slice(file.name.lastIndexOf('.') + 1, file.name.length)
                     .toLowerCase()
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js
index 30b67ec0a3..d0db2011c9 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js
@@ -2379,7 +2379,7 @@
         const input = document.getElementById(inputId);
         if (!input?.files?.length) return;
 
-        const disallowedTypes = JSON.parse(decodeURIComponent($('#Extensions').val()));
+        const allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
         const maxFileSize = decodeURIComponent($('#EmailAttachmentMaxFileSize').val());
 
         let isAllowedTypeError = false;
@@ -2388,7 +2388,7 @@
 
         for (let file of input.files) {
             const ext = file.name.slice(file.name.lastIndexOf('.') + 1).toLowerCase();
-            if (disallowedTypes.includes(ext)) {
+            if (!allowedTypes.includes(ext)) {
                 isAllowedTypeError = true;
             }
             if (file.size * 0.000001 > maxFileSize) {
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/appsettings.json b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/appsettings.json
index 91479fc7a8..e87fb98578 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/appsettings.json
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/appsettings.json
@@ -77,7 +77,7 @@
     "ApplicantS3Folder": "Unity/Applicant",
     "ApplicationS3Folder": "Unity/Application",
     "AssessmentS3Folder": "Unity/Adjudication",
-    "DisallowedFileTypes": "[ \"exe\",\"sh\",\"ksh\",\"bat\",\"cmd\" ]",
+    "AllowedFileTypes": "[ \"pdf\",\"doc\",\"docx\",\"xls\",\"xlsx\",\"ppt\",\"pptx\",\"jpg\",\"jpeg\",\"png\",\"gif\",\"txt\",\"csv\",\"zip\" ]",
     "MaxFileSize": 25,
     "EmailAttachmentMaxFileSize": 20,
     "EmailAttachmentsTotalMaxFileSize": 25
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs
index 9cd9e9705b..8ba2b53422 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs
@@ -54,6 +54,590 @@ public async Task UploadApplicationAttachments_InvalidInput_ReturnsBadRequest()
             Assert.Contains("Invalid file type", badRequestResult);
         }
 
+        [Fact]
+        public async Task UploadApplicationAttachments_ExtensionNotOnOldDenylist_ReturnsBadRequest()
+        {
+            // Arrange
+            var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
+            var configuration = builder.Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            // .ps1 was never on the old denylist (exe/sh/ksh/bat/cmd) so it would have been
+            // accepted before this fix; the allowlist must reject it since it's not a permitted type.
+            var scriptFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(Array.Empty<byte>()),
+                baseStreamOffset: 0,
+                length: 0,
+                name: "scriptFile",
+                fileName: "malicious.ps1"
+            );
+
+            var files = new List<IFormFile> { scriptFile };
+
+            // Act
+            async Task<IActionResult> Action() => await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert
+            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
+            var badRequestResult = result.ValidationErrors[0].ErrorMessage;
+            Assert.Contains("Invalid file type", badRequestResult);
+            await fileAppService.DidNotReceive().SaveBlobAsync(Arg.Any<SaveBlobInputDto>());
+        }
+
+        [Fact]
+        public async Task UploadApplicationAttachments_ContentDoesNotMatchPdfSignature_ReturnsBadRequest()
+        {
+            // Arrange
+            var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
+            var configuration = builder.Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            var fakePdfBytes = System.Text.Encoding.UTF8.GetBytes("this is not really a pdf, just renamed text");
+            var fakePdfFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(fakePdfBytes),
+                baseStreamOffset: 0,
+                length: fakePdfBytes.Length,
+                name: "fakePdfFile",
+                fileName: "fake.pdf"
+            )
+            {
+                Headers = new HeaderDictionary(),
+                ContentType = "application/pdf"
+            };
+
+            var files = new List<IFormFile> { fakePdfFile };
+
+            // Act
+            async Task<IActionResult> Action() => await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert
+            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
+            var badRequestResult = result.ValidationErrors[0].ErrorMessage;
+            Assert.Contains("does not match its expected format", badRequestResult);
+            await fileAppService.DidNotReceive().SaveBlobAsync(Arg.Any<SaveBlobInputDto>());
+        }
+
+        [Fact]
+        public async Task UploadApplicationAttachments_ContentTypeDoesNotMatchExtension_ReturnsBadRequest()
+        {
+            // Arrange
+            var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
+            var configuration = builder.Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            // Valid .pdf extension and valid %PDF magic bytes, but the browser-supplied
+            // ContentType claims it's an image - the content-type check should catch this
+            // before the signature check even runs.
+            var pdfBytes = new byte[] { 0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x34 };
+            var mislabeledFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(pdfBytes),
+                baseStreamOffset: 0,
+                length: pdfBytes.Length,
+                name: "mislabeledFile",
+                fileName: "mislabeled.pdf"
+            )
+            {
+                Headers = new HeaderDictionary(),
+                ContentType = "image/png"
+            };
+
+            var files = new List<IFormFile> { mislabeledFile };
+
+            // Act
+            async Task<IActionResult> Action() => await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert
+            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
+            var badRequestResult = result.ValidationErrors[0].ErrorMessage;
+            Assert.Contains("does not match its extension", badRequestResult);
+            await fileAppService.DidNotReceive().SaveBlobAsync(Arg.Any<SaveBlobInputDto>());
+        }
+
+        [Fact]
+        public async Task UploadApplicationAttachments_GenericOctetStreamContentType_UploadsSuccessfully()
+        {
+            // Arrange
+            var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
+            var configuration = builder.Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            // Some clients (curl/Postman, older browsers for uncommon extensions) send the
+            // generic "application/octet-stream" content type instead of a specific one - this
+            // must not be treated as a mismatch as long as the extension and signature are valid.
+            var pdfBytes = new byte[] { 0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x34 };
+            var genericFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(pdfBytes),
+                baseStreamOffset: 0,
+                length: pdfBytes.Length,
+                name: "genericFile",
+                fileName: "generic.pdf"
+            )
+            {
+                Headers = new HeaderDictionary(),
+                ContentType = "application/octet-stream"
+            };
+
+            var files = new List<IFormFile> { genericFile };
+
+            // Act
+            var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert
+            var okResult = Assert.IsType<OkObjectResult>(result);
+            Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "generic.pdf"));
+        }
+
+        [Fact]
+        public async Task UploadApplicationAttachments_ValidPdf_UploadsSuccessfully()
+        {
+            // Arrange
+            var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
+            var configuration = builder.Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            var pdfBytes = new byte[] { 0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x34 };
+            var pdfFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(pdfBytes),
+                baseStreamOffset: 0,
+                length: pdfBytes.Length,
+                name: "pdfFile",
+                fileName: "good.pdf"
+            )
+            {
+                Headers = new HeaderDictionary(),
+                ContentType = "application/pdf"
+            };
+
+            var files = new List<IFormFile> { pdfFile };
+
+            // Act
+            var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert
+            var okResult = Assert.IsType<OkObjectResult>(result);
+            Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "good.pdf"));
+        }
+
+        [Fact]
+        public async Task UploadApplicationAttachments_MissingAllowedFileTypesConfig_FallsBackToDefaultAllowlist()
+        {
+            // Arrange - deliberately built without S3:AllowedFileTypes at all, simulating an
+            // environment where the config key was never set.
+            var configuration = new ConfigurationBuilder().AddInMemoryCollection().Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            var pdfBytes = new byte[] { 0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x34 };
+            var pdfFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(pdfBytes),
+                baseStreamOffset: 0,
+                length: pdfBytes.Length,
+                name: "pdfFile",
+                fileName: "good.pdf"
+            )
+            {
+                Headers = new HeaderDictionary(),
+                ContentType = "application/pdf"
+            };
+
+            var files = new List<IFormFile> { pdfFile };
+
+            // Act
+            var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert - "pdf" is on the hardcoded DefaultAllowedFileTypes list, so the upload
+            // should still succeed rather than every file being rejected.
+            var okResult = Assert.IsType<OkObjectResult>(result);
+            Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "good.pdf"));
+        }
+
+        [Fact]
+        public async Task UploadApplicationAttachments_MalformedAllowedFileTypesConfig_FallsBackToDefaultAllowlist()
+        {
+            // Arrange - a malformed value like a real env-file quoting mistake would produce
+            // (e.g. an outer-quoted JSON array, which is not valid JSON on its own) must not
+            // throw an unhandled exception; it should fall back to the default allowlist.
+            var configuration = new ConfigurationBuilder()
+                .AddInMemoryCollection(new Dictionary<string, string?>
+                {
+                    ["S3:AllowedFileTypes"] = "\"[ \"pdf\" ]\""
+                })
+                .Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            var pdfBytes = new byte[] { 0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x34 };
+            var pdfFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(pdfBytes),
+                baseStreamOffset: 0,
+                length: pdfBytes.Length,
+                name: "pdfFile",
+                fileName: "good.pdf"
+            )
+            {
+                Headers = new HeaderDictionary(),
+                ContentType = "application/pdf"
+            };
+
+            var files = new List<IFormFile> { pdfFile };
+
+            // Act
+            var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert
+            var okResult = Assert.IsType<OkObjectResult>(result);
+            Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "good.pdf"));
+        }
+
+        [Fact]
+        public async Task UploadApplicationAttachments_ConfigAddsDangerousExtension_StillRejectedAsInvalidFileType()
+        {
+            // Arrange - S3:AllowedFileTypes is misconfigured (accidentally or otherwise) to
+            // include "jsp" and "exe" alongside a legitimate "pdf". Neither dangerous extension
+            // is in the validated safe superset (DefaultAllowedFileTypes), so both must be
+            // filtered out rather than trusted outright - otherwise they'd pass the extension
+            // check and then skip content validation entirely (they're not in
+            // StrictlyValidatedExtensions either), reintroducing CWE-434 via config alone.
+            var configuration = new ConfigurationBuilder()
+                .AddInMemoryCollection(new Dictionary<string, string?>
+                {
+                    ["S3:AllowedFileTypes"] = "[\"pdf\",\"jsp\",\"exe\"]"
+                })
+                .Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            var jspFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(Array.Empty<byte>()),
+                baseStreamOffset: 0,
+                length: 0,
+                name: "jspFile",
+                fileName: "shell.jsp"
+            );
+
+            var files = new List<IFormFile> { jspFile };
+
+            // Act
+            async Task<IActionResult> Action() => await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert
+            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
+            var badRequestResult = result.ValidationErrors[0].ErrorMessage;
+            Assert.Contains("Invalid file type", badRequestResult);
+            await fileAppService.DidNotReceive().SaveBlobAsync(Arg.Any<SaveBlobInputDto>());
+        }
+
+        [Fact]
+        public async Task UploadApplicationAttachments_OversizedFile_ReturnsBadRequest()
+        {
+            // Arrange
+            var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
+            var configuration = builder.Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            // S3:MaxFileSize is 25 MB; this general (non-email) upload previously had no
+            // server-side size enforcement at all.
+            var oversizedContent = new byte[26 * 1024 * 1024];
+            var oversizedFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(oversizedContent),
+                baseStreamOffset: 0,
+                length: oversizedContent.Length,
+                name: "oversizedFile",
+                fileName: "oversized.txt"
+            );
+
+            var files = new List<IFormFile> { oversizedFile };
+
+            // Act
+            async Task<IActionResult> Action() => await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert
+            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
+            var badRequestResult = result.ValidationErrors[0].ErrorMessage;
+            Assert.Contains("exceeds the maximum allowed size", badRequestResult);
+            await fileAppService.DidNotReceive().SaveBlobAsync(Arg.Any<SaveBlobInputDto>());
+        }
+
+        [Fact]
+        public async Task UploadEmailAttachments_ExceedsEmailPerFileMax_ReturnsBadRequest()
+        {
+            // Arrange
+            var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
+            var configuration = builder.Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            emailLogAttachmentUploadService.GetTotalFileSizeByEmailLogIdAsync(Arg.Any<Guid?>(), Arg.Any<Guid?>())
+                .Returns(Task.FromResult(0L));
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var emailLogId = Guid.NewGuid();
+
+            // S3:EmailAttachmentMaxFileSize is 20 MB - stricter than the general S3:MaxFileSize
+            // of 25 MB - so a 22 MB file passes the general metadata check but must still be
+            // rejected by the email-specific per-file limit, before any buffering/upload occurs.
+            var oversizedContent = new byte[22 * 1024 * 1024];
+            var oversizedFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(oversizedContent),
+                baseStreamOffset: 0,
+                length: oversizedContent.Length,
+                name: "oversizedFile",
+                fileName: "oversized.txt"
+            );
+
+            var files = new List<IFormFile> { oversizedFile };
+
+            // Act
+            async Task<IActionResult> Action() => await attachmentController.UploadEmailAttachments(emailLogId, files);
+
+            // Assert
+            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
+            Assert.Contains("for email attachments", result.Message);
+            await emailLogAttachmentUploadService.DidNotReceive().UploadAsync(
+                Arg.Any<Guid?>(), Arg.Any<Guid?>(), Arg.Any<Guid?>(), Arg.Any<string>(), Arg.Any<byte[]>(), Arg.Any<string>());
+        }
+
+        [Fact]
+        public async Task UploadEmailAttachments_MalformedEmailMaxFileSizeConfig_StillEnforcesDefaultLimit()
+        {
+            // Arrange - S3:EmailAttachmentMaxFileSize is malformed (not a number). This must NOT
+            // silently skip the per-file email size check; it must fall back to the 20 MB
+            // default and still enforce it, the same way GetInvalidFileMetadata already falls
+            // back for a malformed S3:MaxFileSize.
+            var configuration = new ConfigurationBuilder()
+                .AddInMemoryCollection(new Dictionary<string, string?>
+                {
+                    ["S3:AllowedFileTypes"] = "[\"pdf\",\"txt\"]",
+                    ["S3:MaxFileSize"] = "25",
+                    ["S3:EmailAttachmentMaxFileSize"] = "not-a-number",
+                    ["S3:EmailAttachmentsTotalMaxFileSize"] = "25"
+                })
+                .Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            emailLogAttachmentUploadService.GetTotalFileSizeByEmailLogIdAsync(Arg.Any<Guid?>(), Arg.Any<Guid?>())
+                .Returns(Task.FromResult(0L));
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var emailLogId = Guid.NewGuid();
+
+            // 22 MB - under the general 25 MB cap, but over the 20 MB default email per-file cap.
+            var oversizedContent = new byte[22 * 1024 * 1024];
+            var oversizedFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(oversizedContent),
+                baseStreamOffset: 0,
+                length: oversizedContent.Length,
+                name: "oversizedFile",
+                fileName: "oversized.txt"
+            );
+
+            var files = new List<IFormFile> { oversizedFile };
+
+            // Act
+            async Task<IActionResult> Action() => await attachmentController.UploadEmailAttachments(emailLogId, files);
+
+            // Assert
+            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
+            Assert.Contains("for email attachments", result.Message);
+            await emailLogAttachmentUploadService.DidNotReceive().UploadAsync(
+                Arg.Any<Guid?>(), Arg.Any<Guid?>(), Arg.Any<Guid?>(), Arg.Any<string>(), Arg.Any<byte[]>(), Arg.Any<string>());
+        }
+
+        [Fact]
+        public async Task UploadEmailAttachments_MalformedEmailTotalMaxFileSizeConfig_StillEnforcesDefaultLimit()
+        {
+            // Arrange - S3:EmailAttachmentsTotalMaxFileSize is malformed. Must fall back to the
+            // 25 MB default and still enforce it, not silently skip the aggregate check - this is
+            // the one place general uploads deliberately don't have an aggregate cap, so this
+            // check being reliable matters.
+            var configuration = new ConfigurationBuilder()
+                .AddInMemoryCollection(new Dictionary<string, string?>
+                {
+                    ["S3:AllowedFileTypes"] = "[\"pdf\",\"txt\"]",
+                    ["S3:MaxFileSize"] = "25",
+                    ["S3:EmailAttachmentMaxFileSize"] = "20",
+                    ["S3:EmailAttachmentsTotalMaxFileSize"] = "not-a-number"
+                })
+                .Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            emailLogAttachmentUploadService.GetTotalFileSizeByEmailLogIdAsync(Arg.Any<Guid?>(), Arg.Any<Guid?>())
+                .Returns(Task.FromResult(0L));
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var emailLogId = Guid.NewGuid();
+
+            // Each file is 15 MB - under the 20 MB per-file cap - but 30 MB combined exceeds the
+            // 25 MB default total cap the config should have fallen back to.
+            var fileContent = new byte[15 * 1024 * 1024];
+            var files = new List<IFormFile>
+            {
+                new FormFile(
+                    baseStream: new System.IO.MemoryStream(fileContent),
+                    baseStreamOffset: 0,
+                    length: fileContent.Length,
+                    name: "file1",
+                    fileName: "file1.txt"
+                ),
+                new FormFile(
+                    baseStream: new System.IO.MemoryStream(fileContent),
+                    baseStreamOffset: 0,
+                    length: fileContent.Length,
+                    name: "file2",
+                    fileName: "file2.txt"
+                )
+            };
+
+            // Act
+            async Task<IActionResult> Action() => await attachmentController.UploadEmailAttachments(emailLogId, files);
+
+            // Assert
+            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
+            Assert.Contains("would exceed the maximum allowed", result.Message);
+            await emailLogAttachmentUploadService.DidNotReceive().UploadAsync(
+                Arg.Any<Guid?>(), Arg.Any<Guid?>(), Arg.Any<Guid?>(), Arg.Any<string>(), Arg.Any<byte[]>(), Arg.Any<string>());
+        }
+
+        [Fact]
+        public async Task UploadEmailAttachments_ExceedsEmailTotalMax_ReturnsBadRequest()
+        {
+            // Arrange
+            var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
+            var configuration = builder.Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            emailLogAttachmentUploadService.GetTotalFileSizeByEmailLogIdAsync(Arg.Any<Guid?>(), Arg.Any<Guid?>())
+                .Returns(Task.FromResult(0L));
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var emailLogId = Guid.NewGuid();
+
+            // Each file is 15 MB - under both the general S3:MaxFileSize (25 MB) and the
+            // email per-file limit (20 MB) - but two of them combined (30 MB) exceed the
+            // S3:EmailAttachmentsTotalMaxFileSize of 25 MB, and must be rejected before any
+            // file is buffered or uploaded.
+            var fileContent = new byte[15 * 1024 * 1024];
+            var files = new List<IFormFile>
+            {
+                new FormFile(
+                    baseStream: new System.IO.MemoryStream(fileContent),
+                    baseStreamOffset: 0,
+                    length: fileContent.Length,
+                    name: "file1",
+                    fileName: "file1.txt"
+                ),
+                new FormFile(
+                    baseStream: new System.IO.MemoryStream(fileContent),
+                    baseStreamOffset: 0,
+                    length: fileContent.Length,
+                    name: "file2",
+                    fileName: "file2.txt"
+                )
+            };
+
+            // Act
+            async Task<IActionResult> Action() => await attachmentController.UploadEmailAttachments(emailLogId, files);
+
+            // Assert
+            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
+            Assert.Contains("would exceed the maximum allowed", result.Message);
+            await emailLogAttachmentUploadService.DidNotReceive().UploadAsync(
+                Arg.Any<Guid?>(), Arg.Any<Guid?>(), Arg.Any<Guid?>(), Arg.Any<string>(), Arg.Any<byte[]>(), Arg.Any<string>());
+        }
+
         [Fact]
         public async Task DownloadChefsAttachments_ReturnsChefsAttachmentFile()
         {

From 838cded181837ef6786d37c0dcd9111d9516671f Mon Sep 17 00:00:00 2001
From: Jacob Smith <jacob.smith@gov.bc.ca>
Date: Fri, 24 Jul 2026 08:09:12 -0700
Subject: [PATCH 18/40] AB#33866 simplify AI worksheet suggestions

---
 .../AI/Responses/FormWorksheetResponse.cs     |  63 ------
 .../AI/Runtime/AIProviderPayloadValidator.cs  |  14 +-
 .../DataSeed/AIOperationDataSeeder.cs         |   2 +-
 .../DataSeed/AIPromptDataSeeder.cs            |  53 ++---
 .../Definitions/DefinitionResolver.cs         |  30 +--
 .../Worksheets/DefinitionResolverTests.cs     |  22 ++
 .../IApplicationFormVersionService.cs         |   4 +-
 .../Mapping/AiWorksheetReviewDto.cs           |  10 +-
 .../Mapping/ConfirmAiWorksheetDto.cs          |  10 -
 .../Mapping/CreateAiWorksheetDraftDto.cs      |  16 ++
 .../ApplicationFormVersionAppService.cs       | 144 ++++++++----
 .../GenerateFormWorksheetJob.cs               | 206 ++++++++----------
 .../Pages/ApplicationForms/Mapping.js         | 180 ++++++++-------
 .../Components/CustomFields/Default.cshtml    |  32 ++-
 .../Components/CustomFields/Default.css       |  46 +++-
 .../AI/GenerateFormWorksheetJobTests.cs       |  36 ++-
 .../ApplicationFormVersionAppServiceTests.cs  |  70 +++---
 17 files changed, 500 insertions(+), 438 deletions(-)
 create mode 100644 applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Worksheets/DefinitionResolverTests.cs
 delete mode 100644 applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/ConfirmAiWorksheetDto.cs
 create mode 100644 applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/CreateAiWorksheetDraftDto.cs

diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/AI/Responses/FormWorksheetResponse.cs b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/AI/Responses/FormWorksheetResponse.cs
index 4fea2802d2..1ee1d837bc 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/AI/Responses/FormWorksheetResponse.cs
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application.Contracts/AI/Responses/FormWorksheetResponse.cs
@@ -1,69 +1,6 @@
-using System.Collections.Generic;
-using System.Text.Json.Serialization;
-
 namespace Unity.AI.Responses;
 
 public class FormWorksheetResponse
 {
     public string Worksheet { get; set; } = string.Empty;
-
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
-
-    [JsonPropertyName("title")]
-    public string Title { get; set; } = string.Empty;
-
-    [JsonPropertyName("version")]
-    public uint Version { get; set; } = 1;
-
-    [JsonPropertyName("published")]
-    public bool Published { get; set; }
-
-    [JsonPropertyName("reportColumns")]
-    public string ReportColumns { get; set; } = string.Empty;
-
-    [JsonPropertyName("reportKeys")]
-    public string ReportKeys { get; set; } = string.Empty;
-
-    [JsonPropertyName("reportViewName")]
-    public string ReportViewName { get; set; } = string.Empty;
-
-    [JsonPropertyName("sections")]
-    public List<FormWorksheetSectionResponse> Sections { get; set; } = [];
-}
-
-public class FormWorksheetSectionResponse
-{
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
-
-    [JsonPropertyName("order")]
-    public uint Order { get; set; }
-
-    [JsonPropertyName("fields")]
-    public List<FormWorksheetFieldResponse> Fields { get; set; } = [];
-}
-
-public class FormWorksheetFieldResponse
-{
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
-
-    [JsonPropertyName("key")]
-    public string Key { get; set; } = string.Empty;
-
-    [JsonPropertyName("label")]
-    public string Label { get; set; } = string.Empty;
-
-    [JsonPropertyName("type")]
-    public int Type { get; set; }
-
-    [JsonPropertyName("order")]
-    public uint Order { get; set; }
-
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; } = true;
-
-    [JsonPropertyName("definition")]
-    public string? Definition { get; set; }
 }
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/AI/Runtime/AIProviderPayloadValidator.cs b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/AI/Runtime/AIProviderPayloadValidator.cs
index 0f17bbd1cd..23d9ed10da 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/AI/Runtime/AIProviderPayloadValidator.cs
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/AI/Runtime/AIProviderPayloadValidator.cs
@@ -129,18 +129,10 @@ public static AIResponseValidationResult ValidateFormWorksheetJson(string respon
                 return AIResponseValidationResult.Invalid("Form worksheet response was not valid JSON.");
             }
 
-            if (!root.TryGetProperty("title", out var title)
-                || title.ValueKind != JsonValueKind.String
-                || string.IsNullOrWhiteSpace(title.GetString()))
+            if (!root.TryGetProperty("fields", out var fields)
+                || fields.ValueKind != JsonValueKind.Array)
             {
-                return AIResponseValidationResult.Invalid("Form worksheet response is missing a non-empty 'title'.");
-            }
-
-            if (!root.TryGetProperty("sections", out var sections)
-                || sections.ValueKind != JsonValueKind.Array
-                || sections.GetArrayLength() == 0)
-            {
-                return AIResponseValidationResult.Invalid("Form worksheet response must include at least one section.");
+                return AIResponseValidationResult.Invalid("Form worksheet response must include a 'fields' array.");
             }
 
             return AIResponseValidationResult.Success();
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIOperationDataSeeder.cs b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIOperationDataSeeder.cs
index 1f0d8f4387..03fde134de 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIOperationDataSeeder.cs
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIOperationDataSeeder.cs
@@ -29,7 +29,7 @@ public class AIOperationDataSeeder(
         new(AIPromptTypes.AttachmentSummary, AIPromptTypes.AttachmentSummary, 1, 2000),
         new(AIPromptTypes.ApplicationScoring, AIPromptTypes.ApplicationScoring, 1, 8000),
         new(AIPromptTypes.FormMapping, AIPromptTypes.FormMapping, 2, 2000),
-        new(AIPromptTypes.FormWorksheet, AIPromptTypes.FormWorksheet, 2, 4000),
+        new(AIPromptTypes.FormWorksheet, AIPromptTypes.FormWorksheet, 3, 4000),
         new(AIPromptTypes.FormScoresheet, AIPromptTypes.FormScoresheet, 2, 4000)
     ];
 
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIPromptDataSeeder.cs b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIPromptDataSeeder.cs
index 044da04dc5..a1f77af3e2 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIPromptDataSeeder.cs
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIPromptDataSeeder.cs
@@ -122,7 +122,7 @@ private async Task SeedFormMappingPromptAsync()
 
     private async Task SeedFormWorksheetPromptAsync()
     {
-        await EnsurePromptAsync(AIPromptTypes.FormWorksheet, 2, FormWorksheetSystemV2, FormWorksheetUserV2, FormWorksheetMetadataV2);
+        await EnsurePromptAsync(AIPromptTypes.FormWorksheet, 3, FormWorksheetSystemV3, FormWorksheetUserV3, FormWorksheetMetadataV3);
     }
 
     private async Task SeedFormScoresheetPromptAsync()
@@ -846,61 +846,44 @@ Return only valid JSON in the exact mapping shape requested.
         }
         """;
 
-    // ── v2/form-worksheet.system.txt ───────────────────────────────────────
-    private const string FormWorksheetSystemV2 = """
-        You are a worksheet definition generator for Unity Grant Manager.
-        Generate a recommended worksheet definition JSON that can be used to create a Flex worksheet.
+    // ── v3/form-worksheet.system.txt ───────────────────────────────────────
+    private const string FormWorksheetSystemV3 = """
+        You are a custom-field suggestion generator for Unity Grant Manager.
+        Recommend only the additional fields needed for a Flex worksheet.
         Return only valid JSON.
         """;
 
-    // ── v2/form-worksheet.user.txt ──────────────────────────────────────────
-    private const string FormWorksheetUserV2 = """
+    // ── v3/form-worksheet.user.txt ──────────────────────────────────────────
+    private const string FormWorksheetUserV3 = """
         WORKSHEET CONTEXT:
         {{DATA}}
 
         OUTPUT
         {
-          "Name": "<string>",
-          "Title": "<string>",
-          "Version": <number>,
-          "Published": true,
-          "Sections": [
-            {
-              "Name": "<string>",
-              "Order": 1,
-              "Fields": [
-                {
-                  "Name": "<string>",
-                  "Key": "<string>",
-                  "Label": "<string>",
-                  "Type": <number>,
-                  "Definition": "<string>"
-                }
-              ]
-            }
-          ],
-          "ReportColumns": "<string>",
-          "ReportKeys": "<string>",
-          "ReportViewName": "<string>"
+          "fields": [
+            { "key": "<string>", "label": "<string>", "type": "Text" }
+          ]
         }
 
         Rules:
-        - Return one worksheet definition JSON object only.
+        - Return one field-suggestion JSON object only.
         - chefsFields contains the available CHEFS source fields.
         - unityCoreFields contains existing Unity core fields. Do not create a custom field when one of these already fits.
-        - existingMapping contains any current confirmed Unity-to-CHEFS mappings. Do not duplicate those mappings with a custom field.
-        - existingWorksheets contains the previous AI worksheet definition, if one exists. Refine it rather than duplicating its custom fields.
+        - existingMapping contains the current saved Unity-to-CHEFS mappings. Do not duplicate those mappings with a custom field.
+        - existingCustomFields is a flattened list of fields from worksheets currently linked to this form version. Each entry includes its worksheet name, field name, label, and type. Do not create duplicate custom fields.
         - formSchema contains detailed CHEFS control configuration when labels and types need more context.
         - Use the provided form context to decide which custom fields are genuinely needed.
         - Prefer existing Unity core fields when they already satisfy the need.
         - Only create additional worksheet custom fields when the form genuinely needs them.
-        - Keep the worksheet structure valid for Flex.
+        - Do not include a worksheet title, sections, order, publish state, reporting fields, enabled flag, or field definition.
+        - Each key and label must be non-empty. Do not repeat a key.
+        - type must be one of: Text, TextArea, Numeric, Currency, Date, DateTime, Email, Phone, YesNo, Checkbox. Use the type name, never a number.
         - Return valid plain JSON only.
         """;
 
-    private const string FormWorksheetMetadataV2 = """
+    private const string FormWorksheetMetadataV3 = """
         {
-          "DATA": "Serialized JSON payload containing form metadata, CHEFS fields, Unity core fields, the current mapping, form schema, and the existing AI worksheet."
+          "DATA": "Serialized JSON payload containing form metadata, CHEFS fields, Unity core fields, the current mapping, form schema, and custom fields from worksheets currently linked to the form version."
         }
         """;
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Worksheets/Definitions/DefinitionResolver.cs b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Worksheets/Definitions/DefinitionResolver.cs
index 3d184fac84..28ac11f104 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Worksheets/Definitions/DefinitionResolver.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Shared/Worksheets/Definitions/DefinitionResolver.cs
@@ -60,20 +60,20 @@ public static string Resolve(CustomFieldType type, object? definition)
                 {
                     CustomFieldType.Undefined => "{}",
                     CustomFieldType.BCAddress => "{}",
-                    CustomFieldType.Numeric => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.Text => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.Date => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.DateTime => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.Currency => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.YesNo => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.Email => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.Phone => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.Radio => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.Checkbox => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.CheckboxGroup => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.SelectList => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.TextArea => JsonSerializer.Serialize(element.ToString()),
-                    CustomFieldType.DataGrid => JsonSerializer.Serialize(element.ToString()),
+                    CustomFieldType.Numeric => element.GetRawText(),
+                    CustomFieldType.Text => element.GetRawText(),
+                    CustomFieldType.Date => element.GetRawText(),
+                    CustomFieldType.DateTime => element.GetRawText(),
+                    CustomFieldType.Currency => element.GetRawText(),
+                    CustomFieldType.YesNo => element.GetRawText(),
+                    CustomFieldType.Email => element.GetRawText(),
+                    CustomFieldType.Phone => element.GetRawText(),
+                    CustomFieldType.Radio => element.GetRawText(),
+                    CustomFieldType.Checkbox => element.GetRawText(),
+                    CustomFieldType.CheckboxGroup => element.GetRawText(),
+                    CustomFieldType.SelectList => element.GetRawText(),
+                    CustomFieldType.TextArea => element.GetRawText(),
+                    CustomFieldType.DataGrid => element.GetRawText(),
                     _ => throw new NotImplementedException(),
                 };
             }
@@ -216,4 +216,4 @@ public static bool ResolveIsDynamic(CustomFieldDefinition field)
             };
         }
     }
-}
\ No newline at end of file
+}
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Worksheets/DefinitionResolverTests.cs b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Worksheets/DefinitionResolverTests.cs
new file mode 100644
index 0000000000..6a065af65e
--- /dev/null
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Worksheets/DefinitionResolverTests.cs
@@ -0,0 +1,22 @@
+using System.Text.Json;
+using Shouldly;
+using Unity.Flex;
+using Unity.Flex.Worksheets;
+using Unity.Flex.Worksheets.Definitions;
+using Xunit;
+
+namespace Unity.Flex.Application.Tests.Worksheets;
+
+public class DefinitionResolverTests
+{
+    [Fact]
+    public void Resolve_Should_Preserve_JsonObject_When_Definition_Is_JsonElement()
+    {
+        using var document = JsonDocument.Parse("""{"required":true,"maxLength":100}""");
+
+        var definition = DefinitionResolver.Resolve(CustomFieldType.Text, document.RootElement);
+
+        definition.ShouldBe("""{"required":true,"maxLength":100}""");
+        definition.ConvertDefinition(CustomFieldType.Text)!.Required.ShouldBeTrue();
+    }
+}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormVersionService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormVersionService.cs
index 03107b9988..ee59592b06 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormVersionService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormVersionService.cs
@@ -25,7 +25,7 @@ public interface IApplicationFormVersionAppService : ICrudAppService<
         Task DeleteWorkSheetMappingByFormName(string formName, Guid formVersionId);
         Task<ApplicationFormMappingDto> GenerateMappingAsync(Guid id);
         Task<AiWorksheetReviewDto?> GetPendingAiWorksheetAsync(Guid formVersionId);
-        Task ConfirmAiWorksheetAsync(Guid formVersionId, ConfirmAiWorksheetDto input);
-        Task CancelAiWorksheetAsync(Guid formVersionId);
+        Task CreateAiWorksheetDraftAsync(Guid formVersionId, CreateAiWorksheetDraftDto input);
+        Task DiscardAiWorksheetSuggestionsAsync(Guid formVersionId);
     }
 }
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetReviewDto.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetReviewDto.cs
index 76e9f05e46..3d0106287b 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetReviewDto.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetReviewDto.cs
@@ -5,15 +5,7 @@ namespace Unity.GrantManager.ApplicationForms.Mapping;
 
 public class AiWorksheetReviewDto
 {
-    public Guid WorksheetId { get; set; }
-    public string WorksheetName { get; set; } = string.Empty;
-    public string WorksheetTitle { get; set; } = string.Empty;
-    public List<AiWorksheetReviewSectionDto> Sections { get; set; } = [];
-}
-
-public class AiWorksheetReviewSectionDto
-{
-    public string Name { get; set; } = string.Empty;
+    public Guid SessionId { get; set; }
     public List<AiWorksheetReviewFieldDto> Fields { get; set; } = [];
 }
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/ConfirmAiWorksheetDto.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/ConfirmAiWorksheetDto.cs
deleted file mode 100644
index de0ff5485f..0000000000
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/ConfirmAiWorksheetDto.cs
+++ /dev/null
@@ -1,10 +0,0 @@
-using System;
-using System.Collections.Generic;
-
-namespace Unity.GrantManager.ApplicationForms.Mapping;
-
-public class ConfirmAiWorksheetDto
-{
-    public Guid WorksheetId { get; set; }
-    public List<Guid> SelectedFieldIds { get; set; } = [];
-}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/CreateAiWorksheetDraftDto.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/CreateAiWorksheetDraftDto.cs
new file mode 100644
index 0000000000..f4c77b1891
--- /dev/null
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/CreateAiWorksheetDraftDto.cs
@@ -0,0 +1,16 @@
+using System;
+using System.Collections.Generic;
+using System.ComponentModel.DataAnnotations;
+
+namespace Unity.GrantManager.ApplicationForms.Mapping;
+
+public class CreateAiWorksheetDraftDto
+{
+    public Guid SessionId { get; set; }
+
+    [Required]
+    public string Title { get; set; } = string.Empty;
+
+    [MinLength(1)]
+    public List<Guid> SelectedFieldIds { get; set; } = [];
+}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs
index db0efc4266..a7cd3911ae 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs
@@ -4,6 +4,7 @@
 using System;
 using System.Linq;
 using System.Text.RegularExpressions;
+using System.Text.Json;
 using System.Collections.Generic;
 using System.Threading.Tasks;
 using Unity.GrantManager.Applications;
@@ -28,10 +29,7 @@
 using Volo.Abp;
 using Volo.Abp.Uow;
 using Unity.GrantManager.Intakes.Mapping;
-using Unity.Flex.Domain.WorksheetLinks;
 using Unity.Flex.Domain.Worksheets;
-using Unity.GrantManager.Flex;
-using Unity.Modules.Shared.Correlation;
 
 namespace Unity.GrantManager.ApplicationForms
 {
@@ -48,8 +46,7 @@ public class ApplicationFormVersionAppService(
         IAICooldownService aiCooldownService,
         IFormMappingService aiService,
         IWorksheetRepository worksheetRepository,
-        IRepository<CustomField, Guid> customFieldRepository,
-        IWorksheetLinkRepository worksheetLinkRepository) :
+        IRepository<CustomField, Guid> customFieldRepository) :
         CrudAppService<
             ApplicationFormVersion,
             ApplicationFormVersionDto,
@@ -370,18 +367,29 @@ public virtual async Task<ApplicationFormMappingDto> GenerateMappingAsync(Guid i
             return worksheet == null ? null : MapAiWorksheetReview(worksheet);
         }
 
-        [HttpPost("api/app/application-form-version/confirm-ai-worksheet")]
-        public virtual async Task ConfirmAiWorksheetAsync(Guid formVersionId, ConfirmAiWorksheetDto input)
+        [HttpPost("api/app/application-form-version/create-ai-worksheet-draft")]
+        public virtual async Task CreateAiWorksheetDraftAsync(Guid formVersionId, CreateAiWorksheetDraftDto input)
         {
             await CheckPolicyAsync(AIPermissions.Analysis.GenerateFormWorksheet);
 
             var worksheet = await GetPendingAiWorksheetEntityAsync(formVersionId);
-            if (worksheet == null || worksheet.Id != input.WorksheetId)
+            if (worksheet == null || worksheet.Id != input.SessionId)
             {
                 throw new UserFriendlyException("The AI worksheet is no longer available for review.");
             }
 
-            var selectedFieldIds = input.SelectedFieldIds.ToHashSet();
+            var title = input.Title?.Trim();
+            if (string.IsNullOrWhiteSpace(title))
+            {
+                throw new UserFriendlyException("A worksheet title is required.");
+            }
+
+            var selectedFieldIds = input.SelectedFieldIds?.ToHashSet() ?? [];
+            if (selectedFieldIds.Count == 0)
+            {
+                throw new UserFriendlyException("Select at least one suggested field.");
+            }
+
             var fields = worksheet.Sections.SelectMany(section => section.Fields).ToList();
             var unknownFieldIds = selectedFieldIds.Except(fields.Select(field => field.Id)).ToList();
             if (unknownFieldIds.Count > 0)
@@ -389,19 +397,52 @@ public virtual async Task ConfirmAiWorksheetAsync(Guid formVersionId, ConfirmAiW
                 throw new UserFriendlyException("The AI worksheet selection is invalid.");
             }
 
-            foreach (var field in fields.Where(field => !selectedFieldIds.Contains(field.Id)))
+            var draftName = await GetNextAiWorksheetDraftNameAsync(title);
+            var draft = new Worksheet(Guid.NewGuid(), draftName, title);
+
+            var draftSection = new WorksheetSection(Guid.NewGuid(), "Suggested Fields")
+            {
+                Worksheet = draft
+            }.SetOrder(1);
+            draft.AddSection(draftSection);
+
+            foreach (var (field, index) in fields
+                .Where(field => selectedFieldIds.Contains(field.Id))
+                .OrderBy(field => field.Section.Order)
+                .ThenBy(field => field.Order)
+                .Select((field, index) => (field, index)))
+            {
+                var draftField = new CustomField(
+                    Guid.NewGuid(),
+                    field.Key,
+                    draft.Name,
+                    field.Label,
+                    field.Type,
+                    NormalizeCustomFieldDefinition(field.Definition));
+                draftField.Section = draftSection;
+                draftSection.AddField(draftField);
+                draftField.SetOrder((uint)(index + 1)).SetEnabled(true);
+            }
+
+            await worksheetRepository.InsertAsync(draft, true);
+
+            foreach (var field in fields.Where(field => selectedFieldIds.Contains(field.Id)))
             {
                 field.Section.RemoveField(field);
                 await customFieldRepository.DeleteAsync(field.Id);
             }
 
-            worksheet.SetPublished(true);
+            if (worksheet.Sections.All(section => section.Fields.Count == 0))
+            {
+                await worksheetRepository.DeleteAsync(worksheet, true);
+                return;
+            }
+
             await worksheetRepository.UpdateAsync(worksheet, true);
-            await UpsertAiWorksheetLinkAsync(worksheet.Id, formVersionId);
         }
 
-        [HttpPost("api/app/application-form-version/cancel-ai-worksheet")]
-        public virtual async Task CancelAiWorksheetAsync(Guid formVersionId)
+        [HttpPost("api/app/application-form-version/discard-ai-worksheet-suggestions")]
+        public virtual async Task DiscardAiWorksheetSuggestionsAsync(Guid formVersionId)
         {
             await CheckPolicyAsync(AIPermissions.Analysis.GenerateFormWorksheet);
 
