Skip to content

Bump L10NSharp, SIL.BuildTasks, and related deps to close known vulnerabilities - #1543

Draft
tombogle wants to merge 9 commits into
masterfrom
update-dependencies
Draft

tombogle wants to merge 9 commits into
masterfrom
update-dependencies

Conversation

@tombogle

@tombogle tombogle commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Upgrades L10NSharp/L10NSharp.Windows.Forms to 11.0.0 and SIL.BuildTasks to 3.3.0, plus the System.Memory/System.Resources.Extensions/FFMpegCore/icu.net version alignment needed to keep restore consistent across the solution.


This change is Reviewable

@tombogle tombogle self-assigned this Sep 10, 2026
@tombogle tombogle added the dependencies Pull requests that update a dependency file label Sep 10, 2026
@github-actions

github-actions Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Palaso Tests

     4 files  ± 0       4 suites  ±0   10m 0s ⏱️ -42s
 5 131 tests + 7   4 898 ✅ + 7  233 💤 ±0  0 ❌ ±0 
16 708 runs  +21  15 988 ✅ +22  720 💤  - 1  0 ❌ ±0 

Results for commit 476564d. ± Comparison against base commit dafc9bd.

♻️ This comment has been updated with latest results.

@imnasnainaec

This comment was marked as off-topic.

imnasnainaec

This comment was marked as resolved.

@tombogle

Copy link
Copy Markdown
Contributor Author

CHANGELOG.md line 93 at r1 (raw file):

Previously, imnasnainaec (D. Ror.) wrote…

For version alignment, should SIL.Scripture.Tests have

<PackageReference Include="System.Resources.Extensions" Version="6.0.0" />

bumped to 10.0.11?

Done

tombogle and others added 5 commits September 14, 2026 08:53
…rabilities

Upgrades L10NSharp/L10NSharp.Windows.Forms to 11.0.0 and SIL.BuildTasks to
3.3.0, plus the System.Memory/System.Resources.Extensions/FFMpegCore/icu.net
version alignment needed to keep restore consistent across the solution.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…ins.Annotations,

NUnit, System.Configuration.ConfigurationManager, System.Resources.Extensions,
and a netstandard2.0-only SIL.ReleaseTasks/Markdig.Signed bump

SIL.ReleaseTasks 3.3.0 pulls in Microsoft.Build.Tasks.Core, which has no net462/net48
asset and disrupts implicit WindowsBase/System.IO.Packaging resolution when consumed
via its netstandard2.0 fallback there, so it's split per-TFM: netstandard2.0-targeting
projects get 3.3.0 (and the Markdig.Signed 0.41.1 floor it requires), net462/net48 stay
on 3.1.1/0.37.0. net8.0-windows projects that transitively consume the netstandard2.0
build of SIL.Core/SIL.WritingSystems get the same Markdig.Signed bump to match.

Also adds unit test coverage for two previously-untested code paths this touches:
Markdig rendering in ShowReleaseNotesDialog, and the ConfigurationManager-backed
FactoryPassword fallback in SettingsProtectionSingleton.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…xtensions

version and a stale hardcoded NUnit copyright-year assertion

SIL.Scripture.Tests still had System.Resources.Extensions pinned at 6.0.0,
which conflicted at runtime with the 10.0.12 pulled in transitively via
SIL.Windows.Forms.Scripture.Tests's other references, causing a
FileLoadException on net48 (assembly manifest mismatch between the two
resolved versions). Bumped it to 10.0.12 to match the rest of the graph.

AcknowledgementAttributeTests.CreateAnAcknowledgement_NoCopyright_OverriddenByFile
hardcoded NUnit's embedded copyright year, which changed for real between
3.13.3 and 3.14.0. Reworked it (and its NoName sibling) to compare against
FileVersionInfo read directly from the DLL, so they test the actual behavior
instead of a value that goes stale on every future NUnit bump.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…t NUnit's

Comparing against FileVersionInfo read live from the DLL (the previous fix)
sidesteps breaking on every NUnit bump, but does so by computing the expected
value the same way the production code does, which is less obvious to read
and weaker at catching a real regression in AcknowledgementAttribute itself.

Pointing at this test assembly instead restores a literal, readable expected
value (its Copyright/ProductName come from Directory.Build.props, which we
only change deliberately) while still being immune to third-party dependency
churn.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…nt range

The exact end year in Directory.Build.props's <Copyright> gets bumped
annually, so hardcoding it meant the test would need editing on the same
cadence. Keep the fixed text ("Copyright © 2010-...SIL Global") asserted
exactly, but accept any year within the last 3 (and not in the future),
so routine annual bumps don't require a matching test change while a
genuinely stale or mistyped year still fails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@tombogle

Copy link
Copy Markdown
Contributor Author

DRAFT: Worth considering waiting for sillsdev/SIL.BuildTasks#90 and getting a new release through the ranks in order to simplify this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants