From 60ab94407ba4491181135360223445950895f170 Mon Sep 17 00:00:00 2001
From: "Eric J. Smith" <eric@codesmithtools.com>
Date: Wed, 11 Nov 2026 16:17:24 -0600
Subject: [PATCH] Upgrade MailKit to 5.0

MailKit 5 drops BouncyCastle and depends on MimeKit.Core, which no longer
pulls in System.Security.Cryptography.Pkcs, so remove the Pkcs pin that
covered MimeKit's vulnerable 10.0.0 range. The SendAsync(MimeMessage)
overload moved to an extension method in the MailKit namespace.
---
 src/Exceptionless.Insulation/Exceptionless.Insulation.csproj | 4 +---
 src/Exceptionless.Insulation/Mail/MailKitMailSender.cs       | 1 +
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/Exceptionless.Insulation/Exceptionless.Insulation.csproj b/src/Exceptionless.Insulation/Exceptionless.Insulation.csproj
index 39e68a2232..1c0ca3b50c 100644
--- a/src/Exceptionless.Insulation/Exceptionless.Insulation.csproj
+++ b/src/Exceptionless.Insulation/Exceptionless.Insulation.csproj
@@ -12,7 +12,7 @@
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="11.0.0" />
     <PackageReference Include="Microsoft.Extensions.DependencyModel" Version="11.0.0" />
     <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="11.0.0" />
-    <PackageReference Include="MailKit" Version="4.18.2" />
+    <PackageReference Include="MailKit" Version="5.0.0" />
     <PackageReference Include="Serilog.Extensions.Logging" Version="10.0.0" />
     <PackageReference Include="Serilog.Formatting.Compact" Version="3.0.0" />
     <PackageReference Include="Serilog.Settings.Configuration" Version="10.0.1" />
@@ -20,8 +20,6 @@
     <PackageReference Include="Serilog.Sinks.ExceptionLess" Version="5.0.0" />
     <!-- AWSSDK.Extensions.CborProtocol (via Foundatio.AWS) pins 9.0.5, which has GHSA-vmv3-wvjp-wqpj. -->
     <PackageReference Include="System.Formats.Cbor" Version="11.0.0" />
-    <!-- MimeKit (via MailKit) allows 10.0.0, which has GHSA-2fmv-rv2c-59x7 and GHSA-846f-f764-76mx. -->
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="11.0.0" />
     <PackageReference Include="YamlDotNet" Version="18.1.0" />
   </ItemGroup>
   <ItemGroup>
diff --git a/src/Exceptionless.Insulation/Mail/MailKitMailSender.cs b/src/Exceptionless.Insulation/Mail/MailKitMailSender.cs
index 517b896fc4..af80775f51 100644
--- a/src/Exceptionless.Insulation/Mail/MailKitMailSender.cs
+++ b/src/Exceptionless.Insulation/Mail/MailKitMailSender.cs
@@ -1,6 +1,7 @@
 using System.Diagnostics;
 using Exceptionless.Core.Configuration;
 using Exceptionless.Core.Mail;
+using MailKit;
 using MailKit.Net.Smtp;
 using MailKit.Security;
 using Microsoft.Extensions.Logging;