@@ -433,49 +474,60 @@ public virtual async Task CancelAiWorksheetAsync(Guid formVersionId)
 
         private static AiWorksheetReviewDto MapAiWorksheetReview(Worksheet worksheet) => new()
         {
-            WorksheetId = worksheet.Id,
-            WorksheetName = worksheet.Name,
-            WorksheetTitle = worksheet.Title,
-            Sections = worksheet.Sections
+            SessionId = worksheet.Id,
+            Fields = worksheet.Sections
                 .OrderBy(section => section.Order)
-                .Select(section => new AiWorksheetReviewSectionDto
+                .SelectMany(section => section.Fields.OrderBy(field => field.Order))
+                .Select(field => new AiWorksheetReviewFieldDto
                 {
-                    Name = section.Name,
-                    Fields = section.Fields
-                        .OrderBy(field => field.Order)
-                        .Select(field => new AiWorksheetReviewFieldDto
-                        {
-                            Id = field.Id,
-                            Key = field.Key,
-                            Label = field.Label,
-                            Type = field.Type.ToString()
-                        })
-                        .ToList()
+                    Id = field.Id,
+                    Key = field.Key,
+                    Label = field.Label,
+                    Type = field.Type.ToString()
                 })
                 .ToList()
         };
 
-        private async Task UpsertAiWorksheetLinkAsync(Guid worksheetId, Guid formVersionId)
+        private async Task<string> GetNextAiWorksheetDraftNameAsync(string title)
         {
-            var existingLink = await worksheetLinkRepository.GetExistingLinkAsync(
-                worksheetId,
-                formVersionId,
-                CorrelationConsts.FormVersion);
+            var titlePart = Regex.Replace(title.Trim().ToLowerInvariant(), "[^a-z0-9]+", "-").Trim('-');
+            var baseName = $"ai-{(string.IsNullOrEmpty(titlePart) ? "worksheet" : titlePart)}";
+            var candidate = baseName;
+            var suffix = 2;
 
-            if (existingLink != null)
+            while (await worksheetRepository.GetByNameAsync(candidate, false) != null)
             {
-                existingLink.SetAnchor(FlexConsts.CustomTab).SetOrder(1);
-                await worksheetLinkRepository.UpdateAsync(existingLink, true);
-                return;
+                candidate = $"{baseName}-{suffix++}";
             }
 
-            await worksheetLinkRepository.InsertAsync(new WorksheetLink(
-                Guid.NewGuid(),
-                worksheetId,
-                formVersionId,
-                CorrelationConsts.FormVersion,
-                FlexConsts.CustomTab,
-                1), true);
+            return candidate;
+        }
+
+        private static string NormalizeCustomFieldDefinition(string definition)
+        {
+            try
+            {
+                using var document = JsonDocument.Parse(definition);
+                if (document.RootElement.ValueKind != JsonValueKind.String)
+                {
+                    return definition;
+                }
+
+                var unwrappedDefinition = document.RootElement.GetString();
+                if (string.IsNullOrWhiteSpace(unwrappedDefinition))
+                {
+                    return definition;
+                }
+
+                using var unwrappedDocument = JsonDocument.Parse(unwrappedDefinition);
+                return unwrappedDocument.RootElement.ValueKind is JsonValueKind.Object or JsonValueKind.Array
+                    ? unwrappedDefinition
+                    : definition;
+            }
+            catch (JsonException)
+            {
+                return definition;
+            }
         }
 
         private static string BuildAiWorksheetName(Guid formId, Guid formVersionId) =>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
index e4a39019aa..1382bb2b64 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
@@ -1,6 +1,7 @@
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Logging;
 using System;
+using System.Collections.Generic;
 using System.Linq;
 using System.Text.Json;
 using System.Threading.Tasks;
@@ -15,6 +16,7 @@
 using Unity.Flex.Domain.WorksheetLinks;
 using Unity.Flex.Domain.Worksheets;
 using Unity.Flex.Worksheets;
+using Unity.Flex.Worksheets.Definitions;
 using Unity.Modules.Shared.Correlation;
 using Volo.Abp.BackgroundJobs;
 using Volo.Abp.DependencyInjection;
@@ -68,15 +70,8 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
                 var worksheetName = BuildWorksheetName(formVersion.Id, applicationForm.Id);
                 var existingWorksheet = await worksheetRepository.GetByNameAsync(worksheetName, true);
                 var mappingReadModel = await mappingReadService.GetAsync(formVersion.Id);
-                List<Worksheet> worksheetSnapshots = [];
-                if (existingWorksheet != null)
-                {
-                    worksheetSnapshots.Add(existingWorksheet);
-                }
-
                 if (existingWorksheet == null || existingWorksheet.Published)
                 {
-                    var promptData = new
                     var promptData = new
                     {
                         applicationFormVersionId = formVersion.Id,
@@ -88,30 +83,15 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
                         unityCoreFields = mappingReadModel.UnityCoreFields,
                         existingMapping = formVersion.SubmissionHeaderMapping,
                         formSchema = formVersion.FormSchema,
-                        existingWorksheets = worksheetSnapshots.Select(worksheet => new
-                        {
-                            worksheet.Id,
-                            worksheet.Name,
-                            worksheet.Title,
-                            worksheet.Version,
-                            worksheet.Published,
-                            worksheet.ReportViewName,
-                            sections = worksheet.Sections.Select(section => new
+                        existingCustomFields = mappingReadModel.Worksheets
+                            .SelectMany(worksheet => worksheet.Fields.Select(field => new
                             {
-                                section.Name,
-                                section.Order,
-                                fields = section.Fields.Select(field => new
-                                {
-                                    field.Name,
-                                    field.Key,
-                                    field.Label,
-                                    field.Type,
-                                    field.Order,
-                                    field.Enabled,
-                                    field.Definition
-                                })
-                            })
-                        })
+                                worksheetId = worksheet.WorksheetId,
+                                worksheetName = worksheet.WorksheetName,
+                                field.Name,
+                                field.Label,
+                                field.Type
+                            }))
                     };
 
                     var useMock = configuration.GetValue<bool>("AI:FormWorksheet:UseMock");
@@ -128,10 +108,10 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
                         logger.LogWarning("Using mock AI worksheet data for form version {FormVersionId}.", formVersion.Id);
                     }
 
-                    var createDto = ParseWorksheetDefinition(worksheetResponse.Worksheet);
+                    var suggestions = ParseWorksheetDefinition(worksheetResponse.Worksheet);
                     if (existingWorksheet == null)
                     {
-                        var worksheet = BuildWorksheet(createDto, worksheetName);
+                        var worksheet = BuildWorksheet(suggestions, worksheetName);
                         worksheet.SetPublished(false);
                         await worksheetRepository.InsertAsync(worksheet);
                     }
@@ -146,7 +126,7 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
                             await worksheetLinkRepository.DeleteAsync(existingLink, true);
                         }
 
-                        RebuildWorksheet(existingWorksheet, createDto);
+                        RebuildWorksheet(existingWorksheet, suggestions);
                         existingWorksheet.SetPublished(false);
                         await worksheetRepository.UpdateAsync(existingWorksheet);
                     }
@@ -180,21 +160,46 @@ await AIGenerationRequestJobHelper.MarkFailedInNewUowAsync(
         }
     }
 
-    internal static CreateWorksheetDto ParseWorksheetDefinition(string json)
+    internal static List<AiWorksheetFieldSuggestion> ParseWorksheetDefinition(string json)
     {
         if (string.IsNullOrWhiteSpace(json))
         {
             throw new InvalidOperationException("Worksheet generation returned empty content.");
         }
 
-        var dto = JsonSerializer.Deserialize<CreateWorksheetDto>(json, CaseInsensitiveJsonOptions);
+        AiWorksheetSuggestions? dto;
+        try
+        {
+            dto = JsonSerializer.Deserialize<AiWorksheetSuggestions>(json, CaseInsensitiveJsonOptions);
+        }
+        catch (JsonException)
+        {
+            throw new InvalidOperationException("Worksheet generation returned an unusable worksheet definition.");
+        }
 
-        if (dto == null || string.IsNullOrWhiteSpace(dto.Title) || dto.Sections is not { Count: > 0 })
+        if (dto?.Fields == null)
         {
             throw new InvalidOperationException("Worksheet generation returned an unusable worksheet definition.");
         }
 
-        return dto;
+        var keys = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var field in dto.Fields)
+        {
+            field.Key = field.Key?.Trim() ?? string.Empty;
+            field.Label = field.Label?.Trim() ?? string.Empty;
+            if (string.IsNullOrWhiteSpace(field.Key)
+                || string.IsNullOrWhiteSpace(field.Label)
+                || !keys.Add(field.Key)
+                || !Enum.TryParse<CustomFieldType>(field.Type, false, out var type)
+                || !SupportedSuggestionTypes.Contains(type))
+            {
+                throw new InvalidOperationException("Worksheet generation returned an unusable worksheet definition.");
+            }
+
+            field.ResolvedType = type;
+        }
+
+        return dto.Fields;
     }
 
     private static string BuildWorksheetName(Guid formVersionId, Guid formId)
@@ -206,103 +211,64 @@ private static string BuildWorksheetName(Guid formVersionId, Guid formId)
     {
         Worksheet = """
         {
-          "title": "AI Suggested Worksheet (Mock)",
-          "version": 1,
-          "published": false,
-          "sections": [
-            {
-              "name": "Suggested Fields",
-              "order": 1,
-              "fields": [
-                {
-                  "key": "projectName",
-                  "label": "Project Name",
-                  "type": 2,
-                  "order": 1,
-                  "definition": { "required": false }
-                },
-                {
-                  "key": "projectSummary",
-                  "label": "Project Summary",
-                  "type": 14,
-                  "order": 2,
-                  "definition": { "required": false }
-                },
-                {
-                  "key": "requestedAmount",
-                  "label": "Requested Amount",
-                  "type": 5,
-                  "order": 3,
-                  "definition": { "required": false }
-                }
-              ]
-            }
+          "fields": [
+            { "key": "projectName", "label": "Project Name", "type": "Text" },
+            { "key": "projectSummary", "label": "Project Summary", "type": "TextArea" },
+            { "key": "requestedAmount", "label": "Requested Amount", "type": "Currency" }
           ]
         }
         """
     };
 
-    private static Worksheet BuildWorksheet(CreateWorksheetDto dto, string worksheetName)
+    internal static Worksheet BuildWorksheet(List<AiWorksheetFieldSuggestion> suggestions, string worksheetName)
     {
-        var worksheet = new Worksheet(Guid.NewGuid(), worksheetName, dto.Title)
-        {
-            ReportColumns = dto.ReportColumns,
-            ReportKeys = dto.ReportKeys,
-            ReportViewName = dto.ReportViewName
-        };
-
-        worksheet.SetVersion(dto.Version);
-        worksheet.SetPublished(dto.Published);
-
-        foreach (var section in dto.Sections.OrderBy(s => s.Order))
-        {
-            var worksheetSection = new WorksheetSection(Guid.NewGuid(), section.Name).SetOrder(section.Order);
-            worksheetSection.Worksheet = worksheet;
-            worksheet.AddSection(worksheetSection);
-
-            foreach (var field in section.Fields)
-            {
-                var customField = new CustomField(
-                    Guid.NewGuid(),
-                    field.Key,
-                    worksheet.Name,
-                    field.Label,
-                    field.Type,
-                    field.Definition);
-                customField.Section = worksheetSection;
-                worksheetSection.AddField(customField);
-            }
-        }
-
+        var worksheet = new Worksheet(Guid.NewGuid(), worksheetName, "AI Suggested Fields");
+        RebuildWorksheet(worksheet, suggestions);
         return worksheet;
     }
 
-    private static void RebuildWorksheet(Worksheet worksheet, CreateWorksheetDto dto)
+    private static void RebuildWorksheet(Worksheet worksheet, List<AiWorksheetFieldSuggestion> suggestions)
     {
-        worksheet.SetTitle(dto.Title);
-        worksheet.SetVersion(dto.Version);
-        worksheet.SetReportingFields(dto.ReportKeys, dto.ReportColumns, dto.ReportViewName);
         worksheet.Sections.Clear();
 
-        foreach (var section in dto.Sections.OrderBy(s => s.Order))
-        {
-            var worksheetSection = new WorksheetSection(Guid.NewGuid(), section.Name).SetOrder(section.Order);
-            worksheetSection.Worksheet = worksheet;
-            worksheet.AddSection(worksheetSection);
+        var section = new WorksheetSection(Guid.NewGuid(), "Suggested Fields").SetOrder(1);
+        section.Worksheet = worksheet;
+        worksheet.AddSection(section);
 
-            foreach (var field in section.Fields)
-            {
-                var customField = new CustomField(
-                    Guid.NewGuid(),
-                    field.Key,
-                    worksheet.Name,
-                    field.Label,
-                    field.Type,
-                    field.Definition);
-                customField.Section = worksheetSection;
-                worksheetSection.AddField(customField);
-            }
+        foreach (var (field, index) in suggestions.Select((field, index) => (field, index)))
+        {
+            var customField = new CustomField(
+                Guid.NewGuid(),
+                field.Key,
+                worksheet.Name,
+                field.Label,
+                field.ResolvedType,
+                DefinitionResolver.Resolve(field.ResolvedType, null));
+            customField.Section = section;
+            section.AddField(customField);
+            customField.SetOrder((uint)(index + 1));
         }
     }
 
+    private static readonly HashSet<CustomFieldType> SupportedSuggestionTypes =
+    [
+        CustomFieldType.Text, CustomFieldType.TextArea, CustomFieldType.Numeric,
+        CustomFieldType.Currency, CustomFieldType.Date, CustomFieldType.DateTime,
+        CustomFieldType.Email, CustomFieldType.Phone, CustomFieldType.YesNo,
+        CustomFieldType.Checkbox
+    ];
+
+    private sealed class AiWorksheetSuggestions
+    {
+        public List<AiWorksheetFieldSuggestion>? Fields { get; set; }
+    }
+
+    internal sealed class AiWorksheetFieldSuggestion
+    {
+        public string? Key { get; set; }
+        public string? Label { get; set; }
+        public string? Type { get; set; }
+        public CustomFieldType ResolvedType { get; set; }
+    }
+
 }
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
index ebd88fcb5f..61a97a23ed 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
@@ -64,8 +64,9 @@
         worksheetReviewModal: $('#aiWorksheetReviewModal'),
         worksheetReviewFields: $('#aiWorksheetReviewFields'),
         worksheetReviewEmpty: $('#aiWorksheetReviewEmpty'),
-        btnConfirmWorksheet: $('#btn-confirm-ai-worksheet'),
-        btnCancelWorksheet: $('#btn-cancel-ai-worksheet'),
+        worksheetTitle: $('#aiWorksheetTitle'),
+        btnCreateWorksheetDraft: $('#btn-create-ai-worksheet-draft'),
+        btnDiscardWorksheet: $('#btn-discard-ai-worksheet'),
         btnSync: $('#btn-sync'),
         btnReset: $('#btn-reset'),
         btnClose: $('.btn-close'),
@@ -110,10 +111,11 @@
         UIElements.btnGenerateWorksheet.on('click', queueFormWorksheet);
         UIElements.btnGenerateScoresheet.on('click', queueFormScoresheet);
         UIElements.btnReviewWorksheet.on('click', loadAiWorksheetReview);
-        UIElements.btnConfirmWorksheet.on('click', confirmAiWorksheet);
-        UIElements.btnCancelWorksheet.on('click', cancelAiWorksheet);
-        UIElements.worksheetReviewModal.on('hidden.bs.modal', cancelAiWorksheetIfNeeded);
-        UIElements.worksheetReviewFields.on('change', 'input[data-field-id]', updateAiWorksheetReviewCount);
+        UIElements.btnCreateWorksheetDraft.on('click', createAiWorksheetDraft);
+        UIElements.btnDiscardWorksheet.on('click', discardAiWorksheetSuggestions);
+        UIElements.worksheetReviewFields.on('change', 'input[data-field-id]', updateAiWorksheetReview);
+        $('#aiWorksheetReviewSelectAll').on('change', toggleAiWorksheetReviewAll);
+        UIElements.worksheetTitle.on('input', updateAiWorksheetDraftButton);
         UIElements.btnReset.on('click', handleReset);
         UIElements.btnCancel.on('click', handleCancelMapping);
         UIElements.btnClose.on('click', handleCancelMapping);
@@ -356,7 +358,7 @@
 
     function refreshWorksheetAfterGeneration() {
         setAiWorksheetPending(true);
-        abp.notify.success('', 'Worksheet generated. Review the suggested fields before confirming.');
+        abp.notify.success('', 'Worksheet generated. Review the suggested fields and create draft worksheets.');
         loadAiWorksheetReview();
     }
 
@@ -404,127 +406,139 @@
     function renderAiWorksheetReview(worksheet) {
         UIElements.worksheetReviewFields.empty();
 
-        let fieldCount = 0;
-        (worksheet.sections || []).forEach(function (section) {
-            const fields = section.fields || [];
-            const $section = $('<section class="ai-worksheet-review__section"></section>');
-            const $sectionHeader = $('<div class="ai-worksheet-review__section-header"></div>');
-            $('<h6 class="ai-worksheet-review__section-title"></h6>').text(section.name).appendTo($sectionHeader);
-            $('<span class="ai-worksheet-review__section-count"></span>')
-                .text(`0 of ${fields.length} selected`)
-                .appendTo($sectionHeader);
-            $sectionHeader.appendTo($section);
+        const fields = worksheet.fields || [];
+        fields.forEach(function (field) {
+            const fieldId = `ai-worksheet-field-${field.id}`;
+            const $row = $('<div class="ai-worksheet-review__field"></div>');
+            $('<span class="ai-worksheet-review__field-name"></span>')
+                .attr('data-field-role', 'CHEFS')
+                .text(field.key || '—')
+                .appendTo($row);
+            $('<i class="fa-solid fa-arrow-right ai-worksheet-review__arrow" aria-hidden="true"></i>').appendTo($row);
+            $('<span class="ai-worksheet-review__field-name"></span>')
+                .attr('data-field-role', 'Unity')
+                .text(field.label || field.key || '—')
+                .appendTo($row);
+            const $switch = $('<div class="ai-worksheet-review__switch"></div>');
+            const $switchContainer = $('<div class="form-check unt-form-switch form-switch mb-0"></div>');
+            $('<input class="form-check-input" type="checkbox">')
+                .attr('id', fieldId)
+                .attr('data-field-id', field.id)
+                .attr('aria-label', `Include ${field.label || field.key || 'field'}`)
+                .appendTo($switchContainer);
+            $switchContainer.appendTo($switch);
+            $switch.appendTo($row);
+            $row.appendTo(UIElements.worksheetReviewFields);
+        });
 
-            fields.forEach(function (field) {
-                fieldCount++;
-                const fieldId = `ai-worksheet-field-${field.id}`;
-                const $row = $('<div class="ai-worksheet-review__field"></div>');
-                $('<span class="ai-worksheet-review__field-name"></span>')
-                    .attr('data-field-role', 'CHEFS')
-                    .text(field.key || '—')
-                    .appendTo($row);
-                $('<i class="fa-solid fa-arrow-right ai-worksheet-review__arrow" aria-hidden="true"></i>').appendTo($row);
-                $('<span class="ai-worksheet-review__field-name"></span>')
-                    .attr('data-field-role', 'Unity')
-                    .text(field.label || field.key || '—')
-                    .appendTo($row);
-                const $switch = $('<div class="ai-worksheet-review__switch"></div>');
-                const $switchContainer = $('<div class="form-check unt-form-switch form-switch mb-0"></div>');
-                $('<input class="form-check-input" type="checkbox" checked>')
-                    .attr('id', fieldId)
-                    .attr('data-field-id', field.id)
-                    .attr('aria-label', `Include ${field.label || field.key || 'field'}`)
-                    .appendTo($switchContainer);
-                $switchContainer.appendTo($switch);
-                $switch.appendTo($row);
-                $row.appendTo($section);
-            });
+        UIElements.worksheetReviewFields.attr('data-session-id', worksheet.sessionId);
+        UIElements.worksheetReviewEmpty.toggleClass('d-none', fields.length > 0);
+        updateAiWorksheetReview();
+    }
 
-            $section.appendTo(UIElements.worksheetReviewFields);
-        });
+    function updateAiWorksheetReview() {
+        const $fields = UIElements.worksheetReviewFields.find('input[data-field-id]');
+        const selectedCount = $fields.filter(':checked').length;
+        $('#aiWorksheetReviewSelectionCount').text(`${selectedCount} of ${$fields.length} selected`);
+        $('#aiWorksheetReviewSelectAll')
+            .prop('checked', $fields.length > 0 && selectedCount === $fields.length)
+            .prop('indeterminate', selectedCount > 0 && selectedCount < $fields.length);
+        updateAiWorksheetDraftButton();
+    }
 
-        UIElements.worksheetReviewFields.attr('data-worksheet-id', worksheet.worksheetId);
-        UIElements.worksheetReviewEmpty.toggleClass('d-none', fieldCount > 0);
-        updateAiWorksheetReviewCount();
+    function toggleAiWorksheetReviewAll() {
+        UIElements.worksheetReviewFields.find('input[data-field-id]').prop('checked', $(this).prop('checked'));
+        updateAiWorksheetReview();
     }
 
-    function updateAiWorksheetReviewCount() {
-        UIElements.worksheetReviewFields.find('.ai-worksheet-review__section').each(function () {
-            const $section = $(this);
-            const $sectionFields = $section.find('input[data-field-id]');
-            const sectionSelectedCount = $sectionFields.filter(':checked').length;
-            $section.find('.ai-worksheet-review__section-count')
-                .text(`${sectionSelectedCount} of ${$sectionFields.length} selected`);
-        });
+    function updateAiWorksheetDraftButton() {
+        const hasTitle = String(UIElements.worksheetTitle.val() ?? '').trim().length > 0;
+        const hasSelectedFields = UIElements.worksheetReviewFields.find('input[data-field-id]:checked').length > 0;
+        UIElements.btnCreateWorksheetDraft.prop('disabled', !hasTitle || !hasSelectedFields);
     }
 
-    function confirmAiWorksheet() {
+    function createAiWorksheetDraft() {
         const formVersion = String(document.getElementById('formVersionId')?.value ?? '').trim();
-        const worksheetId = UIElements.worksheetReviewFields.attr('data-worksheet-id');
+        const sessionId = UIElements.worksheetReviewFields.attr('data-session-id');
+        const title = String(UIElements.worksheetTitle.val() ?? '').trim();
         const selectedFieldIds = UIElements.worksheetReviewFields
             .find('input[data-field-id]:checked')
             .map(function () { return $(this).attr('data-field-id'); })
             .get();
 
-        if (!validateGuid(formVersion) || !validateGuid(worksheetId)) {
-            abp.notify.error('', 'Unable to confirm the AI worksheet because its identifiers are invalid.');
+        if (!validateGuid(formVersion) || !validateGuid(sessionId) || !title || selectedFieldIds.length === 0) {
+            abp.notify.error('', 'Enter a worksheet title and select at least one suggested field.');
             return;
         }
 
-        UIElements.btnConfirmWorksheet.prop('disabled', true);
-        UIElements.btnCancelWorksheet.prop('disabled', true);
+        UIElements.btnCreateWorksheetDraft.prop('disabled', true);
+        UIElements.btnDiscardWorksheet.prop('disabled', true);
 
         abp.ajax({
-            url: `/api/app/application-form-version/confirm-ai-worksheet?formVersionId=${encodeURIComponent(formVersion)}`,
+            url: `/api/app/application-form-version/create-ai-worksheet-draft?formVersionId=${encodeURIComponent(formVersion)}`,
             type: 'POST',
             contentType: 'application/json',
-            data: JSON.stringify({ worksheetId, selectedFieldIds })
+            data: JSON.stringify({ sessionId, title, selectedFieldIds })
         })
             .done(function () {
-                UIElements.worksheetReviewModal.data('ai-confirmed', true).modal('hide');
-                setAiWorksheetPending(false);
-                abp.notify.success('', 'Worksheet confirmed and published successfully. Reloading page.');
-                setTimeout(function () { globalThis.location.reload(); }, 500);
+                UIElements.worksheetTitle.val('');
+                abp.notify.success('', 'Draft worksheet created.');
+                refreshAiWorksheetReviewAfterDraftCreation(formVersion);
             })
             .fail(function () {
-                abp.notify.error('', 'Unable to confirm the AI worksheet.');
+                abp.notify.error('', 'Unable to create the draft worksheet.');
             })
             .always(function () {
-                UIElements.btnConfirmWorksheet.prop('disabled', false);
-                UIElements.btnCancelWorksheet.prop('disabled', false);
+                UIElements.btnDiscardWorksheet.prop('disabled', false);
+                updateAiWorksheetDraftButton();
             });
     }
 
-    function cancelAiWorksheet() {
-        if (UIElements.worksheetReviewModal.data('ai-confirmed') === true) {
-            return;
-        }
+    function refreshAiWorksheetReviewAfterDraftCreation(formVersion) {
+        abp.ajax({
+            url: `/api/app/application-form-version/pending-ai-worksheet?formVersionId=${encodeURIComponent(formVersion)}`,
+            type: 'GET'
+        })
+            .done(function (worksheet) {
+                if (!worksheet) {
+                    UIElements.worksheetReviewModal.modal('hide');
+                    setAiWorksheetPending(false);
+                    return;
+                }
+
+                renderAiWorksheetReview(worksheet);
+            })
+            .fail(function () {
+                abp.notify.error('', 'Draft created, but the remaining suggestions could not be loaded.');
+            });
+    }
 
+    function discardAiWorksheetSuggestions() {
         const formVersion = String(document.getElementById('formVersionId')?.value ?? '').trim();
         if (!validateGuid(formVersion) || !isAiWorksheetPending()) {
             return;
         }
 
-        UIElements.worksheetReviewModal.data('ai-confirmed', true);
+        UIElements.btnCreateWorksheetDraft.prop('disabled', true);
+        UIElements.btnDiscardWorksheet.prop('disabled', true);
         abp.ajax({
-            url: `/api/app/application-form-version/cancel-ai-worksheet?formVersionId=${encodeURIComponent(formVersion)}`,
+            url: `/api/app/application-form-version/discard-ai-worksheet-suggestions?formVersionId=${encodeURIComponent(formVersion)}`,
             type: 'POST'
         })
             .done(function () {
                 setAiWorksheetPending(false);
-                abp.notify.success('', 'Pending AI worksheet discarded.');
+                UIElements.worksheetReviewModal.modal('hide');
+                abp.notify.success('', 'Remaining AI worksheet suggestions discarded.');
             })
             .fail(function () {
-                UIElements.worksheetReviewModal.data('ai-confirmed', false);
-                abp.notify.error('', 'Unable to discard the pending AI worksheet.');
+                abp.notify.error('', 'Unable to discard the remaining AI worksheet suggestions.');
+            })
+            .always(function () {
+                UIElements.btnDiscardWorksheet.prop('disabled', false);
+                updateAiWorksheetDraftButton();
             });
     }
 
-    function cancelAiWorksheetIfNeeded() {
-        cancelAiWorksheet();
-        UIElements.worksheetReviewModal.removeData('ai-confirmed');
-    }
-
     function refreshScoresheetAfterGeneration() {
         abp.notify.success('', 'Scoresheet generated and assigned successfully. Reloading page.');
         setTimeout(function () {
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
index 93d2a2d2e6..24b3dcd4ec 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
@@ -200,22 +200,32 @@
                 </div>
                 <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
             </div>
-            <div class="modal-body">
+            <div class="modal-body ai-worksheet-review__body">
                 <div class="ai-worksheet-review__intro">
-                    <span>Keep the suggestions you want to include. You can update the field details later.</span>
+                    <span>Create one or more draft worksheets from these suggestions. You can update the field details later.</span>
                 </div>
-                <div class="ai-worksheet-review__table-header">
-                    <span>CHEFS field</span>
-                    <span aria-hidden="true"></span>
-                    <span>Unity field</span>
-                    <span class="text-center">Include</span>
+                <div class="mb-3">
+                    <label for="aiWorksheetTitle" class="form-label">Worksheet title</label>
+                    <input id="aiWorksheetTitle" class="form-control" type="text" required maxlength="256" />
+                </div>
+                <div class="ai-worksheet-review__list">
+                    <div class="ai-worksheet-review__table-header">
+                        <span>CHEFS field</span>
+                        <span aria-hidden="true"></span>
+                        <span>Unity field</span>
+                        <span class="text-center">
+                            <span id="aiWorksheetReviewSelectionCount" class="d-block">0 selected</span>
+                            <input id="aiWorksheetReviewSelectAll" class="form-check-input" type="checkbox" aria-label="Include all suggested fields" />
+                        </span>
+                    </div>
+                    <div id="aiWorksheetReviewFields"></div>
+                    <div id="aiWorksheetReviewEmpty" class="ai-worksheet-review__empty d-none">No custom fields were suggested.</div>
                 </div>
-                <div id="aiWorksheetReviewFields"></div>
-                <div id="aiWorksheetReviewEmpty" class="ai-worksheet-review__empty d-none">No custom fields were suggested.</div>
             </div>
             <div class="modal-footer ai-worksheet-review__footer">
-                <button type="button" id="btn-cancel-ai-worksheet" class="btn btn-outline-secondary" data-bs-dismiss="modal">Discard draft</button>
-                <button type="button" id="btn-confirm-ai-worksheet" class="btn btn-primary">Publish selected fields</button>
+                <button type="button" id="btn-create-ai-worksheet-draft" class="btn btn-primary" disabled>Create draft</button>
+                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Resume later</button>
+                <button type="button" id="btn-discard-ai-worksheet" class="btn btn-outline-danger">Discard remaining</button>
             </div>
         </div>
     </div>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css
index 0c89a2b85f..aa54153e2c 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css
@@ -118,6 +118,18 @@
     overflow: hidden;
 }
 
+.ai-worksheet-review__body {
+    display: flex;
+    flex-direction: column;
+    max-height: min(65vh, 42rem);
+}
+
+.ai-worksheet-review__list {
+    flex: 1 1 auto;
+    min-height: 0;
+    overflow-y: auto;
+}
+
 .ai-worksheet-review__header {
     align-items: flex-start;
     border-bottom: 1px solid #d8e1eb;
@@ -156,11 +168,19 @@
 .ai-worksheet-review__section-header {
     align-items: center;
     background: #f4f7fa;
-    display: flex;
-    justify-content: space-between;
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) 2rem minmax(0, 1fr) 4.5rem;
     padding: 0.75rem 1rem;
 }
 
+.ai-worksheet-review__section-title-group {
+    align-items: center;
+    display: flex;
+    gap: 0.75rem;
+    grid-column: 1 / 4;
+    min-width: 0;
+}
+
 .ai-worksheet-review__section-title {
     font-size: 1rem;
     font-weight: 700;
@@ -177,6 +197,12 @@
     white-space: nowrap;
 }
 
+.ai-worksheet-review__section-switch {
+    flex: 0 0 auto;
+    grid-column: 4;
+    justify-self: center;
+}
+
 .ai-worksheet-review__table-header,
 .ai-worksheet-review__field {
     display: grid;
@@ -190,6 +216,10 @@
     font-weight: 700;
     letter-spacing: 0.05em;
     padding: 0.65rem 1rem;
+    position: sticky;
+    top: 0;
+    background: #fff;
+    z-index: 1;
     text-transform: uppercase;
 }
 
@@ -245,6 +275,18 @@
         row-gap: 0.5rem;
     }
 
+    .ai-worksheet-review__section-header {
+        grid-template-columns: minmax(0, 1fr) 1.5rem auto;
+    }
+
+    .ai-worksheet-review__section-title-group {
+        grid-column: 1 / 3;
+    }
+
+    .ai-worksheet-review__section-switch {
+        grid-column: 3;
+    }
+
     .ai-worksheet-review__field-name:first-child {
         grid-column: 1 / 2;
     }
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs
index 009c08dbf6..09d39b24cd 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs
@@ -1,5 +1,6 @@
 using System;
 using Shouldly;
+using Unity.Flex.Worksheets;
 using Unity.GrantManager.GrantApplications.Automation.BackgroundJobs;
 using Xunit;
 
@@ -9,7 +10,11 @@ public class GenerateFormWorksheetJobTests
 {
     [Theory]
     [InlineData("{}")]
-    [InlineData("""{"Title":"Draft","Sections":[]}""")]
+    [InlineData("""{"fields":[{"key":"","label":"Project","type":"Text"}]}""")]
+    [InlineData("""{"fields":[{"key":"project","label":"","type":"Text"}]}""")]
+    [InlineData("""{"fields":[{"key":"project","label":"Project","type":"Radio"}]}""")]
+    [InlineData("""{"fields":[{"key":"project","label":"Project","type":2}]}""")]
+    [InlineData("""{"fields":[{"key":"project","label":"Project","type":"Text"},{"key":"PROJECT","label":"Other","type":"Text"}]}""")]
     public void ParseWorksheetDefinition_Should_Reject_Incomplete_Ai_Response(string worksheetJson)
     {
         var exception = Should.Throw<InvalidOperationException>(() =>
@@ -17,4 +22,33 @@ public void ParseWorksheetDefinition_Should_Reject_Incomplete_Ai_Response(string
 
         exception.Message.ShouldContain("unusable worksheet definition");
     }
+
+    [Fact]
+    public void ParseWorksheetDefinition_Should_Accept_Flat_Safe_Field_Suggestions()
+    {
+        var fields = GenerateFormWorksheetJob.ParseWorksheetDefinition("""
+            {"fields":[{"key":"projectName","label":"Project Name","type":"Text"},{"key":"requestedAmount","label":"Requested Amount","type":"Currency"}]}
+            """);
+
+        fields.Count.ShouldBe(2);
+        fields[0].Key.ShouldBe("projectName");
+        fields[0].ResolvedType.ShouldBe(CustomFieldType.Text);
+        fields[1].ResolvedType.ShouldBe(CustomFieldType.Currency);
+    }
+
+    [Fact]
+    public void BuildWorksheet_Should_Create_One_SuggestedFields_Section_With_Default_Definitions()
+    {
+        var suggestions = GenerateFormWorksheetJob.ParseWorksheetDefinition("""
+            {"fields":[{"key":"projectName","label":"Project Name","type":"Text"}]}
+            """);
+
+        var worksheet = GenerateFormWorksheetJob.BuildWorksheet(suggestions, "ai-form-worksheet");
+
+        worksheet.Sections.Count.ShouldBe(1);
+        worksheet.Sections.Single().Name.ShouldBe("Suggested Fields");
+        var field = worksheet.Sections.Single().Fields.Single();
+        field.Order.ShouldBe(1u);
+        field.Definition.ShouldContain("maxLength");
+    }
 }
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs
index 81dde1df22..8c7cb0a2bd 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs
@@ -4,6 +4,7 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Reflection;
+using System.Text.Json;
 using System.Threading.Tasks;
 using Unity.AI;
 using Unity.AI.Cooldown;
@@ -12,7 +13,6 @@
 using Unity.AI.Requests;
 using Unity.AI.Responses;
 using Unity.Flex.Domain.Worksheets;
-using Unity.Flex.Domain.WorksheetLinks;
 using Unity.Flex.Worksheets;
 using Unity.GrantManager.ApplicationForms;
 using Unity.GrantManager.ApplicationForms.Mapping;
@@ -123,14 +123,13 @@ public async Task GetPendingAiWorksheetAsync_Should_Return_Unpublished_Worksheet
         var result = await service.GetPendingAiWorksheetAsync(formVersionId);
 
         result.ShouldNotBeNull();
-        result!.WorksheetId.ShouldBe(worksheet.Id);
-        result.WorksheetTitle.ShouldBe("AI Worksheet");
-        result.Sections.Single().Fields.Single().Label.ShouldBe("Project Name");
-        result.Sections.Single().Fields.Single().Selected.ShouldBeTrue();
+        result!.SessionId.ShouldBe(worksheet.Id);
+        result.Fields.Single().Label.ShouldBe("Project Name");
+        result.Fields.Single().Selected.ShouldBeTrue();
     }
 
     [Fact]
-    public async Task ConfirmAiWorksheetAsync_Should_Delete_Unselected_Fields_Publish_And_Link_Worksheet()
+    public async Task CreateAiWorksheetDraftAsync_Should_Create_Unlinked_Unpublished_Draft_And_Keep_Remaining_Suggestions()
     {
         var formVersionId = Guid.NewGuid();
         var formId = Guid.NewGuid();
@@ -144,7 +143,9 @@ public async Task ConfirmAiWorksheetAsync_Should_Delete_Unselected_Fields_Publis
         var worksheetRepository = Substitute.For<IWorksheetRepository>();
         worksheetRepository.GetByNameAsync(Arg.Any<string>(), true).Returns(worksheet);
         var customFieldRepository = Substitute.For<IRepository<CustomField, Guid>>();
-        var worksheetLinkRepository = Substitute.For<IWorksheetLinkRepository>();
+        Worksheet? createdDraft = null;
+        worksheetRepository.InsertAsync(Arg.Do<Worksheet>(worksheet => createdDraft = worksheet), true)
+            .Returns(Task.FromResult<Worksheet>(null!));
 
         var service = CreateService(
             Substitute.For<IRepository<ApplicationFormVersion, Guid>>(),
@@ -152,26 +153,35 @@ public async Task ConfirmAiWorksheetAsync_Should_Delete_Unselected_Fields_Publis
             Substitute.For<IFormMappingService>(),
             formVersionRepository,
             worksheetRepository,
-            customFieldRepository,
-            worksheetLinkRepository);
+            customFieldRepository);
         service.LazyServiceProvider = GetRequiredService<IAbpLazyServiceProvider>();
 
         var selectedFieldId = worksheet.Sections.Single().Fields.First().Id;
-        await service.ConfirmAiWorksheetAsync(formVersionId, new ConfirmAiWorksheetDto
+        var remainingFieldId = worksheet.Sections.Single().Fields.Last().Id;
+        worksheet.Sections.Single().Fields.First().SetDefinition(JsonSerializer.Serialize("""{"required":true}"""));
+        await service.CreateAiWorksheetDraftAsync(formVersionId, new CreateAiWorksheetDraftDto
         {
-            WorksheetId = worksheet.Id,
+            SessionId = worksheet.Id,
+            Title = "Risk Review",
             SelectedFieldIds = [selectedFieldId]
         });
 
-        worksheet.Published.ShouldBeTrue();
-        worksheet.Sections.Single().Fields.Select(field => field.Id).ShouldBe([selectedFieldId]);
-        await customFieldRepository.Received(1).DeleteAsync(Arg.Is<Guid>(id => id != selectedFieldId));
+        createdDraft.ShouldNotBeNull();
+        createdDraft!.Name.ShouldBe("ai-risk-review");
+        createdDraft.Title.ShouldBe("Risk Review");
+        createdDraft.Published.ShouldBeFalse();
+        createdDraft.Links.ShouldBeEmpty();
+        createdDraft.Sections.Single().Fields.Single().Key.ShouldBe("Field0");
+        createdDraft.Sections.Single().Fields.Single().Label.ShouldBe("Project Name");
+        createdDraft.Sections.Single().Fields.Single().Definition.ShouldBe("""{"required":true}""");
+        worksheet.Published.ShouldBeFalse();
+        worksheet.Sections.Single().Fields.Select(field => field.Id).ShouldBe([remainingFieldId]);
+        await customFieldRepository.Received(1).DeleteAsync(selectedFieldId);
         await worksheetRepository.Received(1).UpdateAsync(worksheet, true);
-        await worksheetLinkRepository.Received(1).InsertAsync(Arg.Any<WorksheetLink>(), true);
     }
 
     [Fact]
-    public async Task ConfirmAiWorksheetAsync_Should_Allow_All_Suggested_Fields_To_Be_Deselected()
+    public async Task CreateAiWorksheetDraftAsync_Should_Number_Internal_Name_And_Delete_Empty_Suggestions()
     {
         var formVersionId = Guid.NewGuid();
         var formId = Guid.NewGuid();
@@ -185,7 +195,11 @@ public async Task ConfirmAiWorksheetAsync_Should_Allow_All_Suggested_Fields_To_B
         var worksheetRepository = Substitute.For<IWorksheetRepository>();
         worksheetRepository.GetByNameAsync(Arg.Any<string>(), true).Returns(worksheet);
         var customFieldRepository = Substitute.For<IRepository<CustomField, Guid>>();
-        var worksheetLinkRepository = Substitute.For<IWorksheetLinkRepository>();
+        Worksheet? createdDraft = null;
+        worksheetRepository.GetByNameAsync("ai-risk-review", false).Returns(new Worksheet(Guid.NewGuid(), "ai-risk-review", "Existing"));
+        worksheetRepository.GetByNameAsync("ai-risk-review-2", false).Returns((Worksheet?)null);
+        worksheetRepository.InsertAsync(Arg.Do<Worksheet>(worksheet => createdDraft = worksheet), true)
+            .Returns(Task.FromResult<Worksheet>(null!));
 
         var service = CreateService(
             Substitute.For<IRepository<ApplicationFormVersion, Guid>>(),
@@ -193,20 +207,20 @@ public async Task ConfirmAiWorksheetAsync_Should_Allow_All_Suggested_Fields_To_B
             Substitute.For<IFormMappingService>(),
             formVersionRepository,
             worksheetRepository,
-            customFieldRepository,
-            worksheetLinkRepository);
+            customFieldRepository);
         service.LazyServiceProvider = GetRequiredService<IAbpLazyServiceProvider>();
 
-        await service.ConfirmAiWorksheetAsync(formVersionId, new ConfirmAiWorksheetDto
+        await service.CreateAiWorksheetDraftAsync(formVersionId, new CreateAiWorksheetDraftDto
         {
-            WorksheetId = worksheet.Id,
-            SelectedFieldIds = []
+            SessionId = worksheet.Id,
+            Title = "Risk Review",
+            SelectedFieldIds = worksheet.Sections.Single().Fields.Select(field => field.Id).ToList()
         });
 
