PasswordHasher: retarget net10.0 and fix the benchmark project's absolute HintPath

[vladimir-pecanac-main]

Retargets authorization-dotnet/PasswordHasher to .NET 10 and fixes the one defect that made the benchmark project unbuildable on any machine but its author's.

The real defect

PasswordHasher.Benchmark.Tests.csproj reached Microsoft.Extensions.Identity.Core through an absolute Windows HintPath pinned to SDK patch 8.0.4, so it failed on Linux, on macOS, on CI, and on any Windows box with a different patch installed. Replaced with:

<FrameworkReference Include="Microsoft.AspNetCore.App" />

which is how a non-web Microsoft.NET.Sdk project reaches Identity.Core. Verified by building, not assumed.

Retarget and package lifts

All three projects move net8.0 -> net10.0. Versions read from NuGet on 2026-08-30, not from memory:

Package	Was	Now
Microsoft.AspNetCore.OpenApi	8.0.4	10.0.11
Swashbuckle.AspNetCore	6.4.0	10.2.3
BenchmarkDotNet	0.13.12	0.15.8
NUnit	3.14.0	4.6.1
NUnit3TestAdapter	4.5.0	6.3.0
NUnit.Analyzers	3.9.0	4.14.0
Microsoft.NET.Test.Sdk	17.8.0	18.9.0
coverlet.collector	6.0.0	10.0.1

The eight test cases already use the constraint model (Assert.That), so the NUnit 3 to 4 move needed no assertion rewrites.

One comment

CustomerService.Login() folds SuccessRehashNeeded into the success case. That is a correct login decision but an incomplete example, so one comment line now says the omission is deliberate. No behaviour change: a real rehash needs a repository write the in-memory store would make meaningless.

Build and tests

dotnet build PasswordHasher.sln -c Release   ->  0 Error(s)
dotnet test  PasswordHasher.sln -c Release   ->  Passed!  - Failed: 0, Passed: 8, Skipped: 0, Total: 8

SDK 10.0.302, runtime 10.0.10.

Benchmark re-run on net10.0, output verbatim

The published article's benchmark table was measured on the net8.0 build, so it was re-run here. dotnet run -c Release -- --filter '*', pasted exactly as BenchmarkDotNet printed it:

BenchmarkDotNet v0.15.8, Windows 10 (10.0.19045.6466/22H2/2022Update)
AMD Ryzen 5 3600 3.60GHz, 1 CPU, 12 logical and 6 physical cores
.NET SDK 10.0.302
  [Host]     : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3
  Job-CNUJVU : .NET 10.0.10 (10.0.10, 10.0.1026.32716), X64 RyuJIT x86-64-v3

InvocationCount=1  UnrollFactor=1

| Method                       | Mean     | Error   | StdDev  |
|----------------------------- |---------:|--------:|--------:|
| PasswordHasherWithIdentityV2 | 517.6 us | 3.61 us | 2.82 us |

| Method                       | IterationCount | Mean         | Error       | StdDev      |
|----------------------------- |--------------- |-------------:|------------:|------------:|
| PasswordHasherWithIdentityV3 | 1000           |     610.4 us |     8.50 us |     7.09 us |
| PasswordHasherWithIdentityV3 | 10000          |   6,019.2 us |    40.25 us |    35.68 us |
| PasswordHasherWithIdentityV3 | 100000         |  58,748.8 us |   487.55 us |   407.13 us |
| PasswordHasherWithIdentityV3 | 1000000        | 589,053.7 us | 4,246.79 us | 5,215.44 us |

Both qualitative claims the article draws from this table still hold on .NET 10: V2 is faster than V3 at the same 1,000 iterations (517.6 us against 610.4 us), and V3's time scales proportionally with the iteration count (roughly 10x per 10x, across four orders of magnitude).