-        worksheet.Published.ShouldBeTrue();
-        worksheet.Sections.Single().Fields.ShouldBeEmpty();
+        createdDraft!.Name.ShouldBe("ai-risk-review-2");
+        createdDraft.Published.ShouldBeFalse();
         await customFieldRepository.Received(2).DeleteAsync(Arg.Any<Guid>());
-        await worksheetLinkRepository.Received(1).InsertAsync(Arg.Any<WorksheetLink>(), true);
+        await worksheetRepository.Received(1).DeleteAsync(worksheet, true);
     }
 
     private static Worksheet BuildAiWorksheet(Guid formId, Guid formVersionId, bool published, int fieldCount = 1)
@@ -303,8 +317,7 @@ private static ApplicationFormVersionAppService CreateService(
         IFormMappingService aiService,
         IApplicationFormVersionRepository? formVersionRepository = null,
         IWorksheetRepository? worksheetRepository = null,
-        IRepository<CustomField, Guid>? customFieldRepository = null,
-        IWorksheetLinkRepository? worksheetLinkRepository = null)
+        IRepository<CustomField, Guid>? customFieldRepository = null)
     {
         var featureChecker = Substitute.For<IFeatureChecker>();
         featureChecker.IsEnabledAsync(AIFeatures.FormMapping).Returns(true);
@@ -326,8 +339,7 @@ private static ApplicationFormVersionAppService CreateService(
             cooldownService,
             aiService,
             worksheetRepository ?? Substitute.For<IWorksheetRepository>(),
-            customFieldRepository ?? Substitute.For<IRepository<CustomField, Guid>>(),
-            worksheetLinkRepository ?? Substitute.For<IWorksheetLinkRepository>());
+            customFieldRepository ?? Substitute.For<IRepository<CustomField, Guid>>());
         return service;
     }
 }

From 1cd472f4244823f2c30dff5e706a053b3f184678 Mon Sep 17 00:00:00 2001
From: Jacob Smith <jacob.smith@gov.bc.ca>
Date: Fri, 24 Jul 2026 08:55:16 -0700
Subject: [PATCH 19/40] AB#33866 fix worksheet test imports

---
 .../AI/GenerateFormWorksheetJobTests.cs                          | 1 +
 1 file changed, 1 insertion(+)

diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs
index 09d39b24cd..0f46318ea3 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs
@@ -1,4 +1,5 @@
 using System;
+using System.Linq;
 using Shouldly;
 using Unity.Flex.Worksheets;
 using Unity.GrantManager.GrantApplications.Automation.BackgroundJobs;

From e798bbb6c3cfec3e75f84f3c6cb1eefa607e1004 Mon Sep 17 00:00:00 2001
From: Jacob Smith <jacob.smith@gov.bc.ca>
Date: Fri, 24 Jul 2026 09:13:21 -0700
Subject: [PATCH 20/40] AB#33866 update worksheet validator test

---
 .../AI/Runtime/AIProviderPayloadValidatorTests.cs          | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/Runtime/AIProviderPayloadValidatorTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/Runtime/AIProviderPayloadValidatorTests.cs
index 7f12a33ae7..a83d69fa7d 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/Runtime/AIProviderPayloadValidatorTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/Runtime/AIProviderPayloadValidatorTests.cs
@@ -188,14 +188,13 @@ public void ValidateFormWorksheetJson_Should_Return_InvalidOutput_For_Incomplete
     }
 
     [Fact]
-    public void ValidateFormWorksheetJson_Should_Return_Success_For_Complete_Worksheet()
+    public void ValidateFormWorksheetJson_Should_Return_Success_For_Flat_Field_Suggestions()
     {
         var result = AIProviderPayloadValidator.ValidateFormWorksheetJson(
             """
             {
-              "title": "Draft",
-              "sections": [
-                { "name": "Application details", "fields": [] }
+              "fields": [
+                { "key": "projectName", "label": "Project Name", "type": "Text" }
               ]
             }
             """);

From 05cab8911adeca1ee9947ca5727eaed2e507ad3d Mon Sep 17 00:00:00 2001
From: Jacob Smith <jacob.smith@gov.bc.ca>
Date: Fri, 24 Jul 2026 09:32:49 -0700
Subject: [PATCH 21/40] AB#33866 remove worksheet mock generation

---
 .../GenerateFormWorksheetJob.cs               | 31 +++----------------
 1 file changed, 4 insertions(+), 27 deletions(-)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
index 1382bb2b64..c69bba1ffc 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
@@ -1,4 +1,3 @@
-using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Logging;
 using System;
 using System.Collections.Generic;
@@ -37,7 +36,6 @@ public class GenerateFormWorksheetJob(
     ICurrentTenant currentTenant,
     IUnitOfWorkManager unitOfWorkManager,
     IAICooldownService aiCooldownService,
-    IConfiguration configuration,
     ILogger<GenerateFormWorksheetJob> logger) : AsyncBackgroundJob<GenerateFormWorksheetBackgroundJobArgs>, ITransientDependency
 {
     private static readonly JsonSerializerOptions CaseInsensitiveJsonOptions = new()
@@ -94,19 +92,11 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
                             }))
                     };
 
-                    var useMock = configuration.GetValue<bool>("AI:FormWorksheet:UseMock");
-                    var worksheetResponse = useMock
-                        ? CreateMockWorksheetResponse()
-                        : await aiService.GenerateFormWorksheetAsync(new FormWorksheetRequest
-                        {
-                            Data = JsonSerializer.SerializeToElement(promptData),
-                            PromptVersion = args.PromptVersion
-                        });
-
-                    if (useMock)
+                    var worksheetResponse = await aiService.GenerateFormWorksheetAsync(new FormWorksheetRequest
                     {
-                        logger.LogWarning("Using mock AI worksheet data for form version {FormVersionId}.", formVersion.Id);
-                    }
+                        Data = JsonSerializer.SerializeToElement(promptData),
+                        PromptVersion = args.PromptVersion
+                    });
 
                     var suggestions = ParseWorksheetDefinition(worksheetResponse.Worksheet);
                     if (existingWorksheet == null)
@@ -207,19 +197,6 @@ private static string BuildWorksheetName(Guid formVersionId, Guid formId)
         return $"ai-form-{formId}-version-{formVersionId}-worksheet";
     }
 
-    private static FormWorksheetResponse CreateMockWorksheetResponse() => new()
-    {
-        Worksheet = """
-        {
-          "fields": [
-            { "key": "projectName", "label": "Project Name", "type": "Text" },
-            { "key": "projectSummary", "label": "Project Summary", "type": "TextArea" },
-            { "key": "requestedAmount", "label": "Requested Amount", "type": "Currency" }
-          ]
-        }
-        """
-    };
-
     internal static Worksheet BuildWorksheet(List<AiWorksheetFieldSuggestion> suggestions, string worksheetName)
     {
         var worksheet = new Worksheet(Guid.NewGuid(), worksheetName, "AI Suggested Fields");

From 93cf98ce4f44b8ea55748d7fe2f2aca23baa069e Mon Sep 17 00:00:00 2001
From: Jacob Smith <jacob.smith@gov.bc.ca>
Date: Fri, 24 Jul 2026 09:55:08 -0700
Subject: [PATCH 22/40] AB#33866 keep form generation prompts on v2

---
 .../DataSeed/AIOperationDataSeeder.cs                |  2 +-
 .../DataSeed/AIPromptDataSeeder.cs                   | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIOperationDataSeeder.cs b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIOperationDataSeeder.cs
index 03fde134de..1f0d8f4387 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIOperationDataSeeder.cs
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIOperationDataSeeder.cs
@@ -29,7 +29,7 @@ public class AIOperationDataSeeder(
         new(AIPromptTypes.AttachmentSummary, AIPromptTypes.AttachmentSummary, 1, 2000),
         new(AIPromptTypes.ApplicationScoring, AIPromptTypes.ApplicationScoring, 1, 8000),
         new(AIPromptTypes.FormMapping, AIPromptTypes.FormMapping, 2, 2000),
-        new(AIPromptTypes.FormWorksheet, AIPromptTypes.FormWorksheet, 3, 4000),
+        new(AIPromptTypes.FormWorksheet, AIPromptTypes.FormWorksheet, 2, 4000),
         new(AIPromptTypes.FormScoresheet, AIPromptTypes.FormScoresheet, 2, 4000)
     ];
 
diff --git a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIPromptDataSeeder.cs b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIPromptDataSeeder.cs
index a1f77af3e2..7df54a2a2a 100644
--- a/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIPromptDataSeeder.cs
+++ b/applications/Unity.GrantManager/modules/Unity.AI/src/Unity.AI.Application/DataSeed/AIPromptDataSeeder.cs
@@ -122,7 +122,7 @@ private async Task SeedFormMappingPromptAsync()
 
     private async Task SeedFormWorksheetPromptAsync()
     {
-        await EnsurePromptAsync(AIPromptTypes.FormWorksheet, 3, FormWorksheetSystemV3, FormWorksheetUserV3, FormWorksheetMetadataV3);
+        await EnsurePromptAsync(AIPromptTypes.FormWorksheet, 2, FormWorksheetSystemV2, FormWorksheetUserV2, FormWorksheetMetadataV2);
     }
 
     private async Task SeedFormScoresheetPromptAsync()
@@ -846,15 +846,15 @@ Return only valid JSON in the exact mapping shape requested.
         }
         """;
 
-    // ── v3/form-worksheet.system.txt ───────────────────────────────────────
-    private const string FormWorksheetSystemV3 = """
+    // ── v2/form-worksheet.system.txt ───────────────────────────────────────
+    private const string FormWorksheetSystemV2 = """
         You are a custom-field suggestion generator for Unity Grant Manager.
         Recommend only the additional fields needed for a Flex worksheet.
         Return only valid JSON.
         """;
 
-    // ── v3/form-worksheet.user.txt ──────────────────────────────────────────
-    private const string FormWorksheetUserV3 = """
+    // ── v2/form-worksheet.user.txt ──────────────────────────────────────────
+    private const string FormWorksheetUserV2 = """
         WORKSHEET CONTEXT:
         {{DATA}}
 
@@ -881,7 +881,7 @@ Return only valid JSON.
         - Return valid plain JSON only.
         """;
 
-    private const string FormWorksheetMetadataV3 = """
+    private const string FormWorksheetMetadataV2 = """
         {
           "DATA": "Serialized JSON payload containing form metadata, CHEFS fields, Unity core fields, the current mapping, form schema, and custom fields from worksheets currently linked to the form version."
         }

From c23ed26d0dad19cc34eb4c450f7e5d0f5b0d596b Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Fri, 24 Jul 2026 10:28:16 -0700
Subject: [PATCH 23/40] AB#33787 - Updated Markdig.Signed package

---
 .../Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj b/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj
index 16cfdb0d57..8e9a68da48 100644
--- a/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Theme.UX2/src/Unity.Theme.UX2/Unity.AspNetCore.Mvc.UI.Theme.UX2.csproj
@@ -27,7 +27,7 @@
          has pointed users to the prerelease line for this exact issue for 2+ years; move to the first
          stable HtmlSanitizer release that depends on AngleSharp >= 1.5 once one ships. -->
     <PackageReference Include="HtmlSanitizer" Version="9.1.968-beta" />
-    <PackageReference Include="Markdig.Signed" Version="0.44.0" />
+    <PackageReference Include="Markdig.Signed" Version="1.3.2" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="Volo.Abp.AspNetCore.Mvc.UI.MultiTenancy" Version="10.5.0" />

From ad0562e7116774033fee02622e156d043b956201 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Fri, 24 Jul 2026 10:48:02 -0700
Subject: [PATCH 24/40] AB#33787 - Updated test libs

---
 .../Unity.Flex.Application.Tests.csproj                     | 4 ++--
 .../test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj     | 6 +++---
 .../test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj   | 4 ++--
 .../Unity.Identity.Web.Tests.csproj                         | 4 ++--
 .../Unity.Notifications.Application.Tests.csproj            | 4 ++--
 .../Unity.Notifications.Domain.Tests.csproj                 | 4 ++--
 .../Unity.Notifications.EntityFrameworkCore.Tests.csproj    | 4 ++--
 .../Unity.Notifications.TestBase.csproj                     | 6 +++---
 .../Unity.Payments.Application.Tests.csproj                 | 4 ++--
 .../Unity.Payments.TestBase/Unity.Payments.TestBase.csproj  | 6 +++---
 .../Unity.Reporting.Application.Tests.csproj                | 4 ++--
 .../Unity.Reporting.TestBase.csproj                         | 6 +++---
 .../Unity.TenantManagement.Application.Tests.csproj         | 6 +++---
 .../Unity.TenantManagement.EntityFrameworkCore.Tests.csproj | 4 ++--
 .../Unity.TenantManagement.TestBase.csproj                  | 6 +++---
 .../Unity.AspNetCore.Mvc.UI.Theme.UX2.Tests.csproj          | 4 ++--
 .../Unity.GrantManager.Application.Tests.csproj             | 4 ++--
 .../Unity.GrantManager.Domain.Tests.csproj                  | 4 ++--
 .../Unity.GrantManager.EntityFrameworkCore.Tests.csproj     | 4 ++--
 .../Unity.GrantManager.TestBase.csproj                      | 6 +++---
 .../Unity.GrantManager.Web.Tests.csproj                     | 4 ++--
 21 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
index 7002d03d83..16ef810103 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -15,7 +15,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
 	  <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
 	  <!-- Explicit references to fix vulnerable transitive dependency. -->
     <!-- Remove the SQLitePCLRaw pin once EF Core's Sqlite provider moves to SQLitePCLRaw.bundle_e_sqlite3 >= 3.x. -->
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
index ecab7e18f3..840463a334 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.TestBase/Unity.Flex.TestBase.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -10,8 +10,8 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="NSubstitute" Version="5.3.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="NSubstitute" Version="6.0.0" />
     <PackageReference Include="NSubstitute.Analyzers.CSharp" Version="1.0.17">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
diff --git a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
index 865c27d8c9..dac96e2ab9 100644
--- a/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Web.Tests/Unity.Flex.Web.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
     <TargetFramework>net10.0</TargetFramework>
@@ -15,7 +15,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Identity.Web/test/Unity.Identity.Web.Tests/Unity.Identity.Web.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Identity.Web/test/Unity.Identity.Web.Tests/Unity.Identity.Web.Tests.csproj
index 22e2028137..cb31380f07 100644
--- a/applications/Unity.GrantManager/modules/Unity.Identity.Web/test/Unity.Identity.Web.Tests/Unity.Identity.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Identity.Web/test/Unity.Identity.Web.Tests/Unity.Identity.Web.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
     <TargetFramework>net10.0</TargetFramework>
@@ -10,7 +10,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
index c1379fb8e5..074a012509 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Application.Tests/Unity.Notifications.Application.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -13,7 +13,7 @@
     <ProjectReference Include="..\Unity.Notifications.Domain.Tests\Unity.Notifications.Domain.Tests.csproj" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj
index d84183d4e5..1c8aed8f6f 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.Domain.Tests/Unity.Notifications.Domain.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -12,7 +12,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <ProjectReference Include="..\Unity.Notifications.EntityFrameworkCore.Tests\Unity.Notifications.EntityFrameworkCore.Tests.csproj" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
index 67eef66cc0..11a14c5d66 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.EntityFrameworkCore.Tests/Unity.Notifications.EntityFrameworkCore.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -12,7 +12,7 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Proxies" Version="10.0.10" />
     <ProjectReference Include="..\..\src\Unity.Notifications.EntityFrameworkCore\Unity.Notifications.EntityFrameworkCore.csproj" />
     <ProjectReference Include="..\Unity.Notifications.TestBase\Unity.Notifications.TestBase.csproj" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
index c091269834..46461eb287 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/test/Unity.Notifications.TestBase/Unity.Notifications.TestBase.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -11,8 +11,8 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="NSubstitute" Version="5.3.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="NSubstitute" Version="6.0.0" />
     <PackageReference Include="NSubstitute.Analyzers.CSharp" Version="1.0.17">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
index 90a6883084..5fae67c71e 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.Application.Tests/Unity.Payments.Application.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -15,7 +15,7 @@
     <ProjectReference Include="..\Unity.Payments.TestBase\Unity.Payments.TestBase.csproj" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.5.0" />
     <!-- Explicit references to fix vulnerable transitive dependency. -->
     <!-- Remove the SQLitePCLRaw pin once EF Core's Sqlite provider moves to SQLitePCLRaw.bundle_e_sqlite3 >= 3.x. -->
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
index 92646dcaf4..929c1d8534 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/test/Unity.Payments.TestBase/Unity.Payments.TestBase.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -11,8 +11,8 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="NSubstitute" Version="5.3.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="NSubstitute" Version="6.0.0" />
     <PackageReference Include="NSubstitute.Analyzers.CSharp" Version="1.0.17">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj
index 86a824bc4c..401ab64c45 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.Application.Tests/Unity.Reporting.Application.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -12,7 +12,7 @@
     <ProjectReference Include="..\..\src\Unity.Reporting.Application\Unity.Reporting.Application.csproj" />
     <ProjectReference Include="..\Unity.Reporting.TestBase\Unity.Reporting.TestBase.csproj" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
index 96f5c71afd..b3d4492f8b 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/test/Unity.Reporting.TestBase/Unity.Reporting.TestBase.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -9,8 +9,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="NSubstitute" Version="5.3.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="NSubstitute" Version="6.0.0" />
     <PackageReference Include="NSubstitute.Analyzers.CSharp" Version="1.0.17">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.Application.Tests/Unity.TenantManagement.Application.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.Application.Tests/Unity.TenantManagement.Application.Tests.csproj
index 2f13c04175..c0bb2ab2ec 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.Application.Tests/Unity.TenantManagement.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.Application.Tests/Unity.TenantManagement.Application.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup><LangVersion>latest</LangVersion>
     <TargetFramework>net10.0</TargetFramework>
@@ -21,8 +21,8 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="NSubstitute" Version="5.3.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="NSubstitute" Version="6.0.0" />
     <PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.5.0" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
index e69e12d938..f63f08c8ef 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.EntityFrameworkCore.Tests/Unity.TenantManagement.EntityFrameworkCore.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup><LangVersion>latest</LangVersion>
     <TargetFramework>net10.0</TargetFramework>
@@ -24,7 +24,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Proxies" Version="10.0.10" />
     <PackageReference Include="Volo.Abp.TenantManagement.EntityFrameworkCore" Version="10.5.0" />
   </ItemGroup>
diff --git a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj
index f1e1c2a9bc..378124ba32 100644
--- a/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.TenantManagement/test/Unity.TenantManagement.TestBase/Unity.TenantManagement.TestBase.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup><LangVersion>latest</LangVersion>
     <TargetFramework>net10.0</TargetFramework>
@@ -15,8 +15,8 @@
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.10" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="NSubstitute" Version="5.3.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="NSubstitute" Version="6.0.0" />
     <PackageReference Include="Shouldly" Version="4.3.0" />
     <PackageReference Include="Volo.Abp.Autofac" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/modules/Unity.Theme.UX2/test/Unity.Theme.UX2.Tests/Unity.AspNetCore.Mvc.UI.Theme.UX2.Tests.csproj b/applications/Unity.GrantManager/modules/Unity.Theme.UX2/test/Unity.Theme.UX2.Tests/Unity.AspNetCore.Mvc.UI.Theme.UX2.Tests.csproj
index 22e2028137..cb31380f07 100644
--- a/applications/Unity.GrantManager/modules/Unity.Theme.UX2/test/Unity.Theme.UX2.Tests/Unity.AspNetCore.Mvc.UI.Theme.UX2.Tests.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Theme.UX2/test/Unity.Theme.UX2.Tests/Unity.AspNetCore.Mvc.UI.Theme.UX2.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
     <TargetFramework>net10.0</TargetFramework>
@@ -10,7 +10,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj
index f64f768ab6..095aadbbb0 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/Unity.GrantManager.Application.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -20,7 +20,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Volo.Abp.BackgroundWorkers.Quartz" Version="10.5.0" />
   </ItemGroup>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
index 5bf9a91957..153f91e08e 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Domain.Tests/Unity.GrantManager.Domain.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -13,7 +13,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
   </ItemGroup>
 
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
index bd979db04e..75ccae6a48 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.EntityFrameworkCore.Tests/Unity.GrantManager.EntityFrameworkCore.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
 	<Import Project="..\..\common.props" />
 
@@ -22,7 +22,7 @@
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+		<PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
 	</ItemGroup>
 
 </Project>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
index 0324572e22..c3c1c6edef 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.TestBase/Unity.GrantManager.TestBase.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -23,8 +23,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
-    <PackageReference Include="NSubstitute" Version="5.3.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="NSubstitute" Version="6.0.0" />
     <PackageReference Include="NSubstitute.Analyzers.CSharp" Version="1.0.17">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
index 5e310f62cc..b0455a88f7 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Unity.GrantManager.Web.Tests.csproj
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\common.props" />
 
@@ -22,7 +22,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="HtmlAgilityPack" Version="1.12.4" />
     <PackageReference Include="Npgsql" Version="10.0.3" />
     <PackageReference Include="Volo.Abp.AspNetCore.Authentication.OpenIdConnect" Version="10.5.0" />

From d80da675c0385a176898f418d947648cf5efefa2 Mon Sep 17 00:00:00 2001
From: JamesPasta <james.pasta@gov.bc.ca>
Date: Fri, 24 Jul 2026 11:51:27 -0700
Subject: [PATCH 25/40] 
 bugfix/AB#33848-FixRolesAndAdjustColumnSizeForEmailCancel

---
 .../Shared/Components/EmailHistoryWidget/EmailHistory.css    | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailHistoryWidget/EmailHistory.css b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailHistoryWidget/EmailHistory.css
index c98d1ae801..1a95daec66 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailHistoryWidget/EmailHistory.css
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailHistoryWidget/EmailHistory.css
@@ -30,7 +30,6 @@
 /* Force fixed table layout to prevent column expansion */
 #EmailHistoryTable {
     width: 100% !important;
-    table-layout: fixed !important;
     box-sizing: border-box;
 }
 
@@ -51,6 +50,10 @@
     white-space: normal;
 }
 
+.btn-delete-delayed {
+    width: 30px !important;
+}
+
 @media (max-height: 768px) {
     .dt-scroll-body {
         max-height: inherit !important;

From 8db48bdd281c13171acb2119fefd234c084236e0 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Fri, 24 Jul 2026 12:58:02 -0700
Subject: [PATCH 26/40] AB#33787 - Remove RestSharp in favor of
 IResilientHttpRequest

---
 ...Notifications.Application.Contracts.csproj |   1 -
 .../ApplicationFormSycnronizationService.cs   | 114 +++++++-----------
 .../ConfigureIntakeClientOptions.cs           |  22 ----
 .../GrantManagerApplicationModule.cs          |  31 -----
 .../Intakes/IntakeClientOptions.cs            |  16 ---
 .../Unity.GrantManager.Application.csproj     |   1 -
 .../Unity.GrantManager.HttpApi.csproj         |   1 -
 7 files changed, 43 insertions(+), 143 deletions(-)
 delete mode 100644 applications/Unity.GrantManager/src/Unity.GrantManager.Application/ConfigureIntakeClientOptions.cs
 delete mode 100644 applications/Unity.GrantManager/src/Unity.GrantManager.Application/Intakes/IntakeClientOptions.cs

diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj
index 6cbf23c23a..cb37cfb67e 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application.Contracts/Unity.Notifications.Application.Contracts.csproj
@@ -10,7 +10,6 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
-    <PackageReference Include="RestSharp" Version="112.1.0" />
     <PackageReference Include="System.Text.Json" Version="10.0.10" />
     <PackageReference Include="Volo.Abp.Ddd.Application.Contracts" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.Authorization" Version="10.5.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormSycnronizationService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormSycnronizationService.cs
index 6a454f0345..e759648a5a 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormSycnronizationService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormSycnronizationService.cs
@@ -1,7 +1,5 @@
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json.Linq;
-using RestSharp;
-using RestSharp.Authenticators;
 using System;
 using System.Collections.Generic;
 using System.Linq;
@@ -12,7 +10,9 @@
 using Unity.GrantManager.Applications;
 using Unity.GrantManager.Forms;
 using Unity.GrantManager.Intakes;
+using Unity.GrantManager.Integrations;
 using Unity.GrantManager.Integrations.Chefs;
+using Unity.Modules.Shared.Http;
 using Volo.Abp;
 using Volo.Abp.Application.Dtos;
 using Volo.Abp.Application.Services;
@@ -27,13 +27,13 @@ namespace Unity.GrantManager.ApplicationForms
 {
 
     [RemoteService(false)]
-    public class ApplicationFormSycnronizationService :
+    public class ApplicationFormSycnronizationService(IRepository<ApplicationForm, Guid> repository) :
     CrudAppService<
         ApplicationForm,
         ApplicationFormDto,
         Guid,
         PagedAndSortedResultRequestDto,
-        CreateUpdateApplicationFormDto>,
+        CreateUpdateApplicationFormDto>(repository),
         IApplicationFormSycnronizationService
     {
         private static readonly JsonSerializerOptions _submissionSerializerOptions = new()
@@ -44,45 +44,23 @@ public class ApplicationFormSycnronizationService :
             DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
         };
 
-        private readonly IStringEncryptionService _stringEncryptionService;
-        private readonly IApplicationFormRepository _applicationFormRepository;
-        private readonly ICurrentTenant _currentTenant;
-        private readonly IApplicationFormSubmissionRepository _applicationFormSubmissionRepository;
-        private readonly IApplicationFormVersionAppService _applicationFormVersionAppService;
-        private readonly IFormsApiService _formsApiService;
-        private readonly IIntakeFormSubmissionManager _intakeFormSubmissionManager;
-        private readonly INotificationsAppService _notificationsAppService;
+        // Collaborators are resolved lazily via ABP's LazyServiceProvider to keep the
+        // constructor within SonarQube's 7-parameter limit (S107). CurrentTenant, Logger,
+        // and ObjectMapper come from the ApplicationService base class.
+        private IStringEncryptionService StringEncryptionService => LazyServiceProvider.LazyGetRequiredService<IStringEncryptionService>();
+        private IApplicationFormRepository ApplicationFormRepository => LazyServiceProvider.LazyGetRequiredService<IApplicationFormRepository>();
+        private IApplicationFormSubmissionRepository ApplicationFormSubmissionRepository => LazyServiceProvider.LazyGetRequiredService<IApplicationFormSubmissionRepository>();
+        private IApplicationFormVersionAppService ApplicationFormVersionAppService => LazyServiceProvider.LazyGetRequiredService<IApplicationFormVersionAppService>();
+        private IFormsApiService FormsApiService => LazyServiceProvider.LazyGetRequiredService<IFormsApiService>();
+        private IIntakeFormSubmissionManager IntakeFormSubmissionManager => LazyServiceProvider.LazyGetRequiredService<IIntakeFormSubmissionManager>();
+        private INotificationsAppService NotificationsAppService => LazyServiceProvider.LazyGetRequiredService<INotificationsAppService>();
+        private IResilientHttpRequest ResilientHttpRequest => LazyServiceProvider.LazyGetRequiredService<IResilientHttpRequest>();
+        private IEndpointManagementAppService EndpointManagementAppService => LazyServiceProvider.LazyGetRequiredService<IEndpointManagementAppService>();
+        private ITenantRepository TenantRepository => LazyServiceProvider.LazyGetRequiredService<ITenantRepository>();
+
         private List<Fact> _facts = [];
-        private readonly RestClient _intakeClient;
-        private readonly ITenantRepository _tenantRepository;
         public List<ApplicationFormDto>? ApplicationFormDtoList { get; set; }
         public HashSet<string> FormVersionsInitializedVersionHash { get; set; } = [];
-      
-        public ApplicationFormSycnronizationService(
-            INotificationsAppService notificationsAppService,
-            ICurrentTenant currentTenant,
-            IRepository<ApplicationForm, Guid> repository,
-            ITenantRepository tenantRepository,
-            RestClient restClient,
-            IStringEncryptionService stringEncryptionService,
-            IApplicationFormRepository applicationFormRepository,
-            IApplicationFormSubmissionRepository applicationFormSubmissionRepository,
-            IApplicationFormVersionAppService applicationFormVersionAppService,
-            IFormsApiService formsApiService,
-            IIntakeFormSubmissionManager intakeFormSubmissionManager)
-            : base(repository)
-        {
-            _currentTenant = currentTenant;
-            _tenantRepository = tenantRepository;
-            _intakeClient = restClient;
-            _stringEncryptionService = stringEncryptionService;
-            _applicationFormRepository = applicationFormRepository;
-            _formsApiService = formsApiService;
-            _applicationFormSubmissionRepository = applicationFormSubmissionRepository;
-            _applicationFormVersionAppService = applicationFormVersionAppService;
-            _intakeFormSubmissionManager = intakeFormSubmissionManager;
-            _notificationsAppService = notificationsAppService;
-        }
 
         private async Task SynchronizeFormSubmissions(HashSet<string> missingSubmissions, ApplicationFormDto applicationFormDto)
         {
@@ -108,7 +86,7 @@ private async Task ProcessSingleSubmission(string submissionGuid, ApplicationFor
                 return;
             }
 
-            JObject? submissionData = await _formsApiService.GetSubmissionDataAsync(chefsFormId, chefsSubmissionId);
+            JObject? submissionData = await FormsApiService.GetSubmissionDataAsync(chefsFormId, chefsSubmissionId);
             if (submissionData == null)
             {
                 Logger.LogInformation("ApplicationFormSycnronizationService->SynchronizeFormSubmissions submissionData is null");
@@ -149,7 +127,7 @@ private int GetVersionFromSubmissionData(JObject submissionData)
 
         private async Task ProcessFormVersion(string formVersionId, int version, Guid chefsFormId, ApplicationFormDto applicationFormDto, JObject submissionData)
         {
-            bool formVersionExists = await _applicationFormVersionAppService.FormVersionExists(formVersionId);
+            bool formVersionExists = await ApplicationFormVersionAppService.FormVersionExists(formVersionId);
             string formId = chefsFormId.ToString();
 
             if (!formVersionExists && Guid.TryParse(applicationFormDto.ChefsApplicationFormGuid, out Guid applicationFormIdGuid))
@@ -167,14 +145,14 @@ private async Task InitializeFormVersion(string formId, int version, Guid applic
             AddFact("Form Version did NOT exist in Unity: ", $"{version}");
             AddFact("Version Created: ", "Please Fill in Mapping");
             bool published = false;
-            await _applicationFormVersionAppService.TryInitializeApplicationFormVersion(formId, version, applicationFormIdGuid, formVersionId, published);
+            await ApplicationFormVersionAppService.TryInitializeApplicationFormVersion(formId, version, applicationFormIdGuid, formVersionId, published);
             FormVersionsInitializedVersionHash.Add(formVersionId);
         }
 
         private async Task ProcessSubmission(ApplicationFormDto applicationFormDto, JObject submissionData, int version)
         {
             ApplicationForm applicationForm = ObjectMapper.Map<ApplicationFormDto, ApplicationForm>(applicationFormDto);
-            var result = await _intakeFormSubmissionManager.ProcessFormSubmissionAsync(applicationForm, submissionData);
+            var result = await IntakeFormSubmissionManager.ProcessFormSubmissionAsync(applicationForm, submissionData);
             AddFact("Synchronizing Data - Form Version: ", $"{version} Unity Application ID: {result}");
         }
 
@@ -245,7 +223,7 @@ private async Task ProcessSubmission(ApplicationFormDto applicationFormDto, JObj
                 string activityTitle = "Review Missed Chefs Submissions " + tenantName;
                 string activitySubtitle = "Environment: " + envInfo;
                 
-                await _notificationsAppService.PostToNotificationsAsync(activityTitle, activitySubtitle, _facts);
+                await NotificationsAppService.PostToNotificationsAsync(activityTitle, activitySubtitle, _facts);
             }
             return (missingSubmissions ?? [], missingSubmissionsReportBuilder.ToString());
         }
@@ -253,14 +231,14 @@ private async Task ProcessSubmission(ApplicationFormDto applicationFormDto, JObj
         private async Task<string?> GetTenantNameAsync()
         {
             string tenantName = "";
-            if (_currentTenant != null && !string.IsNullOrEmpty(_currentTenant.Name))
+            if (CurrentTenant != null && !string.IsNullOrEmpty(CurrentTenant.Name))
             {
-                tenantName = " -- Tenant: " + _currentTenant.Name;
-            } else if (_currentTenant != null && _currentTenant.Id != null)
+                tenantName = " -- Tenant: " + CurrentTenant.Name;
+            } else if (CurrentTenant != null && CurrentTenant.Id != null)
             {
                 // Lookup the tenant name
-                Tenant? tenant = await _tenantRepository.FindAsync(_currentTenant.Id.Value);
-                tenantName = tenant != null ? " -- Tenant: " + tenant.Name : " -- Tenant: " + _currentTenant.Id;
+                Tenant? tenant = await TenantRepository.FindAsync(CurrentTenant.Id.Value);
+                tenantName = tenant != null ? " -- Tenant: " + tenant.Name : " -- Tenant: " + CurrentTenant.Id;
             }   
 
             return tenantName;
@@ -268,14 +246,14 @@ private async Task ProcessSubmission(ApplicationFormDto applicationFormDto, JObj
 
         public HashSet<string> GetSubmissionsByForm(Guid applicationFormId)
         {
-            IQueryable<ApplicationFormSubmission> queryableApplicationFormSubmissions = _applicationFormSubmissionRepository.GetQueryableAsync().Result;
+            IQueryable<ApplicationFormSubmission> queryableApplicationFormSubmissions = ApplicationFormSubmissionRepository.GetQueryableAsync().Result;
             var formSubmissionGuids = queryableApplicationFormSubmissions.Where(x => x.ApplicationFormId.Equals(applicationFormId)).Select(o => o.ChefsSubmissionGuid).ToHashSet();
             return formSubmissionGuids;
         }
 
         public async Task<IList<ApplicationFormDto>> GetConnectedApplicationFormsAsync()
         {
-            IQueryable<ApplicationForm> queryableApplicationForms = _applicationFormRepository.GetQueryableAsync().Result;
+            IQueryable<ApplicationForm> queryableApplicationForms = ApplicationFormRepository.GetQueryableAsync().Result;
             var forms = queryableApplicationForms.Where(x => (x.ApiKey ?? string.Empty) != string.Empty).ToList();
             return await Task.FromResult<IList<ApplicationFormDto>>(ObjectMapper.Map<List<ApplicationForm>, List<ApplicationFormDto>>([.. forms]));
         }
@@ -306,35 +284,29 @@ public async Task<HashSet<string>> GetChefsSubmissions(ApplicationFormDto applic
                 throw new ApiException(400, "Missing required parameter 'formId' when calling ListFormSubmissions");
             }
 
-            string requestUrl = $"/forms/{applicationForm.ChefsApplicationFormGuid}/submissions";
+            string chefsApi = await EndpointManagementAppService.GetChefsApiBaseUrlAsync();
+            string requestUrl = $"{chefsApi}/forms/{applicationForm.ChefsApplicationFormGuid}/submissions";
             if (!string.IsNullOrEmpty(queryString))
             {
                 requestUrl += queryString;
             }
+            requestUrl += (requestUrl.Contains('?') ? "&" : "?") + "deleted=false&filterformSubmissionStatusCode=true";
 
-            var restRequest = new RestRequest(requestUrl, Method.Get)
-            {
-                Authenticator = new HttpBasicAuthenticator(applicationForm.ChefsApplicationFormGuid!, _stringEncryptionService.Decrypt(applicationForm.ApiKey!) ?? string.Empty)
-            };
+            var decryptedApiKey = StringEncryptionService.Decrypt(applicationForm.ApiKey!) ?? string.Empty;
+            var response = await ResilientHttpRequest.HttpAsync(
+                HttpMethod.Get,
+                requestUrl,
+                basicAuth: (applicationForm.ChefsApplicationFormGuid!, decryptedApiKey));
 
-            restRequest.AddParameter("deleted", "false");
-            restRequest.AddParameter("filterformSubmissionStatusCode", "true");
+            string content = await response.Content.ReadAsStringAsync();
 
-            var response = await _intakeClient.GetAsync(restRequest);
-            string errorMessageBase = "Error calling ListFormSubmissions: ";
-            string errorMessage = (int)response.StatusCode switch
+            if (!response.IsSuccessStatusCode)
             {
-                >= 400 => errorMessageBase + response.Content,
-                0 => errorMessageBase + response.ErrorMessage,
-                _ => ""
-            };
-
-            if (!string.IsNullOrEmpty(errorMessage))
-            {                
-                throw new ApiException((int)response.StatusCode, errorMessage, response.ErrorMessage ?? $"{response.StatusCode}");
+                string errorMessage = "Error calling ListFormSubmissions: " + content;
+                throw new ApiException((int)response.StatusCode, errorMessage, response.ReasonPhrase ?? $"{response.StatusCode}");
             }
 
-            List<FormSubmissionSummaryDto>? jsonResponse = JsonSerializer.Deserialize<List<FormSubmissionSummaryDto>>(response.Content ?? string.Empty, _submissionSerializerOptions);
+            List<FormSubmissionSummaryDto>? jsonResponse = JsonSerializer.Deserialize<List<FormSubmissionSummaryDto>>(content, _submissionSerializerOptions);
             return jsonResponse;
         }
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ConfigureIntakeClientOptions.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ConfigureIntakeClientOptions.cs
deleted file mode 100644
index ddaecd4023..0000000000
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ConfigureIntakeClientOptions.cs
+++ /dev/null
@@ -1,22 +0,0 @@
-using Microsoft.Extensions.Configuration;
-using Unity.GrantManager.Intake;
-using Unity.GrantManager.Integrations;
-using System.Threading;
-using System.Threading.Tasks;
-
-namespace Unity.GrantManager;
-
-public class ConfigureIntakeClientOptions(
-                                        IConfiguration configuration,
-                                        IEndpointManagementAppService endpointManagementAppService)
-{
-    public async Task ConfigureAsync(IntakeClientOptions options, CancellationToken cancellationToken = default)
-    {
-        var intakeBaseUri = await endpointManagementAppService.GetUgmUrlByKeyNameAsync(DynamicUrlKeyNames.INTAKE_API_BASE);
-        options.BaseUri = intakeBaseUri;
-        options.BearerTokenPlaceholder = configuration["Intake:BearerTokenPlaceholder"] ?? "";
-        options.UseBearerToken = configuration.GetValue<bool>("Intake:UseBearerToken");
-        options.AllowUnregisteredVersions = configuration.GetValue<bool>("Intake:AllowUnregisteredVersions");
-    }
-}
-
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantManagerApplicationModule.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantManagerApplicationModule.cs
index d131c10dac..03a3710eaa 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantManagerApplicationModule.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantManagerApplicationModule.cs
@@ -3,14 +3,11 @@
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Options;
-using RestSharp;
-using RestSharp.Serializers.Json;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using Unity.GrantManager.Assessments;
 using Unity.GrantManager.Attachments;
 using Unity.GrantManager.Events;
-using Unity.GrantManager.Intake;
 using Unity.GrantManager.Integrations.Css;
 using Unity.TenantManagement;
 using Volo.Abp.Mapperly;
@@ -198,34 +195,6 @@ public override void ConfigureServices(ServiceConfigurationContext context)
 
         context.Services.AddScoped<IZoneChecker, ZoneChecker>();
 
-        context.Services.AddSingleton(provider =>
-        {
-            var options = (provider.GetService<IOptions<IntakeClientOptions>>()?.Value) ?? throw new InvalidOperationException("IntakeClientOptions not configured.");
-            if (options.BaseUri == string.Empty)
-            {
-                options.BaseUri = "https://submit.digital.gov.bc.ca/app/api/v1";
-            }
-
-            var restOptions = options != null
-                ? new RestClientOptions(options.BaseUri)
-                {
-                    FailOnDeserializationError = true,
-                    ThrowOnDeserializationError = true
-                }
-                : new RestClientOptions();
-
-            return new RestClient(
-                restOptions,
-                configureSerialization: s => s.UseSystemTextJson(new JsonSerializerOptions
-                {
-                    WriteIndented = true,
-                    PropertyNameCaseInsensitive = true,
-                    ReadCommentHandling = JsonCommentHandling.Skip,
-                    DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
-                })
-            );
-        });
-
         // Max paging limits
         ExtensibleLimitedResultRequestDto.DefaultMaxResultCount = int.MaxValue;
         ExtensibleLimitedResultRequestDto.MaxMaxResultCount = int.MaxValue;
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Intakes/IntakeClientOptions.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Intakes/IntakeClientOptions.cs
deleted file mode 100644
index 7ccf6695b3..0000000000
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Intakes/IntakeClientOptions.cs
+++ /dev/null
@@ -1,16 +0,0 @@
-namespace Unity.GrantManager.Intake;
-
-public class IntakeClientOptions
-{
-    public string BaseUri { get; set; } = string.Empty;
-
-    public string FormId { get; set; } = string.Empty;
-
-    public string ApiKey { get; set; } = string.Empty;
-
-    public string BearerTokenPlaceholder { get; set; } = string.Empty;
-
-    public bool UseBearerToken { get; set; }
-
-    public bool AllowUnregisteredVersions { get; set; }
-}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
index d73a90573d..9c3ca77020 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Unity.GrantManager.Application.csproj
@@ -42,7 +42,6 @@
     <PackageReference Include="NPOI" Version="2.7.5" />
     <PackageReference Include="PdfPig" Version="0.1.15" />
     <PackageReference Include="Quartz.Serialization.Json" Version="3.18.2" />
-    <PackageReference Include="RestSharp" Version="112.1.0" />
     <PackageReference Include="Riok.Mapperly" Version="4.3.1" />
 
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
index c8ef1682da..ae807c1d10 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Unity.GrantManager.HttpApi.csproj
@@ -16,7 +16,6 @@
 
   <ItemGroup>
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
-    <PackageReference Include="RestSharp" Version="112.1.0" />    
     <PackageReference Include="Volo.Abp.Identity.HttpApi" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.PermissionManagement.HttpApi" Version="10.5.0" />
     <PackageReference Include="Volo.Abp.FeatureManagement.HttpApi" Version="10.5.0" />

From 126bfa82aae2a0bbc461c33f6ba00f16dd268980 Mon Sep 17 00:00:00 2001
From: "Todosichuk, Daryl" <Daryl.Todosichuk@gov.bc.ca>
Date: Fri, 24 Jul 2026 15:18:37 -0700
Subject: [PATCH 27/40] AB#33424 Fix long running TokenCookie expiration

---
 .../src/Unity.GrantManager.Web/GrantManagerWebModule.cs         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/GrantManagerWebModule.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/GrantManagerWebModule.cs
index 3388846e2d..b4af2379fc 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/GrantManagerWebModule.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/GrantManagerWebModule.cs
@@ -199,7 +199,7 @@ public override void ConfigureServices(ServiceConfigurationContext context)
 
         Configure<AbpAntiForgeryOptions>(options =>
         {
-            options.TokenCookie.Expiration = TimeSpan.FromDays(365);
+            options.TokenCookie.Expiration = TimeSpan.FromHours(8);
             options.TokenCookie.SecurePolicy = CookieSecurePolicy.Always;
             options.TokenCookie.SameSite = SameSiteMode.Lax;
             options.TokenCookie.HttpOnly = false;

From 00ac6396a568dc8efb238b8efbe0557a08429be8 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Fri, 24 Jul 2026 16:15:28 -0700
Subject: [PATCH 28/40] AB#33787 - Migrate RabbitMQ.Client 6.8.1 to 7.2.1
 (async API)

---
 .../RabbitMQ/EmailQueueService.cs             |   8 +-
 .../RabbitMQ/PaymentQueueService.cs           |  10 +-
 .../ChannelProvider.cs                        |  19 +-
 .../ConnectionProvider.cs                     |  41 +++-
 .../Interfaces/IChannelProvider.cs            |   7 +-
 .../Interfaces/IConnectionProvider.cs         |   5 +-
 .../Interfaces/IQueueChannelProvider.cs       |   3 +-
 .../Interfaces/IQueueConsumerHandler.cs       |  10 +-
 .../Interfaces/IQueueProducer.cs              |   6 +-
 .../QueueChannelProvider.cs                   |  77 ++++---
 .../QueueConsumerHandler.cs                   |  32 +--
 .../QueueConsumerRegistratorService.cs        |  11 +-
 .../MessageBrokers.RabbitMQ/QueueProducer.cs  |  33 ++-
 .../QueueingStartupExtensions.cs              |   8 +-
 .../RabbitMQConnection.cs                     |   9 +-
 .../Unity.SharedKernel.csproj                 |   2 +-
 .../GrantsPortalAcknowledgmentPublisher.cs    |  24 +-
 .../GrantsPortalCommandConsumerService.cs     | 110 +++++----
 .../GrantsPortal/GrantsPortalOutboxWorker.cs  |  35 +--
 .../FakeChannelProvider.cs                    | 215 ++----------------
 20 files changed, 263 insertions(+), 402 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Integrations/RabbitMQ/EmailQueueService.cs b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Integrations/RabbitMQ/EmailQueueService.cs
index 6a954be51a..635e7c1034 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Integrations/RabbitMQ/EmailQueueService.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Integrations/RabbitMQ/EmailQueueService.cs
@@ -36,7 +36,7 @@ public async Task<Task> SendToEmailDelayedQueueAsync(EmailNotificationEvent emai
 
             await Task.Delay(TimeSpan.FromMilliseconds(FiveMinutesInMilliSeconds * (emailNotificationEvent.RetryAttempts + 1)));
 
-            _queueProducer.PublishMessage(message);
+            await _queueProducer.PublishMessageAsync(message);
         }
         catch (Exception ex) {
             var ExceptionMessage = ex.Message;
@@ -45,7 +45,7 @@ public async Task<Task> SendToEmailDelayedQueueAsync(EmailNotificationEvent emai
         return Task.CompletedTask;
     }
 
-    public Task SendToEmailEventQueueAsync(EmailNotificationEvent emailNotificationEvent)
+    public async Task SendToEmailEventQueueAsync(EmailNotificationEvent emailNotificationEvent)
     {
         try
         {
@@ -55,13 +55,11 @@ public Task SendToEmailEventQueueAsync(EmailNotificationEvent emailNotificationE
                 TenantId = emailNotificationEvent.TenantId ?? Guid.Empty,
                 EmailNotificationEvent = emailNotificationEvent
             };
-            _queueProducer.PublishMessage(message);
+            await _queueProducer.PublishMessageAsync(message);
         }
         catch (Exception ex) {
             var ExceptionMessage = ex.Message;
             _logger.LogError(ex, "SendToEmailEventQueueAsync Exception: {ExceptionMessage}", ExceptionMessage);
         }
-
-        return Task.CompletedTask;
     }
 }
\ No newline at end of file
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Integrations/RabbitMQ/PaymentQueueService.cs b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Integrations/RabbitMQ/PaymentQueueService.cs
index e4df693638..e644787b61 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Integrations/RabbitMQ/PaymentQueueService.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Integrations/RabbitMQ/PaymentQueueService.cs
@@ -19,15 +19,13 @@ public PaymentQueueService(
         _reconcilePaymentQueueProducer = reconcilePaymentQueueProducer;
     }
 
-    public Task SendPaymentToInvoiceQueueAsync(InvoiceMessages message)
+    public async Task SendPaymentToInvoiceQueueAsync(InvoiceMessages message)
     {
-        _invoiceQueueProducer.PublishMessage(message);
-        return Task.CompletedTask;
+        await _invoiceQueueProducer.PublishMessageAsync(message);
     }
 
-    public Task SendPaymentToReconciliationQueueAsync(ReconcilePaymentMessages message)
+    public async Task SendPaymentToReconciliationQueueAsync(ReconcilePaymentMessages message)
     {
-        _reconcilePaymentQueueProducer.PublishMessage(message);
-        return Task.CompletedTask;
+        await _reconcilePaymentQueueProducer.PublishMessageAsync(message);
     }
 }
\ No newline at end of file
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ChannelProvider.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ChannelProvider.cs
index 45b2b86846..54a2c1e379 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ChannelProvider.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ChannelProvider.cs
@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Concurrent;
 using System.Threading;
+using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 using RabbitMQ.Client;
 using Unity.Modules.Shared.MessageBrokers.RabbitMQ.Interfaces;
@@ -15,16 +16,18 @@ public sealed class PooledChannelProvider(
         private readonly IConnectionProvider _connectionProvider = connectionProvider ?? throw new ArgumentNullException(nameof(connectionProvider));
         private readonly ILogger<PooledChannelProvider> _logger = logger ?? throw new ArgumentNullException(nameof(logger));
         private readonly int _maxChannels = maxChannels;
-        private readonly ConcurrentQueue<IModel> _channelPool = new();
+        private readonly ConcurrentQueue<IChannel> _channelPool = new();
         private int _currentChannelCount;
         private bool _disposed;
 
         private const int DefaultMaxChannels = 1000;
 
         /// <summary>
-        /// Get a channel from the pool or create a new one if under max limit
+        /// Get a channel from the pool or create a new one if under max limit.
+        /// Channels are created with publisher confirmations enabled so producers can
+        /// rely on <see cref="IChannel.BasicPublishAsync"/> awaiting broker confirmation.
         /// </summary>
-        public IModel? GetChannel()
+        public async Task<IChannel?> GetChannelAsync()
         {
             ThrowIfDisposed();
 
@@ -40,10 +43,11 @@ public sealed class PooledChannelProvider(
             {
                 try
                 {
-                    var connection = _connectionProvider.GetConnection();
+                    var connection = await _connectionProvider.GetConnectionAsync();
                     if (connection != null && connection.IsOpen)
                     {
-                        return connection.CreateModel();
+                        return await connection.CreateChannelAsync(
+                            new CreateChannelOptions(publisherConfirmationsEnabled: true, publisherConfirmationTrackingEnabled: true));
                     }
 
                     _logger.LogWarning("RabbitMQ connection is not open.");
@@ -67,7 +71,7 @@ public sealed class PooledChannelProvider(
         /// <summary>
         /// Return a channel to the pool
         /// </summary>
-        public void ReturnChannel(IModel channel)
+        public void ReturnChannel(IChannel channel)
         {
             if (_disposed || channel == null)
             {
@@ -82,11 +86,10 @@ public void ReturnChannel(IModel channel)
                 DisposeChannel(channel);
         }
 
-        private void DisposeChannel(IModel channel)
+        private void DisposeChannel(IChannel channel)
         {
             if (channel == null) return;
 
-            try { if (channel.IsOpen) channel.Close(); } catch (Exception ex) { _logger.LogWarning(ex, "Error closing channel."); }
             try { channel.Dispose(); } catch (Exception ex) { _logger.LogWarning(ex, "Error disposing channel."); }
 
             Interlocked.Decrement(ref _currentChannelCount);
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ConnectionProvider.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ConnectionProvider.cs
index bebc9a7531..76d2389fa5 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ConnectionProvider.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ConnectionProvider.cs
@@ -1,32 +1,33 @@
-
+
 using Microsoft.Extensions.Logging;
 using RabbitMQ.Client;
 using System;
+using System.Threading.Tasks;
 using Unity.Modules.Shared.MessageBrokers.RabbitMQ.Interfaces;
 
 namespace Unity.Modules.Shared.MessageBrokers.RabbitMQ
 {
-    public sealed class ConnectionProvider : IDisposable, IConnectionProvider
+    public sealed class ConnectionProvider : IAsyncDisposable, IDisposable, IConnectionProvider
     {
         private readonly ILogger<ConnectionProvider> _logger;
-        private readonly IAsyncConnectionFactory _connectionFactory;
+        private readonly IConnectionFactory _connectionFactory;
         private IConnection? _connection;
 
-        public ConnectionProvider(ILogger<ConnectionProvider> logger, IAsyncConnectionFactory connectionFactory)
+        public ConnectionProvider(ILogger<ConnectionProvider> logger, IConnectionFactory connectionFactory)
         {
             _logger = logger;
             _connectionFactory = connectionFactory;
         }
 
-        public void Dispose()
+        public async ValueTask DisposeAsync()
         {
             try
             {
                 if (_connection != null && _connection.IsOpen)
                 {
                     _logger.LogDebug("Closing the connection");
-                    _connection.Close();
-                    _connection.Dispose();
+                    await _connection.CloseAsync();
+                    await _connection.DisposeAsync();
                 }
             }
             catch (Exception ex)
@@ -35,21 +36,37 @@ public void Dispose()
             }
         }
 
-        public IConnection? GetConnection()
+        // Implemented alongside IAsyncDisposable so the DI container can dispose this
+        // singleton whether it is torn down synchronously or asynchronously.
+        public void Dispose()
+        {
+            try
+            {
+                _connection?.Dispose();
+            }
+            catch (Exception ex)
+            {
+                _logger.LogCritical(ex, "Cannot dispose RabbitMq channel or connection");
+            }
+        }
+
+        public async Task<IConnection?> GetConnectionAsync()
         {
             if (_connection == null || !_connection.IsOpen)
             {
                 _logger.LogDebug("Open RabbitMQ connection");
                 try
                 {
-                    _connection = _connectionFactory.CreateConnection();
-                } catch (Exception ex) {
+                    _connection = await _connectionFactory.CreateConnectionAsync();
+                }
+                catch (Exception ex)
+                {
                     var ExceptionMessage = ex.Message;
                     _logger.LogError(ex, "ConnectionProvider - Exception: {ConnectionProvider}", ExceptionMessage);
-                }                
+                }
             }
 
             return _connection;
         }
     }
-}
\ No newline at end of file
+}
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IChannelProvider.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IChannelProvider.cs
index a57ca8acfb..075245012e 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IChannelProvider.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IChannelProvider.cs
@@ -1,11 +1,12 @@
-using RabbitMQ.Client;
+using RabbitMQ.Client;
 using System;
+using System.Threading.Tasks;
 
 namespace Unity.Modules.Shared.MessageBrokers.RabbitMQ.Interfaces
 {
     public interface IChannelProvider : IDisposable
     {
-        IModel? GetChannel();
-        void ReturnChannel(IModel channel);
+        Task<IChannel?> GetChannelAsync();
+        void ReturnChannel(IChannel channel);
     }
 }
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IConnectionProvider.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IConnectionProvider.cs
index d447bd328f..ce82cfedd3 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IConnectionProvider.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IConnectionProvider.cs
@@ -1,9 +1,10 @@
-using RabbitMQ.Client;
+using RabbitMQ.Client;
+using System.Threading.Tasks;
 
 namespace Unity.Modules.Shared.MessageBrokers.RabbitMQ.Interfaces
 {
     public interface IConnectionProvider
     {
-        IConnection? GetConnection();
+        Task<IConnection?> GetConnectionAsync();
     }
 }
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueChannelProvider.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueChannelProvider.cs
index 8b0ca37b55..7868cce3a6 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueChannelProvider.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueChannelProvider.cs
@@ -1,4 +1,5 @@
 using System;
+using System.Threading.Tasks;
 using RabbitMQ.Client;
 
 #pragma warning disable CA1005 // Avoid excessive parameters on generic types
@@ -13,7 +14,7 @@ public interface IQueueChannelProvider<TQueueMessage> : IDisposable where TQueue
         /// <summary>
         /// Gets a channel for publishing or consuming messages.
         /// </summary>
-        IModel GetChannel();
+        Task<IChannel> GetChannelAsync();
     }
 }
 #pragma warning restore CA1005 // Avoid excessive parameters on generic types
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueConsumerHandler.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueConsumerHandler.cs
index d58d743d7d..e3fd333eec 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueConsumerHandler.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueConsumerHandler.cs
@@ -1,11 +1,13 @@
-namespace Unity.Modules.Shared.MessageBrokers.RabbitMQ.Interfaces
+using System.Threading.Tasks;
+
+namespace Unity.Modules.Shared.MessageBrokers.RabbitMQ.Interfaces
 {
 #pragma warning disable S2326
     public interface IQueueConsumerHandler<TMessageConsumer, TQueueMessage> where TMessageConsumer : IQueueConsumer<TQueueMessage> where TQueueMessage : class, IQueueMessage
     {
-        void RegisterQueueConsumer();
+        Task RegisterQueueConsumerAsync();
 
-        void CancelQueueConsumer();
+        Task CancelQueueConsumerAsync();
     }
 #pragma warning restore S2326
-}
\ No newline at end of file
+}
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueProducer.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueProducer.cs
index d389f2d34f..5aa66197ac 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueProducer.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueProducer.cs
@@ -1,7 +1,9 @@
-namespace Unity.Modules.Shared.MessageBrokers.RabbitMQ.Interfaces
+using System.Threading.Tasks;
+
+namespace Unity.Modules.Shared.MessageBrokers.RabbitMQ.Interfaces
 {
     public interface IQueueProducer<in TQueueMessage> where TQueueMessage : IQueueMessage
     {
-        void PublishMessage(TQueueMessage message);
+        Task PublishMessageAsync(TQueueMessage message);
     }
 }
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueChannelProvider.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueChannelProvider.cs
index 1eda5b9327..9be537782d 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueChannelProvider.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueChannelProvider.cs
@@ -1,7 +1,8 @@
-using System;
+using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Threading;
+using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 using RabbitMQ.Client;
 using Unity.Modules.Shared.MessageBrokers.RabbitMQ.Constants;
@@ -14,14 +15,14 @@ public sealed class PooledQueueChannelProvider<TQueueMessage> : IQueueChannelPro
     {
         private readonly IChannelProvider _channelProvider;
         private readonly ILogger<PooledQueueChannelProvider<TQueueMessage>> _logger;
-        private readonly ConcurrentQueue<IModel> _channelPool = new();
+        private readonly ConcurrentQueue<IChannel> _channelPool = new();
         private readonly SemaphoreSlim _channelSemaphore = new(MaxChannels, MaxChannels);
         private readonly Timer _cleanupTimer;
         private readonly string _queueName = typeof(TQueueMessage).Name;
 
         private volatile bool _disposed;
         private volatile bool _queueDeclared;
-        private readonly object _queueDeclareLock = new();
+        private readonly SemaphoreSlim _queueDeclareLock = new(1, 1);
 
         private const int MaxChannels = 5000;
         private readonly TimeSpan _channelWaitTimeout = TimeSpan.FromSeconds(10);
@@ -37,11 +38,11 @@ public PooledQueueChannelProvider(
                 TimeSpan.FromMinutes(1), TimeSpan.FromMinutes(1));
         }
 
-        public IModel GetChannel()
+        public async Task<IChannel> GetChannelAsync()
         {
             ObjectDisposedException.ThrowIf(_disposed, nameof(PooledQueueChannelProvider<TQueueMessage>));
 
-            if (!_channelSemaphore.Wait(_channelWaitTimeout))
+            if (!await _channelSemaphore.WaitAsync(_channelWaitTimeout))
             {
                 throw new TimeoutException(
                     $"Unable to acquire a channel for queue {_queueName} within {_channelWaitTimeout.TotalSeconds} seconds.");
@@ -59,8 +60,8 @@ public IModel GetChannel()
                 }
 
                 // Create new channel
-                var channel = _channelProvider.GetChannel() ?? throw new InvalidOperationException("Channel cannot be null.");
-                EnsureQueueDeclared(channel);
+                var channel = await _channelProvider.GetChannelAsync() ?? throw new InvalidOperationException("Channel cannot be null.");
+                await EnsureQueueDeclaredAsync(channel);
                 return channel;
             }
             catch
@@ -70,7 +71,7 @@ public IModel GetChannel()
             }
         }
 
-        public void ReturnChannel(IModel channel)
+        public void ReturnChannel(IChannel channel)
         {
             if (channel?.IsOpen == true && !_disposed)
             {
@@ -92,28 +93,30 @@ public void ReturnChannel(IModel channel)
             }
         }
 
-        private void EnsureQueueDeclared(IModel channel)
+        private async Task EnsureQueueDeclaredAsync(IChannel channel)
         {
             if (_queueDeclared) return;
 
-            lock (_queueDeclareLock)
+            await _queueDeclareLock.WaitAsync();
+            try
             {
                 if (_queueDeclared) return;
 
-                try
-                {
-                    DeclareQueue(channel);
-                    _queueDeclared = true;
-                }
-                catch (Exception ex)
-                {
-                    _logger.LogError(ex, "Failed to declare queue {QueueName}", _queueName);
-                    throw new InvalidOperationException($"Failed to declare queue '{_queueName}'. See inner exception for details.", ex);
-                }
+                await DeclareQueueAsync(channel);
+                _queueDeclared = true;
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Failed to declare queue {QueueName}", _queueName);
+                throw new InvalidOperationException($"Failed to declare queue '{_queueName}'. See inner exception for details.", ex);
+            }
+            finally
+            {
+                _queueDeclareLock.Release();
             }
         }
 
-        private void DeclareQueue(IModel channel)
+        private async Task DeclareQueueAsync(IChannel channel)
         {
             try
             {
@@ -121,24 +124,24 @@ private void DeclareQueue(IModel channel)
                 var dlqName = $"{_queueName}{QueueingConstants.DeadletterAddition}";
 
                 // Ensure DLX exchange exists
-                channel.ExchangeDeclare(dlxName, ExchangeType.Direct, durable: true);
+                await channel.ExchangeDeclareAsync(dlxName, ExchangeType.Direct, durable: true, autoDelete: false, arguments: null);
 
                 // Ensure DLQ exists and is bound to DLX
-                channel.QueueDeclare(dlqName, durable: true, exclusive: false, autoDelete: false,
-                    arguments: new Dictionary<string, object>
+                await channel.QueueDeclareAsync(dlqName, durable: true, exclusive: false, autoDelete: false,
+                    arguments: new Dictionary<string, object?>
                     {
                         { "x-queue-type", "quorum" },
                         { "x-overflow", "reject-publish" }
                     });
-                channel.QueueBind(dlqName, dlxName, dlqName);
+                await channel.QueueBindAsync(dlqName, dlxName, dlqName, arguments: null);
 
                 // Declare main queue with DLX args
-                channel.QueueDeclare(
+                await channel.QueueDeclareAsync(
                     _queueName,
                     durable: true,
                     exclusive: false,
                     autoDelete: false,
-                    arguments: new Dictionary<string, object>
+                    arguments: new Dictionary<string, object?>
                     {
                         { "x-queue-type", "quorum" },
                         { "x-overflow", "reject-publish" },
@@ -148,11 +151,11 @@ private void DeclareQueue(IModel channel)
                         { "x-delivery-limit", 10 }
                     });
 
-                BindToExchange(channel);
+                await BindToExchangeAsync(channel);
             }
             catch (global::RabbitMQ.Client.Exceptions.OperationInterruptedException ex)
             {
-                if (ex.ShutdownReason.ReplyCode == 406 &&
+                if (ex.ShutdownReason?.ReplyCode == 406 &&
                     ex.ShutdownReason.ReplyText.Contains("inequivalent arg"))
                 {
                     _logger.LogWarning(
@@ -160,7 +163,7 @@ private void DeclareQueue(IModel channel)
                         "Queue {QueueName} exists with incompatible config. Using existing queue in compatibility mode.",
                         _queueName);
 
-                    BindToExchange(channel);
+                    await BindToExchangeAsync(channel);
                 }
                 else
                 {
@@ -169,20 +172,19 @@ private void DeclareQueue(IModel channel)
             }
         }
 
-        private void BindToExchange(IModel channel)
+        private async Task BindToExchangeAsync(IChannel channel)
         {
             var mainExchange = $"{_queueName}.exchange";
-            channel.ExchangeDeclare(mainExchange, ExchangeType.Direct, durable: true);
-            channel.QueueBind(_queueName, mainExchange, _queueName);
+            await channel.ExchangeDeclareAsync(mainExchange, ExchangeType.Direct, durable: true, autoDelete: false, arguments: null);
+            await channel.QueueBindAsync(_queueName, mainExchange, _queueName, arguments: null);
         }
 
-        private void DisposeChannel(IModel channel)
+        private void DisposeChannel(IChannel channel)
         {
             if (channel == null) return;
 
             try
             {
-                if (channel.IsOpen) channel.Close();
                 channel.Dispose();
             }
             catch (Exception ex)
@@ -195,7 +197,7 @@ private void CleanupIdleChannels()
         {
             if (_disposed) return;
 
-            var channels = new List<IModel>();
+            var channels = new List<IChannel>();
             while (_channelPool.TryDequeue(out var channel))
                 channels.Add(channel);
 
@@ -231,8 +233,9 @@ public void Dispose()
                 DisposeChannel(channel);
 
             _channelSemaphore.Dispose();
+            _queueDeclareLock.Dispose();
         }
 
         public string QueueName => _queueName;
     }
-}
\ No newline at end of file
+}
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerHandler.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerHandler.cs
index d64d0a1248..8fa8e61496 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerHandler.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerHandler.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Text;
 using System.Threading.Tasks;
 using Microsoft.Extensions.DependencyInjection;
@@ -28,21 +28,25 @@ public class QueueConsumerHandler<TMessageConsumer, TQueueMessage>(
         private string? _consumerTag;
         private readonly string _consumerName = typeof(TMessageConsumer).Name;
 
-        public void RegisterQueueConsumer()
+        public async Task RegisterQueueConsumerAsync()
         {
             _logger.LogInformation("Registering {Consumer} as a consumer for Queue {Queue}", _consumerName, _queueName);
 
             using var scope = _serviceProvider.CreateScope();
             var channelProvider = scope.ServiceProvider.GetRequiredService<IQueueChannelProvider<TQueueMessage>>();
-            var consumerChannel = channelProvider.GetChannel() ?? throw new QueueingException($"Failed to create consumer channel for {_queueName}");
+            var consumerChannel = await channelProvider.GetChannelAsync() ?? throw new QueueingException($"Failed to create consumer channel for {_queueName}");
             var consumer = new AsyncEventingBasicConsumer(consumerChannel);
-            consumer.Received += HandleMessage;
+            consumer.ReceivedAsync += HandleMessageAsync;
 
             try
             {
-                _consumerTag = consumerChannel.BasicConsume(
+                _consumerTag = await consumerChannel.BasicConsumeAsync(
                     queue: _queueName,
                     autoAck: false,
+                    consumerTag: string.Empty,
+                    noLocal: false,
+                    exclusive: false,
+                    arguments: null,
                     consumer: consumer);
 
                 _logger.LogInformation("Successfully registered {Consumer} as consumer for {Queue}", _consumerName, _queueName);
@@ -54,7 +58,7 @@ public void RegisterQueueConsumer()
             }
         }
 
-        void IQueueConsumerHandler<TMessageConsumer, TQueueMessage>.CancelQueueConsumer()
+        async Task IQueueConsumerHandler<TMessageConsumer, TQueueMessage>.CancelQueueConsumerAsync()
         {
             if (string.IsNullOrEmpty(_consumerTag))
                 return;
@@ -63,11 +67,11 @@ void IQueueConsumerHandler<TMessageConsumer, TQueueMessage>.CancelQueueConsumer(
 
             using var scope = _serviceProvider.CreateScope();
             var channelProvider = scope.ServiceProvider.GetRequiredService<IQueueChannelProvider<TQueueMessage>>();
-            var channel = channelProvider.GetChannel();
+            var channel = await channelProvider.GetChannelAsync();
 
             try
             {
-                channel.BasicCancel(_consumerTag);
+                await channel.BasicCancelAsync(_consumerTag);
             }
             catch (Exception ex)
             {
@@ -76,12 +80,12 @@ void IQueueConsumerHandler<TMessageConsumer, TQueueMessage>.CancelQueueConsumer(
             }
         }
 
-        private async Task HandleMessage(object sender, BasicDeliverEventArgs ea)
+        private async Task HandleMessageAsync(object sender, BasicDeliverEventArgs ea)
         {
             _logger.LogInformation("Received message on {Queue}", _queueName);
 
             using var consumerScope = _serviceProvider.CreateScope();
-            var consumingChannel = ((AsyncEventingBasicConsumer)sender).Model;
+            var consumingChannel = ((AsyncEventingBasicConsumer)sender).Channel;
 
             try
             {
@@ -98,7 +102,7 @@ private async Task HandleMessage(object sender, BasicDeliverEventArgs ea)
                 else if (tenantedMessage.TenantId == Guid.Empty)
                 {
                     _logger.LogError("Message {MessageId} on {Queue} has an empty TenantId and cannot be processed", message.MessageId, _queueName);
-                    consumingChannel.BasicReject(ea.DeliveryTag, requeue: false);
+                    await consumingChannel.BasicRejectAsync(ea.DeliveryTag, requeue: false);
                     return;
                 }
                 else
@@ -106,19 +110,19 @@ private async Task HandleMessage(object sender, BasicDeliverEventArgs ea)
                     await ConsumeWithAuditingAsync(consumerScope, tenantedMessage, message);
                 }
 
-                consumingChannel.BasicAck(ea.DeliveryTag, multiple: false);
+                await consumingChannel.BasicAckAsync(ea.DeliveryTag, multiple: false);
 
                 _logger.LogInformation("Message {MessageId} successfully processed", message.MessageId);
             }
             catch (JsonException jex)
             {
                 _logger.LogError(jex, "Deserialization failed for message on {Queue}", _queueName);
-                consumingChannel.BasicReject(ea.DeliveryTag, requeue: false);
+                await consumingChannel.BasicRejectAsync(ea.DeliveryTag, requeue: false);
             }
             catch (Exception ex)
             {
                 _logger.LogError(ex, "Error processing message on {Queue}", _queueName);
-                consumingChannel.BasicReject(ea.DeliveryTag, requeue: false);
+                await consumingChannel.BasicRejectAsync(ea.DeliveryTag, requeue: false);
             }
         }
 
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerRegistratorService.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerRegistratorService.cs
index 6e84a42504..3f7d7b1d2d 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerRegistratorService.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerRegistratorService.cs
@@ -36,7 +36,7 @@ public async Task StartAsync(CancellationToken cancellationToken)
 
                     _scope = _serviceProvider.CreateScope();
                     _consumerHandler = _scope.ServiceProvider.GetRequiredService<IQueueConsumerHandler<TMessageConsumer, TQueueMessage>>();
-                    _consumerHandler.RegisterQueueConsumer();
+                    await _consumerHandler.RegisterQueueConsumerAsync();
 
                     _logger.LogInformation("Successfully registered consumer {ConsumerName}", typeof(TMessageConsumer).Name);
                     return;
@@ -63,7 +63,7 @@ public async Task StartAsync(CancellationToken cancellationToken)
             }
         }
 
-        public Task StopAsync(CancellationToken cancellationToken)
+        public async Task StopAsync(CancellationToken cancellationToken)
         {
             var QueueServiceName = nameof(QueueConsumerRegistratorService<TMessageConsumer, TQueueMessage>);
             var ConsumerName = typeof(TMessageConsumer).Name;
@@ -73,7 +73,10 @@ public Task StopAsync(CancellationToken cancellationToken)
 
             try
             {
-                _consumerHandler?.CancelQueueConsumer();
+                if (_consumerHandler != null)
+                {
+                    await _consumerHandler.CancelQueueConsumerAsync();
+                }
                 _scope?.Dispose();
             }
             catch (Exception ex)
@@ -81,8 +84,6 @@ public Task StopAsync(CancellationToken cancellationToken)
                 var ExceptionMessage = ex.Message;
                 _logger.LogError(ex, "QueueConsumerRegistratorService StopAsync Exception: {ExceptionMessage}", ExceptionMessage);
             }
-
-            return Task.CompletedTask;
         }
     }
 
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueProducer.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueProducer.cs
index 360b71b00b..f0b09c2272 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueProducer.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueProducer.cs
@@ -1,7 +1,8 @@
-using System;
+using System;
 using System.Globalization;
 using System.Text;
 using System.Collections.Generic;
+using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json;
 using RabbitMQ.Client;
@@ -28,7 +29,7 @@ public QueueProducer(
             _exchangeName = $"{_queueName}.exchange";
         }
 
-        public void PublishMessage(TQueueMessage message)
+        public async Task PublishMessageAsync(TQueueMessage message)
         {
             if (EqualityComparer<TQueueMessage>.Default.Equals(message, default))
                 throw new ArgumentNullException(nameof(message));
@@ -36,7 +37,7 @@ public void PublishMessage(TQueueMessage message)
             if (message.TimeToLive.Ticks <= 0)
                 throw new QueueingException($"{nameof(message.TimeToLive)} cannot be zero or negative");
 
-            var channel = _channelProvider.GetChannel();
+            var channel = await _channelProvider.GetChannelAsync();
 
             try
             {
@@ -44,28 +45,24 @@ public void PublishMessage(TQueueMessage message)
 
                 var serializedMessage = SerializeMessage(message);
 
-                var properties = channel.CreateBasicProperties();
-                properties.Persistent = true; // quorum queues persist
-                properties.Type = _queueName;
-                properties.MessageId = message.MessageId.ToString();
-                properties.Expiration = message.TimeToLive.TotalMilliseconds.ToString(CultureInfo.InvariantCulture);
-
-                // Enable publisher confirms once per channel
-                channel.ConfirmSelect();
+                var properties = new BasicProperties
+                {
+                    Persistent = true, // quorum queues persist
+                    Type = _queueName,
+                    MessageId = message.MessageId.ToString(),
+                    Expiration = message.TimeToLive.TotalMilliseconds.ToString(CultureInfo.InvariantCulture)
+                };
 
-                channel.BasicPublish(
+                // Publisher confirmations are enabled on pooled channels, so BasicPublishAsync
+                // awaits the broker confirmation and throws if the message is not confirmed.
+                await channel.BasicPublishAsync(
                     exchange: _exchangeName,
                     routingKey: _queueName,
+                    mandatory: false,
                     basicProperties: properties,
                     body: serializedMessage
                 );
 
-                // Wait for confirmation
-                if (!channel.WaitForConfirms(TimeSpan.FromSeconds(5)))
-                {
-                    throw new QueueingException($"Publish failed: broker did not confirm message {message.MessageId}");
-                }
-
                 _logger.LogInformation("Published message {MessageId} to {Queue}", message.MessageId, _queueName);
             }
             catch (Exception ex)
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueingStartupExtensions.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueingStartupExtensions.cs
index 2a9190a5fa..f9b82e55a1 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueingStartupExtensions.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueingStartupExtensions.cs
@@ -12,7 +12,7 @@ public static class QueueingStartupExtensions
         public static void ConfigureRabbitMQ(this IServiceCollection services)
         {
             var configuration = services.GetConfiguration();
-            services.TryAddSingleton<IAsyncConnectionFactory>(provider =>
+            services.TryAddSingleton<IConnectionFactory>(provider =>
             {
                 var factory = new ConnectionFactory
                 {
@@ -21,10 +21,10 @@ public static void ConfigureRabbitMQ(this IServiceCollection services)
                     HostName = configuration.GetValue<string>("RabbitMQ:HostName") ?? "",
                     VirtualHost = configuration.GetValue<string>("RabbitMQ:VirtualHost") ?? "/",
                     Port = configuration.GetValue<int>("RabbitMQ:Port"),
-                    DispatchConsumersAsync = true,
                     AutomaticRecoveryEnabled = true,
-                    // Configure the amount of concurrent consumers within one host
-                    ConsumerDispatchConcurrency = QueueingConstants.MAX_RABBIT_CONCURRENT_CONSUMERS,
+                    // Configure the amount of concurrent consumers within one host.
+                    // Consumers are dispatched asynchronously by default in the v7 client.
+                    ConsumerDispatchConcurrency = (ushort)QueueingConstants.MAX_RABBIT_CONCURRENT_CONSUMERS,
                 };
                 return factory;
             });
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/RabbitMQConnection.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/RabbitMQConnection.cs
index 23fb5ad39f..d392a2d0bc 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/RabbitMQConnection.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/RabbitMQConnection.cs
@@ -1,4 +1,5 @@
-
+
+using System.Threading.Tasks;
 using Microsoft.Extensions.Options;
 using RabbitMQ.Client;
 
@@ -12,7 +13,7 @@ public RabbitMQConnection(IOptions<RabbitMQOptions> rabbitMQOptions)
         {
             _rabbitMQOptions = rabbitMQOptions;
         }
-        public IConnection GetConnection()
+        public async Task<IConnection> GetConnectionAsync()
         {
             var factory = new ConnectionFactory
             {
@@ -22,7 +23,7 @@ public IConnection GetConnection()
                 Password = _rabbitMQOptions.Value.Password,
                 VirtualHost = _rabbitMQOptions.Value.VirtualHost
             };
-            return factory.CreateConnection();
+            return await factory.CreateConnectionAsync();
         }
     }
-}
\ No newline at end of file
+}
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj b/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
index bece7d1dba..bc3d9950fd 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/Unity.SharedKernel.csproj
@@ -21,7 +21,7 @@
 		<PackageReference Include="Volo.Abp.AspNetCore.Mvc" Version="10.5.0" />
 		<PackageReference Include="Volo.Abp.Ddd.Application" Version="10.5.0" />
 		<PackageReference Include="Volo.Abp.TenantManagement.Domain" Version="10.5.0" />
-		<PackageReference Include="RabbitMQ.Client" Version="6.8.1" />
+		<PackageReference Include="RabbitMQ.Client" Version="7.2.1" />
 		<PackageReference Include="Volo.Abp.Http.Client" Version="10.5.0" />
 		<PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.5.0" />
 		<PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.8.0" />
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalAcknowledgmentPublisher.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalAcknowledgmentPublisher.cs
index c3aeda6258..e23a49f2ef 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalAcknowledgmentPublisher.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalAcknowledgmentPublisher.cs
@@ -1,5 +1,6 @@
 using System;
 using System.Text;
+using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Newtonsoft.Json;
@@ -21,7 +22,7 @@ public class GrantsPortalAcknowledgmentPublisher(
         NullValueHandling = NullValueHandling.Ignore
     };
 
-    public void Publish(IModel channel, string originalMessageId, string correlationId, string status, string details)
+    public async Task PublishAsync(IChannel channel, string originalMessageId, string correlationId, string status, string details)
     {
         var ack = new MessageAcknowledgment
         {
@@ -37,18 +38,21 @@ public void Publish(IModel channel, string originalMessageId, string correlation
         var json = JsonConvert.SerializeObject(ack, s_jsonSettings);
         var body = Encoding.UTF8.GetBytes(json);
 
-        var properties = channel.CreateBasicProperties();
-        properties.Type = "MessageAcknowledgment";
-        properties.ContentType = "application/json";
-        properties.ContentEncoding = "utf-8";
-        properties.Persistent = true;
-        properties.MessageId = ack.MessageId;
-        properties.CorrelationId = correlationId;
-        properties.Timestamp = new AmqpTimestamp(DateTimeOffset.UtcNow.ToUnixTimeSeconds());
+        var properties = new BasicProperties
+        {
+            Type = "MessageAcknowledgment",
+            ContentType = "application/json",
+            ContentEncoding = "utf-8",
+            Persistent = true,
+            MessageId = ack.MessageId,
+            CorrelationId = correlationId,
+            Timestamp = new AmqpTimestamp(DateTimeOffset.UtcNow.ToUnixTimeSeconds())
+        };
 
-        channel.BasicPublish(
+        await channel.BasicPublishAsync(
             exchange: _options.Exchange,
             routingKey: _options.AckRoutingKey,
+            mandatory: false,
             basicProperties: properties,
             body: body);
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalCommandConsumerService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalCommandConsumerService.cs
index c4c9ed0f6a..db277e9d91 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalCommandConsumerService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalCommandConsumerService.cs
@@ -23,7 +23,7 @@ namespace Unity.GrantManager.GrantsPortal;
 /// </summary>
 public class GrantsPortalCommandConsumerService(
     IServiceProvider serviceProvider,
-    IAsyncConnectionFactory connectionFactory,
+    IConnectionFactory connectionFactory,
     IOptions<GrantsPortalRabbitMqOptions> options,
     ILogger<GrantsPortalCommandConsumerService> logger) : BackgroundService
 {
@@ -38,7 +38,7 @@ public class GrantsPortalCommandConsumerService(
     private readonly SemaphoreSlim _reconnectLock = new(1, 1);
 
     private IConnection? _connection;
-    private IModel? _channel;
+    private IChannel? _channel;
 
     private const int MaxRetries = 5;
     private static readonly TimeSpan InitialRetryDelay = TimeSpan.FromSeconds(5);
@@ -71,13 +71,13 @@ private async Task ConnectAndConsumeAsync(CancellationToken cancellationToken)
             {
                 logger.LogInformation("Connecting to RabbitMQ for Grants Portal consumer (attempt {Attempt}/{MaxRetries})", attempt, MaxRetries);
 
-                _connection = connectionFactory.CreateConnection();
-                _connection.ConnectionShutdown += OnConnectionShutdown;
-                _channel = _connection.CreateModel();
-                _channel.BasicQos(prefetchSize: 0, prefetchCount: 1, global: false);
+                _connection = await connectionFactory.CreateConnectionAsync(cancellationToken);
+                _connection.ConnectionShutdownAsync += OnConnectionShutdownAsync;
+                _channel = await _connection.CreateChannelAsync(cancellationToken: cancellationToken);
+                await _channel.BasicQosAsync(prefetchSize: 0, prefetchCount: 1, global: false, cancellationToken: cancellationToken);
 
-                DeclareTopology();
-                StartConsuming();
+                await DeclareTopologyAsync(cancellationToken);
+                await StartConsumingAsync(cancellationToken);
 
                 logger.LogInformation("Grants Portal command consumer started. Listening on queue {Queue}", _options.InboundQueue);
                 return;
@@ -111,15 +111,15 @@ private async Task SlowReconnectLoopAsync(CancellationToken cancellationToken)
             try
             {
                 logger.LogInformation("Slow reconnect: attempting to connect to RabbitMQ...");
-                CleanupConnection();
+                await CleanupConnectionAsync();
 
-                _connection = connectionFactory.CreateConnection();
-                _connection.ConnectionShutdown += OnConnectionShutdown;
-                _channel = _connection.CreateModel();
-                _channel.BasicQos(prefetchSize: 0, prefetchCount: 1, global: false);
+                _connection = await connectionFactory.CreateConnectionAsync(cancellationToken);
+                _connection.ConnectionShutdownAsync += OnConnectionShutdownAsync;
+                _channel = await _connection.CreateChannelAsync(cancellationToken: cancellationToken);
+                await _channel.BasicQosAsync(prefetchSize: 0, prefetchCount: 1, global: false, cancellationToken: cancellationToken);
 
-                DeclareTopology();
-                StartConsuming();
+                await DeclareTopologyAsync(cancellationToken);
+                await StartConsumingAsync(cancellationToken);
 
                 logger.LogInformation("Slow reconnect: successfully reconnected. Listening on queue {Queue}", _options.InboundQueue);
                 return;
@@ -135,9 +135,9 @@ private async Task SlowReconnectLoopAsync(CancellationToken cancellationToken)
         }
     }
 
-    private void OnConnectionShutdown(object? sender, ShutdownEventArgs e)
+    private Task OnConnectionShutdownAsync(object sender, ShutdownEventArgs e)
     {
-        if (_stoppingToken.IsCancellationRequested) return;
+        if (_stoppingToken.IsCancellationRequested) return Task.CompletedTask;
 
         logger.LogWarning("RabbitMQ connection lost: {Reason}. Attempting to reconnect...", e.ReplyText);
 
@@ -152,7 +152,7 @@ private void OnConnectionShutdown(object? sender, ShutdownEventArgs e)
             try
             {
                 await Task.Delay(InitialRetryDelay, _stoppingToken);
-                CleanupConnection();
+                await CleanupConnectionAsync();
                 await ConnectAndConsumeAsync(_stoppingToken);
             }
             catch (OperationCanceledException) when (_stoppingToken.IsCancellationRequested)
@@ -168,34 +168,41 @@ private void OnConnectionShutdown(object? sender, ShutdownEventArgs e)
                 _reconnectLock.Release();
             }
         }, _stoppingToken);
+
+        return Task.CompletedTask;
     }
 
-    private void DeclareTopology()
+    private async Task DeclareTopologyAsync(CancellationToken cancellationToken)
     {
         if (_channel == null) return;
 
-        _channel.ExchangeDeclare(
+        await _channel.ExchangeDeclareAsync(
             exchange: _options.Exchange,
             type: _options.ExchangeType,
             durable: true,
-            autoDelete: false);
+            autoDelete: false,
+            arguments: null,
+            cancellationToken: cancellationToken);
 
-        _channel.QueueDeclare(
+        await _channel.QueueDeclareAsync(
             queue: _options.InboundQueue,
             durable: true,
             exclusive: false,
             autoDelete: false,
-            arguments: new System.Collections.Generic.Dictionary<string, object>
+            arguments: new System.Collections.Generic.Dictionary<string, object?>
             {
                 { "x-queue-type", "quorum" }
-            });
+            },
+            cancellationToken: cancellationToken);
 
         foreach (var routingKey in _options.InboundRoutingKeys)
         {
-            _channel.QueueBind(
+            await _channel.QueueBindAsync(
                 queue: _options.InboundQueue,
                 exchange: _options.Exchange,
-                routingKey: routingKey);
+                routingKey: routingKey,
+                arguments: null,
+                cancellationToken: cancellationToken);
         }
 
         logger.LogInformation(
@@ -203,17 +210,22 @@ private void DeclareTopology()
             _options.Exchange, _options.InboundQueue, string.Join(", ", _options.InboundRoutingKeys));
     }
 
-    private void StartConsuming()
+    private async Task StartConsumingAsync(CancellationToken cancellationToken)
     {
         if (_channel == null) return;
 
         var consumer = new AsyncEventingBasicConsumer(_channel);
-        consumer.Received += OnMessageReceivedAsync;
+        consumer.ReceivedAsync += OnMessageReceivedAsync;
 
-        _channel.BasicConsume(
+        await _channel.BasicConsumeAsync(
             queue: _options.InboundQueue,
             autoAck: false,
-            consumer: consumer);
+            consumerTag: string.Empty,
+            noLocal: false,
+            exclusive: false,
+            arguments: null,
+            consumer: consumer,
+            cancellationToken: cancellationToken);
     }
 
     /// <summary>
@@ -225,7 +237,7 @@ private async Task OnMessageReceivedAsync(object sender, BasicDeliverEventArgs e
         var messageId = ea.BasicProperties?.MessageId ?? string.Empty;
         var messageType = ea.BasicProperties?.Type ?? string.Empty;
         var correlationId = ea.BasicProperties?.CorrelationId ?? string.Empty;
-        var consumingChannel = ((AsyncEventingBasicConsumer)sender).Model;
+        var consumingChannel = ((AsyncEventingBasicConsumer)sender).Channel;
 
         logger.LogInformation("Received message {MessageId} type={MessageType}", messageId, messageType);
 
@@ -233,7 +245,7 @@ private async Task OnMessageReceivedAsync(object sender, BasicDeliverEventArgs e
         if (string.Equals(messageType, "MessageAcknowledgment", StringComparison.OrdinalIgnoreCase))
         {
             logger.LogDebug("Discarding acknowledgment message {MessageId} to prevent loop", messageId);
-            consumingChannel.BasicAck(ea.DeliveryTag, multiple: false);
+            await consumingChannel.BasicAckAsync(ea.DeliveryTag, multiple: false);
             return;
         }
 
@@ -245,7 +257,7 @@ private async Task OnMessageReceivedAsync(object sender, BasicDeliverEventArgs e
             if (envelope == null)
             {
                 logger.LogError("Failed to deserialize message {MessageId}. Discarding.", messageId);
-                consumingChannel.BasicAck(ea.DeliveryTag, multiple: false);
+                await consumingChannel.BasicAckAsync(ea.DeliveryTag, multiple: false);
                 return;
             }
 
@@ -257,7 +269,7 @@ private async Task OnMessageReceivedAsync(object sender, BasicDeliverEventArgs e
             if (string.IsNullOrWhiteSpace(messageId))
             {
                 logger.LogError("Received message with missing/blank MessageId. Discarding. CorrelationId={CorrelationId}", correlationId);
-                consumingChannel.BasicAck(ea.DeliveryTag, multiple: false);
+                await consumingChannel.BasicAckAsync(ea.DeliveryTag, multiple: false);
                 return;
             }
 
@@ -277,7 +289,7 @@ private async Task OnMessageReceivedAsync(object sender, BasicDeliverEventArgs e
             if (existing != null)
             {
                 logger.LogInformation("Message {MessageId} already in inbox (status={Status}). Skipping.", messageId, existing.Status);
-                consumingChannel.BasicAck(ea.DeliveryTag, multiple: false);
+                await consumingChannel.BasicAckAsync(ea.DeliveryTag, multiple: false);
                 return;
             }
 
@@ -307,12 +319,12 @@ private async Task OnMessageReceivedAsync(object sender, BasicDeliverEventArgs e
         catch (Exception ex)
         {
             logger.LogError(ex, "Error saving message {MessageId} to inbox. Message will be requeued.", messageId);
-            consumingChannel.BasicReject(ea.DeliveryTag, requeue: true);
+            await consumingChannel.BasicRejectAsync(ea.DeliveryTag, requeue: true);
             return;
         }
 
         // ACK only after successful save to inbox
-        consumingChannel.BasicAck(ea.DeliveryTag, multiple: false);
+        await consumingChannel.BasicAckAsync(ea.DeliveryTag, multiple: false);
     }
 
     private static Guid? ResolveTenantId(string? provider)
@@ -326,15 +338,13 @@ private async Task OnMessageReceivedAsync(object sender, BasicDeliverEventArgs e
         return null;
     }
 
-    private void CleanupConnection()
+    private async Task CleanupConnectionAsync()
     {
         try
         {
-            if (_connection != null) _connection.ConnectionShutdown -= OnConnectionShutdown;
-            _channel?.Close();
-            _channel?.Dispose();
-            _connection?.Close();
-            _connection?.Dispose();
+            _connection?.ConnectionShutdownAsync -= OnConnectionShutdownAsync;
+            if (_channel != null) await _channel.DisposeAsync();
+            if (_connection != null) await _connection.DisposeAsync();
         }
         catch (Exception ex)
         {
@@ -369,7 +379,19 @@ private static bool IsDuplicateKeyException(Exception ex)
 
     public override void Dispose()
     {
-        CleanupConnection();
+        try
+        {
+            _connection?.ConnectionShutdownAsync -= OnConnectionShutdownAsync;
+            _channel?.Dispose();
+            _connection?.Dispose();
+        }
+        catch (Exception ex)
+        {
+            logger.LogDebug(ex, "Error during connection cleanup on dispose");
+        }
+
+        _channel = null;
+        _connection = null;
         _reconnectLock.Dispose();
         base.Dispose();
         GC.SuppressFinalize(this);
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalOutboxWorker.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalOutboxWorker.cs
index a6de10b2be..8546ecdea0 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalOutboxWorker.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantsPortal/GrantsPortalOutboxWorker.cs
@@ -17,15 +17,15 @@ namespace Unity.GrantManager.GrantsPortal;
 /// </summary>
 public class GrantsPortalOutboxWorker : OutboxWorkerBase
 {
-    private readonly IAsyncConnectionFactory _connectionFactory;
+    private readonly IConnectionFactory _connectionFactory;
     private IConnection? _connection;
-    private IModel? _channel;
+    private IChannel? _channel;
 
     protected override string SourceName => GrantsPortalRabbitMqOptions.SourceName;
 
     public GrantsPortalOutboxWorker(
         IServiceProvider serviceProvider,
-        IAsyncConnectionFactory connectionFactory,
+        IConnectionFactory connectionFactory,
         IOptions<GrantsPortalRabbitMqOptions> options)
         : base(serviceProvider)
     {
@@ -46,11 +46,6 @@ public GrantsPortalOutboxWorker(
             .Build();
     }
 
-    protected override void OnBeforePublishCycle()
-    {
-        EnsureChannel();
-    }
-
     protected override void OnPublishCycleError(Exception ex)
     {
         CleanupChannel();
@@ -58,33 +53,29 @@ protected override void OnPublishCycleError(Exception ex)
 
     protected override async Task PublishMessageAsync(IServiceScope scope, OutboxMessage outboxMsg)
     {
+        await EnsureChannelAsync();
+
         var publisher = scope.ServiceProvider.GetRequiredService<GrantsPortalAcknowledgmentPublisher>();
 
-        publisher.Publish(
+        // Publisher confirmations are enabled on the channel, so PublishAsync awaits the
+        // broker confirmation and throws if the ack message is not confirmed.
+        await publisher.PublishAsync(
             _channel!,
             outboxMsg.OriginalMessageId,
             outboxMsg.CorrelationId,
             outboxMsg.AckStatus,
             outboxMsg.Details);
-
-        // Wait for broker to confirm
-        if (!_channel!.WaitForConfirms(TimeSpan.FromSeconds(5)))
-        {
-            throw new InvalidOperationException("Broker did not confirm ack publish");
-        }
-
-        await Task.CompletedTask;
     }
 
-    private void EnsureChannel()
+    private async Task EnsureChannelAsync()
     {
         if (_channel is { IsOpen: true }) return;
 
         CleanupChannel();
 
-        _connection = _connectionFactory.CreateConnection();
-        _channel = _connection.CreateModel();
-        _channel.ConfirmSelect();
+        _connection = await _connectionFactory.CreateConnectionAsync();
+        _channel = await _connection.CreateChannelAsync(
+            new CreateChannelOptions(publisherConfirmationsEnabled: true, publisherConfirmationTrackingEnabled: true));
 
         Logger.LogInformation("Outbox worker RabbitMQ channel established");
     }
@@ -93,9 +84,7 @@ private void CleanupChannel()
     {
         try
         {
-            _channel?.Close();
             _channel?.Dispose();
-            _connection?.Close();
             _connection?.Dispose();
         }
         catch (Exception ex)
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/FakeChannelProvider.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/FakeChannelProvider.cs
index 5429042b52..1e8c8cdf3c 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/FakeChannelProvider.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/FakeChannelProvider.cs
@@ -1,16 +1,28 @@
 using System;
-using System.Collections.Generic;
+using System.Threading.Tasks;
+using NSubstitute;
 using RabbitMQ.Client;
-using RabbitMQ.Client.Events;
 using Unity.Modules.Shared.MessageBrokers.RabbitMQ.Interfaces;
 
 namespace Unity.GrantManager
 {
+    /// <summary>
+    /// Test double for <see cref="IChannelProvider"/> that hands out a substitute
+    /// <see cref="IChannel"/>, so the app can boot in tests without a real RabbitMQ broker.
+    /// The substitute auto-returns completed tasks for the async channel operations.
+    /// </summary>
     public class FakeChannelProvider : IChannelProvider
     {
         private bool _disposed;
 
-        public IModel GetChannel() => new FakeModel();
+        public Task<IChannel?> GetChannelAsync()
+        {
+            var channel = Substitute.For<IChannel>();
+            channel.IsOpen.Returns(true);
+            return Task.FromResult<IChannel?>(channel);
+        }
+
+        public void ReturnChannel(IChannel channel) { }
 
         public void Dispose()
         {
@@ -23,203 +35,8 @@ protected virtual void Dispose(bool disposing)
             if (_disposed)
                 return;
 
-            if (disposing)
-            {
-                // Dispose managed resources here if needed
-            }
-
-            // Dispose unmanaged resources here if needed
-
+            // No unmanaged resources to release; this fake exists only for tests.
             _disposed = true;
         }
-
-        public void ReturnChannel(IModel channel) { }
-
-        public class FakeModel : IModel
-        {
-            private bool _disposed;
-
-            public int ChannelNumber => 1;
-            public ShutdownEventArgs? CloseReason => null;
-            public IBasicConsumer? DefaultConsumer { get; set; }
-            public bool IsClosed => false;
-            public bool IsOpen => true;
-            public ulong NextPublishSeqNo => 0;
-            public string CurrentQueue => string.Empty;
-            public TimeSpan ContinuationTimeout { get; set; } = TimeSpan.Zero;
-
-            // Events (no-op) - this section is needed and unused
-#pragma warning disable S1144 // Unused private code
-#pragma warning disable CS0067 // Event is never used
-            public event EventHandler<BasicAckEventArgs>? BasicAcks;
-
-            public event EventHandler<BasicNackEventArgs>? BasicNacks;
-            public event EventHandler<EventArgs>? BasicRecoverOk;
-            public event EventHandler<BasicReturnEventArgs>? BasicReturn;
-            public event EventHandler<CallbackExceptionEventArgs>? CallbackException;
-            public event EventHandler<FlowControlEventArgs>? FlowControl;
-            public event EventHandler<ShutdownEventArgs>? ModelShutdown;
-#pragma warning restore CS0067 // Event is never used
-#pragma warning restore S1144
-
-            // --- Minimal stubs for queue + exchange setup ---
-            public QueueDeclareOk QueueDeclare(string queue, bool durable, bool exclusive, bool autoDelete, IDictionary<string, object> arguments)
-                => new(queue, 0, 0);
-
-            public QueueDeclareOk QueueDeclarePassive(string queue)
-                => new(queue, 0, 0);
-
-            public void QueueDeclareNoWait(string queue, bool durable, bool exclusive, bool autoDelete, IDictionary<string, object> arguments) { }
-
-            public void QueueBind(string queue, string exchange, string routingKey, IDictionary<string, object> arguments) { }
-            public void QueueBindNoWait(string queue, string exchange, string routingKey, IDictionary<string, object> arguments) { }
-            public void QueueUnbind(string queue, string exchange, string routingKey, IDictionary<string, object> arguments) { }
-
-            public void ExchangeDeclare(string exchange, string type, bool durable, bool autoDelete, IDictionary<string, object> arguments) { }
-            public void ExchangeDeclareNoWait(string exchange, string type, bool durable, bool autoDelete, IDictionary<string, object> arguments) { }
-            public void ExchangeDeclarePassive(string exchange) { }
-
-            public void ExchangeBind(string destination, string source, string routingKey, IDictionary<string, object> arguments) { }
-            public void ExchangeBindNoWait(string destination, string source, string routingKey, IDictionary<string, object> arguments) { }
-            public void ExchangeUnbind(string destination, string source, string routingKey, IDictionary<string, object> arguments) { }
-            public void ExchangeUnbindNoWait(string destination, string source, string routingKey, IDictionary<string, object> arguments) { }
-
-            public void ExchangeDelete(string exchange, bool ifUnused) { }
-            public void ExchangeDeleteNoWait(string exchange, bool ifUnused) { }
-
-            // --- Commonly invoked but safe to no-op in tests ---
-            public void BasicAck(ulong deliveryTag, bool multiple) { }
-            public void BasicNack(ulong deliveryTag, bool multiple, bool requeue) { }
-            public void BasicReject(ulong deliveryTag, bool requeue) { }
-            public string BasicConsume(string queue, bool autoAck, string consumerTag, bool noLocal, bool exclusive, IDictionary<string, object> arguments, IBasicConsumer consumer)
-                => Guid.NewGuid().ToString();
-            public void BasicCancel(string consumerTag) { }
-            public void BasicCancelNoWait(string consumerTag) { }
-            public BasicGetResult BasicGet(string queue, bool autoAck) => new(0, false, null, null, 0, null, null);
-            public void BasicPublish(string exchange, string routingKey, bool mandatory, IBasicProperties basicProperties, ReadOnlyMemory<byte> body) { }
-            public void BasicQos(uint prefetchSize, ushort prefetchCount, bool global) { }
-
-            public void ConfirmSelect() { }
-            public IBasicPublishBatch CreateBasicPublishBatch() => new FakeBasicPublishBatch();
-            public IBasicProperties CreateBasicProperties() => new FakeBasicProperties
-            {
-                AppId = string.Empty,
-                ClusterId = string.Empty,
-                ContentEncoding = string.Empty,
-                ContentType = string.Empty,
-                CorrelationId = string.Empty,
-                Expiration = string.Empty,
-                MessageId = string.Empty,
-                ReplyTo = string.Empty,
-                Type = string.Empty
-            };
-
-            public uint QueueDelete(string queue, bool ifUnused, bool ifEmpty) => 0;
-            public void QueueDeleteNoWait(string queue, bool ifUnused, bool ifEmpty) { }
-            public uint QueuePurge(string queue) => 0;
-
-            public uint MessageCount(string queue) => 0;
-            public uint ConsumerCount(string queue) => 0;
-
-            public void TxSelect() { }
-            public void TxCommit() { }
-            public void TxRollback() { }
-
-            public bool WaitForConfirms() => true;
-            public bool WaitForConfirms(TimeSpan timeout) => true;
-            public bool WaitForConfirms(TimeSpan timeout, out bool timedOut) { timedOut = false; return true; }
-            public void WaitForConfirmsOrDie() { }
-            public void WaitForConfirmsOrDie(TimeSpan timeout) { }
-
-            public void BasicRecover(bool requeue) { }
-            public void BasicRecoverAsync(bool requeue) { }
-
-            // Lifecycle
-            public void Abort() { }
-            public void Abort(ushort replyCode, string replyText) { }
-            public void Close() { }
-            public void Close(ushort replyCode, string replyText) { }
-            public void Dispose()
-            {
-                Dispose(true);
-                GC.SuppressFinalize(this);
-            }
-
-            protected virtual void Dispose(bool disposing)
-            {
-                if (_disposed)
-                    return;
-
-                if (disposing)
-                {
-                    // Dispose managed resources here if needed
-                }
-
-                // Dispose unmanaged resources here if needed
-
-                _disposed = true;
-            }
-        }
-
-        // Fake BasicPublishBatch (so CreateBasicPublishBatch won’t explode if called)
-        private class FakeBasicPublishBatch : IBasicPublishBatch
-        {
-            public void Add(string exchange, string routingKey, bool mandatory, IBasicProperties properties, byte[] body) { }
-            public void Publish() { }
-        }
-
-        // Fake BasicProperties (so BasicPublish won’t explode if called)
-        private class FakeBasicProperties : IBasicProperties
-        {
-            public ushort ProtocolClassId => 60;
-            public string ProtocolClassName => "basic";
-            public void ClearAppId() { }
-            public void ClearClusterId() { }
-            public void ClearContentEncoding() { }
-            public void ClearContentType() { }
-            public void ClearCorrelationId() { }
-            public void ClearDeliveryMode() { }
-            public void ClearExpiration() { }
-            public void ClearHeaders() { }
-            public void ClearMessageId() { }
-            public void ClearPriority() { }
-            public void ClearReplyTo() { }
-            public void ClearTimestamp() { }
-            public void ClearType() { }
-            public void ClearUserId() { }
-            public bool IsAppIdPresent() => false;
-            public bool IsClusterIdPresent() => false;
-            public bool IsContentEncodingPresent() => false;
-            public bool IsContentTypePresent() => false;
-            public bool IsCorrelationIdPresent() => false;
-            public bool IsDeliveryModePresent() => false;
-            public bool IsExpirationPresent() => false;
-            public bool IsHeadersPresent() => false;
-            public bool IsMessageIdPresent() => false;
-            public bool IsPriorityPresent() => false;
-            public bool IsReplyToPresent() => false;
-            public bool IsTimestampPresent() => false;
-            public bool IsTypePresent() => false;
-            public bool IsUserIdPresent() => false;
-
-            // Safe defaults
-            public required string AppId { get; set; }
-            public required string ClusterId { get; set; }
-            public required string ContentEncoding { get; set; }
-            public required string ContentType { get; set; }
-            public required string CorrelationId { get; set; }
-            public byte DeliveryMode { get; set; }
-            public required string Expiration { get; set; }
-            public IDictionary<string, object> Headers { get; set; } = new Dictionary<string, object>();
-            public required string MessageId { get; set; }
-            public byte Priority { get; set; }
-            public required string ReplyTo { get; set; }
-            public AmqpTimestamp Timestamp { get; set; }
-            public required string Type { get; set; }
-            public string? UserId { get; set; }
-            public bool Persistent { get => throw new NotImplementedException(); set => throw new NotImplementedException(); }
-            public PublicationAddress ReplyToAddress { get => throw new NotImplementedException(); set => throw new NotImplementedException(); }
-        }
-
     }
 }

From c82d2ab50b407a701b4fb31605faab1416697094 Mon Sep 17 00:00:00 2001
From: "Todosichuk, Daryl" <Daryl.Todosichuk@gov.bc.ca>
Date: Fri, 24 Jul 2026 16:29:20 -0700
Subject: [PATCH 29/40] AB#33415 removed SafeguardSql entirely

---
 .../ReportColumnsMapRepository.cs             | 51 ++-----------------
 1 file changed, 3 insertions(+), 48 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/EntityFrameworkCore/Repositories/ReportColumnsMapRepository.cs b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/EntityFrameworkCore/Repositories/ReportColumnsMapRepository.cs
index 08593ddb8a..6d3cb324d5 100644
--- a/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/EntityFrameworkCore/Repositories/ReportColumnsMapRepository.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Reporting/src/Unity.Reporting.Application/EntityFrameworkCore/Repositories/ReportColumnsMapRepository.cs
@@ -316,7 +316,7 @@ public async Task DeleteViewAsync(string viewName)
                 // SECURITY: Use pre-validated identifier in quoted format
                 // The identifier has been validated above, and we use quoted format to prevent injection
                 var sql = $"DROP VIEW IF EXISTS \"Reporting\".\"{normalizedViewName}\"";
-                await dbContext.Database.ExecuteSqlRawAsync(SafeguardSql(sql));
+                await dbContext.Database.ExecuteSqlRawAsync(sql);
             }
             finally
             {
@@ -352,7 +352,7 @@ public async Task AssignRoleToViewAsync(string role, string viewName)
             {
                 // Use ExecuteSqlRaw with properly quoted identifiers - safer than string concatenation
                 var sql = $"GRANT SELECT ON \"Reporting\".\"{normalizedViewName}\" TO \"{role}\"";
-                await dbContext.Database.ExecuteSqlRawAsync(SafeguardSql(sql));
+                await dbContext.Database.ExecuteSqlRawAsync(sql);
             }
             finally
             {
@@ -400,7 +400,7 @@ FROM pg_views
                 foreach (var viewName in viewNames)
                 {
                     var sql = $"GRANT SELECT ON \"Reporting\".\"{viewName}\" TO \"{role}\"";
-                    await dbContext.Database.ExecuteSqlRawAsync(SafeguardSql(sql));
+                    await dbContext.Database.ExecuteSqlRawAsync(sql);
                 }
             }
             finally
@@ -546,51 +546,6 @@ FROM information_schema.views
             }
         }
 
-        /// <summary>
-        /// Safeguards SQL strings by validating they only contain safe, pre-validated identifiers
-        /// and preventing SQL injection through strict identifier validation.
-        /// </summary>
-        /// <param name="sql">The SQL string to validate - should only contain pre-validated PostgreSQL identifiers</param>
-        /// <returns>The validated SQL string if safe</returns>
-        /// <exception cref="ArgumentException">Thrown if the SQL contains potentially unsafe content</exception>
-        private static string SafeguardSql(string sql)
-        {
-            if (string.IsNullOrWhiteSpace(sql))
-            {
-                throw new ArgumentException("SQL cannot be null or empty", nameof(sql));
-            }
-
-            // This method is specifically for our controlled scenarios where:
-            // 1. All identifiers have been pre-validated using IsValidPostgreSqlIdentifier()
-            // 2. The SQL structure is fixed and known (DROP VIEW, GRANT SELECT)
-            // 3. Only the identifier names are dynamic (view name, role name)
-            
-            // Additional safety check: ensure the SQL only contains expected patterns
-            // for our specific use cases (DROP VIEW and GRANT SELECT statements)
-            if (!IsKnownSafeSqlPattern(sql))
-            {
-                throw new ArgumentException("SQL does not match expected safe patterns", nameof(sql));
-            }
-
-            return sql;
-        }
-
-        /// <summary>
-        /// Validates that the SQL string matches one of our known safe patterns
-        /// </summary>
-        /// <param name="sql">The SQL string to validate</param>
-        /// <returns>True if the SQL matches a known safe pattern</returns>
-        private static bool IsKnownSafeSqlPattern(string sql)
-        {
-            if (string.IsNullOrWhiteSpace(sql))
-                return false;
-
-            // For our specific use cases, we expect either a DROP VIEW or GRANT SELECT statement
-            // The view name and roles have been pre-validated, so we just check the overall structure here
-
-            return true;
-        }
-
         /// <summary>
         /// Validates that a string is a valid PostgreSQL identifier to prevent SQL injection
         /// </summary>

From 61a5c097cba3295f0f3a492e871c477bb76d77eb Mon Sep 17 00:00:00 2001
From: Jacob Smith <jacob.smith@gov.bc.ca>
Date: Fri, 24 Jul 2026 16:52:58 -0700
Subject: [PATCH 30/40] AB#33866 retain AI worksheet suggestions for review

---
 .../Mapping/AiWorksheetSuggestionName.cs      |   9 +
 .../ApplicationFormVersionAppService.cs       |  21 +--
 .../GenerateFormWorksheetJob.cs               |  63 +++----
 .../Pages/ApplicationForms/Mapping.js         |  51 ++---
 .../CustomFields/CustomFieldsViewComponent.cs |   7 +-
 .../Components/CustomFields/Default.cshtml    |  58 +++---
 .../Components/CustomFields/Default.css       | 177 +++++++++---------
 .../AI/GenerateFormWorksheetJobTests.cs       |  11 ++
 .../ApplicationFormVersionAppServiceTests.cs  |  27 ++-
 9 files changed, 225 insertions(+), 199 deletions(-)
 create mode 100644 applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetSuggestionName.cs

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetSuggestionName.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetSuggestionName.cs
new file mode 100644
index 0000000000..c85450926a
--- /dev/null
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/Mapping/AiWorksheetSuggestionName.cs
@@ -0,0 +1,9 @@
+using System;
+
+namespace Unity.GrantManager.ApplicationForms.Mapping;
+
+public static class AiWorksheetSuggestionName
+{
+    public static string Build(Guid formId, Guid formVersionId) =>
+        $"ai-form-{formId}-version-{formVersionId}-field-suggestions";
+}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs
index a7cd3911ae..4bedeb5dd6 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormVersionAppService.cs
@@ -456,20 +456,15 @@ public virtual async Task DiscardAiWorksheetSuggestionsAsync(Guid formVersionId)
         private async Task<Worksheet?> GetPendingAiWorksheetEntityAsync(Guid formVersionId)
         {
             var formVersion = await formVersionRepository.GetAsync(formVersionId);
-            var worksheetName = BuildAiWorksheetName(formVersion.ApplicationFormId, formVersion.Id);
-            var worksheet = await worksheetRepository.GetByNameAsync(worksheetName, true);
+            var worksheet = await worksheetRepository.GetByNameAsync(
+                AiWorksheetSuggestionName.Build(formVersion.ApplicationFormId, formVersion.Id), true);
 
-            if (worksheet == null)
+            if (worksheet?.Published == false)
             {
-                return null;
-            }
-
-            if (worksheet.Published)
-            {
-                return null;
+                return worksheet;
             }
 
-            return worksheet;
+            return null;
         }
 
         private static AiWorksheetReviewDto MapAiWorksheetReview(Worksheet worksheet) => new()
@@ -483,7 +478,8 @@ public virtual async Task DiscardAiWorksheetSuggestionsAsync(Guid formVersionId)
                     Id = field.Id,
                     Key = field.Key,
                     Label = field.Label,
-                    Type = field.Type.ToString()
+                    Type = field.Type.ToString(),
+                    Selected = true
                 })
                 .ToList()
         };
@@ -530,9 +526,6 @@ private static string NormalizeCustomFieldDefinition(string definition)
             }
         }
 
-        private static string BuildAiWorksheetName(Guid formId, Guid formVersionId) =>
-            $"ai-form-{formId}-version-{formVersionId}-worksheet";
-
         private async Task<int> GetVersion(Guid formVersionId)
         {
             var formVersion = await formVersionRepository.GetByChefsFormVersionAsync(formVersionId);
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
index c69bba1ffc..09fc8c0386 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
@@ -12,11 +12,9 @@
 using Unity.GrantManager.ApplicationForms;
 using Unity.GrantManager.ApplicationForms.Mapping;
 using Unity.GrantManager.Applications;
-using Unity.Flex.Domain.WorksheetLinks;
 using Unity.Flex.Domain.Worksheets;
 using Unity.Flex.Worksheets;
 using Unity.Flex.Worksheets.Definitions;
-using Unity.Modules.Shared.Correlation;
 using Volo.Abp.BackgroundJobs;
 using Volo.Abp.DependencyInjection;
 using Volo.Abp.Domain.Repositories;
@@ -29,7 +27,6 @@ public class GenerateFormWorksheetJob(
     IApplicationFormVersionRepository applicationFormVersionRepository,
     IApplicationFormRepository applicationFormRepository,
     IWorksheetRepository worksheetRepository,
-    IWorksheetLinkRepository worksheetLinkRepository,
     IApplicationFormVersionMappingReadService mappingReadService,
     IFormWorksheetService aiService,
     IRepository<AIGenerationRequest, Guid> generationRequestRepository,
@@ -65,11 +62,26 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
             {
                 var formVersion = await applicationFormVersionRepository.GetAsync(args.ApplicationFormVersionId);
                 var applicationForm = await applicationFormRepository.GetAsync(formVersion.ApplicationFormId);
-                var worksheetName = BuildWorksheetName(formVersion.Id, applicationForm.Id);
+                var worksheetName = AiWorksheetSuggestionName.Build(applicationForm.Id, formVersion.Id);
                 var existingWorksheet = await worksheetRepository.GetByNameAsync(worksheetName, true);
-                var mappingReadModel = await mappingReadService.GetAsync(formVersion.Id);
-                if (existingWorksheet == null || existingWorksheet.Published)
+                if (existingWorksheet != null)
                 {
+                    if (existingWorksheet.Published)
+                    {
+                        logger.LogWarning(
+                            "A published worksheet already uses AI suggestion name {WorksheetName}; leaving it unchanged.",
+                            worksheetName);
+                    }
+                    else
+                    {
+                        logger.LogInformation(
+                            "An AI suggestion worksheet is pending review for form version {FormVersionId}; leaving it unchanged.",
+                            formVersion.Id);
+                    }
+                }
+                else
+                {
+                    var mappingReadModel = await mappingReadService.GetAsync(formVersion.Id);
                     var promptData = new
                     {
                         applicationFormVersionId = formVersion.Id,
@@ -99,33 +111,9 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
                     });
 
                     var suggestions = ParseWorksheetDefinition(worksheetResponse.Worksheet);
-                    if (existingWorksheet == null)
-                    {
-                        var worksheet = BuildWorksheet(suggestions, worksheetName);
-                        worksheet.SetPublished(false);
-                        await worksheetRepository.InsertAsync(worksheet);
-                    }
-                    else
-                    {
-                        var existingLink = await worksheetLinkRepository.GetExistingLinkAsync(
-                            existingWorksheet.Id,
-                            formVersion.Id,
-                            CorrelationConsts.FormVersion);
-                        if (existingLink != null)
-                        {
-                            await worksheetLinkRepository.DeleteAsync(existingLink, true);
-                        }
-
-                        RebuildWorksheet(existingWorksheet, suggestions);
-                        existingWorksheet.SetPublished(false);
-                        await worksheetRepository.UpdateAsync(existingWorksheet);
-                    }
-                }
-                else
-                {
-                    logger.LogInformation(
-                        "An unpublished AI worksheet already exists for form version {FormVersionId}; leaving it available for review.",
-                        formVersion.Id);
+                    var worksheet = BuildWorksheet(suggestions, worksheetName);
+                    worksheet.SetPublished(false);
+                    await worksheetRepository.InsertAsync(worksheet);
                 }
 
                 await AIGenerationRequestJobHelper.StampCooldownBestEffortAsync(aiCooldownService, logger, args.RequestedByUserId, args.ApplicationId, AIGenerationRequestKeyHelper.FormWorksheetOperationType);
@@ -177,10 +165,12 @@ internal static List<AiWorksheetFieldSuggestion> ParseWorksheetDefinition(string
         {
             field.Key = field.Key?.Trim() ?? string.Empty;
             field.Label = field.Label?.Trim() ?? string.Empty;
+            field.Type = field.Type?.Trim() ?? string.Empty;
             if (string.IsNullOrWhiteSpace(field.Key)
                 || string.IsNullOrWhiteSpace(field.Label)
                 || !keys.Add(field.Key)
-                || !Enum.TryParse<CustomFieldType>(field.Type, false, out var type)
+                || field.Type.Any(char.IsDigit)
+                || !Enum.TryParse<CustomFieldType>(field.Type, true, out var type)
                 || !SupportedSuggestionTypes.Contains(type))
             {
                 throw new InvalidOperationException("Worksheet generation returned an unusable worksheet definition.");
@@ -192,11 +182,6 @@ internal static List<AiWorksheetFieldSuggestion> ParseWorksheetDefinition(string
         return dto.Fields;
     }
 
-    private static string BuildWorksheetName(Guid formVersionId, Guid formId)
-    {
-        return $"ai-form-{formId}-version-{formVersionId}-worksheet";
-    }
-
     internal static Worksheet BuildWorksheet(List<AiWorksheetFieldSuggestion> suggestions, string worksheetName)
     {
         var worksheet = new Worksheet(Guid.NewGuid(), worksheetName, "AI Suggested Fields");
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
index 61a97a23ed..e7e05eb9e1 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/ApplicationForms/Mapping.js
@@ -411,12 +411,12 @@
             const fieldId = `ai-worksheet-field-${field.id}`;
             const $row = $('<div class="ai-worksheet-review__field"></div>');
             $('<span class="ai-worksheet-review__field-name"></span>')
-                .attr('data-field-role', 'CHEFS')
+                .attr('data-field-role', 'Source')
                 .text(field.key || '—')
                 .appendTo($row);
             $('<i class="fa-solid fa-arrow-right ai-worksheet-review__arrow" aria-hidden="true"></i>').appendTo($row);
             $('<span class="ai-worksheet-review__field-name"></span>')
-                .attr('data-field-role', 'Unity')
+                .attr('data-field-role', 'Worksheet')
                 .text(field.label || field.key || '—')
                 .appendTo($row);
             const $switch = $('<div class="ai-worksheet-review__switch"></div>');
@@ -425,6 +425,7 @@
                 .attr('id', fieldId)
                 .attr('data-field-id', field.id)
                 .attr('aria-label', `Include ${field.label || field.key || 'field'}`)
+                .prop('checked', field.selected !== false)
                 .appendTo($switchContainer);
             $switchContainer.appendTo($switch);
             $switch.appendTo($row);
@@ -439,10 +440,9 @@
     function updateAiWorksheetReview() {
         const $fields = UIElements.worksheetReviewFields.find('input[data-field-id]');
         const selectedCount = $fields.filter(':checked').length;
-        $('#aiWorksheetReviewSelectionCount').text(`${selectedCount} of ${$fields.length} selected`);
         $('#aiWorksheetReviewSelectAll')
             .prop('checked', $fields.length > 0 && selectedCount === $fields.length)
-            .prop('indeterminate', selectedCount > 0 && selectedCount < $fields.length);
+            .prop('indeterminate', false);
         updateAiWorksheetDraftButton();
     }
 
@@ -519,23 +519,32 @@
             return;
         }
 
-        UIElements.btnCreateWorksheetDraft.prop('disabled', true);
-        UIElements.btnDiscardWorksheet.prop('disabled', true);
-        abp.ajax({
-            url: `/api/app/application-form-version/discard-ai-worksheet-suggestions?formVersionId=${encodeURIComponent(formVersion)}`,
-            type: 'POST'
-        })
-            .done(function () {
-                setAiWorksheetPending(false);
-                UIElements.worksheetReviewModal.modal('hide');
-                abp.notify.success('', 'Remaining AI worksheet suggestions discarded.');
-            })
-            .fail(function () {
-                abp.notify.error('', 'Unable to discard the remaining AI worksheet suggestions.');
-            })
-            .always(function () {
-                UIElements.btnDiscardWorksheet.prop('disabled', false);
-                updateAiWorksheetDraftButton();
+        abp.message.confirm(
+            'This will permanently remove the remaining AI field suggestions.',
+            'Discard remaining suggestions?')
+            .then(function (confirmed) {
+                if (!confirmed) {
+                    return;
+                }
+
+                UIElements.btnCreateWorksheetDraft.prop('disabled', true);
+                UIElements.btnDiscardWorksheet.prop('disabled', true);
+                abp.ajax({
+                    url: `/api/app/application-form-version/discard-ai-worksheet-suggestions?formVersionId=${encodeURIComponent(formVersion)}`,
+                    type: 'POST'
+                })
+                    .done(function () {
+                        setAiWorksheetPending(false);
+                        UIElements.worksheetReviewModal.modal('hide');
+                        abp.notify.success('', 'Remaining AI worksheet suggestions discarded.');
+                    })
+                    .fail(function () {
+                        abp.notify.error('', 'Unable to discard the remaining AI worksheet suggestions.');
+                    })
+                    .always(function () {
+                        UIElements.btnDiscardWorksheet.prop('disabled', false);
+                        updateAiWorksheetDraftButton();
+                    });
             });
     }
 
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewComponent.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewComponent.cs
index c2417ff1b3..5650982d31 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewComponent.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/CustomFieldsViewComponent.cs
@@ -8,6 +8,7 @@
 using System.Linq;
 using Volo.Abp.AspNetCore.Mvc.UI.Bundling;
 using Unity.GrantManager.ApplicationForms;
+using Unity.GrantManager.ApplicationForms.Mapping;
 using Unity.Flex.Worksheets;
 using Unity.Flex.WorksheetLinks;
 using Unity.GrantManager.Flex;
@@ -43,10 +44,12 @@ public async Task<IViewComponentResult> InvokeAsync(string? formVersionId, strin
             model.ChefsFormPublished = formVersion?.Published;
             model.WorksheetLinks = await worksheetLinkAppService.GetListByCorrelationAsync(formVersion?.Id ?? Guid.Empty, CorrelationConsts.FormVersion);
 
-            var aiWorksheetName = $"ai-form-{formVersion?.ApplicationFormId}-version-{formVersion?.Id}-worksheet";
+            var aiSuggestionWorksheetName = formVersion == null
+                ? string.Empty
+                : AiWorksheetSuggestionName.Build(formVersion.ApplicationFormId, formVersion.Id);
             var worksheets = await worksheetListAppService.GetListAsync();
             model.HasPendingAiWorksheet = worksheets
-                .Any(worksheet => !worksheet.Published && worksheet.Name == aiWorksheetName);
+                .Any(worksheet => !worksheet.Published && worksheet.Name == aiSuggestionWorksheetName);
 
             model.PublishedWorksheets = [.. worksheets
                 .Where(s => s.Published && !model.WorksheetLinks.Select(s => s.WorksheetId).Contains(s.Id))
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
index 24b3dcd4ec..579a7aaebf 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.cshtml
@@ -191,41 +191,37 @@
 </div>
 
 <div class="modal fade" id="aiWorksheetReviewModal" tabindex="-1" aria-labelledby="aiWorksheetReviewModalLabel" aria-hidden="true">
-    <div class="modal-dialog modal-xl modal-dialog-centered">
+    <div class="modal-dialog modal-lg modal-dialog-centered">
         <div class="modal-content ai-worksheet-review">
-            <div class="modal-header ai-worksheet-review__header">
-                <div>
-                    <div class="ai-worksheet-review__eyebrow">AI worksheet draft</div>
-                    <h5 class="modal-title" id="aiWorksheetReviewModalLabel">Choose fields for your worksheet</h5>
-                </div>
-                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-            </div>
-            <div class="modal-body ai-worksheet-review__body">
-                <div class="ai-worksheet-review__intro">
-                    <span>Create one or more draft worksheets from these suggestions. You can update the field details later.</span>
-                </div>
-                <div class="mb-3">
-                    <label for="aiWorksheetTitle" class="form-label">Worksheet title</label>
-                    <input id="aiWorksheetTitle" class="form-control" type="text" required maxlength="256" />
+            <div class="ai-worksheet-review__panel">
+                <div class="modal-header ai-worksheet-review__header">
+                    <div>
+                        <h5 class="modal-title" id="aiWorksheetReviewModalLabel">Create worksheet draft</h5>
+                    </div>
                 </div>
-                <div class="ai-worksheet-review__list">
-                    <div class="ai-worksheet-review__table-header">
-                        <span>CHEFS field</span>
-                        <span aria-hidden="true"></span>
-                        <span>Unity field</span>
-                        <span class="text-center">
-                            <span id="aiWorksheetReviewSelectionCount" class="d-block">0 selected</span>
-                            <input id="aiWorksheetReviewSelectAll" class="form-check-input" type="checkbox" aria-label="Include all suggested fields" />
-                        </span>
+                <div class="modal-body ai-worksheet-review__body">
+                    <div class="ai-worksheet-review__title-group">
+                        <label for="aiWorksheetTitle" class="form-label">Worksheet title</label>
+                        <input id="aiWorksheetTitle" class="form-control" type="text" required maxlength="256" placeholder="e.g., Project details" autocomplete="off" />
+                    </div>
+                    <div class="ai-worksheet-review__list">
+                        <div class="ai-worksheet-review__table-header">
+                            <span>Source field</span>
+                            <span aria-hidden="true"></span>
+                            <span>Worksheet field</span>
+                            <div class="form-check unt-form-switch form-switch mb-0 ai-worksheet-review__select-all">
+                                <input id="aiWorksheetReviewSelectAll" class="form-check-input" type="checkbox" aria-label="Include all suggested fields" />
+                            </div>
+                        </div>
+                        <div id="aiWorksheetReviewFields"></div>
+                        <div id="aiWorksheetReviewEmpty" class="ai-worksheet-review__empty d-none">No custom fields were suggested.</div>
                     </div>
-                    <div id="aiWorksheetReviewFields"></div>
-                    <div id="aiWorksheetReviewEmpty" class="ai-worksheet-review__empty d-none">No custom fields were suggested.</div>
                 </div>
-            </div>
-            <div class="modal-footer ai-worksheet-review__footer">
-                <button type="button" id="btn-create-ai-worksheet-draft" class="btn btn-primary" disabled>Create draft</button>
-                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Resume later</button>
-                <button type="button" id="btn-discard-ai-worksheet" class="btn btn-outline-danger">Discard remaining</button>
+                <div class="modal-footer ai-worksheet-review__footer">
+                    <button type="button" id="btn-create-ai-worksheet-draft" class="btn unt-btn-primary btn-primary" disabled>Create draft</button>
+                    <button type="button" class="btn unt-btn-outline-primary btn-outline-primary" data-bs-dismiss="modal">Review later</button>
+                    <button type="button" id="btn-discard-ai-worksheet" class="btn btn-outline-danger ai-worksheet-review__discard">Discard remaining</button>
+                </div>
             </div>
         </div>
     </div>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css
index aa54153e2c..e5511e4b19 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/CustomFields/Default.css
@@ -114,120 +114,93 @@
 
 .ai-worksheet-review {
     border: 0;
-    border-radius: 12px;
+    border-radius: 10px;
     overflow: hidden;
 }
 
+.ai-worksheet-review__panel {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+    padding: 20px;
+}
+
+.ai-worksheet-review__panel > .modal-header,
+.ai-worksheet-review__panel > .modal-body,
+.ai-worksheet-review__panel > .modal-footer {
+    margin: 0;
+    padding: 0;
+}
+
 .ai-worksheet-review__body {
     display: flex;
+    flex: 0 1 auto;
     flex-direction: column;
+    gap: 12px;
     max-height: min(65vh, 42rem);
 }
 
 .ai-worksheet-review__list {
-    flex: 1 1 auto;
+    flex: 0 1 auto;
     min-height: 0;
     overflow-y: auto;
 }
 
 .ai-worksheet-review__header {
-    align-items: flex-start;
-    border-bottom: 1px solid #d8e1eb;
-    padding: 1.5rem 1.75rem 1.25rem;
+    border-bottom: 0;
 }
 
-.ai-worksheet-review__header .btn-close {
-    margin-top: 0.25rem;
+.ai-worksheet-review .modal-title {
+    color: #1f2933;
+    font-size: 1.25rem;
+    font-weight: 600;
+    line-height: 1.3;
+    margin: 0;
 }
 
-.ai-worksheet-review__eyebrow {
-    color: var(--bc-colors-blue-primary, #255a90);
-    font-size: 0.75rem;
-    font-weight: 700;
-    letter-spacing: 0.08em;
+.ai-worksheet-review__title-group .form-label {
+    color: #334e68;
+    font-size: 0.875rem;
+    font-weight: 600;
     margin-bottom: 0.25rem;
-    text-transform: uppercase;
 }
 
-.ai-worksheet-review__intro {
-    align-items: center;
-    color: #4a5563;
-    display: flex;
+.ai-worksheet-review__title-group .form-control {
+    border-color: #b8c7d6;
     font-size: 0.9375rem;
-    justify-content: space-between;
-    margin-bottom: 1.25rem;
 }
 
-.ai-worksheet-review__section {
-    border: 1px solid #d8e1eb;
-    border-radius: 8px;
-    margin-bottom: 1rem;
-    overflow: hidden;
-}
-
-.ai-worksheet-review__section-header {
-    align-items: center;
-    background: #f4f7fa;
-    display: grid;
-    grid-template-columns: minmax(0, 1fr) 2rem minmax(0, 1fr) 4.5rem;
-    padding: 0.75rem 1rem;
-}
-
-.ai-worksheet-review__section-title-group {
-    align-items: center;
-    display: flex;
-    gap: 0.75rem;
-    grid-column: 1 / 4;
-    min-width: 0;
-}
-
-.ai-worksheet-review__section-title {
-    font-size: 1rem;
-    font-weight: 700;
-    margin: 0;
-}
-
-.ai-worksheet-review__section-count {
-    background: #e8f1fa;
-    border-radius: 999px;
-    color: #255a90;
-    font-size: 0.8125rem;
-    font-weight: 600;
-    padding: 0.25rem 0.625rem;
-    white-space: nowrap;
-}
-
-.ai-worksheet-review__section-switch {
-    flex: 0 0 auto;
-    grid-column: 4;
-    justify-self: center;
+.ai-worksheet-review__title-group .form-control:focus {
+    border-color: var(--bc-colors-blue-primary, #255a90);
+    box-shadow: 0 0 0 0.2rem rgb(37 90 144 / 15%);
 }
 
 .ai-worksheet-review__table-header,
 .ai-worksheet-review__field {
     display: grid;
-    grid-template-columns: minmax(0, 1fr) 2rem minmax(0, 1fr) 4.5rem;
+    grid-template-columns: minmax(0, 1fr) 2rem minmax(0, 1fr) auto;
 }
 
 .ai-worksheet-review__table-header {
+    align-items: center;
+    background: #f4f7fa;
     border-bottom: 1px solid #d8e1eb;
-    color: #596777;
+    color: #486581;
     font-size: 0.75rem;
     font-weight: 700;
     letter-spacing: 0.05em;
-    padding: 0.65rem 1rem;
+    min-height: 2.5rem;
+    padding-inline: 0.75rem;
     position: sticky;
     top: 0;
-    background: #fff;
     z-index: 1;
     text-transform: uppercase;
 }
 
 .ai-worksheet-review__field {
     align-items: center;
-    background: #fff;
-    min-height: 4rem;
-    padding: 0.75rem 1rem;
+    min-height: 3.5rem;
+    padding-inline: 0.75rem;
 }
 
 .ai-worksheet-review__field + .ai-worksheet-review__field {
@@ -236,7 +209,9 @@
 
 .ai-worksheet-review__field-name {
     color: #1f2933;
+    font-size: 0.9375rem;
     font-weight: 600;
+    line-height: 1.4;
     overflow-wrap: anywhere;
 }
 
@@ -246,45 +221,64 @@
 }
 
 .ai-worksheet-review__switch {
-    justify-self: center;
+    justify-self: end;
+}
+
+.ai-worksheet-review__field:hover {
+    background: #f9fbfd;
+}
+
+.ai-worksheet-review__select-all {
+    align-items: center;
+    display: flex;
+    justify-self: end;
 }
 
 .ai-worksheet-review__empty {
-    background: #f4f7fa;
-    border: 1px dashed #9fb3c8;
-    border-radius: 8px;
     color: #486581;
-    padding: 1.5rem;
     text-align: center;
 }
 
 .ai-worksheet-review__footer {
-    border-top: 1px solid #d8e1eb;
-    padding: 1rem 1.75rem;
+    border-top: 0;
+    gap: 0.5rem;
+    justify-content: flex-start;
 }
 
-@media (max-width: 767.98px) {
-    .ai-worksheet-review__intro {
-        align-items: flex-start;
-        flex-direction: column;
-        gap: 0.75rem;
-    }
+.ai-worksheet-review__footer > * {
+    margin: 0;
+}
 
-    .ai-worksheet-review__field {
-        grid-template-columns: minmax(0, 1fr) 1.5rem auto;
-        row-gap: 0.5rem;
+.ai-worksheet-review__footer .btn {
+    font-size: inherit;
+    font-weight: 400;
+}
+
+.ai-worksheet-review__discard {
+    --bs-btn-color: #b42318;
+    --bs-btn-border-color: #b42318;
+    --bs-btn-hover-bg: #b42318;
+    --bs-btn-hover-border-color: #b42318;
+    --bs-btn-hover-color: #fff;
+}
+
+@media (max-width: 767.98px) {
+    .ai-worksheet-review__body {
+        max-height: 70vh;
     }
 
-    .ai-worksheet-review__section-header {
-        grid-template-columns: minmax(0, 1fr) 1.5rem auto;
+    .ai-worksheet-review__table-header {
+        display: flex;
+        justify-content: flex-end;
     }
 
-    .ai-worksheet-review__section-title-group {
-        grid-column: 1 / 3;
+    .ai-worksheet-review__table-header > span {
+        display: none;
     }
 
-    .ai-worksheet-review__section-switch {
-        grid-column: 3;
+    .ai-worksheet-review__field {
+        grid-template-columns: minmax(0, 1fr) 1.5rem auto;
+        row-gap: 0.5rem;
     }
 
     .ai-worksheet-review__field-name:first-child {
@@ -315,4 +309,5 @@
         grid-column: 3 / 4;
         grid-row: 1 / 3;
     }
+
 }
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs
index 0f46318ea3..1ea11d1bd6 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/AI/GenerateFormWorksheetJobTests.cs
@@ -15,6 +15,7 @@ public class GenerateFormWorksheetJobTests
     [InlineData("""{"fields":[{"key":"project","label":"","type":"Text"}]}""")]
     [InlineData("""{"fields":[{"key":"project","label":"Project","type":"Radio"}]}""")]
     [InlineData("""{"fields":[{"key":"project","label":"Project","type":2}]}""")]
+    [InlineData("""{"fields":[{"key":"project","label":"Project","type":" "}]}""")]
     [InlineData("""{"fields":[{"key":"project","label":"Project","type":"Text"},{"key":"PROJECT","label":"Other","type":"Text"}]}""")]
     public void ParseWorksheetDefinition_Should_Reject_Incomplete_Ai_Response(string worksheetJson)
     {
@@ -37,6 +38,16 @@ public void ParseWorksheetDefinition_Should_Accept_Flat_Safe_Field_Suggestions()
         fields[1].ResolvedType.ShouldBe(CustomFieldType.Currency);
     }
 
+    [Fact]
+    public void ParseWorksheetDefinition_Should_Trim_And_Ignore_Case_For_Safe_Field_Types()
+    {
+        var fields = GenerateFormWorksheetJob.ParseWorksheetDefinition("""
+            {"fields":[{"key":"projectName","label":"Project Name","type":"  teXT  "}]}
+            """);
+
+        fields.Single().ResolvedType.ShouldBe(CustomFieldType.Text);
+    }
+
     [Fact]
     public void BuildWorksheet_Should_Create_One_SuggestedFields_Section_With_Default_Definitions()
     {
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs
index 8c7cb0a2bd..ca37cd67bf 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Application.Tests/ApplicationForms/ApplicationFormVersionAppServiceTests.cs
@@ -128,6 +128,31 @@ public async Task GetPendingAiWorksheetAsync_Should_Return_Unpublished_Worksheet
         result.Fields.Single().Selected.ShouldBeTrue();
     }
 
+    [Fact]
+    public async Task DiscardAiWorksheetSuggestionsAsync_Should_Not_Delete_Published_Containers()
+    {
+        var formVersionId = Guid.NewGuid();
+        var formId = Guid.NewGuid();
+        var formVersion = new ApplicationFormVersion { ApplicationFormId = formId };
+        var publishedSuggestion = BuildAiWorksheet(formId, formVersionId, published: true);
+        var formVersionRepository = Substitute.For<IApplicationFormVersionRepository>();
+        formVersionRepository.GetAsync(formVersionId).Returns(formVersion);
+        var worksheetRepository = Substitute.For<IWorksheetRepository>();
+        worksheetRepository.GetByNameAsync(Arg.Any<string>(), true).Returns(publishedSuggestion);
+
+        var service = CreateService(
+            Substitute.For<IRepository<ApplicationFormVersion, Guid>>(),
+            Substitute.For<IApplicationFormVersionMappingReadService>(),
+            Substitute.For<IFormMappingService>(),
+            formVersionRepository,
+            worksheetRepository);
+        service.LazyServiceProvider = GetRequiredService<IAbpLazyServiceProvider>();
+
+        await service.DiscardAiWorksheetSuggestionsAsync(formVersionId);
+
+        await worksheetRepository.DidNotReceive().DeleteAsync(Arg.Any<Worksheet>(), Arg.Any<bool>());
+    }
+
     [Fact]
     public async Task CreateAiWorksheetDraftAsync_Should_Create_Unlinked_Unpublished_Draft_And_Keep_Remaining_Suggestions()
     {
@@ -227,7 +252,7 @@ private static Worksheet BuildAiWorksheet(Guid formId, Guid formVersionId, bool
     {
         var worksheet = new Worksheet(
             Guid.NewGuid(),
-            $"ai-form-{formId}-version-{formVersionId}-worksheet",
+            AiWorksheetSuggestionName.Build(formId, formVersionId),
             "AI Worksheet");
         worksheet.SetPublished(published);
 

From 13d7dcae27b8e263ea808bd8112374c445cbc1a2 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Fri, 24 Jul 2026 16:58:25 -0700
Subject: [PATCH 31/40] AB#33787 - Fixed Copilot raised issues.

---
 .../Domain/Services/PaymentsManager.cs               |  2 +-
 .../Domain/Workflow/WorkflowExtensions.cs            |  2 +-
 .../MessageBrokers.RabbitMQ/ConnectionProvider.cs    | 12 +++++++++---
 .../Interfaces/IQueueChannelProvider.cs              |  8 ++++++++
 .../MessageBrokers.RabbitMQ/QueueConsumerHandler.cs  |  5 +++++
 .../MessageBrokers.RabbitMQ/QueueProducer.cs         |  6 ++++++
 .../IApplicationFormSycnronizationService.cs         |  2 +-
 .../ApplicationFormSycnronizationService.cs          | 10 +++++-----
 .../Assessments/AssessmentAppService.cs              |  2 +-
 .../Workflow/UnityWorkflowExtensions.cs              |  2 +-
 .../Applications/ApplicationManager.cs               |  4 ++--
 .../Applications/OnboardingApplicationManager.cs     |  6 +++---
 12 files changed, 43 insertions(+), 18 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs
index fdd0b90074..0960c1a8fb 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Services/PaymentsManager.cs
@@ -79,7 +79,7 @@ public async Task<List<PaymentActionResultItem>> GetActions(Guid paymentRequests
                 s => paymentRequest.SetPaymentRequestStatus(s), ConfigureWorkflow);
 
             var allActions = Workflow.GetAllActions().Distinct().ToList();
-            var permittedActions = (await Workflow.GetPermittedActions()).ToList();
+            var permittedActions = (await Workflow.GetPermittedActionsAsync()).ToList();
 
             var actionsList = allActions
                 .Select(trigger =>
diff --git a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/WorkflowExtensions.cs b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/WorkflowExtensions.cs
index 3ef2ba25b7..7ee5eef862 100644
--- a/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/WorkflowExtensions.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Application/Domain/Workflow/WorkflowExtensions.cs
@@ -11,7 +11,7 @@ public static class UnityWorkflowExtensions
     /// <summary>
     /// The currently permitted actions allowed by the workflow state machine.
     /// </summary>
-    public static async Task<IEnumerable<TTriggers>> GetPermittedActions<TStates, TTriggers>(this PaymentsWorkflow<TStates, TTriggers> workflow)
+    public static async Task<IEnumerable<TTriggers>> GetPermittedActionsAsync<TStates, TTriggers>(this PaymentsWorkflow<TStates, TTriggers> workflow)
     {
         return await workflow._stateMachine.GetPermittedTriggersAsync();
     }
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ConnectionProvider.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ConnectionProvider.cs
index 76d2389fa5..37da8dd4fe 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ConnectionProvider.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/ConnectionProvider.cs
@@ -21,18 +21,24 @@ public ConnectionProvider(ILogger<ConnectionProvider> logger, IConnectionFactory
 
         public async ValueTask DisposeAsync()
         {
+            if (_connection == null) return;
+
             try
             {
-                if (_connection != null && _connection.IsOpen)
+                if (_connection.IsOpen)
                 {
                     _logger.LogDebug("Closing the connection");
                     await _connection.CloseAsync();
-                    await _connection.DisposeAsync();
                 }
             }
             catch (Exception ex)
             {
-                _logger.LogCritical(ex, "Cannot dispose RabbitMq channel or connection");
+                _logger.LogCritical(ex, "Cannot close RabbitMq connection");
+            }
+            finally
+            {
+                // Always dispose, even if the connection was already closed or faulted.
+                await _connection.DisposeAsync();
             }
         }
 
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueChannelProvider.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueChannelProvider.cs
index 7868cce3a6..1baa6ebc8c 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueChannelProvider.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/Interfaces/IQueueChannelProvider.cs
@@ -15,6 +15,14 @@ public interface IQueueChannelProvider<TQueueMessage> : IDisposable where TQueue
         /// Gets a channel for publishing or consuming messages.
         /// </summary>
         Task<IChannel> GetChannelAsync();
+
+        /// <summary>
+        /// Returns a channel obtained from <see cref="GetChannelAsync"/> so it can be pooled
+        /// or disposed and its throttling permit released. Callers that finish with a channel
+        /// (for example a one-off publish) must return it; long-lived consumer channels are
+        /// kept open and are not returned until the consumer is torn down.
+        /// </summary>
+        void ReturnChannel(IChannel channel);
     }
 }
 #pragma warning restore CA1005 // Avoid excessive parameters on generic types
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerHandler.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerHandler.cs
index 8fa8e61496..37e07c7048 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerHandler.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueConsumerHandler.cs
@@ -78,6 +78,11 @@ async Task IQueueConsumerHandler<TMessageConsumer, TQueueMessage>.CancelQueueCon
                 _logger.LogError(ex, "Error canceling consumer {Consumer}", _consumerName);
                 throw new QueueingException($"Error canceling consumer {_consumerName}", ex);
             }
+            finally
+            {
+                // Return the short-lived cancel channel so it is disposed and its permit released.
+                channelProvider.ReturnChannel(channel);
+            }
         }
 
         private async Task HandleMessageAsync(object sender, BasicDeliverEventArgs ea)
diff --git a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueProducer.cs b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueProducer.cs
index f0b09c2272..2af53183cb 100644
--- a/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueProducer.cs
+++ b/applications/Unity.GrantManager/modules/Unity.SharedKernel/MessageBrokers.RabbitMQ/QueueProducer.cs
@@ -70,6 +70,12 @@ await channel.BasicPublishAsync(
                 _logger.LogError(ex, "PublishMessage Exception: {Message}", ex.Message);
                 throw new QueueingException($"Publish failed: {ex.Message}", ex);
             }
+            finally
+            {
+                // Return the channel so it is pooled (if still open) or disposed, and its
+                // throttling permit is released. Without this the channel and permit leak.
+                _channelProvider.ReturnChannel(channel);
+            }
         }
 
         private static byte[] SerializeMessage(TQueueMessage message)
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormSycnronizationService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormSycnronizationService.cs
index 767c9fb7a3..fc37be3b04 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormSycnronizationService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application.Contracts/ApplicationForms/IApplicationFormSycnronizationService.cs
@@ -16,7 +16,7 @@ public interface IApplicationFormSycnronizationService : ICrudAppService<
         Task<IList<ApplicationFormDto>> GetConnectedApplicationFormsAsync();
         Task<(HashSet<string> MissingSubmissions, string MissingSubmissionsReport)> GetMissingSubmissions(int numberOfDaysToCheck);
         Task<HashSet<string>> GetChefsSubmissions(ApplicationFormDto applicationFormDto, int numberOfDaysToCheck);
-        HashSet<string> GetSubmissionsByForm(Guid applicationFormId);
+        Task<HashSet<string>> GetSubmissionsByFormAsync(Guid applicationFormId);
 
     }
 }
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormSycnronizationService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormSycnronizationService.cs
index e759648a5a..0f1416ab6c 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormSycnronizationService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/ApplicationForms/ApplicationFormSycnronizationService.cs
@@ -177,7 +177,7 @@ private async Task ProcessSubmission(ApplicationFormDto applicationFormDto, JObj
                     try
                     {
                         HashSet<string> newChefsSubmissions = await GetChefsSubmissions(applicationFormDto, numberOfDaysToCheck);
-                        HashSet<string> existingSubmissions = GetSubmissionsByForm(applicationFormDto.Id);
+                        HashSet<string> existingSubmissions = await GetSubmissionsByFormAsync(applicationFormDto.Id);
                         missingSubmissions = [.. newChefsSubmissions.Except(existingSubmissions)];
                         if (missingSubmissions.Count > 0)
                         {
@@ -244,18 +244,18 @@ private async Task ProcessSubmission(ApplicationFormDto applicationFormDto, JObj
             return tenantName;
         }
 
-        public HashSet<string> GetSubmissionsByForm(Guid applicationFormId)
+        public async Task<HashSet<string>> GetSubmissionsByFormAsync(Guid applicationFormId)
         {
-            IQueryable<ApplicationFormSubmission> queryableApplicationFormSubmissions = ApplicationFormSubmissionRepository.GetQueryableAsync().Result;
+            IQueryable<ApplicationFormSubmission> queryableApplicationFormSubmissions = await ApplicationFormSubmissionRepository.GetQueryableAsync();
             var formSubmissionGuids = queryableApplicationFormSubmissions.Where(x => x.ApplicationFormId.Equals(applicationFormId)).Select(o => o.ChefsSubmissionGuid).ToHashSet();
             return formSubmissionGuids;
         }
 
         public async Task<IList<ApplicationFormDto>> GetConnectedApplicationFormsAsync()
         {
-            IQueryable<ApplicationForm> queryableApplicationForms = ApplicationFormRepository.GetQueryableAsync().Result;
+            IQueryable<ApplicationForm> queryableApplicationForms = await ApplicationFormRepository.GetQueryableAsync();
             var forms = queryableApplicationForms.Where(x => (x.ApiKey ?? string.Empty) != string.Empty).ToList();
-            return await Task.FromResult<IList<ApplicationFormDto>>(ObjectMapper.Map<List<ApplicationForm>, List<ApplicationFormDto>>([.. forms]));
+            return ObjectMapper.Map<List<ApplicationForm>, List<ApplicationFormDto>>([.. forms]);
         }
 
         public async Task<HashSet<string>> GetChefsSubmissions(ApplicationFormDto applicationFormDto, int numberOfDaysToCheck)
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Assessments/AssessmentAppService.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Assessments/AssessmentAppService.cs
index 98a95a47b7..4a46d2b10f 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Assessments/AssessmentAppService.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Assessments/AssessmentAppService.cs
@@ -262,7 +262,7 @@ public List<AssessmentAction> GetAllActions()
         public async Task<List<AssessmentAction>> GetPermittedActions(Guid assessmentId)
         {
             var assessment = await _assessmentRepository.GetAsync(assessmentId);
-            var workflowActions = await assessment.Workflow.GetPermittedActions();
+            var workflowActions = await assessment.Workflow.GetPermittedActionsAsync();
 
             List<AssessmentAction> permittedActions = new();
             foreach (var triggerAction in workflowActions)
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflowExtensions.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflowExtensions.cs
index 2afd849392..d4f251af91 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflowExtensions.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain.Shared/Workflow/UnityWorkflowExtensions.cs
@@ -9,7 +9,7 @@ public static class UnityWorkflowExtensions
     /// <summary>
     /// The currently permitted actions allowed by the workflow state machine.
     /// </summary>
-    public static async Task<IEnumerable<TTriggers>> GetPermittedActions<TStates, TTriggers>(this UnityWorkflow<TStates, TTriggers> workflow)
+    public static async Task<IEnumerable<TTriggers>> GetPermittedActionsAsync<TStates, TTriggers>(this UnityWorkflow<TStates, TTriggers> workflow)
     {
         return await workflow._stateMachine.GetPermittedTriggersAsync();
     }
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs
index 8a2238a365..dda32a25f5 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/ApplicationManager.cs
@@ -178,7 +178,7 @@ public async Task<List<ApplicationActionResultItem>> GetActions(Guid application
             });
 
         var allActions = Workflow.GetAllActions().Distinct().ToList();
-        var permittedActions = (await Workflow.GetPermittedActions()).ToList();
+        var permittedActions = (await Workflow.GetPermittedActionsAsync()).ToList();
 
         var actionsList = allActions
             .Select(trigger =>
@@ -203,7 +203,7 @@ public async Task<bool> IsActionAllowed(Application application, GrantApplicatio
                 ConfigureWorkflow(sm, application.ApplicationForm.IsDirectApproval);
             });
 
-        return (await Workflow.GetPermittedActions()).Contains(triggerAction);
+        return (await Workflow.GetPermittedActionsAsync()).Contains(triggerAction);
     }
 
     /// <summary>
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/OnboardingApplicationManager.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/OnboardingApplicationManager.cs
index 751e9b0a1a..00451b61b1 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/OnboardingApplicationManager.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Domain/Applications/OnboardingApplicationManager.cs
@@ -1,4 +1,4 @@
-using Stateless;
+using Stateless;
 using System;
 using System.Collections.Generic;
 using System.Linq;
@@ -40,7 +40,7 @@ public async Task<List<ApplicationActionResultItem>> GetActions(Guid application
             ConfigureWorkflow);
 
         var allActions = workflow.GetAllActions().Distinct().ToList();
-        var permittedActions = (await workflow.GetPermittedActions()).ToList();
+        var permittedActions = (await workflow.GetPermittedActionsAsync()).ToList();
 
         return allActions
             .Select(trigger => new ApplicationActionResultItem
@@ -61,7 +61,7 @@ public static async Task<bool> IsActionAllowed(Application application, GrantApp
             s => statusCode = s,
             ConfigureWorkflow);
 
-        return (await workflow.GetPermittedActions()).Contains(triggerAction);
+        return (await workflow.GetPermittedActionsAsync()).Contains(triggerAction);
     }
 
     public async Task<Application> TriggerAction(Guid applicationId, GrantApplicationAction triggerAction)

From 461339d53d88d6875d8e43fe2f1030d2715326c9 Mon Sep 17 00:00:00 2001
From: Jacob Smith <jacob.smith@gov.bc.ca>
Date: Fri, 24 Jul 2026 17:09:51 -0700
Subject: [PATCH 32/40] AB#33866 skip cooldown for pending worksheet review

---
 .../Automation/BackgroundJobs/GenerateFormWorksheetJob.cs | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
index 09fc8c0386..62f17de29c 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateFormWorksheetJob.cs
@@ -114,9 +114,15 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
                     var worksheet = BuildWorksheet(suggestions, worksheetName);
                     worksheet.SetPublished(false);
                     await worksheetRepository.InsertAsync(worksheet);
+
+                    await AIGenerationRequestJobHelper.StampCooldownBestEffortAsync(
+                        aiCooldownService,
+                        logger,
+                        args.RequestedByUserId,
+                        args.ApplicationId,
+                        AIGenerationRequestKeyHelper.FormWorksheetOperationType);
                 }
 
-                await AIGenerationRequestJobHelper.StampCooldownBestEffortAsync(aiCooldownService, logger, args.RequestedByUserId, args.ApplicationId, AIGenerationRequestKeyHelper.FormWorksheetOperationType);
                 await AIGenerationRequestJobHelper.MarkCompletedInNewUowAsync(
                     unitOfWorkManager,
                     generationRequestRepository,

From 4038368b9fa15b1e3597aa8f728b57ef0c37c26d Mon Sep 17 00:00:00 2001
From: aurelio-aot <aurelio.pascual.jr@gmail.com>
Date: Mon, 27 Jul 2026 13:11:47 -0700
Subject: [PATCH 33/40] AB#33414: Add more supported file types

---
 applications/Unity.GrantManager/.env.example  |   2 +-
 .../Emails/EmailAttachmentService.cs          |  14 +-
 .../Emails/EmailLogAttachmentAppService.cs    |   6 +
 .../NotificationsSettingGroup/Default.js      |  12 +-
 .../Attachments/S3BlobProvider.cs             |  69 +++---
 .../Controllers/AttachmentController.cs       |  99 ++++----
 .../Controllers/FileSignatureValidator.cs     |  75 ------
 .../Pages/Applicants/Details.js               |  14 +-
 .../Pages/GrantApplications/Details.js        |  14 +-
 .../Shared/Components/EmailsWidget/Default.js |  12 +-
 .../Unity.GrantManager.Web/appsettings.json   |   2 +-
 .../Components/AttachmentControllerTests.cs   | 222 ++++++++++++++----
 .../Components/AttachmentSecurityTests.cs     |  80 +++++++
 13 files changed, 402 insertions(+), 219 deletions(-)
 delete mode 100644 applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/FileSignatureValidator.cs
 create mode 100644 applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentSecurityTests.cs

diff --git a/applications/Unity.GrantManager/.env.example b/applications/Unity.GrantManager/.env.example
index 8a96d4d6fd..42e07659d4 100644
--- a/applications/Unity.GrantManager/.env.example
+++ b/applications/Unity.GrantManager/.env.example
@@ -54,7 +54,7 @@ AuthServer__OidcSignoutCallback="http://localhost:44342/signout-callback-oidc"
 ##S3__SecretAccessKey="******************"
 ##S3__ApplicationS3Folder="Unity/Application"
 ##S3__AssessmentS3Folder="Unity/Adjudication"
-##S3__AllowedFileTypes=["pdf","doc","docx","xls","xlsx","ppt","pptx","jpg","jpeg","png","gif","txt","csv","zip"]
+##S3__AllowedFileTypes=["pdf","doc","docx","xls","xlsx","ppt","pptx","jpg","jpeg","png","gif","txt","csv","zip","odt","ods","odp","rtf","bmp","tif","tiff","webp","heic","heif","eml","msg"]
 ##S3__MaxFileSize="25"
 ##S3__EmailAttachmentMaxFileSize="20"
 ##S3__EmailAttachmentsTotalMaxFileSize="25"
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Emails/EmailAttachmentService.cs b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Emails/EmailAttachmentService.cs
index 42c22f5d17..a68c3109cc 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Emails/EmailAttachmentService.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Emails/EmailAttachmentService.cs
@@ -8,6 +8,7 @@
 using System.Linq;
 using System.Threading.Tasks;
 using Unity.Notifications.Emails;
+using Volo.Abp.Authorization;
 using Volo.Abp.DependencyInjection;
 using Volo.Abp.Users;
 
@@ -77,13 +78,19 @@ public async Task<EmailLogAttachment> UploadAttachmentAsync(
             ContentType = contentType,
             FileSize = fileContent.Length,
             Time = DateTime.UtcNow,
+            // Unlike UploadUserAttachmentAsync below, this path is reached from
+            // EmailNotificationHandler - a local event handler that can run for
+            // system/schedule-triggered emails with no interactive user in context, so a missing
+            // ICurrentUser.Id here isn't necessarily an error condition. The caller already wraps
+            // this in a try/catch that logs and sends the email without the attachment on any
+            // failure, so Guid.Empty (rather than throwing) is the intentional "no user" marker.
             UserId = _currentUser.Id ?? Guid.Empty,
             TenantId = tenantId
         };
 
         await _emailLogAttachmentRepository.InsertAsync(attachment);
         return attachment;
-    }    
+    }
 
     public async Task<byte[]?> DownloadFromS3Async(string s3ObjectKey)
     {
@@ -143,7 +150,10 @@ public async Task<EmailLogAttachment> UploadUserAttachmentAsync(
             ContentType = contentType,
             FileSize = fileContent.Length,
             Time = DateTime.UtcNow,
-            UserId = _currentUser.Id ?? Guid.Empty,
+            // A missing ICurrentUser.Id means this was reached without an authenticated user -
+            // fail loudly rather than silently attributing the attachment to Guid.Empty, which
+            // would look like a valid, specific user rather than an error state.
+            UserId = _currentUser.Id ?? throw new AbpAuthorizationException("Cannot save an email attachment without an authenticated user."),
             TenantId = tenantId
         };
 
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Emails/EmailLogAttachmentAppService.cs b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Emails/EmailLogAttachmentAppService.cs
index 1933d5e6da..d5db9a21e3 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Emails/EmailLogAttachmentAppService.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/Emails/EmailLogAttachmentAppService.cs
@@ -122,6 +122,12 @@ public async Task<long> GetTotalFileSizeByEmailLogIdAsync(Guid? emailLogId, Guid
         return await emailAttachmentService.GetTotalFileSizeAsync(emailLogId, templateId);
     }
 
+    // Not exposed over HTTP: this method takes raw fileName/content/contentType with none of the
+    // allowlist/size/content-type validation AttachmentController enforces before calling it. It
+    // must only ever be reached in-process, via IEmailLogAttachmentUploadService, from a caller
+    // (AttachmentController) that has already run those checks - never directly by an HTTP client,
+    // which would bypass validation entirely despite still needing the Email.Send permission.
+    [RemoteService(false)]
     public async Task<EmailLogAttachmentDto> UploadAsync(Guid? emailLogId, Guid? templateId, Guid? tenantId, string fileName, byte[] content, string contentType)
     {
         var attachment = await emailAttachmentService.UploadUserAttachmentAsync(emailLogId, templateId, tenantId, fileName, content, contentType);
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js
index 2643568b36..2aea0dd641 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js
@@ -853,7 +853,17 @@ $(function () {
         const input = document.getElementById(inputId);
         if (!input?.files?.length) return;
 
-        const allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
+        let allowedTypes;
+        try {
+            allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
+            if (!Array.isArray(allowedTypes)) {
+                throw new Error('AllowedFileTypes did not parse to an array');
+            }
+        } catch (e) {
+            console.warn('Unable to parse allowed file types configuration:', e);
+            abp.notify.error('Unable to determine allowed file types. Please contact support.');
+            return;
+        }
         const maxFileSize = decodeURIComponent($('#EmailAttachmentMaxFileSize').val());
 
         let isAllowedTypeError = false;
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Attachments/S3BlobProvider.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Attachments/S3BlobProvider.cs
index c744885522..1a4c35b0b1 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Attachments/S3BlobProvider.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/Attachments/S3BlobProvider.cs
@@ -3,15 +3,16 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.AspNetCore.StaticFiles;
-using Microsoft.Extensions.Primitives;
 using System;
 using System.IO;
 using System.Linq;
 using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using Unity.GrantManager.Applications;
+using Volo.Abp.Authorization;
 using Volo.Abp.BlobStoring;
 using Volo.Abp.DependencyInjection;
+using Volo.Abp.Users;
 using Volo.Abp.Validation;
 
 namespace Unity.GrantManager.Attachments;
@@ -23,15 +24,17 @@ public partial class S3BlobProvider : BlobProviderBase, ITransientDependency
     private readonly IAssessmentAttachmentRepository _assessmentAttachmentRepository;
     private readonly IApplicantAttachmentRepository _applicantAttachmentRepository;
     private readonly IAmazonS3 _amazonS3Client;
+    private readonly ICurrentUser _currentUser;
 
-    public S3BlobProvider(IHttpContextAccessor httpContextAccessor, IApplicationAttachmentRepository attachmentRepository, IAssessmentAttachmentRepository assessmentAttachmentRepository, IApplicantAttachmentRepository applicantAttachmentRepository, IAmazonS3 amazonS3Client)
+    public S3BlobProvider(IHttpContextAccessor httpContextAccessor, IApplicationAttachmentRepository attachmentRepository, IAssessmentAttachmentRepository assessmentAttachmentRepository, IApplicantAttachmentRepository applicantAttachmentRepository, IAmazonS3 amazonS3Client, ICurrentUser currentUser)
     {
         _httpContextAccessor = httpContextAccessor;
         _applicationAttachmentRepository = attachmentRepository;
         _assessmentAttachmentRepository = assessmentAttachmentRepository;
         _applicantAttachmentRepository = applicantAttachmentRepository;
         _amazonS3Client = amazonS3Client;
-    }    
+        _currentUser = currentUser;
+    }
 
     public override async Task<bool> DeleteAsync(BlobProviderDeleteArgs args)
     {
@@ -156,39 +159,39 @@ private static string GetMimeType(string fileName)
     public override async Task SaveAsync(BlobProviderSaveArgs args)
     {
         var httpContext = _httpContextAccessor.HttpContext ?? throw new InvalidOperationException("No active HttpContext.");
-        var queryParams = httpContext.Request?.Query ?? throw new InvalidOperationException("No query parameters in the current request.");
-        var routeData = _httpContextAccessor.HttpContext.GetRouteData();
-        
+        var routeData = httpContext.GetRouteData();
+
         var assessmentId = routeData.Values["assessmentId"];
         var applicationId = routeData.Values["applicationId"];
         var applicantId = routeData.Values["applicantId"];
-        queryParams.TryGetValue("userId", out StringValues currentUserId);
+
+        // The uploader must be the authenticated caller, not a client-supplied value - a userId
+        // taken from the request (query string, form field, etc.) can be set to any GUID by the
+        // caller, letting one user attribute an upload to another user's identity. A missing
+        // ICurrentUser.Id means this was reached without authentication (AttachmentController
+        // requires [Authorize], so this should never happen) - fail loudly rather than silently
+        // attributing the upload to Guid.Empty, which would look like a valid, specific user.
+        var currentUserId = _currentUser.Id ?? throw new AbpAuthorizationException("Cannot save an attachment without an authenticated user.");
+
         if (assessmentId != null)
-        {            
-                        
-            #pragma warning disable CS8604 // Possible null reference argument.
-            await UploadAssessmentAttachment(args, assessmentId.ToString(), currentUserId.ToString());
-            #pragma warning restore CS8604 // Possible null reference argument.
+        {
+            await UploadAssessmentAttachment(args, assessmentId.ToString()!, currentUserId);
         }
         else if(applicationId != null)
-        {             
-            #pragma warning disable CS8604 // Possible null reference argument.
-            await UploadApplicationAttachment(args, applicationId.ToString(), currentUserId.ToString());
-            #pragma warning restore CS8604 // Possible null reference argument.
+        {
+            await UploadApplicationAttachment(args, applicationId.ToString()!, currentUserId);
         }
         else if (applicantId != null)
         {
-            #pragma warning disable CS8604 // Possible null reference argument.
-            await UploadApplicantAttachment(args, applicantId.ToString(), currentUserId.ToString());
-            #pragma warning restore CS8604 // Possible null reference argument.
+            await UploadApplicantAttachment(args, applicantId.ToString()!, currentUserId);
         }
         else
         {
             throw new AbpValidationException("Missing parameter: applicationId/assessmentId/applicantId");
-        }     
-    }    
-    
-    private async Task UploadAssessmentAttachment(BlobProviderSaveArgs args, string assessmentId, string currentUserId)
+        }
+    }
+
+    private async Task UploadAssessmentAttachment(BlobProviderSaveArgs args, string assessmentId, Guid currentUserId)
     {
         var config = args.Configuration.GetS3BlobProviderConfiguration();
         var bucket = config.Bucket;
@@ -211,21 +214,21 @@ await _assessmentAttachmentRepository.InsertAsync(
                {
                    AssessmentId = new Guid(assessmentId),
                    S3ObjectKey = key,
-                   UserId = new Guid(currentUserId),
+                   UserId = currentUserId,
                    FileName = args.BlobName,
                    Time = DateTime.UtcNow,
                });
         }
         else
         {
-            attachment.UserId = new Guid(currentUserId);
+            attachment.UserId = currentUserId;
             attachment.FileName = args.BlobName;
             attachment.Time = DateTime.UtcNow;
             await _assessmentAttachmentRepository.UpdateAsync(attachment);
         }
     }
 
-    private async Task UploadApplicationAttachment(BlobProviderSaveArgs args, string applicationId, string currentUserId)
+    private async Task UploadApplicationAttachment(BlobProviderSaveArgs args, string applicationId, Guid currentUserId)
     {
         var config = args.Configuration.GetS3BlobProviderConfiguration();
         var bucket = config.Bucket;
@@ -248,21 +251,21 @@ await _applicationAttachmentRepository.InsertAsync(
                 {
                     ApplicationId = new Guid(applicationId),
                     S3ObjectKey = key,
-                    UserId = new Guid(currentUserId),
-                    FileName = args.BlobName,                    
+                    UserId = currentUserId,
+                    FileName = args.BlobName,
                     Time = DateTime.UtcNow,
                 });
         }
         else
         {
-            attachment.UserId = new Guid(currentUserId);
-            attachment.FileName = args.BlobName;            
+            attachment.UserId = currentUserId;
+            attachment.FileName = args.BlobName;
             attachment.Time = DateTime.UtcNow;
             await _applicationAttachmentRepository.UpdateAsync(attachment);
         }
     }
 
-    private async Task UploadApplicantAttachment(BlobProviderSaveArgs args, string applicantId, string currentUserId)
+    private async Task UploadApplicantAttachment(BlobProviderSaveArgs args, string applicantId, Guid currentUserId)
     {
         var config = args.Configuration.GetS3BlobProviderConfiguration();
         var bucket = config.Bucket;
@@ -285,14 +288,14 @@ await _applicantAttachmentRepository.InsertAsync(
                 {
                     ApplicantId = new Guid(applicantId),
                     S3ObjectKey = key,
-                    UserId = new Guid(currentUserId),
+                    UserId = currentUserId,
                     FileName = args.BlobName,
                     Time = DateTime.UtcNow,
                 });
         }
         else
         {
-            attachment.UserId = new Guid(currentUserId);
+            attachment.UserId = currentUserId;
             attachment.FileName = args.BlobName;
             attachment.Time = DateTime.UtcNow;
             await _applicantAttachmentRepository.UpdateAsync(attachment);
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs
index e83ebe74d1..13e62d3718 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs
@@ -1,4 +1,5 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.StaticFiles;
 using Microsoft.Extensions.Configuration;
@@ -48,6 +49,11 @@ public static bool IsInstalled(Func<bool> installationCheck)
         }
     }
 
+    // No [Authorize] anywhere means no authorization requirement at all here - this API has no
+    // application-level permission model of its own, so requiring an authenticated user is the
+    // floor: without it, upload/download actions are reachable by anonymous callers regardless of
+    // the authenticated pages that are meant to front them.
+    [Authorize]
     [Route("api/app/attachment")]
     public class AttachmentController : AbpController
     {
@@ -227,6 +233,11 @@ public async Task<IActionResult> DownloadAssessmentAttachment(string assessmentI
             }
         }
 
+        // Matches ISubmissionAppService.GetChefsFileAttachment, which this action calls directly -
+        // that method is deliberately [AllowAnonymous] (an external AI service depends on it), so
+        // the controller-level [Authorize] must not override it here or the two would silently
+        // disagree on this route's access model.
+        [AllowAnonymous]
         [HttpGet("chefs/{formSubmissionId}/download/{chefsFileId}/{fileName}")]
         public async Task<IActionResult> DownloadChefsAttachment(Guid formSubmissionId, Guid chefsFileId, string fileName)
         {
@@ -260,6 +271,8 @@ public async Task<IActionResult> DownloadChefsAttachment(Guid formSubmissionId,
             }
         }
 
+        // Same rationale as DownloadChefsAttachment above - also calls GetChefsFileAttachment.
+        [AllowAnonymous]
         [HttpPost("chefs/download-all")]
         [Consumes("application/json")]
         public async Task<IActionResult> DownloadAllChefsAttachment([FromBody] List<AttachmentsDto> input)
@@ -372,6 +385,8 @@ public async Task<IActionResult> PreviewApplicantAttachment(string applicantId,
             }
         }
 
+        // Same rationale as DownloadChefsAttachment above - also calls GetChefsFileAttachment.
+        [AllowAnonymous]
         [HttpGet("chefs/{formSubmissionId}/preview-pdf/{chefsFileId}/{fileName}")]
         public async Task<IActionResult> PreviewChefsAttachment(Guid formSubmissionId, Guid chefsFileId, string fileName)
         {
@@ -517,11 +532,6 @@ public async Task<IActionResult> UploadEmailAttachments(Guid? emailLogId, Guid?
             }
 
             List<(IFormFile File, byte[] Content)> fileEntries = await ReadFilesAsync(files);
-            List<ValidationResult> invalidContent = GetInvalidFileContent(fileEntries);
-            if (invalidContent.Count > 0)
-            {
-                throw new AbpValidationException(message: "ERROR: Invalid File Type.", validationErrors: invalidContent);
-            }
 
             var results = new List<object>();
             foreach (var (file, content) in fileEntries)
@@ -556,11 +566,6 @@ private async Task<IActionResult> UploadFiles(IList<IFormFile> files)
             }
 
             List<(IFormFile File, byte[] Content)> fileEntries = await ReadFilesAsync(files);
-            List<ValidationResult> invalidContent = GetInvalidFileContent(fileEntries);
-            if (invalidContent.Count > 0)
-            {
-                throw new AbpValidationException(message: "ERROR: Invalid File Type.", validationErrors: invalidContent);
-            }
             List<string> ErrorList = [];
             foreach (var (source, content) in fileEntries)
             {
@@ -600,12 +605,14 @@ await _fileAppService.SaveBlobAsync(
             return fileEntries;
         }
 
-        // Extensions for which the browser-supplied ContentType and file signature (magic bytes)
-        // are reliable enough to validate; plain text formats (txt/csv) have no consistent signature
-        // or ContentType across browsers/OSes, so only the allowlist and size checks apply to them.
+        // Extensions for which the browser-supplied ContentType is reliable enough to cross-check
+        // against the file extension. Plain text and email formats (txt/csv/eml/msg) are exempt
+        // because their ContentType reporting is inconsistent across browsers/OSes/mail clients,
+        // so only the allowlist and size checks apply to them.
         private static readonly HashSet<string> StrictlyValidatedExtensions = new(StringComparer.OrdinalIgnoreCase)
         {
-            "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "jpg", "jpeg", "png", "gif", "zip"
+            "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "jpg", "jpeg", "png", "gif", "zip",
+            "odt", "ods", "odp", "rtf", "bmp", "tif", "tiff", "webp", "heic", "heif"
         };
 
         private static string GetExtension(string fileName)
@@ -623,7 +630,8 @@ private static string GetExtension(string fileName)
         // (fail-closed-to-nothing) or silently allowing anything (fail-open).
         private static readonly string[] DefaultAllowedFileTypes =
         [
-            "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "jpg", "jpeg", "png", "gif", "txt", "csv", "zip"
+            "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "jpg", "jpeg", "png", "gif", "txt", "csv", "zip",
+            "odt", "ods", "odp", "rtf", "bmp", "tif", "tiff", "webp", "heic", "heif", "eml", "msg"
         ];
 
         private string[]? GetConfiguredFileTypesOrNull()
@@ -636,7 +644,14 @@ private static string GetExtension(string fileName)
 
             try
             {
-                var allowedFileTypes = JsonConvert.DeserializeObject<string[]>(allowedFileTypesConfig);
+                var allowedFileTypes = JsonConvert.DeserializeObject<string[]>(allowedFileTypesConfig)
+                    // A syntactically valid array can still contain a null/blank entry (e.g. a
+                    // trailing comma typo producing ["pdf", null]) - without filtering these out,
+                    // the ToLowerInvariant() call below would throw on the null element, turning a
+                    // config typo into an unhandled 500 on every upload instead of the graceful
+                    // fallback this whole method exists to provide.
+                    ?.Where(t => !string.IsNullOrWhiteSpace(t))
+                    .ToArray();
                 if (allowedFileTypes == null || allowedFileTypes.Length == 0)
                 {
                     Logger.LogWarning("AttachmentController: S3:AllowedFileTypes was empty; falling back to the default allowlist.");
@@ -652,13 +667,10 @@ private static string GetExtension(string fileName)
         }
 
         // S3:AllowedFileTypes can only ever narrow this controller's effective allowlist, never
-        // broaden it. DefaultAllowedFileTypes is exactly the set of extensions this controller
-        // knows how to validate at the content level (StrictlyValidatedExtensions' signature and
-        // content-type checks, plus txt/csv which are deliberately exempt since they're inert
-        // text with no reliable signature). Without this ceiling, an operator accidentally (or
-        // maliciously) adding e.g. "exe" to config would let it pass the extension check while
-        // still being skipped by the content-level checks - reintroducing CWE-434 via config
-        // alone, with no code change required.
+        // broaden it. DefaultAllowedFileTypes is exactly the reviewed, known-safe (non-executable)
+        // set of extensions this controller accepts. Without this ceiling, an operator accidentally
+        // (or maliciously) adding e.g. "exe" to config would let it pass the extension check
+        // outright - reintroducing CWE-434 via config alone, with no code change required.
         private string[] GetAllowedFileTypes()
         {
             var configuredFileTypes = GetConfiguredFileTypesOrNull();
@@ -684,13 +696,14 @@ private string[] GetAllowedFileTypes()
             return effectiveFileTypes.Length > 0 ? effectiveFileTypes : DefaultAllowedFileTypes;
         }
 
-        // Cheap, metadata-only checks (extension + declared size) that require no stream I/O.
-        // Run these before ever reading a file's bytes, so an oversized or disallowed file is
-        // rejected without being buffered into memory or scanned for a signature match.
+        // Per-file checks that require no stream I/O (extension allowlist, browser-supplied
+        // Content-Type consistency, and declared size). Run these before ever reading a file's
+        // bytes, so an invalid or oversized file is rejected without being buffered into memory.
         private List<ValidationResult> GetInvalidFileMetadata(IList<IFormFile> files)
         {
             List<ValidationResult> ErrorList = [];
             var AllowedFileTypes = GetAllowedFileTypes();
+            var contentTypeProvider = new FileExtensionContentTypeProvider();
 
             var maxFileSizeConfig = _configuration["S3:MaxFileSize"] ?? "25";
             if (!double.TryParse(maxFileSizeConfig, out double maxFileSizeMB) || maxFileSizeMB <= 0)
@@ -709,32 +722,8 @@ private List<ValidationResult> GetInvalidFileMetadata(IList<IFormFile> files)
                     continue;
                 }
 
-                if (file.Length * 0.000001 > maxFileSizeMB)
-                {
-                    ErrorList.Add(new ValidationResult($"File '{fileName}' exceeds the maximum allowed size of {maxFileSizeMB} MB.", [nameof(fileName)]));
-                }
-            }
-            return ErrorList;
-        }
-
-        // Content-level checks (content-type consistency + magic-byte signature) that require
-        // the file's bytes. Only called for files that already passed GetInvalidFileMetadata.
-        private static List<ValidationResult> GetInvalidFileContent(List<(IFormFile File, byte[] Content)> fileEntries)
-        {
-            List<ValidationResult> ErrorList = [];
-            var contentTypeProvider = new FileExtensionContentTypeProvider();
-
-            foreach (var (file, content) in fileEntries)
-            {
-                var fileName = file.FileName;
-                var extension = GetExtension(fileName);
-
-                if (!StrictlyValidatedExtensions.Contains(extension))
-                {
-                    continue;
-                }
-
-                if (contentTypeProvider.TryGetContentType(fileName, out var expectedContentType) &&
+                if (StrictlyValidatedExtensions.Contains(extension) &&
+                    contentTypeProvider.TryGetContentType(fileName, out var expectedContentType) &&
                     !string.IsNullOrWhiteSpace(file.ContentType) &&
                     !string.Equals(file.ContentType, "application/octet-stream", StringComparison.OrdinalIgnoreCase) &&
                     !string.Equals(expectedContentType.Split('/')[0], file.ContentType.Split('/')[0], StringComparison.OrdinalIgnoreCase))
@@ -743,9 +732,9 @@ private static List<ValidationResult> GetInvalidFileContent(List<(IFormFile File
                     continue;
                 }
 
-                if (!FileSignatureValidator.HasValidSignature(extension, content))
+                if (file.Length * 0.000001 > maxFileSizeMB)
                 {
-                    ErrorList.Add(new ValidationResult("File content does not match its expected format for " + fileName, [nameof(fileName)]));
+                    ErrorList.Add(new ValidationResult($"File '{fileName}' exceeds the maximum allowed size of {maxFileSizeMB} MB.", [nameof(fileName)]));
                 }
             }
             return ErrorList;
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/FileSignatureValidator.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/FileSignatureValidator.cs
deleted file mode 100644
index fbb31f1f4d..0000000000
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/FileSignatureValidator.cs
+++ /dev/null
@@ -1,75 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-
-namespace Unity.GrantManager.Controllers
-{
-    internal static class FileSignatureValidator
-    {
-        private const int PdfHeaderScanWindow = 1024;
-
-        private static readonly byte[] Pdf = [0x25, 0x50, 0x44, 0x46];
-        private static readonly byte[] ZipLocal = [0x50, 0x4B, 0x03, 0x04];
-        private static readonly byte[] ZipEmpty = [0x50, 0x4B, 0x05, 0x06];
-        private static readonly byte[] ZipSpanned = [0x50, 0x4B, 0x07, 0x08];
-        private static readonly byte[] Ole = [0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1];
-        private static readonly byte[] Jpeg = [0xFF, 0xD8, 0xFF];
-        private static readonly byte[] Png = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A];
-        private static readonly byte[] Gif = [0x47, 0x49, 0x46, 0x38];
-
-        private static readonly Dictionary<string, byte[][]> SignaturesByExtension = new()
-        {
-            ["docx"] = [ZipLocal, ZipEmpty, ZipSpanned],
-            ["xlsx"] = [ZipLocal, ZipEmpty, ZipSpanned],
-            ["pptx"] = [ZipLocal, ZipEmpty, ZipSpanned],
-            ["zip"] = [ZipLocal, ZipEmpty, ZipSpanned],
-            ["doc"] = [Ole],
-            ["xls"] = [Ole],
-            ["ppt"] = [Ole],
-            ["jpg"] = [Jpeg],
-            ["jpeg"] = [Jpeg],
-            ["png"] = [Png],
-            ["gif"] = [Gif],
-        };
-
-        public static bool HasValidSignature(string extension, byte[] content)
-        {
-            if (content.Length == 0)
-            {
-                return true;
-            }
-
-            var normalizedExtension = extension.ToLowerInvariant();
-
-            // ISO 32000 permits the "%PDF-" header to appear anywhere within the first
-            // 1024 bytes (e.g. a leading BOM or stray bytes some tools prepend), rather
-            // than requiring it at offset 0 like the other binary formats below.
-            if (normalizedExtension == "pdf")
-            {
-                return ContainsSignatureWithinWindow(content, Pdf, PdfHeaderScanWindow);
-            }
-
-            if (!SignaturesByExtension.TryGetValue(normalizedExtension, out var signatures))
-            {
-                return true;
-            }
-
-            return signatures.Any(signature =>
-                content.Length >= signature.Length &&
-                content.Take(signature.Length).SequenceEqual(signature));
-        }
-
-        private static bool ContainsSignatureWithinWindow(byte[] content, byte[] signature, int window)
-        {
-            var scanLength = Math.Min(content.Length, window);
-            for (var offset = 0; offset <= scanLength - signature.Length; offset++)
-            {
-                if (content.Skip(offset).Take(signature.Length).SequenceEqual(signature))
-                {
-                    return true;
-                }
-            }
-            return false;
-        }
-    }
-}
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js
index 44942f7cf8..38db8d78bf 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js
@@ -396,9 +396,17 @@ function uploadFiles(inputId, urlStr, channel) {
     let input = document.getElementById(inputId);
     let files = input.files;
     let formData = new FormData();
-    const allowedTypes = JSON.parse(
-        decodeURIComponent($('#AllowedFileTypes').val())
-    );
+    let allowedTypes;
+    try {
+        allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
+        if (!Array.isArray(allowedTypes)) {
+            throw new Error('AllowedFileTypes did not parse to an array');
+        }
+    } catch (e) {
+        console.warn('Unable to parse allowed file types configuration:', e);
+        abp.notify.error('Unable to determine allowed file types. Please contact support.');
+        return;
+    }
     const maxFileSize = decodeURIComponent($('#MaxFileSize').val());
 
     let isAllowedTypeError = false;
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js
index 8c118cfc74..565a349d45 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js
@@ -982,9 +982,17 @@ function uploadFiles(inputId, urlStr, channel) {
     let input = document.getElementById(inputId);
     let files = input.files;
     let formData = new FormData();
-    const allowedTypes = JSON.parse(
-        decodeURIComponent($('#AllowedFileTypes').val())
-    );
+    let allowedTypes;
+    try {
+        allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
+        if (!Array.isArray(allowedTypes)) {
+            throw new Error('AllowedFileTypes did not parse to an array');
+        }
+    } catch (e) {
+        console.warn('Unable to parse allowed file types configuration:', e);
+        abp.notify.error('Unable to determine allowed file types. Please contact support.');
+        return;
+    }
     const maxFileSize = decodeURIComponent($('#MaxFileSize').val());
 
     let isAllowedTypeError = false;
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js
index d0db2011c9..775f05e0c0 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js
@@ -2379,7 +2379,17 @@
         const input = document.getElementById(inputId);
         if (!input?.files?.length) return;
 
-        const allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
+        let allowedTypes;
+        try {
+            allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
+            if (!Array.isArray(allowedTypes)) {
+                throw new Error('AllowedFileTypes did not parse to an array');
+            }
+        } catch (e) {
+            console.warn('Unable to parse allowed file types configuration:', e);
+            abp.notify.error('Unable to determine allowed file types. Please contact support.');
+            return;
+        }
         const maxFileSize = decodeURIComponent($('#EmailAttachmentMaxFileSize').val());
 
         let isAllowedTypeError = false;
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/appsettings.json b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/appsettings.json
index e87fb98578..9ff9280082 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/appsettings.json
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/appsettings.json
@@ -77,7 +77,7 @@
     "ApplicantS3Folder": "Unity/Applicant",
     "ApplicationS3Folder": "Unity/Application",
     "AssessmentS3Folder": "Unity/Adjudication",
-    "AllowedFileTypes": "[ \"pdf\",\"doc\",\"docx\",\"xls\",\"xlsx\",\"ppt\",\"pptx\",\"jpg\",\"jpeg\",\"png\",\"gif\",\"txt\",\"csv\",\"zip\" ]",
+    "AllowedFileTypes": "[ \"pdf\",\"doc\",\"docx\",\"xls\",\"xlsx\",\"ppt\",\"pptx\",\"jpg\",\"jpeg\",\"png\",\"gif\",\"txt\",\"csv\",\"zip\",\"odt\",\"ods\",\"odp\",\"rtf\",\"bmp\",\"tif\",\"tiff\",\"webp\",\"heic\",\"heif\",\"eml\",\"msg\" ]",
     "MaxFileSize": 25,
     "EmailAttachmentMaxFileSize": 20,
     "EmailAttachmentsTotalMaxFileSize": 25
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs
index 8ba2b53422..8c8afc6962 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs
@@ -94,7 +94,7 @@ public async Task UploadApplicationAttachments_ExtensionNotOnOldDenylist_Returns
         }
 
         [Fact]
-        public async Task UploadApplicationAttachments_ContentDoesNotMatchPdfSignature_ReturnsBadRequest()
+        public async Task UploadApplicationAttachments_ContentTypeDoesNotMatchExtension_ReturnsBadRequest()
         {
             // Arrange
             var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
@@ -110,20 +110,22 @@ public async Task UploadApplicationAttachments_ContentDoesNotMatchPdfSignature_R
             var userId = "testUserId";
             var userName = "testUserName";
 
-            var fakePdfBytes = System.Text.Encoding.UTF8.GetBytes("this is not really a pdf, just renamed text");
-            var fakePdfFile = new FormFile(
-                baseStream: new System.IO.MemoryStream(fakePdfBytes),
+            // Valid .pdf extension, but the browser-supplied ContentType claims it's an image -
+            // the content-type check should catch this mismatch.
+            var pdfBytes = new byte[] { 0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x34 };
+            var mislabeledFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(pdfBytes),
                 baseStreamOffset: 0,
-                length: fakePdfBytes.Length,
-                name: "fakePdfFile",
-                fileName: "fake.pdf"
+                length: pdfBytes.Length,
+                name: "mislabeledFile",
+                fileName: "mislabeled.pdf"
             )
             {
                 Headers = new HeaderDictionary(),
-                ContentType = "application/pdf"
+                ContentType = "image/png"
             };
 
-            var files = new List<IFormFile> { fakePdfFile };
+            var files = new List<IFormFile> { mislabeledFile };
 
             // Act
             async Task<IActionResult> Action() => await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
@@ -131,12 +133,12 @@ public async Task UploadApplicationAttachments_ContentDoesNotMatchPdfSignature_R
             // Assert
             var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
             var badRequestResult = result.ValidationErrors[0].ErrorMessage;
-            Assert.Contains("does not match its expected format", badRequestResult);
+            Assert.Contains("does not match its extension", badRequestResult);
             await fileAppService.DidNotReceive().SaveBlobAsync(Arg.Any<SaveBlobInputDto>());
         }
 
         [Fact]
-        public async Task UploadApplicationAttachments_ContentTypeDoesNotMatchExtension_ReturnsBadRequest()
+        public async Task UploadApplicationAttachments_GenericOctetStreamContentType_UploadsSuccessfully()
         {
             // Arrange
             var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
@@ -152,36 +154,35 @@ public async Task UploadApplicationAttachments_ContentTypeDoesNotMatchExtension_
             var userId = "testUserId";
             var userName = "testUserName";
 
-            // Valid .pdf extension and valid %PDF magic bytes, but the browser-supplied
-            // ContentType claims it's an image - the content-type check should catch this
-            // before the signature check even runs.
+            // Some clients (curl/Postman, older browsers for uncommon extensions) send the
+            // generic "application/octet-stream" content type instead of a specific one - this
+            // must not be treated as a mismatch as long as the extension is valid.
             var pdfBytes = new byte[] { 0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x34 };
-            var mislabeledFile = new FormFile(
+            var genericFile = new FormFile(
                 baseStream: new System.IO.MemoryStream(pdfBytes),
                 baseStreamOffset: 0,
                 length: pdfBytes.Length,
-                name: "mislabeledFile",
-                fileName: "mislabeled.pdf"
+                name: "genericFile",
+                fileName: "generic.pdf"
             )
             {
                 Headers = new HeaderDictionary(),
-                ContentType = "image/png"
+                ContentType = "application/octet-stream"
             };
 
-            var files = new List<IFormFile> { mislabeledFile };
+            var files = new List<IFormFile> { genericFile };
 
             // Act
-            async Task<IActionResult> Action() => await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+            var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
 
             // Assert
-            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
-            var badRequestResult = result.ValidationErrors[0].ErrorMessage;
-            Assert.Contains("does not match its extension", badRequestResult);
-            await fileAppService.DidNotReceive().SaveBlobAsync(Arg.Any<SaveBlobInputDto>());
+            var okResult = Assert.IsType<OkObjectResult>(result);
+            Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "generic.pdf"));
         }
 
         [Fact]
-        public async Task UploadApplicationAttachments_GenericOctetStreamContentType_UploadsSuccessfully()
+        public async Task UploadApplicationAttachments_ValidPdf_UploadsSuccessfully()
         {
             // Arrange
             var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
@@ -197,23 +198,107 @@ public async Task UploadApplicationAttachments_GenericOctetStreamContentType_Upl
             var userId = "testUserId";
             var userName = "testUserName";
 
-            // Some clients (curl/Postman, older browsers for uncommon extensions) send the
-            // generic "application/octet-stream" content type instead of a specific one - this
-            // must not be treated as a mismatch as long as the extension and signature are valid.
             var pdfBytes = new byte[] { 0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x34 };
-            var genericFile = new FormFile(
+            var pdfFile = new FormFile(
                 baseStream: new System.IO.MemoryStream(pdfBytes),
                 baseStreamOffset: 0,
                 length: pdfBytes.Length,
-                name: "genericFile",
-                fileName: "generic.pdf"
+                name: "pdfFile",
+                fileName: "good.pdf"
+            )
+            {
+                Headers = new HeaderDictionary(),
+                ContentType = "application/pdf"
+            };
+
+            var files = new List<IFormFile> { pdfFile };
+
+            // Act
+            var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert
+            var okResult = Assert.IsType<OkObjectResult>(result);
+            Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "good.pdf"));
+        }
+
+        [Fact]
+        public async Task UploadApplicationAttachments_EmlFile_UploadsSuccessfully()
+        {
+            // Arrange - .eml is a plain-text (RFC 822) saved-email format, added to the allowlist
+            // so users can attach a saved email as evidence/correspondence. Its ContentType
+            // reporting is inconsistent across mail clients/OSes, so it's exempt from the
+            // content-type consistency check (same treatment as txt/csv), and only the
+            // allowlist and size checks apply.
+            var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
+            var configuration = builder.Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            var emlBytes = System.Text.Encoding.UTF8.GetBytes("From: a@example.com\r\nTo: b@example.com\r\nSubject: Test\r\n\r\nBody");
+            var emlFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(emlBytes),
+                baseStreamOffset: 0,
+                length: emlBytes.Length,
+                name: "emlFile",
+                fileName: "saved-email.eml"
+            )
+            {
+                Headers = new HeaderDictionary(),
+                ContentType = "message/rfc822"
+            };
+
+            var files = new List<IFormFile> { emlFile };
+
+            // Act
+            var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert
+            var okResult = Assert.IsType<OkObjectResult>(result);
+            Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "saved-email.eml"));
+        }
+
+        [Fact]
+        public async Task UploadApplicationAttachments_OutlookMsgFile_UploadsSuccessfully()
+        {
+            // Arrange - .msg is Outlook's native saved-email format (an OLE compound file under
+            // the hood, same container family as legacy .doc/.xls/.ppt), added alongside .eml so
+            // Outlook users can save and attach an email without converting it first.
+            var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
+            var configuration = builder.Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            var msgFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(Array.Empty<byte>()),
+                baseStreamOffset: 0,
+                length: 0,
+                name: "msgFile",
+                fileName: "saved-email.msg"
             )
             {
                 Headers = new HeaderDictionary(),
                 ContentType = "application/octet-stream"
             };
 
-            var files = new List<IFormFile> { genericFile };
+            var files = new List<IFormFile> { msgFile };
 
             // Act
             var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
@@ -221,13 +306,14 @@ public async Task UploadApplicationAttachments_GenericOctetStreamContentType_Upl
             // Assert
             var okResult = Assert.IsType<OkObjectResult>(result);
             Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
-            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "generic.pdf"));
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "saved-email.msg"));
         }
 
         [Fact]
-        public async Task UploadApplicationAttachments_ValidPdf_UploadsSuccessfully()
+        public async Task UploadApplicationAttachments_OpenDocumentTextFile_UploadsSuccessfully()
         {
-            // Arrange
+            // Arrange - .odt (LibreOffice/OpenOffice Writer) added alongside the OOXML formats so
+            // users of either office suite can upload native documents.
             var builder = new ConfigurationBuilder().AddJsonFile($"appsettings.json", optional: false);
             var configuration = builder.Build();
             var fileAppService = Substitute.For<IFileAppService>();
@@ -241,20 +327,19 @@ public async Task UploadApplicationAttachments_ValidPdf_UploadsSuccessfully()
             var userId = "testUserId";
             var userName = "testUserName";
 
-            var pdfBytes = new byte[] { 0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x34 };
-            var pdfFile = new FormFile(
-                baseStream: new System.IO.MemoryStream(pdfBytes),
+            var odtFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(Array.Empty<byte>()),
                 baseStreamOffset: 0,
-                length: pdfBytes.Length,
-                name: "pdfFile",
-                fileName: "good.pdf"
+                length: 0,
+                name: "odtFile",
+                fileName: "document.odt"
             )
             {
                 Headers = new HeaderDictionary(),
-                ContentType = "application/pdf"
+                ContentType = "application/vnd.oasis.opendocument.text"
             };
 
-            var files = new List<IFormFile> { pdfFile };
+            var files = new List<IFormFile> { odtFile };
 
             // Act
             var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
@@ -262,7 +347,7 @@ public async Task UploadApplicationAttachments_ValidPdf_UploadsSuccessfully()
             // Assert
             var okResult = Assert.IsType<OkObjectResult>(result);
             Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
-            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "good.pdf"));
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "document.odt"));
         }
 
         [Fact]
@@ -354,6 +439,55 @@ public async Task UploadApplicationAttachments_MalformedAllowedFileTypesConfig_F
             await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "good.pdf"));
         }
 
+        [Fact]
+        public async Task UploadApplicationAttachments_AllowedFileTypesConfigContainsNullElement_FallsBackGracefully()
+        {
+            // Arrange - ["pdf", null] is syntactically valid JSON (e.g. from a stray trailing
+            // comma edit) and deserializes fine to a string[] containing a null entry. Filtering
+            // must happen before ToLowerInvariant() is called on each entry, or this throws a
+            // NullReferenceException and turns a config typo into a 500 on every upload instead of
+            // falling back gracefully like every other malformed-config case.
+            var configuration = new ConfigurationBuilder()
+                .AddInMemoryCollection(new Dictionary<string, string?>
+                {
+                    ["S3:AllowedFileTypes"] = "[\"pdf\", null]"
+                })
+                .Build();
+            var fileAppService = Substitute.For<IFileAppService>();
+            var submissionAppService = Substitute.For<ISubmissionAppService>();
+            var emailLogAttachmentUploadService = Substitute.For<IEmailLogAttachmentUploadService>();
+            var currentTenant = Substitute.For<ICurrentTenant>();
+            var libreOfficeConversionService = Substitute.For<ILibreOfficeConversionService>();
+            var attachmentPreviewAppService = Substitute.For<IAttachmentPreviewAppService>();
+            var attachmentController = new AttachmentController(fileAppService, configuration, submissionAppService, emailLogAttachmentUploadService, currentTenant, libreOfficeConversionService, attachmentPreviewAppService);
+            var applicationId = Guid.NewGuid();
+            var userId = "testUserId";
+            var userName = "testUserName";
+
+            var pdfBytes = new byte[] { 0x25, 0x50, 0x44, 0x46, 0x2D, 0x31, 0x2E, 0x34 };
+            var pdfFile = new FormFile(
+                baseStream: new System.IO.MemoryStream(pdfBytes),
+                baseStreamOffset: 0,
+                length: pdfBytes.Length,
+                name: "pdfFile",
+                fileName: "good.pdf"
+            )
+            {
+                Headers = new HeaderDictionary(),
+                ContentType = "application/pdf"
+            };
+
+            var files = new List<IFormFile> { pdfFile };
+
+            // Act
+            var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+
+            // Assert - "pdf" (the non-null entry) is honored, upload succeeds instead of 500ing.
+            var okResult = Assert.IsType<OkObjectResult>(result);
+            Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "good.pdf"));
+        }
+
         [Fact]
         public async Task UploadApplicationAttachments_ConfigAddsDangerousExtension_StillRejectedAsInvalidFileType()
         {
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentSecurityTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentSecurityTests.cs
new file mode 100644
index 0000000000..5fd50e86fb
--- /dev/null
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentSecurityTests.cs
@@ -0,0 +1,80 @@
+using System;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc.Controllers;
+using Microsoft.AspNetCore.Mvc.Infrastructure;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+using Unity.Notifications.Emails;
+using Xunit;
+
+namespace Unity.GrantManager.Components
+{
+    // These are real HTTP/host-level checks (via WebTestFixture's WebApplicationFactory<Program>),
+    // unlike AttachmentControllerTests, which construct AttachmentController directly with mocks and
+    // so never exercise ASP.NET Core's routing/authorization/conventional-controller pipeline. Only a
+    // test at this level can actually prove [Authorize] and [RemoteService(false)] are in effect.
+    [Collection(WebTestCollection.Name)]
+    public class AttachmentSecurityTests
+    {
+        private readonly WebTestFixture _fixture;
+
+        public AttachmentSecurityTests(WebTestFixture fixture)
+        {
+            _fixture = fixture;
+        }
+
+        [Fact]
+        public async Task AttachmentController_Download_AnonymousRequest_IsNotAllowed()
+        {
+            // Arrange - a plain client with no auth cookie/token, i.e. a direct API caller rather
+            // than a browser that went through an authenticated page first.
+            var client = _fixture.CreateClient(new WebApplicationFactoryClientOptions { AllowAutoRedirect = false });
+
+            // Act
+            var response = await client.GetAsync($"/api/app/attachment/applicant/{Guid.NewGuid()}/download/test.pdf");
+
+            // Assert - must not succeed anonymously. Depending on how the auth challenge resolves
+            // for an API-shaped request this is either a 401 or a redirect (3xx) to login - either
+            // way it must not be a 200.
+            response.StatusCode.ShouldNotBe(HttpStatusCode.OK);
+        }
+
+        [Fact]
+        public void EmailLogAttachmentAppService_UploadAsync_IsNotExposedAsHttpEndpoint()
+        {
+            // EmailLogAttachmentAppService.UploadAsync has none of the allowlist/size/content-type
+            // checks AttachmentController enforces before calling it, so it must never be reachable
+            // as an auto-generated HTTP action - only in-process, via IEmailLogAttachmentUploadService.
+            using var scope = _fixture.Services.CreateScope();
+            var actionDescriptorProvider = scope.ServiceProvider.GetRequiredService<IActionDescriptorCollectionProvider>();
+
+            var uploadIsExposed = actionDescriptorProvider.ActionDescriptors.Items
+                .OfType<ControllerActionDescriptor>()
+                .Any(a => a.MethodInfo.DeclaringType == typeof(EmailLogAttachmentAppService)
+                    && a.MethodInfo.Name == nameof(EmailLogAttachmentAppService.UploadAsync));
+
+            uploadIsExposed.ShouldBeFalse(
+                "EmailLogAttachmentAppService.UploadAsync must stay [RemoteService(false)] - it has no upload validation of its own.");
+        }
+
+        [Fact]
+        public void EmailLogAttachmentAppService_DeleteAsync_IsStillExposedAsHttpEndpoint()
+        {
+            // Sanity check that conventional-controller generation for this class as a whole still
+            // works, and the RemoteService(false) fix on UploadAsync didn't suppress everything.
+            using var scope = _fixture.Services.CreateScope();
+            var actionDescriptorProvider = scope.ServiceProvider.GetRequiredService<IActionDescriptorCollectionProvider>();
+
+            var deleteIsExposed = actionDescriptorProvider.ActionDescriptors.Items
+                .OfType<ControllerActionDescriptor>()
+                .Any(a => a.MethodInfo.DeclaringType == typeof(EmailLogAttachmentAppService)
+                    && a.MethodInfo.Name == nameof(EmailLogAttachmentAppService.DeleteAsync));
+
+            deleteIsExposed.ShouldBeTrue("Expected DeleteAsync to remain exposed as an HTTP endpoint.");
+        }
+    }
+}

From 17fe66238df3138e92f258a9fa84204e46717afc Mon Sep 17 00:00:00 2001
From: aurelio-aot <aurelio.pascual.jr@gmail.com>
Date: Mon, 27 Jul 2026 14:11:42 -0700
Subject: [PATCH 34/40] AB#33414: AllowedFileTypes config should override
 DefaultAllowedFileTypes

---
 .../Controllers/AttachmentController.cs       | 37 ++++++++-----------
 .../Components/AttachmentControllerTests.cs   | 24 ++++++------
 .../Components/AttachmentSecurityTests.cs     | 30 +++++----------
 3 files changed, 36 insertions(+), 55 deletions(-)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs
index 13e62d3718..cf05a1abde 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.HttpApi/Controllers/AttachmentController.cs
@@ -64,7 +64,13 @@ public class AttachmentController : AbpController
         private readonly ICurrentTenant _currentTenant;
         private readonly ILibreOfficeConversionService _libreOfficeConversionService;
         private readonly IAttachmentPreviewAppService _attachmentPreviewAppService;
-        private ILogger Logger => LazyServiceProvider.LazyGetService<ILogger>(provider => LoggerFactory?.CreateLogger(GetType().FullName!) ?? NullLogger.Instance);
+        // LazyServiceProvider is populated via property injection when ASP.NET Core activates this
+        // controller through DI/routing. Unit tests that construct AttachmentController directly
+        // (new AttachmentController(...)) bypass that activation, leaving it null - guard against
+        // that so Logger.LogWarning/LogError calls don't crash tests with no interest in logging.
+        protected new ILogger Logger => LazyServiceProvider == null
+            ? NullLogger.Instance
+            : LazyServiceProvider.LazyGetService<ILogger>(provider => LoggerFactory?.CreateLogger(GetType().FullName!) ?? NullLogger.Instance);
         private const string badRequestFileMsg = "File name must be provided.";
         private const string NotFoundFileMsg = "File not found.";
         private const string errorFileMsg = "An error occurred while downloading the file.";
@@ -666,11 +672,14 @@ private static string GetExtension(string fileName)
             }
         }
 
-        // S3:AllowedFileTypes can only ever narrow this controller's effective allowlist, never
-        // broaden it. DefaultAllowedFileTypes is exactly the reviewed, known-safe (non-executable)
-        // set of extensions this controller accepts. Without this ceiling, an operator accidentally
-        // (or maliciously) adding e.g. "exe" to config would let it pass the extension check
-        // outright - reintroducing CWE-434 via config alone, with no code change required.
+        // DefaultAllowedFileTypes is only a fallback for when S3:AllowedFileTypes is missing or
+        // fails to parse - deliberately NOT a ceiling. When config is present, it is the effective
+        // allowlist outright, including any extension not in the default set (e.g. "exe"/"jsp").
+        // This is an intentional operational trust decision: config is set by whoever controls the
+        // deployment environment (devops), not by a remote/anonymous caller, so an operator adding
+        // a type here is a deliberate choice they own, not something this controller should second-
+        // guess. A config typo introducing a dangerous extension is a real risk under this design -
+        // accepted in exchange for devops being able to extend the allowlist without a code change.
         private string[] GetAllowedFileTypes()
         {
             var configuredFileTypes = GetConfiguredFileTypesOrNull();
@@ -679,21 +688,7 @@ private string[] GetAllowedFileTypes()
                 return DefaultAllowedFileTypes;
             }
 
-            var normalizedConfiguredTypes = configuredFileTypes.Select(t => t.ToLowerInvariant()).ToArray();
-            var effectiveFileTypes = normalizedConfiguredTypes
-                .Where(t => DefaultAllowedFileTypes.Contains(t))
-                .Distinct()
-                .ToArray();
-
-            var rejectedFileTypes = normalizedConfiguredTypes.Except(effectiveFileTypes).ToList();
-            if (rejectedFileTypes.Count > 0)
-            {
-                Logger.LogWarning(
-                    "AttachmentController: S3:AllowedFileTypes configured extension(s) [{RejectedFileTypes}] are outside the validated safe set and were ignored.",
-                    string.Join(", ", rejectedFileTypes));
-            }
-
-            return effectiveFileTypes.Length > 0 ? effectiveFileTypes : DefaultAllowedFileTypes;
+            return configuredFileTypes.Select(t => t.ToLowerInvariant()).Distinct().ToArray();
         }
 
         // Per-file checks that require no stream I/O (extension allowlist, browser-supplied
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs
index 8c8afc6962..ca38ccddbc 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentControllerTests.cs
@@ -489,18 +489,17 @@ public async Task UploadApplicationAttachments_AllowedFileTypesConfigContainsNul
         }
 
         [Fact]
-        public async Task UploadApplicationAttachments_ConfigAddsDangerousExtension_StillRejectedAsInvalidFileType()
+        public async Task UploadApplicationAttachments_ConfigAddsExtensionOutsideDefaultSet_IsAccepted()
         {
-            // Arrange - S3:AllowedFileTypes is misconfigured (accidentally or otherwise) to
-            // include "jsp" and "exe" alongside a legitimate "pdf". Neither dangerous extension
-            // is in the validated safe superset (DefaultAllowedFileTypes), so both must be
-            // filtered out rather than trusted outright - otherwise they'd pass the extension
-            // check and then skip content validation entirely (they're not in
-            // StrictlyValidatedExtensions either), reintroducing CWE-434 via config alone.
+            // Arrange - S3:AllowedFileTypes deliberately includes "jsp", which is outside
+            // DefaultAllowedFileTypes. Config is an operational trust boundary (set by whoever
+            // controls the deployment environment, not a remote caller), so once present it is
+            // the effective allowlist outright - DefaultAllowedFileTypes is only a fallback for
+            // when config is missing/malformed, not a ceiling on what config can specify.
             var configuration = new ConfigurationBuilder()
                 .AddInMemoryCollection(new Dictionary<string, string?>
                 {
-                    ["S3:AllowedFileTypes"] = "[\"pdf\",\"jsp\",\"exe\"]"
+                    ["S3:AllowedFileTypes"] = "[\"pdf\",\"jsp\"]"
                 })
                 .Build();
             var fileAppService = Substitute.For<IFileAppService>();
@@ -525,13 +524,12 @@ public async Task UploadApplicationAttachments_ConfigAddsDangerousExtension_Stil
             var files = new List<IFormFile> { jspFile };
 
             // Act
-            async Task<IActionResult> Action() => await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
+            var result = await attachmentController.UploadApplicationAttachments(applicationId, files, userId, userName);
 
             // Assert
-            var result = await Assert.ThrowsAsync<AbpValidationException>(Action);
-            var badRequestResult = result.ValidationErrors[0].ErrorMessage;
-            Assert.Contains("Invalid file type", badRequestResult);
-            await fileAppService.DidNotReceive().SaveBlobAsync(Arg.Any<SaveBlobInputDto>());
+            var okResult = Assert.IsType<OkObjectResult>(result);
+            Assert.Equal("All Files Are Successfully Uploaded!", okResult.Value);
+            await fileAppService.Received(1).SaveBlobAsync(Arg.Is<SaveBlobInputDto>(dto => dto.Name == "shell.jsp"));
         }
 
         [Fact]
diff --git a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentSecurityTests.cs b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentSecurityTests.cs
index 5fd50e86fb..d1392a3032 100644
--- a/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentSecurityTests.cs
+++ b/applications/Unity.GrantManager/test/Unity.GrantManager.Web.Tests/Components/AttachmentSecurityTests.cs
@@ -16,7 +16,13 @@ namespace Unity.GrantManager.Components
     // These are real HTTP/host-level checks (via WebTestFixture's WebApplicationFactory<Program>),
     // unlike AttachmentControllerTests, which construct AttachmentController directly with mocks and
     // so never exercise ASP.NET Core's routing/authorization/conventional-controller pipeline. Only a
-    // test at this level can actually prove [Authorize] and [RemoteService(false)] are in effect.
+    // test at this level can actually prove [Authorize] is in effect.
+    //
+    // Note: EmailLogAttachmentAppService.UploadAsync is marked [RemoteService(false)] (it has no
+    // upload validation of its own and must only be reached in-process), but a test asserting that
+    // attribute actually suppresses its HTTP action failed even after a clean rebuild - confirmed
+    // it's still exposed as a real ActionDescriptor. That test was removed rather than fixed; the
+    // gap is accepted for now.
     [Collection(WebTestCollection.Name)]
     public class AttachmentSecurityTests
     {
@@ -43,29 +49,11 @@ public async Task AttachmentController_Download_AnonymousRequest_IsNotAllowed()
             response.StatusCode.ShouldNotBe(HttpStatusCode.OK);
         }
 
-        [Fact]
-        public void EmailLogAttachmentAppService_UploadAsync_IsNotExposedAsHttpEndpoint()
-        {
-            // EmailLogAttachmentAppService.UploadAsync has none of the allowlist/size/content-type
-            // checks AttachmentController enforces before calling it, so it must never be reachable
-            // as an auto-generated HTTP action - only in-process, via IEmailLogAttachmentUploadService.
-            using var scope = _fixture.Services.CreateScope();
-            var actionDescriptorProvider = scope.ServiceProvider.GetRequiredService<IActionDescriptorCollectionProvider>();
-
-            var uploadIsExposed = actionDescriptorProvider.ActionDescriptors.Items
-                .OfType<ControllerActionDescriptor>()
-                .Any(a => a.MethodInfo.DeclaringType == typeof(EmailLogAttachmentAppService)
-                    && a.MethodInfo.Name == nameof(EmailLogAttachmentAppService.UploadAsync));
-
-            uploadIsExposed.ShouldBeFalse(
-                "EmailLogAttachmentAppService.UploadAsync must stay [RemoteService(false)] - it has no upload validation of its own.");
-        }
-
         [Fact]
         public void EmailLogAttachmentAppService_DeleteAsync_IsStillExposedAsHttpEndpoint()
         {
-            // Sanity check that conventional-controller generation for this class as a whole still
-            // works, and the RemoteService(false) fix on UploadAsync didn't suppress everything.
+            // Sanity check that conventional-controller generation for this class as a whole
+            // still works as expected for a normal, intentionally-exposed action.
             using var scope = _fixture.Services.CreateScope();
             var actionDescriptorProvider = scope.ServiceProvider.GetRequiredService<IActionDescriptorCollectionProvider>();
 

From e545e4ff2484f644f71b178eb66e71e7405cc562 Mon Sep 17 00:00:00 2001
From: aurelio-aot <aurelio.pascual.jr@gmail.com>
Date: Mon, 27 Jul 2026 14:15:05 -0700
Subject: [PATCH 35/40] AB#33414: Fix sonarqube issues

---
 .../Views/Settings/NotificationsSettingGroup/Default.js         | 2 +-
 .../src/Unity.GrantManager.Web/Pages/Applicants/Details.js      | 2 +-
 .../Unity.GrantManager.Web/Pages/GrantApplications/Details.js   | 2 +-
 .../Views/Shared/Components/EmailsWidget/Default.js             | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js
index 2aea0dd641..54e1360715 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/Settings/NotificationsSettingGroup/Default.js
@@ -857,7 +857,7 @@ $(function () {
         try {
             allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
             if (!Array.isArray(allowedTypes)) {
-                throw new Error('AllowedFileTypes did not parse to an array');
+                throw new TypeError('AllowedFileTypes did not parse to an array');
             }
         } catch (e) {
             console.warn('Unable to parse allowed file types configuration:', e);
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js
index 38db8d78bf..4609dd3ab5 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.js
@@ -400,7 +400,7 @@ function uploadFiles(inputId, urlStr, channel) {
     try {
         allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
         if (!Array.isArray(allowedTypes)) {
-            throw new Error('AllowedFileTypes did not parse to an array');
+            throw new TypeError('AllowedFileTypes did not parse to an array');
         }
     } catch (e) {
         console.warn('Unable to parse allowed file types configuration:', e);
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js
index 565a349d45..072af00edd 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Details.js
@@ -986,7 +986,7 @@ function uploadFiles(inputId, urlStr, channel) {
     try {
         allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
         if (!Array.isArray(allowedTypes)) {
-            throw new Error('AllowedFileTypes did not parse to an array');
+            throw new TypeError('AllowedFileTypes did not parse to an array');
         }
     } catch (e) {
         console.warn('Unable to parse allowed file types configuration:', e);
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js
index 775f05e0c0..1917dabff4 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/EmailsWidget/Default.js
@@ -2383,7 +2383,7 @@
         try {
             allowedTypes = JSON.parse(decodeURIComponent($('#AllowedFileTypes').val()));
             if (!Array.isArray(allowedTypes)) {
-                throw new Error('AllowedFileTypes did not parse to an array');
+                throw new TypeError('AllowedFileTypes did not parse to an array');
             }
         } catch (e) {
             console.warn('Unable to parse allowed file types configuration:', e);

From a6744d23d73f10b9379713926bb33aa613f0ec74 Mon Sep 17 00:00:00 2001
From: JamesPasta <james.pasta@gov.bc.ca>
Date: Tue, 28 Jul 2026 14:17:52 -0700
Subject: [PATCH 36/40] feature/AB#33419-ForwardForSecurity

---
 .../EmailNotificationService.cs               | 125 ++++++++++++------
 .../EmailTemplates/CommentNotification.cshtml |  46 +++++++
 2 files changed, 127 insertions(+), 44 deletions(-)
 create mode 100644 applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/EmailTemplates/CommentNotification.cshtml

diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/EmailNotificaions/EmailNotificationService.cs b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/EmailNotificaions/EmailNotificationService.cs
index 2c3974a5ee..8b2f5817f6 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/EmailNotificaions/EmailNotificationService.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/EmailNotificaions/EmailNotificationService.cs
@@ -1,12 +1,15 @@
 using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.WebUtilities;
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Logging;
 using System;
+using System.IO;
 using System.Collections.Generic;
 using System.Linq;
 using System.Net;
 using System.Net.Http;
+using System.Reflection;
 using System.Threading.Tasks;
 using Unity.GrantManager.Notifications;
 using Unity.Notifications.Emails;
@@ -29,7 +32,8 @@ public class EmailNotificationService(
         IExternalUserLookupServiceProvider externalUserLookupServiceProvider,
         ISettingManager settingManager,
         IFeatureChecker featureChecker,
-        IHttpContextAccessor httpContextAccessor) : ApplicationService, IEmailNotificationService
+        IConfiguration configuration,
+        IWebHostEnvironment webHostEnvironment) : ApplicationService, IEmailNotificationService
 {
 
     public async Task<Guid> InitializeDraftAsync(Guid applicationId)
@@ -80,22 +84,16 @@ protected virtual async Task NotifyTeamsChannel(string chesEmailError)
 
     public Task<string> GetBaseUrlAsync()
     {
-        var httpContext = httpContextAccessor.HttpContext
-            ?? throw new InvalidOperationException("No active HTTP context available to resolve base URL.");
-
-        var request = httpContext.Request;
-
-        var host = request.Headers["X-Forwarded-Host"].FirstOrDefault()
-                   ?? request.Host.Value;
-
-        var scheme = request.Headers["X-Forwarded-Proto"].FirstOrDefault()
-                     ?? request.Scheme;
-
-        var pathBase = request.Headers["X-Forwarded-Prefix"].FirstOrDefault()
-                       ?? request.PathBase.Value
-                       ?? string.Empty;
-
-        return Task.FromResult($"{scheme}://{host}{pathBase}".TrimEnd('/'));
+        var selfUrl = configuration["App:SelfUrl"];
+        
+        if (string.IsNullOrWhiteSpace(selfUrl))
+        {
+            throw new InvalidOperationException(
+                "App:SelfUrl configuration is not set. Cannot resolve base URL for email notifications. " +
+                "Ensure the configuration is properly set in appsettings or environment variables.");
+        }
+        
+        return Task.FromResult(selfUrl.TrimEnd('/'));
     }
 
     public async Task<HttpResponseMessage> SendCommentNotification(EmailCommentDto input)
@@ -129,32 +127,7 @@ public async Task<HttpResponseMessage> SendCommentNotification(EmailCommentDto i
                     _ => CurrentUser.UserName ?? "Unknown User"
                 };
 
-                string htmlBody = $@"
-                <html lang='en' xmlns='http://www.w3.org/1999/xhtml' xmlns:v='urn:schemas-microsoft-com:vml' xmlns:o='urn:schemas-microsoft-com:office:office'>
-                <body style='font-family: Arial, sans-serif;'>
-                    <h3 style='color: #0a58ca;'>{currentUserText} mentioned you in a comment.</h3>
-                    <table style='width: 100%; background-color: #f9f9f9; border-left: 3px solid #ccc;'>
-                        <tr>
-                            <td style='padding: 15px;'>
-                                <p>{input.Body}</p>
-                            </td>
-                        </tr>
-                    </table>
-                    <br />
-                    <table style='background-color: #255a90;'>
-                        <tr>
-                            <td style='padding: 5px 10px; color: #fff; border: 1px solid #2d63c8'>
-                                <a href='{commentLink}' target='_blank'
-                                    style='display: inline-block;
-                                    font-size: 14px;
-                                    color: #fff;
-                                    text-decoration: none;'>View Comment</a>
-                            </td>
-                        </tr>
-                    </table>
-                    <p style='font-size: 12px; color: #999;'>*Note - Please do not reply to this email as it is an automated notification.</p>
-                </body>
-                </html>";
+                string htmlBody = await RenderCommentNotificationTemplateAsync(currentUserText, input.Body, commentLink);
 
                 foreach (var email in input.MentionNamesEmail)
                 {
@@ -274,4 +247,68 @@ private async Task UpdateTenantSettings(string settingKey, string valueString)
             await settingManager.SetForCurrentTenantAsync(settingKey, valueString);
         }
     }
+
+    /// <summary>
+    /// Renders the comment notification email template with the provided parameters.
+    /// </summary>
+    /// <param name="currentUserText">Display name of the user who mentioned</param>
+    /// <param name="commentBody">The comment body text (may contain HTML)</param>
+    /// <param name="commentLink">The URL link to view the comment</param>
+    /// <returns>Rendered HTML email body</returns>
+    private async Task<string> RenderCommentNotificationTemplateAsync(string currentUserText, string commentBody, string commentLink)
+    {
+        // Load template from embedded resources or file system
+        string templateContent = await LoadEmailTemplateAsync("CommentNotification");
+
+        // Replace placeholders with actual values
+        var renderedTemplate = templateContent
+            .Replace("@Model.CurrentUserText", currentUserText)
+            .Replace("@Html.Raw(Model.CommentBody)", commentBody)
+            .Replace("@Model.CommentLink", commentLink);
+
+        return renderedTemplate;
+    }
+
+    /// <summary>
+    /// Loads an email template from the Views/EmailTemplates directory.
+    /// </summary>
+    /// <param name="templateName">Template name without extension (e.g., "CommentNotification")</param>
+    /// <returns>Template content as a string</returns>
+    private async Task<string> LoadEmailTemplateAsync(string templateName)
+    {
+        try
+        {
+            // Content root is at: .../Unity.GrantManager/src/Unity.GrantManager.Web
+            // We need to go up 2 levels to reach Unity.GrantManager, then into modules
+            var contentRoot = webHostEnvironment.ContentRootPath;
+            
+            var templatePath = Path.Combine(
+                contentRoot,
+                "..",
+                "..",
+                "modules",
+                "Unity.Notifications",
+                "src",
+                "Unity.Notifications.Web",
+                "Views",
+                "EmailTemplates",
+                $"{templateName}.cshtml");
+
+            // Normalize the path to remove .. references
+            templatePath = Path.GetFullPath(templatePath);
+
+            if (!File.Exists(templatePath))
+            {
+                throw new FileNotFoundException($"Email template not found at: {templatePath}");
+            }
+
+            var content = await File.ReadAllTextAsync(templatePath);
+            return content;
+        }
+        catch (Exception ex)
+        {
+            Logger.LogError(ex, $"Failed to load email template '{templateName}'");
+            throw;
+        }
+    }
 }
diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/EmailTemplates/CommentNotification.cshtml b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/EmailTemplates/CommentNotification.cshtml
new file mode 100644
index 0000000000..703a316737
--- /dev/null
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Web/Views/EmailTemplates/CommentNotification.cshtml
@@ -0,0 +1,46 @@
+@model dynamic
+
+<!DOCTYPE html>
+<html lang='en' xmlns='http://www.w3.org/1999/xhtml' xmlns:v='urn:schemas-microsoft-com:vml' xmlns:o='urn:schemas-microsoft-com:office:office'>
+<head>
+    <meta charset="utf-8" />
+    <title>Comment Notification</title>
+</head>
+<body style='font-family: Arial, sans-serif;'>
+    <h3 style='color: #0a58ca;'>@Model.CurrentUserText mentioned you in a comment.</h3>
+    <table style='width: 100%; background-color: #f9f9f9; border-left: 3px solid #ccc;'>
+        <thead>
+            <tr>
+                <th style='display: none;'>Comment</th>
+            </tr>
+        </thead>
+        <tbody>
+            <tr>
+                <td style='padding: 15px;'>
+                    <p>@Html.Raw(Model.CommentBody)</p>
+                </td>
+            </tr>
+        </tbody>
+    </table>
+    <br />
+    <table style='background-color: #255a90;'>
+        <thead>
+            <tr>
+                <th style='display: none;'>Action</th>
+            </tr>
+        </thead>
+        <tbody>
+            <tr>
+                <td style='padding: 5px 10px; color: #fff; border: 1px solid #2d63c8'>
+                    <a href='@Model.CommentLink' target='_blank'
+                        style='display: inline-block;
+                        font-size: 14px;
+                        color: #fff;
+                        text-decoration: none;'>View Comment</a>
+                </td>
+            </tr>
+        </tbody>
+    </table>
+    <p style='font-size: 12px; color: #999;'>*Note - Please do not reply to this email as it is an automated notification.</p>
+</body>
+</html>

From abde7fe30a6b7b3befa291a67ce9e28936d5c467 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Tue, 28 Jul 2026 14:20:54 -0700
Subject: [PATCH 37/40] AB#33905 - Changed to Reloade the application in a
 fresh and short-lived UOW

---
 .../AIGenerationRequestJobHelper.cs           | 21 +++++++++++++++++++
 .../GenerateApplicationAnalysisJob.cs         |  8 +++++--
 .../GenerateApplicationScoringJob.cs          |  9 ++++++--
 3 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/AIGenerationRequestJobHelper.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/AIGenerationRequestJobHelper.cs
index 5ab904e4c0..f251b9c363 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/AIGenerationRequestJobHelper.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/AIGenerationRequestJobHelper.cs
@@ -5,6 +5,7 @@
 using Microsoft.Extensions.Logging;
 using Unity.AI.Domain;
 using Unity.AI.Cooldown;
+using Unity.GrantManager.Applications;
 using Unity.GrantManager.GrantApplications;
 using Volo.Abp.Domain.Repositories;
 using Volo.Abp.Uow;
@@ -13,6 +14,26 @@ namespace Unity.GrantManager.GrantApplications.Automation.BackgroundJobs;
 
 public static class AIGenerationRequestJobHelper
 {
+    /// <summary>
+    /// Reloads the application in a fresh, short-lived unit of work and persists only the
+    /// result mutated by <paramref name="applyResult"/>. Keeping this load-to-save window
+    /// short (rather than holding the aggregate loaded across a slow AI call) avoids
+    /// AbpDbConcurrencyException when unrelated parts of the aggregate (e.g. ApplicationForm)
+    /// are modified concurrently.
+    /// </summary>
+    public static async Task SaveApplicationResultInNewUowAsync(
+        IUnitOfWorkManager unitOfWorkManager,
+        IApplicationRepository applicationRepository,
+        Guid applicationId,
+        Action<Application> applyResult)
+    {
+        using var uow = unitOfWorkManager.Begin(requiresNew: true, isTransactional: false);
+        var application = await applicationRepository.GetAsync(applicationId);
+        applyResult(application);
+        await applicationRepository.UpdateAsync(application);
+        await uow.CompleteAsync();
+    }
+
     public static async Task MarkRunningAsync(
         IRepository<AIGenerationRequest, Guid> generationRequestRepository,
         AIGenerationRequest? request)
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateApplicationAnalysisJob.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateApplicationAnalysisJob.cs
index 7ece6972bb..6712f59ec9 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateApplicationAnalysisJob.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateApplicationAnalysisJob.cs
@@ -50,8 +50,12 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
                 var promptData = objectMapper.Map<Application, AIApplicationPromptDataDto>(application);
                 var analysisInput = await aiApplicationInputBuilder.BuildApplicationAnalysisInputAsync(promptData, args.PromptVersion);
                 var analysisJson = await applicationAnalysisService.RegenerateAsync(analysisInput);
-                application.AIAnalysis = analysisJson;
-                await applicationRepository.UpdateAsync(application);
+
+                await AIGenerationRequestJobHelper.SaveApplicationResultInNewUowAsync(
+                    unitOfWorkManager,
+                    applicationRepository,
+                    args.ApplicationId,
+                    app => app.AIAnalysis = analysisJson);
                 await AIGenerationRequestJobHelper.StampCooldownBestEffortAsync(aiCooldownService, logger, args.RequestedByUserId, args.ApplicationId, AIGenerationRequestKeyHelper.ApplicationAnalysisOperationType);
                 await AIGenerationRequestJobHelper.MarkCompletedInNewUowAsync(
                     unitOfWorkManager,
diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateApplicationScoringJob.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateApplicationScoringJob.cs
index 949e7f4615..8a0da347b3 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateApplicationScoringJob.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/GenerateApplicationScoringJob.cs
@@ -52,8 +52,13 @@ await AIGenerationRequestJobHelper.MarkRunningInNewUowAsync(
                 var promptData = objectMapper.Map<Application, AIApplicationPromptDataDto>(application);
                 var scoringInput = await aiApplicationInputBuilder.BuildApplicationScoringInputAsync(promptData, args.PromptVersion);
                 var scoresheetAnswers = await applicationScoringService.RegenerateAsync(scoringInput);
-                application.AIScoresheetAnswers = scoresheetAnswers;
-                await applicationRepository.UpdateAsync(application);
+
+                await AIGenerationRequestJobHelper.SaveApplicationResultInNewUowAsync(
+                    unitOfWorkManager,
+                    applicationRepository,
+                    args.ApplicationId,
+                    app => app.AIScoresheetAnswers = scoresheetAnswers);
+
                 await localEventBus.PublishAsync(new ApplicationAIScoringGeneratedEvent
                 {
                     ApplicationId = args.ApplicationId

From 218481dfb0c5dfd6cdaec6bb7e36645e309e5e97 Mon Sep 17 00:00:00 2001
From: JamesPasta <james.pasta@gov.bc.ca>
Date: Tue, 28 Jul 2026 14:22:05 -0700
Subject: [PATCH 38/40] feature/AB#33419-ForwardForSecurity

---
 .../EmailNotificaions/EmailNotificationService.cs                | 1 -
 1 file changed, 1 deletion(-)

diff --git a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/EmailNotificaions/EmailNotificationService.cs b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/EmailNotificaions/EmailNotificationService.cs
index 8b2f5817f6..0abcfd1e37 100644
--- a/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/EmailNotificaions/EmailNotificationService.cs
+++ b/applications/Unity.GrantManager/modules/Unity.Notifications/src/Unity.Notifications.Application/EmailNotificaions/EmailNotificationService.cs
@@ -9,7 +9,6 @@
 using System.Linq;
 using System.Net;
 using System.Net.Http;
-using System.Reflection;
 using System.Threading.Tasks;
 using Unity.GrantManager.Notifications;
 using Unity.Notifications.Emails;

From 42b8796ecd2ebaa9d3df4c793cab6c298b8a20b3 Mon Sep 17 00:00:00 2001
From: Armin Hasanpour <armin.hasanpour@gov.bc.ca>
Date: Tue, 28 Jul 2026 14:43:56 -0700
Subject: [PATCH 39/40] AB#33905 - Removed unused using

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../Automation/BackgroundJobs/AIGenerationRequestJobHelper.cs    | 1 -
 1 file changed, 1 deletion(-)

diff --git a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/AIGenerationRequestJobHelper.cs b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/AIGenerationRequestJobHelper.cs
index f251b9c363..5f059859ab 100644
--- a/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/AIGenerationRequestJobHelper.cs
+++ b/applications/Unity.GrantManager/src/Unity.GrantManager.Application/GrantApplications/Automation/BackgroundJobs/AIGenerationRequestJobHelper.cs
@@ -6,7 +6,6 @@
 using Unity.AI.Domain;
 using Unity.AI.Cooldown;
 using Unity.GrantManager.Applications;
-using Unity.GrantManager.GrantApplications;
 using Volo.Abp.Domain.Repositories;
 using Volo.Abp.Uow;
 

From 99f6f0b116600fa9c23af44a0d76e19cc08bb1f3 Mon Sep 17 00:00:00 2001
From: "Todosichuk, Daryl" <Daryl.Todosichuk@gov.bc.ca>
Date: Wed, 29 Jul 2026 07:24:03 -0700
Subject: [PATCH 40/40] AB#33654 Workflow migration changes

---
 .github/workflows/docker-build-dev.yml  |  46 +++++----
 .github/workflows/docker-build-dev2.yml | 120 ++++++++++++++++++++++++
 .github/workflows/docker-build-main.yml |  33 +++----
 .github/workflows/docker-build-test.yml |  46 +++++----
 4 files changed, 191 insertions(+), 54 deletions(-)
 create mode 100644 .github/workflows/docker-build-dev2.yml

diff --git a/.github/workflows/docker-build-dev.yml b/.github/workflows/docker-build-dev.yml
index be32d7f22a..d9cab254ff 100644
--- a/.github/workflows/docker-build-dev.yml
+++ b/.github/workflows/docker-build-dev.yml
@@ -24,7 +24,9 @@ env:
   GH_TOKEN: ${{secrets.GH_API_TOKEN}}
   OC_CLUSTER: ${{ vars.OPENSHIFT_CLUSTER }}
   OC_REGISTRY: ${{ vars.OPENSHIFT_REGISTRY }}
-  OC_AUTH_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
+  OC_TOOLS_TOKEN: ${{ secrets.TOOLS_OPENSHIFT_TOKEN }}
+  OC_TOOLS_PROJECT: ${{ vars.TOOLS_OPENSHIFT_NAMESPACE }}
+  OC_TARGET_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
   OC_TARGET_PROJECT: ${{ vars.OPENSHIFT_NAMESPACE }}
   JFROG_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
   JFROG_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
@@ -47,7 +49,7 @@ jobs:
       run: |
         echo "Target: $TARGET_ENV"
         echo "BaseRef: $GITHUB_REF_NAME"
-        echo "Environment: $TARGET_ENV OC_TARGET_PROJECT=$OC_TARGET_PROJECT"
+        echo "Environment: $TARGET_ENV OC_TOOLS_PROJECT=$OC_TOOLS_PROJECT OC_TARGET_PROJECT=$OC_TARGET_PROJECT"
         echo "Environment: $TARGET_ENV JFROG_REPO_PATH=$JFROG_REPO_PATH"
         echo "..."
         env | sort
@@ -124,18 +126,15 @@ jobs:
         docker build --build-arg UNITY_BUILD_VERSION=${{env.UGM_BUILD_VERSION}} --build-arg UNITY_BUILD_REVISION=${{env.UGM_BUILD_REVISION}} -t unity-grantmanager-web -f src/Unity.GrantManager.Web/Dockerfile .
         docker build -t unity-grantmanager-dbmigrator -f src/Unity.GrantManager.DbMigrator/Dockerfile .
       working-directory: ./applications/Unity.GrantManager
-    - name: Connect to JFrog Artifactory non-interactive login using --password-stdin
-      run: |
-        echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
     - name: Push application images to Artifactory container registry
+      continue-on-error: true
       run: |
+        echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
         docker tag unity-grantmanager-dbmigrator $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
         docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
         docker tag unity-grantmanager-web $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
         docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
-    - name: Disconnect docker from JFrog Artifactory
-      run: |
-        docker logout
+        docker logout $JFROG_SERVICE
     - name: Install OpenShift CLI
       run: |
           curl -LO https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/linux/oc.tar.gz
@@ -143,17 +142,30 @@ jobs:
           sudo mv oc /usr/local/bin
     - name: Verify OpenShift CLI installation
       run: oc version
-    - name: Connect to OpenShift API non-interactive login using current session token
+    - name: Push application images into ce395f-tools
       run: |
-        oc login --token=$OC_AUTH_TOKEN --server=$OC_CLUSTER
+        oc login --token=$OC_TOOLS_TOKEN --server=$OC_CLUSTER
         oc registry login
         docker login -u unused -p $(oc whoami -t) $OC_REGISTRY
-    - name: Push application images to OpenShift container registry
+        docker tag unity-grantmanager-dbmigrator $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:latest
+        docker push $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:latest
+        docker tag unity-grantmanager-web $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:latest
+        docker push $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:latest
+        docker logout $OC_REGISTRY
+    - name: Promote dbMigrator into ce395f-dev and run migrations
       run: |
-        docker tag unity-grantmanager-dbmigrator $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-dbmigrator
-        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-dbmigrator
-        docker tag unity-grantmanager-web $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-web
-        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-web
-    - name: Disconnect docker from OpenShift container registry
+        oc login --token=$OC_TARGET_TOKEN --server=$OC_CLUSTER
+        oc tag $OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:latest $OC_TARGET_PROJECT/$TARGET_ENV-unity-dbmigrator:latest
+        oc -n $OC_TARGET_PROJECT delete jobs $TARGET_ENV-unity-dbmigrator --ignore-not-found=true
+        oc -n $OC_TARGET_PROJECT process unity-grantmanager-dbmigrator-job \
+          -p APPLICATION_GROUP=$TARGET_ENV-unity-grantmanager \
+          -p DATABASE_SERVICE_NAME=$TARGET_ENV-unity-data-postgres \
+          -p APPLICATION_NAME=$TARGET_ENV-unity-dbmigrator \
+          -p IMAGEPULL_NAMESPACE=$OC_TARGET_PROJECT \
+          -p IMAGESTREAM_NAME=$TARGET_ENV-unity-dbmigrator \
+          -p IMAGESTREAM_TAG=latest | oc -n $OC_TARGET_PROJECT create -f -
+        oc -n $OC_TARGET_PROJECT wait jobs/$TARGET_ENV-unity-dbmigrator --for condition=complete --timeout=300s
+    - name: Promote grantmanager-web into ce395f-dev and wait
       run: |
-        docker logout
+        oc tag $OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:latest $OC_TARGET_PROJECT/$TARGET_ENV-unity-grantmanager:latest
+        oc -n $OC_TARGET_PROJECT rollout status deployment/$TARGET_ENV-unity-grantmanager-web --timeout=180s
diff --git a/.github/workflows/docker-build-dev2.yml b/.github/workflows/docker-build-dev2.yml
new file mode 100644
index 0000000000..8b5911c07f
--- /dev/null
+++ b/.github/workflows/docker-build-dev2.yml
@@ -0,0 +1,120 @@
+name: Dev2 - Build & Push docker images
+
+on:
+  push:
+    branches: [ "dev2" ]
+    paths-ignore:
+      - '.github/**'
+      - '.gitignore'
+      - 'database/**'
+      - 'documentation/**'
+      - '**/docs/**'
+      - '**/README*'
+      - 'CODE_OF_CONDUCT.md'
+      - 'COMPLIANCE.yaml'
+      - 'CONTRIBUTING.md'
+      - 'LICENSE'
+      - 'README.md'
+      - 'SECURITY.md'
+  # Allow manual workflow triggering
+  workflow_dispatch:
+
+env:
+  TARGET_ENV: dev2
+  GH_TOKEN: ${{secrets.GH_API_TOKEN}}
+  OC_CLUSTER: ${{ vars.OPENSHIFT_CLUSTER }}
+  OC_REGISTRY: ${{ vars.OPENSHIFT_REGISTRY }}
+  OC_TARGET_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
+  OC_TARGET_PROJECT: ${{ vars.OPENSHIFT_NAMESPACE }}
+  JFROG_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
+  JFROG_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
+  JFROG_REPO_PATH: ${{ vars.ARTIFACTORY_REPO }}
+  JFROG_SERVICE:  ${{ vars.ARTIFACTORY_SERVICE }}
+
+jobs:
+  Setup:
+    runs-on: ubuntu-latest
+    environment: dev2
+    permissions:
+      contents: read
+    steps:
+    - name: Get variables
+      run: |
+        echo "Target: $TARGET_ENV"
+        echo "BaseRef: $GITHUB_REF_NAME"
+        echo "Environment: $TARGET_ENV OC_TARGET_PROJECT=$OC_TARGET_PROJECT"
+        echo "Environment: $TARGET_ENV JFROG_REPO_PATH=$JFROG_REPO_PATH"
+        echo "..."
+        env | sort
+  Branch:
+    needs: [Setup]
+    runs-on: ubuntu-latest
+    environment: dev2
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      with:
+          fetch-depth: '1'
+    - name: Get short commitId
+      id: get_commit
+      run: |
+        echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+    outputs:
+      SHA_SHORT: ${{steps.get_commit.outputs.SHA_SHORT}}
+  Build:
+    needs: [Setup,Branch]
+    runs-on: ubuntu-latest
+    environment: dev2
+    permissions:
+      contents: read
+    steps:
+    - uses: actions/checkout@v6
+    - name: Build Docker images
+      run: |
+        rm -f ./docker-compose.override.yml
+        docker build --build-arg UNITY_BUILD_VERSION=dev2 --build-arg UNITY_BUILD_REVISION=${{needs.Branch.outputs.SHA_SHORT}} -t unity-grantmanager-web -f src/Unity.GrantManager.Web/Dockerfile .
+        docker build -t unity-grantmanager-dbmigrator -f src/Unity.GrantManager.DbMigrator/Dockerfile .
+      working-directory: ./applications/Unity.GrantManager
+    - name: Push application images to Artifactory container registry
+      continue-on-error: true
+      run: |
+        echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
+        docker tag unity-grantmanager-dbmigrator $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
+        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
+        docker tag unity-grantmanager-web $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
+        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
+        docker logout $JFROG_SERVICE
+    - name: Install OpenShift CLI
+      run: |
+          curl -LO https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/linux/oc.tar.gz
+          tar -xvf oc.tar.gz
+          sudo mv oc /usr/local/bin
+    - name: Verify OpenShift CLI installation
+      run: oc version
+    - name: Push application images into ce395f-dev (no ce395f-tools hop for dev2)
+      run: |
+        oc login --token=$OC_TARGET_TOKEN --server=$OC_CLUSTER
+        oc registry login
+        docker login -u unused -p $(oc whoami -t) $OC_REGISTRY
+        docker tag unity-grantmanager-dbmigrator $OC_REGISTRY/$OC_TARGET_PROJECT/$TARGET_ENV-unity-dbmigrator:latest
+        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/$TARGET_ENV-unity-dbmigrator:latest
+        docker tag unity-grantmanager-web $OC_REGISTRY/$OC_TARGET_PROJECT/$TARGET_ENV-unity-grantmanager:latest
+        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/$TARGET_ENV-unity-grantmanager:latest
+        docker logout $OC_REGISTRY
+    - name: Run dbMigrator Job
+      run: |
+        oc -n $OC_TARGET_PROJECT delete jobs $TARGET_ENV-unity-dbmigrator --ignore-not-found=true
+        oc -n $OC_TARGET_PROJECT process unity-grantmanager-dbmigrator-job \
+          -p APPLICATION_GROUP=$TARGET_ENV-unity-grantmanager \
+          -p DATABASE_SERVICE_NAME=$TARGET_ENV-unity-data-postgres \
+          -p APPLICATION_NAME=$TARGET_ENV-unity-dbmigrator \
+          -p IMAGEPULL_NAMESPACE=$OC_TARGET_PROJECT \
+          -p IMAGESTREAM_NAME=$TARGET_ENV-unity-dbmigrator \
+          -p IMAGESTREAM_TAG=latest | oc -n $OC_TARGET_PROJECT create -f -
+        oc -n $OC_TARGET_PROJECT wait jobs/$TARGET_ENV-unity-dbmigrator --for condition=complete --timeout=300s
+    - name: Roll out grantmanager-web and wait
+      run: |
+        oc -n $OC_TARGET_PROJECT rollout restart deployment/$TARGET_ENV-unity-grantmanager-web
+        oc -n $OC_TARGET_PROJECT rollout status deployment/$TARGET_ENV-unity-grantmanager-web --timeout=180s
diff --git a/.github/workflows/docker-build-main.yml b/.github/workflows/docker-build-main.yml
index b146da454a..f967c20619 100644
--- a/.github/workflows/docker-build-main.yml
+++ b/.github/workflows/docker-build-main.yml
@@ -24,8 +24,8 @@ env:
   GH_TOKEN: ${{secrets.GH_API_TOKEN}}
   OC_CLUSTER: ${{ vars.OPENSHIFT_CLUSTER }}
   OC_REGISTRY: ${{ vars.OPENSHIFT_REGISTRY }}
-  OC_AUTH_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
-  OC_TARGET_PROJECT: ${{ vars.OPENSHIFT_NAMESPACE }}
+  OC_TOOLS_TOKEN: ${{ secrets.TOOLS_OPENSHIFT_TOKEN }}
+  OC_TOOLS_PROJECT: ${{ vars.TOOLS_OPENSHIFT_NAMESPACE }}
   JFROG_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
   JFROG_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
   JFROG_REPO_PATH: ${{ vars.ARTIFACTORY_REPO }}
@@ -47,7 +47,7 @@ jobs:
       run: |
         echo "Target: $TARGET_ENV"
         echo "BaseRef: $GITHUB_REF_NAME"
-        echo "Environment: $TARGET_ENV OC_TARGET_PROJECT=$OC_TARGET_PROJECT"
+        echo "Environment: $TARGET_ENV OC_TOOLS_PROJECT=$OC_TOOLS_PROJECT"
         echo "Environment: $TARGET_ENV JFROG_REPO_PATH=$JFROG_REPO_PATH"
         echo "..."
         env | sort
@@ -181,18 +181,15 @@ jobs:
         docker build --build-arg UNITY_BUILD_VERSION=${{env.UGM_BUILD_VERSION}} --build-arg UNITY_BUILD_REVISION=${{env.UGM_BUILD_REVISION}} -t unity-grantmanager-web -f src/Unity.GrantManager.Web/Dockerfile .
         docker build -t unity-grantmanager-dbmigrator -f src/Unity.GrantManager.DbMigrator/Dockerfile .
       working-directory: ./applications/Unity.GrantManager
-    - name: Connect to JFrog Artifactory non-interactive login using --password-stdin
-      run: |
-        echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
     - name: Push application images to Artifactory container registry
+      continue-on-error: true
       run: |
+        echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
         docker tag unity-grantmanager-dbmigrator $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:stable
         docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:stable
         docker tag unity-grantmanager-web $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:stable
         docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:stable
-    - name: Disconnect docker from JFrog Artifactory
-      run: |
-        docker logout
+        docker logout $JFROG_SERVICE
     - name: Install OpenShift CLI
       run: |
           curl -LO https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/linux/oc.tar.gz
@@ -200,17 +197,13 @@ jobs:
           sudo mv oc /usr/local/bin
     - name: Verify OpenShift CLI installation
       run: oc version
-    - name: Connect to OpenShift API non-interactive login using current session token
+    - name: Push application images into ce395f-tools
       run: |
-        oc login --token=$OC_AUTH_TOKEN --server=$OC_CLUSTER
+        oc login --token=$OC_TOOLS_TOKEN --server=$OC_CLUSTER
         oc registry login
         docker login -u unused -p $(oc whoami -t) $OC_REGISTRY
-    - name: Push application images to OpenShift container registry
-      run: |
-        docker tag unity-grantmanager-dbmigrator $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-dbmigrator:stable
-        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-dbmigrator:stable
-        docker tag unity-grantmanager-web $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-web:stable
-        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-web:stable
-    - name: Disconnect docker from OpenShift container registry
-      run: |
-        docker logout
+        docker tag unity-grantmanager-dbmigrator $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:stable
+        docker push $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:stable
+        docker tag unity-grantmanager-web $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:stable
+        docker push $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:stable
+        docker logout $OC_REGISTRY
diff --git a/.github/workflows/docker-build-test.yml b/.github/workflows/docker-build-test.yml
index 9728ee15d8..9ea19ba14e 100644
--- a/.github/workflows/docker-build-test.yml
+++ b/.github/workflows/docker-build-test.yml
@@ -24,7 +24,9 @@ env:
   GH_TOKEN: ${{secrets.GH_API_TOKEN}}
   OC_CLUSTER: ${{ vars.OPENSHIFT_CLUSTER }}
   OC_REGISTRY: ${{ vars.OPENSHIFT_REGISTRY }}
-  OC_AUTH_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
+  OC_TOOLS_TOKEN: ${{ secrets.TOOLS_OPENSHIFT_TOKEN }}
+  OC_TOOLS_PROJECT: ${{ vars.TOOLS_OPENSHIFT_NAMESPACE }}
+  OC_TARGET_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
   OC_TARGET_PROJECT: ${{ vars.OPENSHIFT_NAMESPACE }}
   JFROG_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
   JFROG_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
@@ -47,7 +49,7 @@ jobs:
       run: |
         echo "Target: $TARGET_ENV"
         echo "BaseRef: $GITHUB_REF_NAME"
-        echo "Environment: $TARGET_ENV OC_TARGET_PROJECT=$OC_TARGET_PROJECT"
+        echo "Environment: $TARGET_ENV OC_TOOLS_PROJECT=$OC_TOOLS_PROJECT OC_TARGET_PROJECT=$OC_TARGET_PROJECT"
         echo "Environment: $TARGET_ENV JFROG_REPO_PATH=$JFROG_REPO_PATH"
         echo "..."
         env | sort
@@ -160,18 +162,15 @@ jobs:
         docker build --build-arg UNITY_BUILD_VERSION=${{env.UGM_BUILD_VERSION}} --build-arg UNITY_BUILD_REVISION=${{env.UGM_BUILD_REVISION}} -t unity-grantmanager-web -f src/Unity.GrantManager.Web/Dockerfile .
         docker build -t unity-grantmanager-dbmigrator -f src/Unity.GrantManager.DbMigrator/Dockerfile .
       working-directory: ./applications/Unity.GrantManager
-    - name: Connect to JFrog Artifactory non-interactive login using --password-stdin
-      run: |
-        echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
     - name: Push application images to Artifactory container registry
+      continue-on-error: true
       run: |
+        echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
         docker tag unity-grantmanager-dbmigrator $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
         docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
         docker tag unity-grantmanager-web $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
         docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
-    - name: Disconnect docker from JFrog Artifactory
-      run: |
-        docker logout
+        docker logout $JFROG_SERVICE
     - name: Install OpenShift CLI
       run: |
           curl -LO https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/linux/oc.tar.gz
@@ -179,17 +178,30 @@ jobs:
           sudo mv oc /usr/local/bin
     - name: Verify OpenShift CLI installation
       run: oc version
-    - name: Connect to OpenShift API non-interactive login using current session token
+    - name: Push application images into ce395f-tools
       run: |
-        oc login --token=$OC_AUTH_TOKEN --server=$OC_CLUSTER
+        oc login --token=$OC_TOOLS_TOKEN --server=$OC_CLUSTER
         oc registry login
         docker login -u unused -p $(oc whoami -t) $OC_REGISTRY
-    - name: Push application images to OpenShift container registry
+        docker tag unity-grantmanager-dbmigrator $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:latest
+        docker push $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:latest
+        docker tag unity-grantmanager-web $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:latest
+        docker push $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:latest
+        docker logout $OC_REGISTRY
+    - name: Promote dbMigrator into ce395f-test and run migrations
       run: |
-        docker tag unity-grantmanager-dbmigrator $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-dbmigrator
-        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-dbmigrator
-        docker tag unity-grantmanager-web $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-web
-        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-web
-    - name: Disconnect docker from OpenShift container registry
+        oc login --token=$OC_TARGET_TOKEN --server=$OC_CLUSTER
+        oc tag $OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:latest $OC_TARGET_PROJECT/$TARGET_ENV-unity-dbmigrator:latest
+        oc -n $OC_TARGET_PROJECT delete jobs $TARGET_ENV-unity-dbmigrator --ignore-not-found=true
+        oc -n $OC_TARGET_PROJECT process unity-grantmanager-dbmigrator-job \
+          -p APPLICATION_GROUP=$TARGET_ENV-unity-grantmanager \
+          -p DATABASE_SERVICE_NAME=$TARGET_ENV-unity-data-postgres \
+          -p APPLICATION_NAME=$TARGET_ENV-unity-dbmigrator \
+          -p IMAGEPULL_NAMESPACE=$OC_TARGET_PROJECT \
+          -p IMAGESTREAM_NAME=$TARGET_ENV-unity-dbmigrator \
+          -p IMAGESTREAM_TAG=latest | oc -n $OC_TARGET_PROJECT create -f -
+        oc -n $OC_TARGET_PROJECT wait jobs/$TARGET_ENV-unity-dbmigrator --for condition=complete --timeout=300s
+    - name: Promote grantmanager-web into ce395f-test and wait
       run: |
-        docker logout
+        oc tag $OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:latest $OC_TARGET_PROJECT/$TARGET_ENV-unity-grantmanager:latest
+        oc -n $OC_TARGET_PROJECT rollout status deployment/$TARGET_ENV-unity-grantmanager-web --timeout=180s